deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-2688
Published: 2006-05-31
Description: SQL injection vulnerability in the employees node (class.employee.inc) in Achievo 1.1.0 and earlier and 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the atkselector parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://bugzilla.achievo.org/show_bug.cgi?id=624; http://secunia.com/advisories/20327; http://www.achievo.org/download/releasenotes/1_2_1
CVE: CVE-2006-2689
Published: 2006-05-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) debut_image parameter in (a) article-album.php3, (2) date parameter in (b) rubrique.php3, and the (3) perso and (4) aide parameters to (c) an unknown script, probably index.php.
CVSS Score: 6.8 (MEDIUM)
References: http://pridels0.blogspot.com/2006/05/eva-web-212-vuln.html; http://secunia.com/advisories/20279; http://www.securityfocus.com/bid/18161
CVE: CVE-2006-2690
Published: 2006-05-31
Description: An unspecified script in EVA-Web 2.1.2 and earlier, probably index.php, allows remote attackers to obtain the full path of the web server via invalid (1) perso or (2) aide parameters.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2006/05/eva-web-212-vuln.html; http://pridels0.blogspot.com/2006/05/eva-web-212-vuln.html
CVE: CVE-2006-2691
Published: 2006-05-31
Description: Unspecified "information leakage" vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to access arbitrary images, including dynamically generated images, via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20351; http://securitytracker.com/id?1016188; http://www.amule.org/wiki/index.php/Changelog_2.1.2
CVE: CVE-2006-2692
Published: 2006-05-31
Description: Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image, HTML, or PHP files via unknown vectors, probably related to directory traversal.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20351; http://securitytracker.com/id?1016188; http://www.amule.org/wiki/index.php/Changelog_2.1.2
CVE: CVE-2006-2693
Published: 2006-05-31
Description: Directory traversal vulnerability in admin/admin_hacks_list.php in Nivisec Hacks List 1.20 and earlier for phpBB, when register_globals is enabled, allows remote attackers to read arbitrary files via a ".." in the phpEx parameter.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/20359; http://www.nivisec.com/article.php?l=vi&ar=15; http://www.nukedx.com/?viewdoc=37
CVE: CVE-2006-2694
Published: 2006-05-31
Description: Multiple PHP remote file inclusion vulnerabilities in EzUpload Pro 2.10 allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) form.php, (2) customize.php, and (3) initialize.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/998; http://www.securityfocus.com/archive/1/435276/100/0/threaded; http://www.securityfocus.com/bid/18135
CVE: CVE-2006-2695
Published: 2006-05-31
Description: admin/upprocess.php in DGNews 1.5 and earlier allows remote attackers to execute arbitrary code by uploading scripts with arbitrary extensions to the img directory.
CVSS Score: 5.1 (MEDIUM)
References: http://pridels0.blogspot.com/2006/05/dgnews-v-15-file-upload-vuln.html; http://secunia.com/advisories/20340; http://securitytracker.com/id?1016174
CVE: CVE-2006-2696
Published: 2006-05-31
Description: Cross-site scripting (XSS) vulnerabilities in Easy-Content Forums 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) startletter parameter in userview.asp and the (2) catid parameter in topics.asp.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/997; http://www.securityfocus.com/archive/1/435140/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26803
CVE: CVE-2006-2697
Published: 2006-05-31
Description: Multiple SQL injection vulnerabilities in Easy-Content Forums 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) startletter parameter in userview.asp and the (2) forumname parameter in topics.asp.
CVSS Score: 6.4 (MEDIUM)
References: http://securityreason.com/securityalert/997; http://www.securityfocus.com/archive/1/435140/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26804
CVE: CVE-2006-2698
Published: 2006-05-31
Description: Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to (1) layout/professional/functions.php or (2) getimage.php.
CVSS Score: 7.8 (HIGH)
References: http://kapda.ir/advisory-336.html; http://secunia.com/advisories/20316; http://securityreason.com/securityalert/993
CVE: CVE-2006-2699
Published: 2006-05-31
Description: Cross-site scripting (XSS) vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action.
CVSS Score: 6.8 (MEDIUM)
References: http://kapda.ir/advisory-336.html; http://secunia.com/advisories/20316; http://securityreason.com/securityalert/993
CVE: CVE-2006-2700
Published: 2006-05-31
Description: SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://kapda.ir/advisory-336.html; http://secunia.com/advisories/20316; http://securityreason.com/securityalert/993
CVE: CVE-2006-2701
Published: 2006-05-31
Description: SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20316; http://www.geeklog.net/index.php?topic=Security; http://www.vupen.com/english/advisories/2006/2050
CVE: CVE-2006-2702
Published: 2006-05-31
Description: vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine $_SERVER['REMOTE_ADDR'].
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/wordpress_202_xpl.html; http://secunia.com/advisories/20271; http://secunia.com/advisories/20608
CVE: CVE-2006-1515
Published: 2006-05-31
Description: Buffer overflow in the addnewword function in typespeed 0.4.4 and earlier might allow remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20379; http://secunia.com/advisories/20393; http://secunia.com/advisories/20708
CVE: CVE-2006-2704
Published: 2006-05-31
Description: Secure Elements Class 5 AVR server and client (aka C5 EVM) before 2.8.1 send messages in cleartext, which allows remote attackers to read sensitive vulnerability information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/135529
CVE: CVE-2006-2705
Published: 2006-05-31
Description: Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 allows remote attackers to cause an unspecified denial of service via a large number of forged client registration messages.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/207161
CVE: CVE-2006-2706
Published: 2006-05-31
Description: Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 allows remote attackers to cause a denial of service via forged "session start" messages that cause AVR to connect to arbitrary hosts.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/487617
CVE: CVE-2006-2707
Published: 2006-05-31
Description: Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 does not validate the peer certificate when obtaining an update, which could allow remote attackers to distribute malicious updates to clients.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/207337
CVE: CVE-2006-2708
Published: 2006-05-31
Description: Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 allows remote attackers to read portions of process memory via a modified size for (1) EM_GET_CE_PARAMETER and (2) EM_SET_CE_PARAMETER messages, which leads to a buffer overflow (probably an over-read).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/227929
CVE: CVE-2006-2709
Published: 2006-05-31
Description: Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 do not validate the source address of a message, which allows remote attackers to (1) execute arbitrary code on a client or (2) forge messages to the server.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/288121
CVE: CVE-2006-2710
Published: 2006-05-31
Description: Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 uses the same invariant RSA key for all installations, which allows remote attackers with the key to decrypt communications.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/566553
CVE: CVE-2006-2711
Published: 2006-05-31
Description: Secure Elements Class 5 AVR (aka C5 EVM) 2.8.1 and earlier, and possibly later 2.8.x releases, uses the same initialization vector and key for each message session, which allows remote attackers to obtain potentially sensitive information about messages.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20377; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/346377
CVE: CVE-2006-2712
Published: 2006-05-31
Description: Secure Elements Class 5 AVR (aka C5 EVM) client and server before 2.8.1 do not verify the integrity of a message digest, which allows remote attackers to modify and replay messages.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/353769
CVE: CVE-2006-2713
Published: 2006-05-31
Description: Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 generates predictable CEIDs, which allows remote attackers to determine the CEID of a protected asset, which can be used in other attacks against AVR.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/353945
CVE: CVE-2006-2714
Published: 2006-05-31
Description: Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 does not validate the CEID of an incoming message, which allows remote attackers to send messages to a protected asset without knowing the proper CEID.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/635721
CVE: CVE-2006-2715
Published: 2006-05-31
Description: The Administration Console in Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 does not enforce access control, which allows remote attackers to gain access to servers via the console.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/397417
CVE: CVE-2006-2716
Published: 2006-05-31
Description: Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 uses a hard-coded user ID and password, which allows remote attackers to gain access to the server.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/584329
CVE: CVE-2006-2717
Published: 2006-05-31
Description: Unspecified vulnerability in Secure Elements Class 5 AVR client and server (aka C5 EVM) before 2.8.1 allows authenticated attackers to overwrite arbitrary files (1) on a server during an update or (2) on a client via modified pathnames, possibly due to a directory traversal issue.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/20378; http://securitytracker.com/id?1016184; http://www.kb.cert.org/vuls/id/764025
CVE: CVE-2006-2718
Published: 2006-06-01
Description: JIWA Financials 6.4.14 passes a Microsoft SQL Server account's username and password, and the name of a data source, to a Crystal Reports .rpt file, which allows remote authenticated users to execute certain standard stored procedures by referencing them in a user-written .rpt file, as demonstrated by using a stored procedure that provides the username and cleartext password of every account.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046398.html; http://secunia.com/advisories/20342; http://securityreason.com/securityalert/1000
CVE: CVE-2006-2719
Published: 2006-06-01
Description: JIWA Financials 6.4.14 stores usernames and passwords for all accounts in cleartext in the HR_Staff table in Microsoft SQL Server, and sends the usernames and passwords in cleartext to the application's SQL Server ODBC driver, which might allow context-dependent attackers to obtain the passwords.
CVSS Score: 4.9 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046398.html; http://secunia.com/advisories/20342; http://securityreason.com/securityalert/1000
CVE: CVE-2006-2720
Published: 2006-06-01
Description: SQL injection vulnerability in news.php in VARIOMAT allows remote attackers to execute arbitrary SQL commands via the subcat parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/999; http://www.securityfocus.com/archive/1/435290/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26872
CVE: CVE-2006-2721
Published: 2006-06-01
Description: Cross-site scripting (XSS) vulnerability in news.php in VARIOMAT allows remote attackers to inject arbitrary HTML or web script via the subcat parameter.  NOTE: this issue might be resultant from SQL injection.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/999; http://www.securityfocus.com/archive/1/435290/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26877
CVE: CVE-2006-2722
Published: 2006-06-01
Description: SQL injection vulnerability in view_album.php in SelectaPix 1.4 allows remote attackers to execute arbitrary SQL commands via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party sources.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/18196; https://exchange.xforce.ibmcloud.com/vulnerabilities/27013; http://www.securityfocus.com/bid/18196
CVE: CVE-2006-2723
Published: 2006-06-01
Description: Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags.  NOTE: a followup post indicated that the initial report could not be verified.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/435373/100/0/threaded; http://www.securityfocus.com/archive/1/435411/100/0/threaded; http://www.securityfocus.com/archive/1/435882/100/0/threaded
CVE: CVE-2006-2724
Published: 2006-06-01
Description: Cross-site scripting (XSS) vulnerability in PunBB 1.2.11 allows remote authenticated administrators to inject arbitrary HTML or web script to other administrators via the "Admin note" feature, a different vulnerability than CVE-2006-2227.
CVSS Score: 6.8 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2006/May/0408.html; http://securitytracker.com/id?1016157; http://www.neosecurityteam.net/advisories/Advisory-22.txt
CVE: CVE-2006-2439
Published: 2006-06-01
Description: Stack-based buffer overflow in ZipCentral 4.01 allows remote user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/20179; http://secunia.com/secunia_research/2006-35/advisory/; http://securitytracker.com/id?1016176
CVE: CVE-2006-2703
Published: 2006-06-01
Description: The RedCarpet command-line client (rug) does not verify SSL certificates from a server, which allows remote attackers to read network traffic and execute commands via a man-in-the-middle (MITM) attack.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20396; http://www.securityfocus.com/archive/1/435491/100/0/threaded; http://www.securityfocus.com/bid/18193
CVE: CVE-2006-2725
Published: 2006-06-01
Description: SQL injection vulnerability in rss/posts.php in Eggblog before 3.07 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20352; http://www.nukedx.com/?getxpl=36; http://www.nukedx.com/?viewdoc=36
CVE: CVE-2006-2726
Published: 2006-06-01
Description: PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files via the config[fsBase] parameter in (1) drucken.php, (2) drucken2.php, (3) email_an_benutzer.php, (4) rechnung.php, (5) suche/search.php and (6) adminbereich/admin.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20346; http://www.osvdb.org/26157; http://www.osvdb.org/26158
CVE: CVE-2006-2727
Published: 2006-06-01
Description: home/register.php in Eggblog before 3.0 allows remote attackers to change the password of administrators and possibly other users via a modified username parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1005; http://www.nukedx.com/?viewdoc=36; http://www.securityfocus.com/archive/1/435284/100/0/threaded
CVE: CVE-2006-2728
Published: 2006-06-01
Description: Cross-site scripting (XSS) vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the pic parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20336; http://securityreason.com/securityalert/1004; http://www.securityfocus.com/archive/1/435294/100/0/threaded
CVE: CVE-2006-2729
Published: 2006-06-01
Description: Cross-site scripting (XSS) vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the gal parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20336; http://www.vupen.com/english/advisories/2006/2051; https://exchange.xforce.ibmcloud.com/vulnerabilities/26750
CVE: CVE-2006-2730
Published: 2006-06-01
Description: PHP remote file inclusion vulnerability in admin/lib_action_step.php in Hot Open Tickets (HOT) 11012004_ver2f, when register_globals is enabled, allows remote attackers to include arbitrary files via the GLOBALS[CLASS_PATH] parameter.  NOTE: this issue might be resultant from a global overwrite vulnerability.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20331; http://www.securityfocus.com/bid/18137; http://www.vupen.com/english/advisories/2006/2022
CVE: CVE-2006-2731
Published: 2006-06-01
Description: Multiple SQL injection vulnerabilities in Enigma Haber 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) e_mesaj_yas.asp, (b) edi_haber.asp, and (c) haber_devam.asp; (2) hid parameter in (d) yazdir.asp and (e) yorum.asp, and the (3) e parameter in (f) arsiv.asp.  NOTE: with administrator credentials, additional vectors exist including (4) yid parameter to (g) admin/y_admin.asp, (5) bid parameter to (h) admin/reklam_detay.asp, hid parameter to (i) admin/detay_yorum.asp and (j) admin/haber_sil.asp, (6) kid parameter to (k) admin/kategori_d.asp, (7) tur parameter to (l) admin/haber_ekle.asp, (8) s parameter to (m) admin/e_mesaj_yaz.asp, and id parameter to (n) admin/admin_sil.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20357; http://securityreason.com/securityalert/1003; http://securitytracker.com/id?1016171
CVE: CVE-2006-2732
Published: 2006-06-01
Description: SQL injection vulnerability in Your_Account.asp in Mini-Nuke 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) yas_1, (2) yas_2, and (3) yas_3 parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20317; http://securityreason.com/securityalert/1002; http://securitytracker.com/id?1016170
CVE: CVE-2006-2733
Published: 2006-06-01
Description: membership.asp in Mini-Nuke 2.3 and earlier uses plaintext security codes, which allows remote attackers to register multiple times via automated scripts.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20317; http://securityreason.com/securityalert/1002; http://www.nukedx.com/?getxpl=31
CVE: CVE-2006-2734
Published: 2006-06-01
Description: enter.asp in Mini-Nuke 2.3 and earlier makes it easier for remote attackers to conduct password guessing attacks by setting the guvenlik parameter to the same value as the hidden gguvenlik parameter, which bypasses a verification step because the gguvenlik parameter is assumed to be immutable by the attacker.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1002; http://www.nukedx.com/?getxpl=31; http://www.nukedx.com/?viewdoc=31
CVE: CVE-2006-2735
Published: 2006-06-01
Description: PHP remote file inclusion vulnerability in language/lang_english/lang_activity.php in Activity MOD Plus (Amod) 1.1.0, as used with phpBB when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.  NOTE: This is a similar vulnerability to CVE-2006-2507.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0709.html; http://phpbb-tweaks.com/topics.html-p-17623#17623; http://secunia.com/advisories/20354
CVE: CVE-2006-2736
Published: 2006-06-01
Description: PHP remote file inclusion vulnerability in blend_data/blend_common.php in Blend Portal 1.2.0, as used with phpBB when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.  NOTE: This is a similar vulnerability to CVE-2006-2507.
CVSS Score: 5.1 (MEDIUM)
References: http://phpbb-tweaks.com/topics.html-p-17623#17623; http://secunia.com/advisories/20350; http://securityreason.com/securityalert/1001
CVE: CVE-2006-2737
Published: 2006-06-01
Description: utilities/register.asp in Nukedit 4.9.6 and earlier allows remote attackers to create new users as part of arbitrary groups, including the administrative group, via a modified groupid parameter when creating a user via the addDB action.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20348; http://securityreason.com/securityalert/1013; http://www.kapda.ir/advisory-337.html
CVE: CVE-2006-2738
Published: 2006-06-01
Description: The open source version of Open-Xchange 0.8.2 and earlier uses a static default username and password with a valid login shell in the initfile for the ldap-server, which allows remote attackers to access any server where the default has not been changed.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20323; http://securityreason.com/securityalert/1012; http://www.golem.de/0605/45407.html
CVE: CVE-2006-2739
Published: 2006-06-01
Description: PHP remote file inclusion vulnerability in footers.php in Epicdesigns tinyBB 0.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the tinybb_footers parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20356; http://securityreason.com/securityalert/1011; http://securitytracker.com/id?1016172