deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1739
Published: 2006-04-14
Description: The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain Cascading Style Sheets (CSS) that causes an out-of-bounds array write and buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1740
Published: 2006-04-14
Description: Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site.
CVSS Score: 2.6 (LOW)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1741
Published: 2006-04-14
Description: Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.__proto__ to extend eval, aka "cross-site JavaScript injection".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1742
Published: 2006-04-14
Description: The JavaScript engine in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly handle temporary variables that are not garbage collected, which might allow remote attackers to trigger operations on freed memory and cause memory corruption.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1737
Published: 2006-04-14
Description: Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large regular expression.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1738
Published: 2006-04-14
Description: Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) by changing the (1) -moz-grid and (2) -moz-grid-group display styles.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1790
Published: 2006-04-14
Description: A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-0558
Published: 2006-04-14
Description: perfmon (perfmon.c) in Linux kernel on IA64 architectures allows local users to cause a denial of service (crash) by interrupting a task while another process is accessing the mm_struct, which triggers a BUG_ON action in the put_page_testzero function.
CVSS Score: 4.9 (MEDIUM)
References: http://marc.info/?l=linux-ia64&m=[PII_REDACTED]1688; http://secunia.com/advisories/19737; http://secunia.com/advisories/20914
CVE: CVE-2006-1791
Published: 2006-04-14
Description: Directory traversal vulnerability in acc.php in QuickBlogger 1.4 allows remote attackers to read or include arbitrary local files via the request parameter.  NOTE: this issue can also produce resultant XSS when the associated include statement fails.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15942; http://www.securityfocus.com/archive/1/430878/100/0/threaded; http://www.securityfocus.com/archive/1/431059/100/0/threaded
CVE: CVE-2006-1792
Published: 2006-04-15
Description: Unspecified vulnerability in the POP service in MailEnable Standard Edition before 1.94, Professional Edition before 1.74, and Enterprise Edition before 1.22 has unknown attack vectors and impact related to "authentication exploits".  NOTE: this is a different set of affected versions, and probably a different vulnerability than CVE-2006-1337.
CVSS Score: 10.0 (HIGH)
References: http://www.mailenable.com/enterprisehistory.asp; http://www.mailenable.com/professionalhistory.asp; http://www.mailenable.com/standardhistory.asp
CVE: CVE-2006-1436
Published: 2006-04-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in UPOINT @1 Event Publisher allow remote attackers to inject arbitrary web script or HTML via the (1) Event, (2) Description, (3) Time, (4) Website, and (5) Public Remarks fields to (a) eventpublisher_admin.htm and (b) eventpublisher_usersubmit.htm.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/24/24236-upoint.txt; http://secunia.com/advisories/19727; http://www.osvdb.org/24235
CVE: CVE-2006-1437
Published: 2006-04-15
Description: UPOINT @1 Event Publisher stores sensitive information under the web document root with insufifcient access control, which allows remote attackers to read private comments via a direct request to eventpublisher.txt.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/ref/24/24236-upoint.txt; http://secunia.com/advisories/19727; http://www.osvdb.org/24237
CVE: CVE-2006-1793
Published: 2006-04-17
Description: Directory traversal vulnerability in runCMS 1.2 and earlier allows remote attackers to read arbitrary files via the bbPath[path] parameter to (1) class.forumposts.php and (2) forumpollrenderer.php. NOTE: this issue is closely related to CVE-2006-0659.
CVSS Score: 7.6 (HIGH)
References: http://retrogod.altervista.org/runcms_13a_xpl.html; http://www.securityfocus.com/archive/1/424708; http://www.securityfocus.com/bid/16578
CVE: CVE-2006-1794
Published: 2006-04-17
Description: SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via (1) the $username variable in the mosGetParam function and (2) the $task parameter in the mosMenuCheck function in (a) includes/mambo.php; and (3) the $filter variable to the showCategory function in the com_content component (content.php).
CVSS Score: 7.6 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0463.html; http://secunia.com/advisories/18935; http://source.mambo-foundation.org/view/news/Announcements/Security_Patch_Released/
CVE: CVE-2006-1795
Published: 2006-04-17
Description: Cross-site scripting (XSS) vulnerability in tablepublisher.cgi in UPDI Network Enterprise @1 Table Publisher 2006-03-23 allows remote attackers to inject arbitrary web script or HTML via the Title of Table field.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19723; http://www.osvdb.org/24238; http://www.securityfocus.com/bid/17642
CVE: CVE-2006-1796
Published: 2006-04-17
Description: Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI ($_SERVER['REQUEST_URI']).
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=328909; http://trac.wordpress.org/ticket/1686; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=328909
CVE: CVE-2006-0744
Published: 2006-04-18
Description: Linux kernel before 2.6.16.5 does not properly handle uncanonical return addresses on Intel EM64T CPUs, which reports an exception in the SYSRET instead of the next instruction, which causes the kernel exception handler to run on the user stack with the wrong GS.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.5; http://lwn.net/Alerts/180820/; http://secunia.com/advisories/19639
CVE: CVE-2006-1797
Published: 2006-04-18
Description: The kernel in NetBSD-current before September 28, 2005 allows local users to cause a denial of service (system crash) by using the SIOCGIFALIAS ioctl to gather information on a non-existent alias of a network interface, which causes a NULL pointer dereference.
CVSS Score: 4.9 (MEDIUM)
References: http://archives.neohapsis.com/archives/netbsd/2006-q2/0014.html; http://secunia.com/advisories/19615; http://securitytracker.com/id?1015908
CVE: CVE-2006-1798
Published: 2006-04-18
Description: SQL injection vulnerability in rateit.php in RateIt 2.2 allows remote attackers to execute arbitrary SQL commands via the rateit_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/124/summary.html; http://secunia.com/advisories/19637; http://securitytracker.com/id?1015983
CVE: CVE-2006-1799
Published: 2006-04-18
Description: censtore.cgi in Censtore 7.3.002 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19666; http://www.securityfocus.com/bid/17515; http://www.vupen.com/english/advisories/2006/1352
CVE: CVE-2006-1800
Published: 2006-04-18
Description: Directory traversal vulnerability in posts.php in SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and execute arbitrary files via ".." sequences in the language cookie, as demonstrated by by injecting the code into the gl_session cookie of users.php, which is stored in error.log.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/SimpleBBS-RCE-posts.php.pl; http://www.securityfocus.com/archive/1/430872; http://www.securityfocus.com/bid/17501
CVE: CVE-2006-1801
Published: 2006-04-18
Description: Cross-site scripting (XSS) vulnerability in planetsearchplus.php in planetSearch+ allows remote attackers to inject arbitrary web script or HTML via the search_exp parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://d4igoro.blogspot.com/2006/04/planetsearch-xss-vulnerabilities.html; http://secunia.com/advisories/19681; http://www.securityfocus.com/archive/1/431033/100/0/threaded
CVE: CVE-2006-1802
Published: 2006-04-18
Description: Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the twg_album parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19660; http://securityreason.com/securityalert/717; http://www.securityfocus.com/archive/1/431069/100/0/threaded
CVE: CVE-2006-1803
Published: 2006-04-18
Description: Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19659; http://secunia.com/advisories/19897; http://www.novell.com/linux/security/advisories/2006_04_28.html
CVE: CVE-2006-1804
Published: 2006-04-18
Description: SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19659; http://secunia.com/advisories/19897; http://www.novell.com/linux/security/advisories/2006_04_28.html
CVE: CVE-2006-1805
Published: 2006-04-18
Description: SQL injection vulnerability in member.php in PowerClan 1.14 allows remote attackers to execute arbitrary SQL commands via the memberid parameter.
CVSS Score: 7.5 (HIGH)
References: http://d4igoro.blogspot.com/2006/04/powerclan-114-sql-injection.html; http://secunia.com/advisories/19689; http://securityreason.com/securityalert/706
CVE: CVE-2006-1806
Published: 2006-04-18
Description: Cross-site scripting (XSS) vulnerability in index.php in Musicbox 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter in a search action.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/musicbox-vuln.html; http://secunia.com/advisories/19672; http://www.securityfocus.com/archive/1/441000/100/0/threaded
CVE: CVE-2006-1807
Published: 2006-04-18
Description: Multiple SQL injection vulnerabilities in index.php in Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) start parameter in a search action or (2) type parameter in a top action.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/04/musicbox-vuln.html; http://secunia.com/advisories/19672; http://www.securityfocus.com/archive/1/441000/100/0/threaded
CVE: CVE-2006-1808
Published: 2006-04-18
Description: Cross-site scripting (XSS) vulnerability in index.php in Lifetype 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the show parameter in a Template operation.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19646; http://securitytracker.com/id?1015941; http://www.securityfocus.com/archive/1/431008/100/0/threaded
CVE: CVE-2006-1809
Published: 2006-04-18
Description: index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/711; http://securitytracker.com/id?1015941; http://www.securityfocus.com/archive/1/431008/100/0/threaded
CVE: CVE-2006-1810
Published: 2006-04-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to inject arbitrary web script or HTML via the (1) ICQ, (2) AIM, (3) MSN, (4) Google Talk, (5) Website Name, (6) Website Address, (7) Email Address, (8) Location, (9) Signature, and (10) Sub-Titles fields in the user profile.
CVSS Score: 1.9 (LOW)
References: http://www.securityfocus.com/archive/1/431121/100/0/threaded; http://www.securityfocus.com/bid/17539; http://www.securityfocus.com/archive/1/431121/100/0/threaded
CVE: CVE-2006-1811
Published: 2006-04-18
Description: Multiple SQL injection vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) forumid, or (3) threadid parameter to index.php; the (4) ICQ, (5) AIM, (6) MSN, (7) Google Talk, (8) Website Name, (9) Website Address, (10) Email Address, (11) Location, (12) Signature, and (13) Sub-Titles fields in the user profile; or (14) flexbb_password field in a cookie.
CVSS Score: 6.4 (MEDIUM)
References: http://www.securityfocus.com/archive/1/431121/100/0/threaded; http://www.securityfocus.com/bid/17574; http://www.securityfocus.com/archive/1/431121/100/0/threaded
CVE: CVE-2006-1812
Published: 2006-04-18
Description: phpWebFTP 3.2 and earlier stores script.js under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19706; http://www.securityfocus.com/archive/1/431115/100/0/threaded; http://www.securityfocus.com/bid/17557
CVE: CVE-2006-1813
Published: 2006-04-18
Description: Directory traversal vulnerability in index.php in phpWebFTP 3.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the language parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19706; http://securityreason.com/securityalert/723; http://www.securityfocus.com/archive/1/431115/100/0/threaded
CVE: CVE-2006-1814
Published: 2006-04-18
Description: NetBSD 1.6, 2.0, 2.1 and 3.0 allows local users to cause a denial of service (memory exhaustion) by using the sysctl system call to lock a large buffer into physical memory.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-013.txt.asc; http://secunia.com/advisories/19616; http://securitytracker.com/id?1015909
CVE: CVE-2006-1815
Published: 2006-04-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) newuser_realname and (2) newuser_icq parameters, a different vector than CVE-2006-1768.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19635; http://securityreason.com/securityalert/693; http://www.osvdb.org/24556
CVE: CVE-2006-1816
Published: 2006-04-18
Description: PHP remote file inclusion vulnerability in VBulletin 3.5.1, 3.5.2, and 3.5.4 allows remote attackers to execute arbitrary code via a URL in the systempath parameter to (1) ImpExModule.php, (2) ImpExController.php, and (3) ImpExDisplay.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19352; http://www.osvdb.org/24690; http://www.osvdb.org/24691
CVE: CVE-2006-1817
Published: 2006-04-18
Description: SQL injection vulnerability in authcheck.php in warforge.NEWS 1.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the (1) authusername and possibly the (2) authpassword cookie.
CVSS Score: 2.6 (LOW)
References: http://evuln.com/vulns/125/summary.html; http://www.securityfocus.com/archive/1/432104/100/0/threaded; http://www.securityfocus.com/bid/17520
CVE: CVE-2006-1818
Published: 2006-04-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly including the (1) first_name and (2) last_name parameter in myaccounts.php.  NOTE: portions of these details were obtained from third party sources instead of the original disclosure.
CVSS Score: 2.6 (LOW)
References: http://evuln.com/vulns/125/summary.html; http://www.securityfocus.com/archive/1/432104/100/0/threaded; http://www.securityfocus.com/bid/17520
CVE: CVE-2006-1819
Published: 2006-04-18
Description: Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter, as demonstrated by including access_log.  NOTE: in some cases, arbitrary remote file inclusion could be performed under PHP 5 using an SMB share argument such as "\\systemname\sharename".
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/PHPWebSite_fi_poc; http://secunia.com/advisories/19647; http://secunia.com/advisories/19914
CVE: CVE-2006-1820
Published: 2006-04-18
Description: Cross-site scripting (XSS) vulnerability in index.php in ModX 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this might be resultant from the directory traversal vulnerability.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/19645; http://securitytracker.com/id?1015940; http://www.securityfocus.com/archive/1/431010/100/0/threaded
CVE: CVE-2006-1821
Published: 2006-04-18
Description: Directory traversal vulnerability in index.php in ModX 0.9.1 allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the id parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19645; http://securitytracker.com/id?1015940; http://www.securityfocus.com/archive/1/431010/100/0/threaded
CVE: CVE-2006-1822
Published: 2006-04-18
Description: Cross-site scripting (XSS) vulnerability in search.php in FarsiNews 2.5.3 Pro and earlier allows remote attackers to inject arbitrary web script or HTML via the selected_search_arch parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/19648; http://securityreason.com/securityalert/710; http://securitytracker.com/id?1015943
CVE: CVE-2006-1823
Published: 2006-04-18
Description: Directory traversal vulnerability in FarsiNews 2.5.3 Pro and earlier allows remote attackers to obtain the installation path via ".." sequences in the archive parameter to index.php, which leaks the full pathname in an error message.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19648; http://securityreason.com/securityalert/710; http://securitytracker.com/id?1015943
CVE: CVE-2006-1824
Published: 2006-04-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in PhpGuestbook.php in PhpGuestbook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Website, and (3) Comment parameter.
CVSS Score: 1.2 (LOW)
References: http://pridels0.blogspot.com/2006/04/phpguestbook-v10-script-insertion.html; http://secunia.com/advisories/19669; http://www.securityfocus.com/archive/1/431070/100/0/threaded
CVE: CVE-2006-1825
Published: 2006-04-18
Description: Cross-site scripting (XSS) vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/phplinks-2131-xss-vuln.html; http://www.securityfocus.com/bid/17586; http://www.vupen.com/english/advisories/2006/1378
CVE: CVE-2006-1826
Published: 2006-04-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Snipe Gallery 3.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in view.php, (2) keyword parameter in search.php, and (3) image_id parameter in image.php.  NOTE: it is possible that vectors 1 and 3 are resultant from SQL injection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securitytracker.com/id?1015947; http://www.securityfocus.com/archive/1/431074/100/0/threaded; http://www.securityfocus.com/archive/1/431123/100/0/threaded
CVE: CVE-2006-1753
Published: 2006-04-18
Description: A cron job in fcheck before 2.7.59 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
CVSS Score: 3.6 (LOW)
References: http://secunia.com/advisories/19675; http://www.securityfocus.com/bid/17524; http://www.us.debian.org/security/2006/dsa-1035
CVE: CVE-2006-1827
Published: 2006-04-18
Description: Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length.
CVSS Score: 6.4 (MEDIUM)
References: http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.7-patch.gz; http://secunia.com/advisories/19800; http://secunia.com/advisories/19872