deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0325
Published: 2006-01-20
Description: Etomite Content Management System 0.6, and possibly earlier versions, when downloaded from the web site in January 2006 after January 10, contains a back door in manager/includes/todo.inc.php, which allows remote attackers to execute arbitrary commands via the "cij" parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://secunia.com/advisories/18556; http://www.etomite.org/forums/index.php?showtopic=4185; http://www.etomite.org/forums/index.php?showtopic=4291
CVE: CVE-2006-0327
Published: 2006-01-21
Description: TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.typo3.org/view.php?id=2248; http://secunia.com/advisories/18546; http://securityreason.com/securityalert/361
CVE: CVE-2006-0328
Published: 2006-01-21
Description: Format string vulnerability in Tftpd32 2.81 allows remote attackers to cause a denial of service via format string specifiers in a filename in a (1) GET or (2) SEND request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18539; http://securityreason.com/securityalert/362; http://www.critical.lt/?vulnerabilities/200
CVE: CVE-2006-0329
Published: 2006-01-21
Description: SQL injection vulnerability in HITSENSER Data Mart Server BS, BS-S, BS-M, BS-L, and EX allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18553; http://securitytracker.com/id?1015519; http://www.hitachi-support.com/security_e/vuls_e/HS05-026_e/index-e.html
CVE: CVE-2006-0330
Published: 2006-01-21
Description: Cross-site scripting (XSS) vulnerability in Gallery before 1.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving the user name (fullname).
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285; http://gallery.menalto.com/page/gallery_1_5_2_release; http://secunia.com/advisories/18557
CVE: CVE-2006-0331
Published: 2006-01-21
Description: Buffer overflow in Change passwd 3.1 (chpasswd) SquirrelMail plugin allows local users to execute arbitrary code via long command line arguments.
CVSS Score: 4.6 (MEDIUM)
References: http://securityreason.com/securityalert/363; http://www.securityfocus.com/archive/1/422414/100/0/threaded; http://www.squirrelmail.org/plugin_view.php?id=117
CVE: CVE-2006-0332
Published: 2006-01-21
Description: Pantomime in Ecartis 1.0.0 snapshot 20050909 stores e-mail attachments in a publicly accessible directory, which may allow remote attackers to upload arbitrary files.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-94
References: http://marc.info/?l=listar-dev&m=[PII_REDACTED]8625&w=2; http://marc.info/?l=listar-dev&m=[PII_REDACTED]8358&w=2; http://secunia.com/advisories/18524
CVE: CVE-2006-0333
Published: 2006-01-21
Description: Cross-site scripting (XSS) vulnerability in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) month or (2) year parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/422386/100/0/threaded; http://www.securityfocus.com/archive/1/435205/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24246
CVE: CVE-2006-0334
Published: 2006-01-21
Description: Cross-site scripting (XSS) vulnerability in search.php in My Amazon Store Manager 1.0 allows remote attackers to inject arbitrary web script or HTML via the Keywords parameter.  NOTE: some sources claim that the affected parameter is "q", but the only public archive of the original researcher notification shows an XSS manipulation in "Keywords".
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/22/22626-my_amazon.txt; http://secunia.com/advisories/18535; http://www.osvdb.org/22626
CVE: CVE-2006-0335
Published: 2006-01-21
Description: Multiple unspecified vulnerabilities in Kerio WinRoute Firewall before 6.1.4 Patch 1 allow remote attackers to cause a denial of service via multiple unspecified vectors involving (1) long strings received from Active Directory and (2) the filtering of HTML.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18542; http://www.kerio.com/kwf_history.html; http://www.osvdb.org/22631
CVE: CVE-2006-0336
Published: 2006-01-21
Description: Kerio WinRoute Firewall before 6.1.4 Patch 2 allows attackers to cause a denial of service (CPU consumption and hang) via unknown vectors involving "browsing the web".
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18589; http://www.kerio.com/kwf_history.html; http://www.osvdb.org/22631
CVE: CVE-2006-0337
Published: 2006-01-21
Description: Buffer overflow in multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti-Virus for Linux Servers 4.64 and earlier, allows remote attackers to execute arbitrary code via crafted ZIP archives.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18529; http://securitytracker.com/id?1015507; http://securitytracker.com/id?1015508
CVE: CVE-2006-0338
Published: 2006-01-21
Description: Multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti-Virus for Linux Servers 4.64 and earlier, allow remote attackers to hide arbitrary files and data via malformed (1) RAR and (2) ZIP archives, which are not properly scanned.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18529; http://securitytracker.com/id?1015507; http://securitytracker.com/id?1015508
CVE: CVE-2006-0339
Published: 2006-01-21
Description: Buffer overflow in BitComet Client 0.60 allows remote attackers to execute arbitrary code, when the publisher's name link is clicked, via a long publisher URI in a torrent file.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-01/0442.html; http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0669.html; http://secunia.com/advisories/18522
CVE: CVE-2006-0340
Published: 2006-01-21
Description: Unspecified vulnerability in Stack Group Bidding Protocol (SGBP) support in Cisco IOS 12.0 through 12.4 running on various Cisco products, when SGBP is enabled, allows remote attackers on the local network to cause a denial of service (device hang and network traffic loss) via a crafted UDP packet to port 9900.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/18490; http://securityreason.com/securityalert/358; http://securitytracker.com/id?1015501
CVE: CVE-2006-0342
Published: 2006-01-21
Description: RockLiffe MailSite HTTP Mail management agent (httpma) 7.0.3.1 allows remote attackers to cause a denial of service (CPU consumption and crash) via a malformed query string containing special characters such as "|".
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2043&w=2; http://secunia.com/advisories/18551; http://www.osvdb.org/22678
CVE: CVE-2006-0343
Published: 2006-01-21
Description: Unspecified vulnerability in the Port Discovery Standard and Advanced features in Hitachi JP1/NetInsight II allows attackers to stop the Port Discovery service via unknown vectors involving "invalid format data".
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18538; http://securitytracker.com/id?1015520; http://www.hitachi-support.com/security_e/vuls_e/HS05-027_e/index-e.html
CVE: CVE-2006-0344
Published: 2006-01-21
Description: Directory traversal vulnerability in Intervations FileCOPA FTP Server 1.01 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the (1) STOR and (2) RETR commands.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/18550; http://www.nii.co.in/vuln/filecopa.html; http://www.osvdb.org/22694
CVE: CVE-2006-0345
Published: 2006-01-21
Description: Multiple SQL injection vulnerabilities in SaralBlog 1.0 allow remote attackers to execute arbitrary SQL commands via the search parameter to search.php.  NOTE: the id/viewprofile.php issue is already covered by CVE-2005-4058.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-01/0372.html; http://evuln.com/vulns/40/summary.html; http://securitytracker.com/id?1015517
CVE: CVE-2006-0346
Published: 2006-01-21
Description: Cross-site scripting (XSS) vulnerability in SaralBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via a website field in a new comment to view.php, which is not properly handled in the comment function in functions.php.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-01/0372.html; http://evuln.com/vulns/40/summary.html; http://securitytracker.com/id?1015517
CVE: CVE-2006-0347
Published: 2006-01-21
Description: Directory traversal vulnerability in ELOG before 2.6.1 allows remote attackers to access arbitrary files outside of the elog directory via "../" (dot dot) sequences in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://midas.psi.ch/elog/download/ChangeLog; http://secunia.com/advisories/18533; http://secunia.com/advisories/18783
CVE: CVE-2006-0348
Published: 2006-01-21
Description: Format string vulnerability in the write_logfile function in ELOG before 2.6.1 allows remote attackers to cause a denial of service (server crash) via unknown attack vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://midas.psi.ch/elog/download/ChangeLog; http://secunia.com/advisories/18533; http://secunia.com/advisories/18783
CVE: CVE-2006-0349
Published: 2006-01-21
Description: SQL injection vulnerability in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to blog.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-01/0371.html; http://evuln.com/vulns/39/summary.html; http://secunia.com/advisories/18212
CVE: CVE-2006-0350
Published: 2006-01-21
Description: Cross-site scripting (XSS) vulnerability in eggblog 2.0 allow remote attackers to inject arbitrary web script or HTML via the message field to topic.php.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-01/0371.html; http://evuln.com/vulns/39/summary.html; http://secunia.com/advisories/18212
CVE: CVE-2006-0351
Published: 2006-01-21
Description: Unspecified "critical denial-of-service vulnerability" in MyDNS before 1.1.0 has unknown impact and attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://mydns.bboy.net/download/changelog.html; http://secunia.com/advisories/18532; http://secunia.com/advisories/18641
CVE: CVE-2006-0352
Published: 2006-01-21
Description: The default configuration of Fluffington FLog 1.01 installs users.0.dat under the web document root with insufficient access control, which might allow remote attackers to obtain sensitive information (login credentials) via a direct request.  NOTE: It was later reported that 1.1.2 is also affected.
CVSS Score: 5.0 (MEDIUM)
References: http://evuln.com/vulns/38/summary/bt/; http://www.securityfocus.com/archive/1/422268/100/0/threaded; http://www.securityfocus.com/archive/1/456069/100/0/threaded
CVE: CVE-2006-0353
Published: 2006-01-22
Description: unix_random.c in lshd for lsh 2.0.1 leaks file descriptors related to the randomness generator, which allows local users to cause a denial of service by truncating the seed file, which prevents the server from starting, or obtain sensitive seed information that could be used to crack keys.
CVSS Score: 3.6 (LOW)
CWE: CWE-200
References: http://lists.lysator.liu.se/pipermail/lsh-bugs/2006q1/000467.html; http://secunia.com/advisories/18564; http://secunia.com/advisories/18623
CVE: CVE-2006-0354
Published: 2006-01-22
Description: Cisco IOS before 12.3-7-JA2 on Aironet Wireless Access Points (WAP) allows remote authenticated users to cause a denial of service (termination of packet passing or termination of client connections) by sending the management interface a large number of spoofed ARP packets, which creates a large ARP table that exhausts memory, aka Bug ID CSCsc16644.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/18430; http://securityreason.com/securityalert/339; http://securitytracker.com/id?1015483
CVE: CVE-2006-0355
Published: 2006-01-22
Description: Helmsman Research (aka CoolUtils) HomeFtp 1.1 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command and an NLST command.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/350; http://www.kapda.ir/advisory-202.html; http://www.securityfocus.com/archive/1/421869/100/0/threaded
CVE: CVE-2006-0356
Published: 2006-01-22
Description: Ari Pikivirta Home Ftp Server 1.0.7 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kapda.ir/advisory-211.html; http://www.securityfocus.com/archive/1/422033/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24227
CVE: CVE-2006-0357
Published: 2006-01-22
Description: Grant Averett Cerberus FTP Server 2.32, and possibly earlier versions, allows remote attackers to cause an unspecified denial of service via a long string that does not contain a valid FTP command.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cerberusftp.com/cerberus-releasenotes.htm; http://www.kapda.ir/advisory-210.html; http://www.securityfocus.com/archive/1/422162/100/0/threaded
CVE: CVE-2006-0358
Published: 2006-01-22
Description: Multiple SQL injection vulnerabilities in PowerPortal, possibly 1.1 beta through 1.3, allow remote attackers to execute arbitrary SQL commands via the search parameter in (1) index.php and (2) search.php. NOTE: This issue might overlap CVE-2004-0663.2.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10172; http://web.archive.org/web/[PII_REDACTED]3128/http://powerportal.sourceforge.net/; http://www.osvdb.org/27957
CVE: CVE-2006-0359
Published: 2006-01-22
Description: Buffer overflow in CounterPath eyeBeam SIP Softphone allows remote attackers to (1) cause a denial of service (device crash) via SIP INVITE commands with a long header field name sent during startup and (2) cause a denial of service (device hang or crash) via SIP INVITE commands with a long header field name sent during a call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://blog.donews.com/zwell/archive/2006/01/17/698810.aspx; http://secunia.com/advisories/18516; http://securityreason.com/securityalert/354
CVE: CVE-2006-0360
Published: 2006-01-22
Description: MPM SIP HP-180W Wireless IP Phone WE.00.17 allows remote attackers to obtain sensitive information and possibly cause a denial of service via a direct connection to UDP port 9090, which is undocumented and does not require authentication.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041437.html; http://secunia.com/advisories/18512; http://www.securityfocus.com/bid/16285
CVE: CVE-2006-0361
Published: 2006-01-22
Description: Cross-site scripting (XSS) vulnerability in addcomment.php in Bit 5 Blog 8.01 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in an <a> tag in the comment parameter, which strips most tags but not <a>.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/32/exploit; http://evuln.com/vulns/32/summary/; http://secunia.com/advisories/18464
CVE: CVE-2006-0362
Published: 2006-01-22
Description: TippingPoint Intrusion Prevention System (IPS) TOS before 2.1.4.6324, and TOS 2.2.x before 2.2.1.6506, allow remote attackers to cause a denial of service (CPU consumption) via an unknown vector, probably involving an HTTP request with a negative number in the Content-Length header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://isc.sans.org/diary.php?storyid=1042; http://secunia.com/advisories/18515; http://securitytracker.com/id?1015511
CVE: CVE-2006-0363
Published: 2006-01-22
Description: The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local users to obtain the original passwords via a program that calls CryptUnprotectData, as demonstrated by the "MSN Password Recovery.exe" program.  NOTE: it could be argued that local-only password recovery is inherently insecure because the decryption methods and keys must be stored somewhere on the local system, and are thus inherently accessible with varying degrees of effort.  Perhaps this issue should not be included in CVE.
CVSS Score: 2.1 (LOW)
References: http://www.msn-password-recovery.com/; http://www.securityfocus.com/archive/1/421921/100/0/threaded; http://www.securityfocus.com/archive/1/422283/100/0/threaded
CVE: CVE-2006-0364
Published: 2006-01-22
Description: Cross-site scripting (XSS) vulnerability in MyBulletinBoard (MyBB) allows remote attackers to inject arbitrary web script or HTML via a signature containing a JavaScript URI in the SRC attribute of an IMG element, in which the URI uses SGML numeric character references without trailing semicolons, as demonstrated by "&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2006-01/0332.html; http://secunia.com/advisories/18544; http://www.osvdb.org/22628
CVE: CVE-2006-0365
Published: 2006-01-22
Description: Cross-site scripting (XSS) vulnerability in XMB (aka extreme message board) allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element.
CVSS Score: 4.3 (MEDIUM)
References: http://www.osvdb.org/27920; http://www.securityfocus.com/archive/1/422277/100/0/threaded; https://docs.xmbforum2.com/index.php?title=Security_Issue_History
CVE: CVE-2006-0366
Published: 2006-01-22
Description: Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18541; http://www.securityfocus.com/archive/1/422265/100/0/threaded; http://www.securityfocus.com/bid/16300
CVE: CVE-2006-0367
Published: 2006-01-22
Description: Unspecified vulnerability in Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allows remote authenticated users with read-only administrative privileges to obtain full administrative privileges via a "crafted URL on the CCMAdmin web page."
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/18501; http://securitytracker.com/id?1015502; http://www.cisco.com/warp/public/707/cisco-sa-20060118-ccmpe.shtml
CVE: CVE-2006-0368
Published: 2006-01-22
Description: Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allow remote attackers to (1) cause a denial of service (CPU and memory consumption) via a large number of open TCP connections to port 2000 and (2) cause a denial of service (fill the Windows Service Manager communication queue) via a large number of TCP connections to port 2001, 2002, or 7727.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/18494; http://securityreason.com/securityalert/359; http://securitytracker.com/id?1015503
CVE: CVE-2006-0369
Published: 2006-01-22
Description: MySQL 5.0.18 allows local users with access to a VIEW to obtain sensitive information via the "SELECT * FROM information_schema.views;" query, which returns the query that created the VIEW.  NOTE: this issue has been disputed by third parties, saying that the availability of the schema is a normal and sometimes desired aspect of database access
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/422491/100/0/threaded; http://www.securityfocus.com/archive/1/422592/100/0/threaded; http://www.securityfocus.com/archive/1/422698/100/0/threaded
CVE: CVE-2006-0370
Published: 2006-01-22
Description: Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes.
CVSS Score: 5.0 (MEDIUM)
References: http://evuln.com/vulns/42/summary.html; http://secunia.com/advisories/18547; http://securitytracker.com/id?1015523
CVE: CVE-2006-0371
Published: 2006-01-22
Description: Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly including one that stores the administrator's account name and password, via a .. (dot dot) in the post parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://evuln.com/vulns/42/summary.html; http://secunia.com/advisories/18547; http://securitytracker.com/id?1015523
CVE: CVE-2006-0372
Published: 2006-01-22
Description: Multiple SQL injection vulnerabilities in config.php in Insane Visions BlogPHP, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (1) blogphp_username or (2) blogphp_password parameter in a cookie.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/365; http://www.osvdb.org/22738; http://www.securityfocus.com/archive/1/422483/100/0/threaded
CVE: CVE-2006-0373
Published: 2006-01-22
Description: Cross-site scripting (XSS) vulnerability in register.aspx in Douran FollowWeb allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://www.osvdb.org/27918; http://www.securityfocus.com/bid/16302; http://www.osvdb.org/27918
CVE: CVE-2006-0374
Published: 2006-01-22
Description: Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 has multiple undocumented ports available, which (1) might allow remote attackers to obtain sensitive information, such as memory contents and internal operating-system data, by directly accessing the VxWorks WDB remote debugging ONCRPC (aka wdbrpc) on UDP 17185, (2) reflect network data using echo (TCP 7), or (3) gain access without authentication using rlogin (TCP 513).
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041434.html; http://secunia.com/advisories/18514; http://www.securityfocus.com/bid/16288
CVE: CVE-2006-0375
Published: 2006-01-22
Description: Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 on VxWorks uses a hardcoded Network Time Protocol (NTP) server in Taiwan, which could allow remote attackers to provide false time information, block access to time information, or conduct other attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041434.html; http://secunia.com/advisories/18514; http://www.securityfocus.com/bid/16288
CVE: CVE-2006-0376
Published: 2006-01-22
Description: The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when (1) it establishes an association with a station in ad hoc (aka peer-to-peer) mode or (2) a station in ad hoc mode establishes an association with it, which allows remote attackers to put unexpected wireless communication into place.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/349; http://securitytracker.com/id?1015489; http://www.nmrc.org/pub/advise/20060114.txt