deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6114
Published: 2006-11-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-5854.  Reason: This candidate is a duplicate of CVE-2006-5854.  Notes: All CVE users should reference CVE-2006-5854 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-6115
Published: 2006-11-26
Description: SQL injection vulnerability in index.asp in fipsCMS 4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the fid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23061; http://www.securityfocus.com/bid/21258; http://www.vupen.com/english/advisories/2006/4681
CVE: CVE-2006-6116
Published: 2006-11-26
Description: SQL injection vulnerability in default2.asp in fipsForum 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the kat parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23057; http://www.securityfocus.com/bid/21253; http://www.vupen.com/english/advisories/2006/4682
CVE: CVE-2006-6117
Published: 2006-11-26
Description: SQL injection vulnerability in index1.asp in fipsGallery 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the which parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23056; http://www.securityfocus.com/bid/21254; http://www.vupen.com/english/advisories/2006/4683
CVE: CVE-2006-6118
Published: 2006-11-26
Description: Cross-site scripting (XSS) vulnerability in thumbs.php in mmgallery 1.55 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23130; http://securityreason.com/securityalert/1917; http://securitytracker.com/id?1017283
CVE: CVE-2006-6119
Published: 2006-11-26
Description: mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation path in various error messages.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23130; http://securityreason.com/securityalert/1917; http://securitytracker.com/id?1017283
CVE: CVE-2006-5965
Published: 2006-11-26
Description: PassGo SSO Plus 2.1.0.32, and probably earlier versions, uses insecure permissions (Everyone/Full Control) for the PassGo Technologies directory, which allows local users to gain privileges by modifying critical programs.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/22301; http://secunia.com/secunia_research/2006-68/advisory; http://securitytracker.com/id?1017272
CVE: CVE-2006-6121
Published: 2006-11-26
Description: Acer Notebook LunchApp.APlunch ActiveX control allows remote attackers to execute arbitrary commands by calling the Run method.
CVSS Score: 9.3 (HIGH)
References: ftp://ftp.support.acer-euro.com/utilities/LaunchAppFix/AcerLAppFix.zip; http://global.acer.com/support/patch20070101.htm; http://secunia.com/advisories/23003
CVE: CVE-2006-6122
Published: 2006-11-26
Description: Multiple buffer overflows in TIN before 1.8.2 have unspecified impact and attack vectors, a different vulnerability than CVE-2006-0804.
CVSS Score: 7.5 (HIGH)
References: http://www.gentoo.org/security/en/glsa/glsa-200611-18.xml; https://exchange.xforce.ibmcloud.com/vulnerabilities/30564; http://www.gentoo.org/security/en/glsa/glsa-200611-18.xml
CVE: CVE-2006-6123
Published: 2006-11-26
Description: Coppermine Photo Gallery (CPG) 1.4.8 stable, with register_globals enabled, allows remote attackers to bypass XSS protection and set arbitrary variables via a query string that causes the variable to be defined in global space, with separate _GET, _REQUEST, or other critical parameters, which are unset by the protection scheme and prevent the original variable from being detected.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0482.html; http://myimei.com/security/2006-06-20/coppermine-148parameter-cleanup-system-bypassregistering-global-varables.html; http://secunia.com/advisories/20597
CVE: CVE-2006-6124
Published: 2006-11-26
Description: Cross-site scripting (XSS) vulnerability in SeleniumServer Web Server 1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22927; http://www.osvdb.org/30454; https://exchange.xforce.ibmcloud.com/vulnerabilities/30313
CVE: CVE-2006-6125
Published: 2006-11-27
Description: Heap-based buffer overflow in the wireless driver (WG311ND5.SYS) 2.3.1.10 for NetGear WG311v1 wireless adapter allows remote attackers to execute arbitrary code via an 802.11 management frame with a long SSID.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://projects.info-pull.com/mokb/MOKB-22-11-2006.html; http://secunia.com/advisories/23051; http://securitytracker.com/id?1017275
CVE: CVE-2006-6126
Published: 2006-11-27
Description: Apple Mac OS X allows local users to cause a denial of service (memory corruption) via a crafted Mach-O binary with a malformed load_command data structure.
CVSS Score: 2.1 (LOW)
References: http://projects.info-pull.com/mokb/MOKB-23-11-2006.html; http://www.osvdb.org/30740; http://www.securityfocus.com/bid/21272
CVE: CVE-2006-6127
Published: 2006-11-27
Description: Apple Mac OS X kernel allows local users to cause a denial of service via a process that uses kevent to register a queue and an event, then fork a child process that uses kevent to register an event for the same queue as the parent.
CVSS Score: 2.1 (LOW)
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://projects.info-pull.com/mokb/MOKB-24-11-2006.html
CVE: CVE-2006-6128
Published: 2006-11-27
Description: The ReiserFS functionality in Linux kernel 2.6.18, and possibly other versions, allows local users to cause a denial of service via a malformed ReiserFS file system that triggers memory corruption when a sync is performed.
CVSS Score: 2.1 (LOW)
References: http://projects.info-pull.com/mokb/MOKB-25-11-2006.html; http://secunia.com/advisories/23093; http://www.vupen.com/english/advisories/2006/4716
CVE: CVE-2006-6129
Published: 2006-11-27
Description: Integer overflow in the fatfile_getarch2 in Apple Mac OS X allows local users to cause a denial of service and possibly execute arbitrary code via a crafted Mach-O Universal program that triggers memory corruption.
CVSS Score: 4.6 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305214; http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html; http://projects.info-pull.com/mokb/MOKB-26-11-2006.html
CVE: CVE-2006-5750
Published: 2006-11-27
Description: Directory traversal vulnerability in the DeploymentFileRepository class in JBoss Application Server (jbossas) 3.2.4 through 4.0.5 allows remote authenticated users to read or modify arbitrary files, and possibly execute arbitrary code, via unspecified vectors related to the console manager.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01390402; http://jira.jboss.com/jira/browse/ASPATCH-126; http://jira.jboss.com/jira/browse/JBAS-3861
CVE: CVE-2006-5896
Published: 2006-11-27
Description: REMLAB Web Mech Designer 2.0.5 allows remote attackers to obtain the full path of the script via an incorrect Tonnage parameter to calculate.php that triggers a divide-by-zero error, which leaks the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050879.html; http://netvigilance.com/advisory0007; http://securityreason.com/securityalert/1911
CVE: CVE-2006-6130
Published: 2006-11-28
Description: Apple Mac OS X AppleTalk allows local users to cause a denial of service (kernel panic) by calling the AIOCREGLOCALZN ioctl command with a crafted data structure on an AppleTalk socket.
CVSS Score: 4.9 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305214; http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html; http://projects.info-pull.com/mokb/MOKB-27-11-2006.html
CVE: CVE-2006-6131
Published: 2006-11-28
Description: Untrusted search path vulnerability in (1) WSAdminServer and (2) WSWebServer in Kerio WebSTAR (4D WebSTAR Server Suite) 5.4.2 and earlier allows local users with webstar privileges to gain root privileges via a malicious libucache.dylib helper library in the current working directory.
CVSS Score: 6.2 (MEDIUM)
References: http://secunia.com/advisories/22906; http://securityreason.com/securityalert/1921; http://securitytracker.com/id?1017239
CVE: CVE-2006-6132
Published: 2006-11-28
Description: Multiple SQL injection vulnerabilities in Link Exchange Lite allow remote attackers to execute arbitrary SQL commands via (1) the search engine field to search.asp and (2) psearch parameter to linkslist.asp.
CVSS Score: 7.5 (HIGH)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=53; http://secunia.com/advisories/23068; http://securityreason.com/securityalert/1920
CVE: CVE-2006-6133
Published: 2006-11-28
Description: Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and 2005 SP1 (formerly Business Objects Crystal Reports XI Professional) allows user-assisted remote attackers to execute arbitrary code via a crafted RPT file.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/23091; http://secunia.com/advisories/26754; http://securitytracker.com/id?1017279
CVE: CVE-2006-6134
Published: 2006-11-28
Description: Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long HREF attribute, using an unrecognized protocol, in a REF element in an ASX PlayList file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://blogs.technet.com/msrc/archive/2006/12/07/public-proof-of-concept-code-for-asx-file-format-isssue.aspx; http://research.eeye.com/html/alerts/zeroday/20061122.html; http://secunia.com/advisories/22971
CVE: CVE-2006-4181
Published: 2006-11-28
Description: Format string vulnerability in the sqllog function in the SQL accounting code for radiusd in GNU Radius 1.2 and 1.3 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=443; http://secunia.com/advisories/23087; http://security.gentoo.org/glsa/glsa-200612-17.xml
CVE: CVE-2006-6135
Published: 2006-11-28
Description: Multiple unspecified vulnerabilities in IBM WebSphere Application Server 6.1.0 before Fix Pack 3 (6.1.0.3) have unknown impact and attack vectors, related to (1) a "Potential security vulnerability" (PK29725) and (2) "Potential security exposure" (PK30831).
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23028; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24013830; http://www-1.ibm.com/support/docview.wss?uid=swg27007951
CVE: CVE-2006-6136
Published: 2006-11-28
Description: IBM WebSphere Application Server 6.1.0 before Fix Pack 3 (6.1.0.3) does not perform EAL4 authentication checks at the proper time during "registering of response operation," which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23028; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24013830; http://www-1.ibm.com/support/docview.wss?uid=swg27007951
CVE: CVE-2006-6137
Published: 2006-11-28
Description: Multiple PHP remote file inclusion vulnerabilities in Sisfo Kampus 0.8 allow remote attackers to execute arbitrary PHP code via a URL in the (1) exec parameter to index.php or (2) print parameter to print.php, which is also accessible via the print command to index.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21294; https://www.exploit-db.com/exploits/2847; http://www.securityfocus.com/bid/21294
CVE: CVE-2006-6138
Published: 2006-11-28
Description: Directory traversal vulnerability in download.php in Sisfo Kampus 0.8 allows remote attackers to list arbitrary directories via an absolute pathname in the dir parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/21294; https://www.exploit-db.com/exploits/2847; http://www.securityfocus.com/bid/21294
CVE: CVE-2006-6139
Published: 2006-11-28
Description: Directory traversal vulnerability in downloadexcel.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitrary files via the fn parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23109; http://www.vupen.com/english/advisories/2006/4723; http://secunia.com/advisories/23109
CVE: CVE-2006-6140
Published: 2006-11-28
Description: PHP remote file inclusion vulnerability in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to execute arbitrary PHP code via a URL in the slnt parameter to (1) index.php and (2) print.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23109; http://www.vupen.com/english/advisories/2006/4723; http://secunia.com/advisories/23109
CVE: CVE-2006-6141
Published: 2006-11-28
Description: Buffer overflow in Tftpd32 3.01 allows remote attackers to cause a denial of service via a long GET or PUT request, which is not properly handled when the request is displayed in the title of the gauge window.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22968; http://securityreason.com/securityalert/1923; http://www.kb.cert.org/vuls/id/632633
CVE: CVE-2006-4518
Published: 2006-11-28
Description: Qbik WinGate 6.1.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a DNS request with a self-referencing compressed name pointer, which triggers an infinite loop.
CVSS Score: 5.0 (MEDIUM)
References: http://forums.qbik.com/viewtopic.php?t=4215; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=444; http://secunia.com/advisories/23029
CVE: CVE-2006-6113
Published: 2006-11-28
Description: Monkey Boards 0.3.5 allows remote attackers to obtain sensitive information via direct requests to (1) include/admin_auth.inc.php and (2) include/engine/class.compiler.php, which reveals the full path in an error message.  NOTE: this issue is only an exposure if the administrator has changed the default script path.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050969.html; http://sourceforge.net/tracker/index.php?func=detail&aid=1603389&group_id=165094&atid=834302; http://www.netvigilance.com/advisory0009
CVE: CVE-2006-6145
Published: 2006-11-28
Description: CRYPTOCard CRYPTO-Server before 6.4.56 stores LDAP credentials in plaintext in UninstallerData\installvariables.properties, which has insecure permissions and allows local users to obtain the credentials. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/22138; http://www.securityfocus.com/bid/21305; http://www.vupen.com/english/advisories/2006/4710
CVE: CVE-2006-6146
Published: 2006-11-28
Description: Buffer overflow in the HPDF_Page_Circle function in hpdf_page_operator.c in Takeshi Kanno Haru Free PDF Library (libharu2, aka libharu) 2.0.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via certain arguments that yield a large amount of PDF data, as demonstrated by a filled circle.
CVSS Score: 2.6 (LOW)
References: http://sourceforge.net/project/shownotes.php?release_id=465886; http://sourceforge.net/tracker/index.php?func=detail&aid=1597538&group_id=83044&atid=568129; http://www.securityfocus.com/bid/21259
CVE: CVE-2006-6147
Published: 2006-11-28
Description: Multiple SQL injection vulnerabilities in JiRos Links Manager allow remote attackers to execute arbitrary SQL commands via the (1) LinkID parameter to openlink.asp or the (2) CategoryID parameter to viewlinks.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23063; http://securitytracker.com/id?1017280; http://www.frsirt.com/english/reference-2006-4664-1.php
CVE: CVE-2006-6148
Published: 2006-11-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in submitlink.asp in JiRos Links Manager allow remote attackers to inject arbitrary web script or HTML via the (1) lName, (2) lURL, (3) lImage, and (4) lDescription parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23063; http://securityreason.com/securityalert/1924; http://securitytracker.com/id?1017280
CVE: CVE-2006-6149
Published: 2006-11-28
Description: SQL injection vulnerability in index.asp in JiRos FAQ Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the tID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23085; http://www.securityfocus.com/bid/21271; http://www.vupen.com/english/advisories/2006/4688
CVE: CVE-2006-6150
Published: 2006-11-28
Description: PHP remote file inclusion vulnerability in memory/OWLMemoryProperty.php in OWLLib 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the OWLLIB_ROOT parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23079; http://www.securityfocus.com/bid/21268; http://www.vupen.com/english/advisories/2006/4690
CVE: CVE-2006-6151
Published: 2006-11-28
Description: PHP remote file inclusion vulnerability in centre.php in Messagerie Locale as of 20061127 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23081; http://www.securityfocus.com/bid/21267; http://www.vupen.com/english/advisories/2006/4684
CVE: CVE-2006-6152
Published: 2006-11-28
Description: Multiple SQL injection vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to (a) cat.asp, or the (2) keyword, (3) order, (4) sort, (5) menuSelect, or (6) state parameter to (b) search.asp.
CVSS Score: 7.5 (HIGH)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=47; http://secunia.com/advisories/22987; http://securityreason.com/securityalert/1926
CVE: CVE-2006-6153
Published: 2006-11-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to inject arbitrary web script or HTML via (1) catname parameter to cat.asp or the (2) minprice parameter to search.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=47; http://secunia.com/advisories/22987; http://securityreason.com/securityalert/1926
CVE: CVE-2006-6154
Published: 2006-11-28
Description: PHP remote file inclusion vulnerability in addcode.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23078; http://www.securityfocus.com/archive/1/494928/100/0/threaded; http://www.securityfocus.com/bid/21280
CVE: CVE-2006-6155
Published: 2006-11-28
Description: Multiple SQL injection vulnerabilities in addrating.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ipadd or (2) url parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/4689; https://exchange.xforce.ibmcloud.com/vulnerabilities/30529; http://www.vupen.com/english/advisories/2006/4689
CVE: CVE-2006-6156
Published: 2006-11-28
Description: Cross-site scripting (XSS) vulnerability in auth/message.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF).  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/4689; https://exchange.xforce.ibmcloud.com/vulnerabilities/30530; http://www.vupen.com/english/advisories/2006/4689
CVE: CVE-2006-6157
Published: 2006-11-28
Description: SQL injection vulnerability in index.php in ContentNow 1.39 and earlier allows remote attackers to execute arbitrary SQL commands via the pageid parameter.  NOTE: this issue can be leveraged for path disclosure with an invalid pageid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/23005; http://securityreason.com/securityalert/1925; http://securitytracker.com/id?1017265
CVE: CVE-2006-6158
Published: 2006-11-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in (a) PMOS Help Desk 2.4, formerly (b) InverseFlow Help Desk 2.31 and also sold as (c) Ace Helpdesk 2.31, allow remote attackers to inject arbitrary web script or HTML via the (1) id or email parameter to ticketview.php, or (2) the email parameter to ticket.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23052; http://secunia.com/advisories/23070; http://secunia.com/advisories/23071
CVE: CVE-2006-6159
Published: 2006-11-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) message or (2) subject parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/22991; http://www.osvdb.org/30671; http://www.securityfocus.com/bid/21248
CVE: CVE-2006-6160
Published: 2006-11-28
Description: SQL injection vulnerability in details.asp in Doug Luxem Liberum Help Desk 0.97.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21292; http://www.vupen.com/english/advisories/2006/4704; https://exchange.xforce.ibmcloud.com/vulnerabilities/30485
CVE: CVE-2006-6161
Published: 2006-11-28
Description: Multiple SQL injection vulnerabilities in Doug Luxem Liberum Help Desk 0.97.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) uid parameter to (a) inout/status.asp, (b) inout/update.asp, and (c) forgotpass.asp.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/32884; http://www.vupen.com/english/advisories/2006/4704; https://exchange.xforce.ibmcloud.com/vulnerabilities/47420
CVE: CVE-2006-6162
Published: 2006-11-29
Description: Cross-site scripting (XSS) vulnerability in tiki-edit_structures.php in TikiWiki 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the pageAlias parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/22850; http://www.osvdb.org/30692; http://www.securityfocus.com/bid/21297