deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4546
Published: 2006-09-06
Description: Lyris ListManager 8.95 allows remote authenticated users, who have administrative privileges for at least one list on the server, to add new administrators to any list via a modified MEMBERS_.List_ parameter.
CVSS Score: 6.5 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0817.html; http://secunia.com/advisories/21698; http://securityreason.com/securityalert/1502
CVE: CVE-2006-4547
Published: 2006-09-06
Description: Lyris ListManager 8.95 allows remote authenticated users to obtain sensitive information by attempting to add a user with a ' (single quote) character in the name, which reveals the details of the underlying SQL query, possibly because of a forced SQL error or SQL injection.
CVSS Score: 6.5 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0817.html; http://securityreason.com/securityalert/1502; http://securitytracker.com/id?1016771
CVE: CVE-2006-4548
Published: 2006-09-06
Description: e107 0.75 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code via the tinyMCE_imglib_include image/jpeg parameter in e107_handlers/tiny_mce/plugins/ibrowser/ibrowser.php, as demonstrated by a multipart/form-data request.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in e107.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/e107_075_xpl.html; http://securityreason.com/securityalert/1497; http://www.securityfocus.com/archive/1/444644/100/0/threaded
CVE: CVE-2006-4549
Published: 2006-09-06
Description: CHXO Feedsplitter 2006-01-21 allows remote attackers to read the source code of feedsplitter.php via the showsource function.  NOTE: this issue is not a vulnerability in standard distributions, but could be an issue if the source has been modified.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22000; http://www.securityfocus.com/archive/1/444805/100/0/threaded; http://www.securityfocus.com/bid/19779
CVE: CVE-2006-4550
Published: 2006-09-06
Description: Directory traversal vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to read arbitrary XML files via .. (dot dot) sequences in the format parameter with a leading ".", which bypasses a security check.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22000; http://www.securityfocus.com/archive/1/444805/100/0/threaded; http://www.securityfocus.com/bid/19779
CVE: CVE-2006-4551
Published: 2006-09-06
Description: Eval injection vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to execute arbitrary PHP code via (1) the file specified as the value of the format parameter, and possibly (2) the RSS feed.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22000; http://www.securityfocus.com/archive/1/444805/100/0/threaded; http://www.securityfocus.com/bid/19779
CVE: CVE-2006-4552
Published: 2006-09-06
Description: Cross-site scripting (XSS) vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to inject arbitrary web script or HTML via the RSS feed.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22000; http://www.securityfocus.com/archive/1/444805/100/0/threaded; http://www.securityfocus.com/bid/19779
CVE: CVE-2006-4553
Published: 2006-09-06
Description: PHP remote file inclusion vulnerability in plugin.class.php in the com_comprofiler Components 1.0 RC2 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21636; http://securityreason.com/securityalert/1491; http://www.securityfocus.com/archive/1/444425/100/0/threaded
CVE: CVE-2006-4554
Published: 2006-09-06
Description: Stack-based buffer overflow in the ReadFile function in the ZOO-processing exports in the BeCubed Compression Plus before 5.0.1.28, as used in products including (1) Tumbleweed EMF, (2) VCOM/Ontrack PowerDesk Pro, (3) Canyon Drag and Zip, (4) Canyon Power File, and (5) Canyon Power File Gold, allow context-dependent attackers to execute arbitrary code via an inconsistent size parameter in a ZOO file header.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21714; http://secunia.com/advisories/21718; http://secunia.com/advisories/21720
CVE: CVE-2006-4555
Published: 2006-09-06
Description: Buffer overflow in the Retro64 / Miniclip CR64Loader ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors involving an HTML document that references the CLSID of the control.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21743; http://securitytracker.com/id?1016781; http://www.kb.cert.org/vuls/id/649289
CVE: CVE-2006-4556
Published: 2006-09-06
Description: PHP remote file inclusion vulnerability in index.php in the JIM component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: another researcher has stated that the product distribution does not include an index.php file.  Also, this might be related to CVE-2006-4242
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/28097; http://www.securityfocus.com/archive/1/443674/100/100/threaded; http://www.securityfocus.com/archive/1/444216/100/100/threaded
CVE: CVE-2006-4557
Published: 2006-09-06
Description: PHP remote file inclusion vulnerability in plugins/plugins.php in Bob Jewell Discloser 0.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the type parameter.  NOTE: another researcher has stated that an attacker cannot control the type parameter.  As of 20060901, CVE analysis concurs with the dispute
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/443466/100/200/threaded; http://www.securityfocus.com/archive/1/443522/100/200/threaded; http://www.securityfocus.com/archive/1/443710/100/100/threaded
CVE: CVE-2006-4558
Published: 2006-09-06
Description: DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0318.html; http://retrogod.altervista.org/deluxebb_106_xpl.html; http://secunia.com/advisories/20135
CVE: CVE-2006-4559
Published: 2006-09-06
Description: Multiple PHP remote file inclusion vulnerabilities in Yet Another Community System (YACS) CMS 6.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the context[path_to_root] parameter in (1) articles/populate.php, (2) categories/category.php, (3) categories/populate.php, (4) comments/populate.php, (5) files/file.php, (6) sections/section.php, (7) sections/populate.php, (8) tables/populate.php, (9) users/user.php, and (10) users/populate.php.  The articles/article.php vector is covered by CVE-2006-4532.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21680; http://www.osvdb.org/31301; http://www.osvdb.org/31302
CVE: CVE-2006-4560
Published: 2006-09-06
Description: Internet Explorer 6 on Windows XP SP2 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker's control, which can force the browser to drop DNS pinning and perform a new DNS query for the domain name after the script is already running.
CVSS Score: 7.5 (HIGH)
References: http://polyboy.net/xss/dnsslurp.html; http://shampoo.antville.org/stories/1451301/; http://www.osvdb.org/31329
CVE: CVE-2006-4561
Published: 2006-09-06
Description: Mozilla Firefox 1.5.0.6 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker's control, which can force the browser to drop DNS pinning and perform a new DNS query for the domain name after the script is already running.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31834; http://polyboy.net/xss/dnsslurp.html; http://shampoo.antville.org/stories/1451301/
CVE: CVE-2006-4562
Published: 2006-09-06
Description: The proxy DNS service in Symantec Gateway Security (SGS) allows remote attackers to make arbitrary DNS queries to third-party DNS servers, while hiding the source IP address of the attacker.  NOTE: another researcher has stated that the default configuration does not proxy DNS queries received on the external interface
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/444114/100/100/threaded; http://www.securityfocus.com/archive/1/444134/100/100/threaded; http://www.securityfocus.com/archive/1/444135/100/100/threaded
CVE: CVE-2006-4563
Published: 2006-09-06
Description: Cross-site scripting (XSS) vulnerability in the MyHeadlines before 4.3.2 module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the myh_op parameter to modules.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21653; http://www.jmagar.com/index.php?y=0&myh=user&myh_op=showLink&myh_link=8; http://www.osvdb.org/28463
CVE: CVE-2006-4564
Published: 2006-09-06
Description: SQL injection vulnerability in Sources/ManageBoards.php in Simple Machines Forum 1.1 RC3 allows remote attackers to execute arbitrary SQL commands via the cur_cat parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2006-09/0009.html; http://secunia.com/advisories/21740; http://securityreason.com/securityalert/1506
CVE: CVE-2006-3742
Published: 2006-09-06
Description: The KDE PAM configuration shipped with Fedora Core 5 causes KDM passwords to be cached, which allows attackers to login without a password by attempting to log in multiple times.
CVSS Score: 10.0 (HIGH)
References: http://lwn.net/Alerts/197302/; http://lwn.net/Alerts/197302/
CVE: CVE-2006-4583
Published: 2006-09-06
Description: Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the dir[inc] parameter in (1) inc/cmses/aedatingCMS.php, (2) inc/cmses/aedatingCMS2.php, or (3) inc/cmses/aedating4CMS.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/21756; http://securitytracker.com/id?1016784; http://www.securityfocus.com/archive/1/445219/100/0/threaded
CVE: CVE-2006-4584
Published: 2006-09-06
Description: Tr Forum 2.0 allows remote attackers to bypass authentication and add an administrative account via the login and password parameters to admin/insert_admin.php.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/10060903.txt; http://secunia.com/advisories/21754; http://securityreason.com/securityalert/1508
CVE: CVE-2006-4585
Published: 2006-09-06
Description: SQL injection vulnerability in admin/editer.php in Tr Forum 2.0 allows remote authenticated users to execute arbitrary SQL commands via the id2 parameter.  NOTE: this can be leveraged with other Tr Forum vulnerabilities to allow unauthenticated attackers to gain privileges.
CVSS Score: 9.0 (HIGH)
References: http://acid-root.new.fr/poc/10060903.txt; http://secunia.com/advisories/21754; http://securityreason.com/securityalert/1508
CVE: CVE-2006-4586
Published: 2006-09-06
Description: The admin panel in Tr Forum 2.0 accepts a username and password hash for authentication, which allows remote authenticated users to perform unauthorized actions, as demonstrated by modifying user settings via the id parameter to /membres/modif_profil.php, and changing a password via /membres/change_mdp.php.  NOTE: this can be leveraged with other Tr Forum vulnerabilities to allow unauthenticated attackers to gain privileges.
CVSS Score: 5.5 (MEDIUM)
References: http://acid-root.new.fr/poc/10060903.txt; http://secunia.com/advisories/21754; http://securityreason.com/securityalert/1508
CVE: CVE-2006-4587
Published: 2006-09-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) description parameter in unspecified modules or the (2) solution parameter in the HelpDesk module.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21728; http://www.osvdb.org/28460; http://www.osvdb.org/28461
CVE: CVE-2006-4588
Published: 2006-09-06
Description: vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21728; http://www.osvdb.org/28462; http://www.security-net.biz/adv/D3906a.txt
CVE: CVE-2006-4589
Published: 2006-09-06
Description: PHP remote file inclusion vulnerability in 0_admin/modules/Wochenkarte/frontend/index.php in DynCMS 6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the x_admindir parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21729; http://securitytracker.com/id?1016798; http://www.securityfocus.com/archive/1/445264/100/0/threaded
CVE: CVE-2006-4590
Published: 2006-09-06
Description: SQL injection vulnerability in admin/default.asp in Jetstat.com JS ASP Faq Manager 1.10 and earlier allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2006-4463.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21674; http://www.osvdb.org/28266; http://www.securityfocus.com/bid/19761
CVE: CVE-2006-4591
Published: 2006-09-06
Description: Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to execute arbitrary PHP code via a URL in the config[template_path] parameter to (1) payment/payment_result.php or (2) /payment/spuser_result.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1509; http://www.securityfocus.com/archive/1/445156/100/0/threaded; http://www.securityfocus.com/bid/19769
CVE: CVE-2006-4592
Published: 2006-09-06
Description: Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection attacks via ">" characters in the id parameter, which are not filtered by the protection mechanism.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21755; http://securitytracker.com/id?1016793; http://www.osvdb.org/28541
CVE: CVE-2006-4593
Published: 2006-09-06
Description: Cross-site scripting (XSS) vulnerability in index.php in SoftBB 0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1511; http://securitytracker.com/id?1016797; http://www.osvdb.org/29886
CVE: CVE-2006-4594
Published: 2006-09-06
Description: Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpAtm) 1.21 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the include_location parameter in (1) confirm.php or (2) login.php.  NOTE: the include_location parameter to index.php is already covered by CVE-2005-1681.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19765; https://exchange.xforce.ibmcloud.com/vulnerabilities/28670; https://www.exploit-db.com/exploits/2279
CVE: CVE-2006-4595
Published: 2006-09-07
Description: muforum (µforum) 0.4c stores membres/members.dat under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and password hashes.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://acid-root.new.fr/poc/08060901.txt; http://secunia.com/advisories/21742; http://securityreason.com/securityalert/1514
CVE: CVE-2006-4596
Published: 2006-09-07
Description: PHP remote file inclusion in MyBace Light Skrip, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the (1) hauptverzeichniss parameter in includes/login_check.php and the (2) template_back parameter in admin/login/content/user_daten.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21746; http://www.bb-pcsecurity.de/Websecurity/384/org/MyBace_Light_%28hauptverzeichniss%29_Remote_File_Inclusion.htm; http://www.securityfocus.com/archive/1/445185/100/0/threaded
CVE: CVE-2006-4597
Published: 2006-09-07
Description: SQL injection vulnerability in devam.asp in ICBlogger 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the YID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21741; http://securityreason.com/securityalert/1503; http://www.securityfocus.com/archive/1/445002/100/0/threaded
CVE: CVE-2006-4598
Published: 2006-09-07
Description: Multiple SQL injection vulnerabilities in links.php in ssLinks 1.22 allow remote attackers to execute arbitrary SQL commands via the (1) go parameter and (2) id parameter in a rate action.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21736; http://securityreason.com/securityalert/1505; http://www.securityfocus.com/archive/1/445009/100/0/threaded
CVE: CVE-2006-4599
Published: 2006-09-07
Description: SQL injection vulnerability in aut_verifica.inc.php in Autentificator 2.01 allows remote attackers to execute arbitrary SQL commands via the user parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21737; http://securityreason.com/securityalert/1494; http://www.securityfocus.com/archive/1/445008/100/0/threaded
CVE: CVE-2006-4600
Published: 2006-09-07
Description: slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List (ACL) privileges to modify arbitrary Distinguished Names (DN).
CVSS Score: 2.3 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://secunia.com/advisories/21721
CVE: CVE-2006-4601
Published: 2006-09-07
Description: SQL injection vulnerability in index.php in Annuaire 1Two 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/09060902.txt; http://secunia.com/advisories/21734; http://securityreason.com/securityalert/1496
CVE: CVE-2006-4602
Published: 2006-09-07
Description: Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory.
CVSS Score: 7.5 (HIGH)
References: http://isc.sans.org/diary.php?storyid=1672; http://secunia.com/advisories/21733; http://secunia.com/advisories/22100
CVE: CVE-2006-4603
Published: 2006-09-07
Description: NCH Swift Sound Web Dictate 1.02 allows remote attackers to bypass authentication via a null password.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21747; http://securityreason.com/securityalert/1510; http://securitytracker.com/id?1016789
CVE: CVE-2006-4604
Published: 2006-09-07
Description: PHP remote file inclusion vulnerability in LFXlib/access_manager.php in Lanifex Database of Managed Objects (DMO) 2.3 Beta and earlier allows remote attackers to execute arbitrary PHP code via the _incMgr parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19773; https://exchange.xforce.ibmcloud.com/vulnerabilities/28673; https://www.exploit-db.com/exploits/2280
CVE: CVE-2006-4605
Published: 2006-09-07
Description: PHP remote file inclusion vulnerability in index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to execute arbitrary PHP code via the adodb parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21738; http://securityreason.com/securityalert/1499; http://www.attrition.org/pipermail/vim/2009-April/002167.html
CVE: CVE-2006-4606
Published: 2006-09-07
Description: Multiple SQL injection vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to execute arbitrary SQL commands via the (1) id_temas parameter in busqueda_tema.php, the (2) cadena parameter in busqueda.php, the (3) id_autor parameter in autor.php, the (4) email parameter in lista.php, and the (5) id_articulo parameter in articulo.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21738; http://securityreason.com/securityalert/1499; http://www.attrition.org/pipermail/vim/2009-April/002167.html
CVE: CVE-2006-4607
Published: 2006-09-07
Description: admin/index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to bypass authentication controls by setting the ID_ADMIN and SUPER_ADMIN parameters to 1.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21738; http://securityreason.com/securityalert/1499; http://www.attrition.org/pipermail/vim/2009-April/002167.html
CVE: CVE-2006-4608
Published: 2006-09-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cadena parameter in busqueda.php and the (2) email parameter in lista.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21738; http://securityreason.com/securityalert/1499; http://www.attrition.org/pipermail/vim/2009-April/002167.html
CVE: CVE-2006-4609
Published: 2006-09-07
Description: Multiple PHP remote file inclusion vulnerabilities in the Content Management module ("Content manager") for PHProjekt 0.6.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the path_pre parameter in (1) cm_lib.inc.php, (2) doc/br.edithelp.php, (3) doc/de.edithelp.php, (4) doc/ct.edithelp.php, (5) userrating.php, and (6) listing.php, a different set of vectors than CVE-2006-4204.  NOTE: a third-party researcher has disputed the impact of the cm_lib.inc.php vector, stating that it is limited to local file inclusion. CVE analysis as of 20060905 concurs, although use of ftp URLs is also possible. The remaining five vectors have also been disputed by the same third party, stating that the path_pre variable is initialized before it is used
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21590; http://securityreason.com/securityalert/1495; http://www.osvdb.org/28217
CVE: CVE-2006-4610
Published: 2006-09-07
Description: PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the page parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://kurdishsecurity.blogspot.com/2006/09/kurdish-security-25-grapagenda-remote.html; http://secunia.com/advisories/21775; http://securityreason.com/securityalert/1513
CVE: CVE-2006-4611
Published: 2006-09-07
Description: Buffer overflow in the _tor_resolve function in dsocks.c in dsocks before 1.4 allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a long node name.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049258.html; http://secunia.com/advisories/21771; http://securityreason.com/securityalert/1493