deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4768
Published: 2006-09-13
Description: Multiple direct static code injection vulnerabilities in add_go.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via the (1) description, (2) issue, (3) title, (4) var, (5) name, (6) keywords, and (7) note parameters, which are stored in an article file.  NOTE: the original source of this vulnerability is unknown; the details are obtained from third party information and CVE post-disclosure analysis.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21826; http://www.osvdb.org/28814; http://www.securityfocus.com/bid/84155
CVE: CVE-2006-4769
Published: 2006-09-13
Description: PHP remote file inclusion vulnerability in abf_js.php in p4CMS 1.05 allows remote attackers to execute arbitrary PHP code via a URL in the abs_pfad parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21891; http://www.securityfocus.com/bid/19971; http://www.vupen.com/english/advisories/2006/3590
CVE: CVE-2006-4770
Published: 2006-09-13
Description: PHP remote file inclusion vulnerability in menu.php in MiniPort@l 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the skiny parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19949; https://exchange.xforce.ibmcloud.com/vulnerabilities/28856; https://www.exploit-db.com/exploits/2343
CVE: CVE-2006-3454
Published: 2006-09-14
Description: Multiple format string vulnerabilities in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security 1.x up to 3.0, allow local users to execute arbitrary code via format strings in (1) Tamper Protection and (2) Virus Alert Notification messages.
CVSS Score: 7.2 (HIGH)
References: http://layereddefense.com/SAV13SEPT.html; http://secunia.com/advisories/21884; http://securityresponse.symantec.com/avcenter/security/Content/2006.09.13.html
CVE: CVE-2006-4724
Published: 2006-09-14
Description: Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors involving a crafted command.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21866; http://securitytracker.com/id?1016833; http://www.adobe.com/support/security/bulletins/apsb06-12.html
CVE: CVE-2006-4725
Published: 2006-09-14
Description: Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components (CFC) within a sandbox from CFML templates that are located outside of the sandbox.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21866; http://securitytracker.com/id?1016833; http://www.adobe.com/support/security/bulletins/apsb06-13.html
CVE: CVE-2006-4726
Published: 2006-09-14
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a ColdFusion error page.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/21858; http://securitytracker.com/id?1016833; http://www.adobe.com/support/security/bulletins/apsb06-14.html
CVE: CVE-2006-4771
Published: 2006-09-14
Description: Cross-site scripting (XSS) vulnerability in haut.php in ForumJBC 4 allows remote attackers to inject arbitrary web script or HTML via the nb_connecte parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1573; http://www.securityfocus.com/archive/1/445877/100/0/threaded; http://www.securityfocus.com/bid/19992
CVE: CVE-2006-4772
Published: 2006-09-14
Description: HotPlug CMS stores sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password and database credentials via a direct request for includes/class/config.inc.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1572; http://www.securityfocus.com/archive/1/445761/100/0/threaded; http://securityreason.com/securityalert/1572
CVE: CVE-2006-4773
Published: 2006-09-14
Description: Sun StorEdge 6130 Array Controllers with firmware 06.12.10.11 and earlier allow remote attackers to cause a denial of service (controller reboot) via a flood of traffic on the LAN.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21925; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102601-1; http://www.vupen.com/english/advisories/2006/3637
CVE: CVE-2006-4774
Published: 2006-09-14
Description: The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to cause a denial of service by sending a VTP version 1 summary frame with a VTP version field value of 2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/21896; http://securitytracker.com/id?1016843; http://www.cisco.com/warp/public/707/cisco-sr-20060913-vtp.shtml
CVE: CVE-2006-4775
Published: 2006-09-14
Description: The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) and CatOS allows remote attackers to cause a denial of service by sending a VTP update with a revision value of 0x7FFFFFFF, which is incremented to 0x80000000 and is interpreted as a negative number in a signed context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/21896; http://secunia.com/advisories/21902; http://securitytracker.com/id?1016843
CVE: CVE-2006-4776
Published: 2006-09-14
Description: Heap-based buffer overflow in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to execute arbitrary code via a long VLAN name in a VTP type 2 summary advertisement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/21896; http://securitytracker.com/id?1016843; http://www.cisco.com/warp/public/707/cisco-sr-20060913-vtp.shtml
CVE: CVE-2006-4777
Published: 2006-09-14
Description: Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, on Chinese and possibly other Windows distributions, allows remote attackers to execute arbitrary code via unknown manipulations in arguments to the KeyFrame method, possibly related to an integer overflow, as demonstrated by daxctle2, and a different vulnerability than CVE-2006-4446.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/21910; http://securityreason.com/securityalert/1577; http://securitytracker.com/id?1016854
CVE: CVE-2006-4778
Published: 2006-09-14
Description: SQL injection vulnerability in Creative Commons Tools ccHost before 3.0 allows remote attackers to execute arbitrary SQL commands via a crafted URL, which is used to populate the file ID.  NOTE: Some details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21822; http://sourceforge.net/project/shownotes.php?release_id=445818&group_id=80503; http://www.securityfocus.com/bid/19978
CVE: CVE-2006-4779
Published: 2006-09-14
Description: PHP remote file inclusion vulnerability in includes/functions_portal.php in Vitrax Premodded phpBB 1.0.6-R3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21882; http://www.securityfocus.com/bid/19979; http://www.vupen.com/english/advisories/2006/3571
CVE: CVE-2006-4780
Published: 2006-09-14
Description: PHP remote file inclusion vulnerability in includes/functions.php in phpBB XS 0.58 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21841; http://securityreason.com/securityalert/1576; http://www.securityfocus.com/archive/1/445816/100/0/threaded
CVE: CVE-2006-4781
Published: 2006-09-14
Description: Heap-based buffer overflow in FutureSoft TFTP Server Multithreaded (MT) 1.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by sending a crafted packet to port 69/UDP, which triggers the overflow when constructing an absolute path name.  NOTE: Some details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21844; http://www.securityfocus.com/bid/19925; http://www.vupen.com/english/advisories/2006/3559
CVE: CVE-2006-4782
Published: 2006-09-14
Description: src/index.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication and gain sensitive information stored in the database via a modified userID parameter in a write action to admin/database.php.
CVSS Score: 5.4 (MEDIUM)
References: http://cms.webspell.org/index.php?site=files&file=15; http://secunia.com/advisories/21881; http://www.securityfocus.com/bid/19975
CVE: CVE-2006-4783
Published: 2006-09-14
Description: SQL injection vulnerability in squads.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the squadID parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://cms.webspell.org/index.php?site=files&file=11; http://secunia.com/advisories/21881; http://translate.google.com/translate?hl=en&sl=de&u=http://webspell.org/&sa=X&oi=translate&resnum=2&ct=result&prev=/search%3Fq%3Dwebspell%26hl%3Den%26lr%3D
CVE: CVE-2006-4784
Published: 2006-09-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.6.1 and earlier might allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) doc/index.php or (2) files/index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://docs.moodle.org/en/Release_Notes#Moodle_1.6.2; http://secunia.com/advisories/21899; http://www.securityfocus.com/bid/19995
CVE: CVE-2006-4785
Published: 2006-09-14
Description: SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insert_record function, which calls _adodb_column_sql in the adodb layer (lib/adodb/adodb-lib.inc.php), which does not convert the data type to an int.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://docs.moodle.org/en/Release_notes#Moodle_1.6.2; http://secunia.com/advisories/21899; http://securitytracker.com/id?1016877
CVE: CVE-2006-4786
Published: 2006-09-14
Description: Moodle 1.6.1 and earlier allows remote attackers to obtain sensitive information via (1) help.php and (2) other unspecified vectors involving scheduled backups.
CVSS Score: 5.0 (MEDIUM)
References: http://docs.moodle.org/en/Release_Notes#Moodle_1.6.2; http://secunia.com/advisories/21899; http://www.securityfocus.com/bid/19995
CVE: CVE-2006-4787
Published: 2006-09-14
Description: AlphaMail before 1.0.16 allows local users to obtain sensitive information via the logging functionality, which displays unencrypted passwords in an error message.  NOTE: some details are obtained from third party information.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/21871; http://whizzo.uoregon.edu/public/src/alphamail/ChangeLog; http://www.securityfocus.com/bid/19996
CVE: CVE-2006-4788
Published: 2006-09-14
Description: PHP remote file inclusion vulnerability in includes/log.inc.php in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, when register_globals is enabled and _SESSION[permission] parameter is set to "yes", allows remote attackers to execute arbitrary PHP code via a URL in the dir_path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21878; http://www.telekorn.com/forum/showthread.php?t=1427; http://www.vupen.com/english/advisories/2006/3570
CVE: CVE-2006-4789
Published: 2006-09-14
Description: Buffer overflow in Open Movie Editor 0.0.20060901 allows local users to cause a denial of service (system crash) or execute arbitrary code via a long project name in an open_movie_editor_project XML tag.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/bid/19938; https://exchange.xforce.ibmcloud.com/vulnerabilities/28854; https://www.exploit-db.com/exploits/2338
CVE: CVE-2006-4790
Published: 2006-09-14
Description: verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents GnuTLS from correctly verifying X.509 and other certificates that use PKCS, a variant of CVE-2006-4339.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html; http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001212.html; http://secunia.com/advisories/21937
CVE: CVE-2006-4793
Published: 2006-09-14
Description: Multiple SQL injection vulnerabilities in icerik.asp in TualBLOG 1.0 allow remote attackers to execute arbitrary SQL commands, as demonstrated by the icerikno parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21918; http://securityreason.com/securityalert/1588; http://www.securityfocus.com/archive/1/445918/100/0/threaded
CVE: CVE-2006-4794
Published: 2006-09-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the query string (PATH_INFO) in (1) contact.php, (2) download.php, (3) admin.php, (4) fpw.php, (5) news.php, (6) search.php, (7) signup.php, (8) submitnews.php, and (9) user.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://www.osvdb.org/30979; http://www.osvdb.org/30980; http://www.osvdb.org/30981
CVE: CVE-2006-4795
Published: 2006-09-14
Description: Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport software in HP-UX B.11.11 and B.11.23 before 20060912 allows local users to cause a denial of service via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21909; http://secunia.com/advisories/22010; http://securityreason.com/securityalert/1596
CVE: CVE-2006-4796
Published: 2006-09-14
Description: Cross-site scripting (XSS) vulnerability in forum.asp in Snitz Forums 2000 3.4.06 allows remote attackers to inject arbitrary web script or HTML via the sortorder parameter (strtopicsortord variable).
CVSS Score: 4.3 (MEDIUM)
References: http://forum.snitz.com/forum/topic.asp?TOPIC_ID=62773; http://secunia.com/advisories/21946; http://securityreason.com/securityalert/1578
CVE: CVE-2006-4797
Published: 2006-09-14
Description: Cross-site scripting (XSS) vulnerability in tag.php in CloudNine Interactive CJ Tag Board 3.0 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a url BBcode tag in the cjmsg parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/137/summary.html; http://securityreason.com/securityalert/1580; http://www.securityfocus.com/archive/1/445913/100/0/threaded
CVE: CVE-2006-4798
Published: 2006-09-14
Description: SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1579; http://www.securityfocus.com/archive/1/445512; https://exchange.xforce.ibmcloud.com/vulnerabilities/28671
CVE: CVE-2006-4799
Published: 2006-09-14
Description: Buffer overflow in ffmpeg for xine-lib before 1.1.2 might allow context-dependent attackers to execute arbitrary code via a crafted AVI file and "bad indexes", a different vulnerability than CVE-2005-4048 and CVE-2006-2802.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22230; http://secunia.com/advisories/23010; http://secunia.com/advisories/23213
CVE: CVE-2006-4437
Published: 2006-09-14
Description: Eval injection vulnerability in Tagger LE allows remote attackers to execute arbitrary PHP code via the query string in (1) tags.php, (2) sign.php, and (3) admin/index.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21449; http://secunia.com/secunia_research/2006-62/advisory/; http://securityreason.com/securityalert/1584
CVE: CVE-2006-4800
Published: 2006-09-14
Description: Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9_p20060530 allow remote attackers to cause a denial of service or possibly execute arbitrary code via multiple unspecified vectors in (1) dtsdec.c, (2) vorbis.c, (3) rm.c, (4) sierravmd.c, (5) smacker.c, (6) tta.c, (7) 4xm.c, (8) alac.c, (9) cook.c, (10) shorten.c, (11) smacker.c, (12) snow.c, and (13) tta.c.  NOTE: it is likely that this is a different vulnerability than CVE-2005-4048 and CVE-2006-2802.
CVSS Score: 7.5 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=133520; http://secunia.com/advisories/21921; http://secunia.com/advisories/22180
CVE: CVE-2006-4801
Published: 2006-09-14
Description: Race condition in Deja Vu, as used in Roxio Toast Titanium 7 and possibly other products, allows local users to execute arbitrary code via temporary files, including dejavu_manual.rb, which are executed with raised privileges.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/21867; http://www.netragard.com/pdfs/research/ROXIO_RACE_NETRAGARD-20060624.txt; http://www.securityfocus.com/bid/19955
CVE: CVE-2006-4802
Published: 2006-09-14
Description: Format string vulnerability in the Real Time Virus Scan service in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security 1.x up to 3.0, allows local users to execute arbitrary code via an unspecified vector related to alert notification messages, a different vector than CVE-2006-3454, a "second format string vulnerability" as found by the vendor.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21884; http://securityresponse.symantec.com/avcenter/security/Content/2006.09.13.html; http://securitytracker.com/id?1016842
CVE: CVE-2006-4803
Published: 2006-09-14
Description: The Fan-Out Linux and UNIX receiver scripts in Novell Identity Manager (IDM) 3.0.1 allows local users to execute arbitrary commands via unspecified vectors involving certain environment variables and "code injection."
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/21888; http://securitytracker.com/id?1016853; http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974421.htm
CVE: CVE-2006-4340
Published: 2006-09-15
Description: Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates, a similar vulnerability to CVE-2006-4339.  NOTE: on 20061107, Mozilla released an advisory stating that these versions were not completely patched by MFSA2006-60. The newer fixes for 1.5.0.7 are covered by CVE-2006-5462.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://secunia.com/advisories/21903; http://secunia.com/advisories/21906
CVE: CVE-2006-4565
Published: 2006-09-15
Description: Heap-based buffer overflow in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a JavaScript regular expression with a "minimal quantifier."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://secunia.com/advisories/21906; http://secunia.com/advisories/21915
CVE: CVE-2006-4566
Published: 2006-09-15
Description: Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allows remote attackers to cause a denial of service (crash) via a malformed JavaScript regular expression that ends with a backslash in an unterminated character set ("[\\"), which leads to a buffer over-read.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://secunia.com/advisories/21906; http://secunia.com/advisories/21915
CVE: CVE-2006-4567
Published: 2006-09-15
Description: Mozilla Firefox before 1.5.0.7 and Thunderbird before 1.5.0.7 makes it easy for users to accept self-signed certificates for the auto-update mechanism, which might allow remote user-assisted attackers to use DNS spoofing to trick users into visiting a malicious site and accepting a malicious certificate for the Mozilla update site, which can then be used to install arbitrary code on the next update.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/21906; http://secunia.com/advisories/21916; http://secunia.com/advisories/21939
CVE: CVE-2006-4568
Published: 2006-09-15
Description: Mozilla Firefox before 1.5.0.7 and SeaMonkey before 1.0.5 allows remote attackers to bypass the security model and inject content into the sub-frame of another site via targetWindow.frames[n].document.open(), which facilitates spoofing and other attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://secunia.com/advisories/21906; http://secunia.com/advisories/21915
CVE: CVE-2006-4569
Published: 2006-09-15
Description: The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting (XSS) attacks.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/21949; http://secunia.com/advisories/21950; http://secunia.com/advisories/22001
CVE: CVE-2006-4570
Published: 2006-09-15
Description: Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
CVSS Score: 2.6 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://secunia.com/advisories/21915; http://secunia.com/advisories/21916
CVE: CVE-2006-4571
Published: 2006-09-15
Description: Multiple unspecified vulnerabilities in Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allow remote attackers to cause a denial of service (crash), corrupt memory, and possibly execute arbitrary code via unspecified vectors, some of which involve JavaScript, and possibly large images or plugin data.
CVSS Score: 10.0 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://secunia.com/advisories/21906; http://secunia.com/advisories/21915
CVE: CVE-2006-4820
Published: 2006-09-15
Description: Unspecified vulnerability in X.25 on HP-UX B.11.00, B.11.11, and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/21928; http://securityreason.com/securityalert/1595; http://securitytracker.com/id?1016857
CVE: CVE-2006-4821
Published: 2006-09-15
Description: Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Userreview module before 1.19 2006/09/12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://drupal.org/node/83954; http://secunia.com/advisories/21907; http://www.securityfocus.com/bid/20015