deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6163
Published: 2006-11-29
Description: Cross-site scripting (XSS) vulnerability in tiki-setup_base.php in TikiWiki before 1.9.7 allows remote attackers to inject arbitrary JavaScript via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?r1=1.157.2.50&r2=1.157.2.51; http://www.vupen.com/english/advisories/2006/4709; http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?r1=1.157.2.50&r2=1.157.2.51
CVE: CVE-2006-6164
Published: 2006-11-29
Description: The _dl_unsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LD_PRELOAD to loading processes, which might be leveraged to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/22993; http://securitytracker.com/id?1017253; http://www.matasano.com/log/592/finger-79tcp-mcdonald-dowd-and-schuh-challenge-part-2/
CVE: CVE-2006-6165
Published: 2006-11-29
Description: ld.so in FreeBSD, NetBSD, and possibly other BSD distributions does not remove certain harmful environment variables, which allows local users to gain privileges by passing certain environment variables to loading processes.  NOTE: this issue has been disputed by a third party, stating that it is the responsibility of the application to properly sanitize the environment
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/archive/1/452371/100/0/threaded; http://www.securityfocus.com/archive/1/452428/100/0/threaded; http://www.securityfocus.com/archive/1/452371/100/0/threaded
CVE: CVE-2006-6166
Published: 2006-11-29
Description: Cross-site scripting (XSS) vulnerability in jce.php in the JCE Admin Component in Ryan Demmer Joomla Content Editor (JCE) 1.0.4 for Joomla! (com_jce), without the 20060821 jce_patch, allows remote attackers to inject arbitrary web script or HTML via the mosConfig_live_site parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://forum.joomla.org/index.php?topic=113796.new#new; http://www.cellardoor.za.net/index.php?option=com_content&task=view&id=28; http://www.cellardoor.za.net/index.php?option=com_docman&task=doc_download&gid=51&Itemid=6
CVE: CVE-2006-6167
Published: 2006-11-29
Description: Multiple PHP remote file inclusion vulnerabilities in L. Brandon Stone and Nathanial P. Hendler Active PHP Bookmarks (APB) 1.1.02 allow remote attackers to execute arbitrary PHP code via a URL in the APB_SETTINGS['apb_path'] parameter in (1) apb_common.php or (2) apb.php.  NOTE: CVE and another third party dispute this vulnerability because these PHP scripts exit if the attack vectors are present in GPC variables
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/31956; http://www.securityfocus.com/archive/1/452490/100/0/threaded; http://www.securityfocus.com/archive/1/452559/100/0/threaded
CVE: CVE-2006-6168
Published: 2006-11-29
Description: tiki-register.php in TikiWiki before 1.9.7 allows remote attackers to trigger "notification-spam" via certain vectors such as a comma-separated list of addresses in the email field, related to lack of "a minimal check on email."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?r1=1.157.2.50&r2=1.157.2.51; http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/tiki-register.php?r1=1.68&r2=1.69; http://www.vupen.com/english/advisories/2006/4709
CVE: CVE-2006-4099
Published: 2006-11-29
Description: Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23137; http://support.businessobjects.com/communityCS/FilesAndUpdates/ce10win_en.pdf; http://www.mwrinfosecurity.com/advisories/MWR_crystal-reports-weak-sessions-advisory_2006-11-28.pdf
CVE: CVE-2006-6169
Published: 2006-11-29
Description: Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt.
CVSS Score: 6.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc; http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html; http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html
CVE: CVE-2006-6170
Published: 2006-11-30
Description: Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815.
CVSS Score: 7.5 (HIGH)
References: http://elegerov.blogspot.com/2006/10/do-you-remember-2-years-old-overflow.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050935.html; http://secunia.com/advisories/23141
CVE: CVE-2006-6171
Published: 2006-11-30
Description: ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow.  NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure.  NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability
CVSS Score: 7.5 (HIGH)
References: http://proftp.cvs.sourceforge.net/proftp/proftpd/src/main.c?r1=1.292&r2=1.293&sortby=date; http://secunia.com/advisories/23174; http://secunia.com/advisories/23179
CVE: CVE-2006-6172
Published: 2006-11-30
Description: Buffer overflow in the asmrp_eval function in the RealMedia RTSP stream handler (asmrp.c) for Real Media input plugin, as used in (1) xine/xine-lib, (2) MPlayer 1.0rc1 and earlier, and possibly others, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a rulebook with a large number of rulematches.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23218; http://secunia.com/advisories/23242; http://secunia.com/advisories/23249
CVE: CVE-2006-4396
Published: 2006-11-30
Description: The Apple Type Services (ATS) server in Mac OS X 10.4.8 and earlier does not securely create log files, which allows local users to create and modify arbitrary files via unspecified vectors, possibly relating to a symlink attack.
CVSS Score: 4.6 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4398
Published: 2006-11-30
Description: Multiple buffer overflows in the Apple Type Services (ATS) server in Mac OS X 10.4 through 10.4.8 allow local users to execute arbitrary code via crafted service requests.
CVSS Score: 7.2 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4400
Published: 2006-11-30
Description: Stack-based buffer overflow in the Apple Type Services (ATS) server in Mac OS 10.4.8 and earlier allow user-assisted attackers to execute arbitrary code via crafted font files.
CVSS Score: 5.1 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4401
Published: 2006-11-30
Description: Unspecified vulnerability in CFNetwork in Mac OS 10.4.8 and earlier allows user-assisted remote attackers to execute arbitrary FTP commands via a crafted FTP URI.
CVSS Score: 5.1 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4402
Published: 2006-11-30
Description: Heap-based buffer overflow in the Finder in Apple Mac OS X 10.4.8 and earlier allows user-assisted remote attackers to execute arbitrary code by browsing directories containing crafted .DS_Store files.
CVSS Score: 5.1 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4403
Published: 2006-11-30
Description: The FTP server in Apple Mac OS X 10.4.8 and earlier, when FTP Access is enabled, will crash when a login failure occurs with a valid user name, which allows remote attackers to cause a denial of service (crash) and enumerate valid usernames.
CVSS Score: 4.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4404
Published: 2006-11-30
Description: The Installer application in Apple Mac OS X 10.4.8 and earlier, when used by a user with Admin credentials, does not authenticate the user before installing certain software requiring system privileges.
CVSS Score: 10.0 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4406
Published: 2006-11-30
Description: Buffer overflow in PPP on Apple Mac OS X 10.4.x up to 10.4.8 and 10.3.x up to 10.3.9, when PPPoE is enabled, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=304829; http://labs.musecurity.com/advisories/MU-200611-01.txt; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
CVE: CVE-2006-4407
Published: 2006-11-30
Description: The Security Framework in Apple Mac OS X 10.3.x up to 10.3.9 does not properly prioritize encryption ciphers when negotiating the strongest shared cipher, which causes Secure Transport to user a weaker cipher that makes it easier for remote attackers to decrypt traffic.
CVSS Score: 5.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4408
Published: 2006-11-30
Description: The Security Framework in Apple Mac OS X 10.4 through 10.4.8 allows remote attackers to cause a denial of service (resource consumption) via certain public key values in an X.509 certificate that requires extra resources during signature verification.  NOTE: this issue may be similar to CVE-2006-2940.
CVSS Score: 5.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4409
Published: 2006-11-30
Description: The Online Certificate Status Protocol (OCSP) service in the Security Framework in Apple Mac OS X 10.4 through 10.4.8 retrieve certificate revocation lists (CRL) when an HTTP proxy is in use, which could cause the system to accept certificates that have been revoked.
CVSS Score: 5.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4410
Published: 2006-11-30
Description: The Security Framework in Apple Mac OS X 10.3.9, and 10.4.x before 10.4.7, does not properly search certificate revocation lists (CRL), which allows remote attackers to access systems by using revoked certificates.
CVSS Score: 7.5 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4411
Published: 2006-11-30
Description: The VPN service in Apple Mac OS X 10.3.x through 10.3.9 and 10.4.x through 10.4.8 does not properly clean the environment when executing commands, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-4412
Published: 2006-11-30
Description: WebKit in Apple Mac OS X 10.3.x through 10.3.9 and 10.4 through 10.4.8 allows remote attackers to execute arbitrary code via a crafted HTML file, which accesses previously deallocated objects.
CVSS Score: 6.8 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html; http://secunia.com/advisories/23155
CVE: CVE-2006-6173
Published: 2006-11-30
Description: Buffer overflow in the shared_region_make_private_np function in vm/vm_unix.c in Mac OS X 10.4.6 and earlier allows local users to execute arbitrary code via (1) a small range count, which causes insufficient memory allocation, or (2) a large number of ranges in the shared_region_make_private_np_args parameter.
CVSS Score: 7.2 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305214; http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html; http://projects.info-pull.com/mokb/MOKB-28-11-2006.html
CVE: CVE-2006-6174
Published: 2006-11-30
Description: Cross-site scripting (XSS) vulnerability in tDiary before 2.0.3 and 2.1.x before 2.1.4.20061126 allows remote attackers to inject arbitrary web script or HTML via the conf parameter in (1) tdiary.rb and (2) skel/conf.rhtml.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/23092; http://sourceforge.net/forum/forum.php?forum_id=638868
CVE: CVE-2006-6175
Published: 2006-11-30
Description: Directory traversal vulnerability in lib/FBView.php in Horde Kronolith H3 before 2.0.7 and 2.1.x before 2.1.4 allows remote attackers to include arbitrary files and execute PHP code via a .. (dot dot) sequence in the view parameter.
CVSS Score: 7.5 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=445; http://marc.info/?l=horde-announce&m=[PII_REDACTED]7152&w=2; http://marc.info/?l=horde-announce&m=[PII_REDACTED]1579&w=2
CVE: CVE-2006-6176
Published: 2006-11-30
Description: Cross-site scripting (XSS) vulnerability in admin.php in Blogn before 1.9.4 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/23126; http://www.blogn.org/index.php?e=66
CVE: CVE-2006-6177
Published: 2006-11-30
Description: SQL injection vulnerability in system/core/users/users.profile.inc.php in Neocrome Seditio 1.10 and earlier allows remote authenticated users to execute arbitrary SQL commands via a double-url-encoded id parameter to users.php that begins with a valid filename, as demonstrated by "default.gif" followed by an encoded NULL and ' (apostrophe) (%2500%2527).
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23054; http://securityreason.com/securityalert/1931; http://www.neocrome.net/page.php?id=2233
CVE: CVE-2006-4514
Published: 2006-11-30
Description: Heap-based buffer overflow in the ole_info_read_metabat function in Gnome Structured File library (libgsf) 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbitrary code via a large num_metabat value in an OLE document, which causes the ole_init_info function to allocate insufficient memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20070101-01-P.asc; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=446; http://lists.suse.com/archive/suse-security-announce/2006-Dec/0005.html
CVE: CVE-2006-6178
Published: 2006-11-30
Description: Buffer overflow in PCCSRV\Web_console\RemoteInstallCGI\Wizard.exe for Trend Micro OfficeScan 7.3 before build 7.3.0.1087 allows remote attackers to execute arbitrary code via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1031702; http://solutionfile.trendmicro.com/SolutionFile/1031702/en/Hotfix_Readme_OSCE7_3_B1087.txt; http://www.securityfocus.com/bid/21442
CVE: CVE-2006-6179
Published: 2006-11-30
Description: Buffer overflow in PCCSRV\Web_console\RemoteInstallCGI\CgiRemoteInstall.exe for Trend Micro OfficeScan 7.3 before build 7.3.0.1089 allows remote attackers to execute arbitrary code via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1031753; http://solutionfile.trendmicro.com/SolutionFile/1031753/en/Hotfix_Readme_OSCE7_3_B1089.txt; http://www.securityfocus.com/bid/21442
CVE: CVE-2006-6180
Published: 2006-12-01
Description: Cross-site scripting (XSS) vulnerability in articles.asp in Expinion.net iNews Publisher (iNP) 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the hl parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23123; http://www.securityfocus.com/bid/21296; http://www.vupen.com/english/advisories/2006/4707
CVE: CVE-2006-6181
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in default.asp in ClickTech ClickContact allow remote attackers to execute arbitrary SQL commands via the (1) AlphaSort, (2) In, and (3) orderby parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23119; http://www.aria-security.com/forum/showthread.php?t=51; http://www.securityfocus.com/archive/1/452825/100/0/threaded
CVE: CVE-2006-6182
Published: 2006-12-01
Description: The Gabriele Teotino GNotebook 0.7.0.1 gadget for Google Desktop stores Gmail passwords in plaintext in the %SYSTEMDRIVE%\temp\Gnotebook.txt log file, which allows local users to obtain passwords by reading the file.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/23191; http://securitytracker.com/id?1017286; http://www.securityfocus.com/bid/21307
CVE: CVE-2006-6183
Published: 2006-12-01
Description: Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long mode field (aka transporting mode) in a (1) GET or (2) PUT command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/23113; http://securityreason.com/securityalert/1930; http://www.securityfocus.com/archive/1/452754/100/0/threaded
CVE: CVE-2006-6184
Published: 2006-12-01
Description: Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long filename in a (1) GET or (2) PUT command.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23106; http://securityreason.com/securityalert/1929; http://securityreason.com/securityalert/8120
CVE: CVE-2006-6185
Published: 2006-12-01
Description: Directory traversal vulnerability in script.php in Wabbit PHP Gallery 0.9 allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22994; http://securityreason.com/securityalert/1939; http://www.attrition.org/pipermail/vim/2006-November/001152.html
CVE: CVE-2006-6186
Published: 2006-12-01
Description: Multiple directory traversal vulnerabilities in enomphp 4.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter to (1) config.php, (2) ranklv_inside.php, (3) rankml_inside.php, and (4) admin/Restore/config.php.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1940; http://www.attrition.org/pipermail/vim/2006-November/001152.html; http://www.securityfocus.com/archive/1/452123/100/100/threaded
CVE: CVE-2006-6187
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in ClickTech Click Gallery allow remote attackers to execute arbitrary SQL commands via the (1) currentpage or (2) gallery_id parameter to (a) view_gallery.asp, the (3) image_id parameter to (b) download_image.asp, the currentpage or (5) orderby parameter to (c) gallery.asp, or the currentpage parameter to (d) view_recent.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23136; http://securityreason.com/securityalert/1937; http://www.aria-security.com/forum/showthread.php?t=49
CVE: CVE-2006-6188
Published: 2006-12-01
Description: Cross-site scripting (XSS) vulnerability in view_search.asp in ClickTech Click Gallery allows remote attackers to inject arbitrary web script or HTML via the txtKeyWord parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/23136; http://securityreason.com/securityalert/1937; http://www.aria-security.com/forum/showthread.php?t=49
CVE: CVE-2006-6189
Published: 2006-12-01
Description: SQL injection vulnerability in displayCalendar.asp in ClickTech Click Blog allows remote attackers to execute arbitrary SQL commands via the date parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1934; http://www.aria-security.com/forum/showthread.php?t=50; http://www.securityfocus.com/archive/1/452730/100/0/threaded
CVE: CVE-2006-6190
Published: 2006-12-01
Description: SQL injection vulnerability in anna.pl in Anna^ IRC Bot before 0.30 (aka caprice) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: it is possible that there are multiple issues.
CVSS Score: 7.5 (HIGH)
References: http://anna.svn.sourceforge.net/viewvc/anna/branches/0.30/anna.pl?r1=22&r2=23; http://secunia.com/advisories/23200; http://sourceforge.net/project/shownotes.php?release_id=466517
CVE: CVE-2006-6191
Published: 2006-12-01
Description: SQL injection vulnerability in admin/edit.asp in 8pixel.net simpleblog 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23098; http://www.vupen.com/english/advisories/2006/4742; https://exchange.xforce.ibmcloud.com/vulnerabilities/30483
CVE: CVE-2006-6192
Published: 2006-12-01
Description: Unspecified scripts in the admin directory in 8pixel.net SimpleBlog 3.0 and earlier do not properly perform authentication, which allows remote attackers to add users and perform certain other unauthorized privileged actions.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23098; http://www.vupen.com/english/advisories/2006/4742; http://secunia.com/advisories/23098
CVE: CVE-2006-6193
Published: 2006-12-01
Description: SQL injection vulnerability in edit.asp in BasicForum 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23102; http://www.securityfocus.com/bid/21293; http://www.vupen.com/english/advisories/2006/4703
CVE: CVE-2006-6194
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in index.asp in Ultimate Survey Pro allow remote attackers to execute arbitrary SQL commands via the (1) cat or (2) did parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1936; http://www.aria-security.com/forum/showthread.php?t=38; http://www.securityfocus.com/archive/1/452554/100/0/threaded