deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6195
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in Fixit iDMS Pro Image Gallery allow remote attackers to execute arbitrary SQL commands via the (1) show_id or (2) parentid parameter to (a) filelist.asp, or the (3) fid parameter to (b) showfile.asp.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1017281; http://www.aria-security.com/forum/showthread.php?t=39; http://www.securityfocus.com/archive/1/452567/100/0/threaded
CVE: CVE-2006-6196
Published: 2006-12-01
Description: Cross-site scripting (XSS) vulnerability in the search functionality in Fixit iDMS Pro Image Gallery allows remote attackers to inject arbitrary web script or HTML via a search field (txtsearchtext parameter).
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1941; http://securitytracker.com/id?1017281; http://www.aria-security.com/forum/showthread.php?t=39
CVE: CVE-2006-6197
Published: 2006-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in b2evolution 1.8.2 through 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the (1) app_name parameter in (a) _404_not_found.page.php, (b) _410_stats_gone.page.php, and (c) _referer_spam.page.php in inc/VIEW/errors/; the (2) baseurl parameter in (d) inc/VIEW/errors/_404_not_found.page.php; and the (3) ReqURI parameter in (e) inc/VIEW/errors/_referer_spam.page.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23148; http://securityreason.com/securityalert/1944; http://www.securityfocus.com/archive/1/452895/100/0/threaded
CVE: CVE-2006-6198
Published: 2006-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) email parameter to (a) scripts2/dochangeemail, the (2) supporturl parameter to (b) cgi/addon_configsupport.cgi, the (3) pkg parameter to (c) scripts/editpkg, the (4) domain parameter to (d) scripts2/domts2 and (e) scripts/editzone, the (5) feature parameter to (g) scripts2/dofeaturemanager, and the (6) ndomain parameter to (h) scripts/park.
CVSS Score: 6.0 (MEDIUM)
References: http://securityreason.com/securityalert/1938; http://www.aria-security.com/forum/showthread.php?t=44; http://www.securityfocus.com/archive/1/452618/100/0/threaded
CVE: CVE-2006-6199
Published: 2006-12-01
Description: Stack-based buffer overflow in BlazeVideo BlazeDVD Standard and Professional 5.0, and possibly earlier, allows remote attackers to execute arbitrary code via a long filename in a PLF playlist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/23041; http://whitestar.linuxbox.org/pipermail/exploits/2006-December/000065.html; http://www.exploit-db.com/exploits/23783
CVE: CVE-2006-6200
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in the (1) rate_article and (2) rate_complete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23128; http://securityreason.com/securityalert/1935; http://securitytracker.com/id?1017282
CVE: CVE-2006-6201
Published: 2006-12-01
Description: Heap-based buffer overflow in Borland idsql32.dll 5.1.0.4, as used by RevilloC MailServer; 5.2.0.2 as used by Borland Developer Studio 2006; and possibly other versions allows remote attackers to execute arbitrary code via a long SQL statement, related to use of the DbiQExec function.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22570; http://secunia.com/secunia_research/2006-70/advisory/; http://www.securityfocus.com/archive/1/453003/100/0/threaded
CVE: CVE-2006-6202
Published: 2006-12-01
Description: PHP remote file inclusion vulnerability in modules/NukeAI/util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot, allows remote attackers to execute arbitrary PHP code via a URL in the AIbasedir parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21284; http://www.vupen.com/english/advisories/2006/4702; https://exchange.xforce.ibmcloud.com/vulnerabilities/30524
CVE: CVE-2006-6203
Published: 2006-12-01
Description: Directory traversal vulnerability in startdown.php in the Flyspray ME 1.0.1 (com_flyspray) component for Mambo allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23097; http://www.securityfocus.com/bid/21315; http://www.vupen.com/english/advisories/2006/4721
CVE: CVE-2006-6204
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in Enthrallweb eHomes allow remote attackers to execute arbitrary SQL commands via the (1) cid parameter to (a) dircat.asp; the (2) sid parameter to (b) dirSub.asp; the (3) TYPE_ID parameter to (c) types.asp; the (4) AD_ID parameter to (d) homeDetail.asp; the (5) cat parameter to (e) result.asp; the (6) compare, (7) clear, and (8) adID parameters to (f) compareHomes.asp; and the (9) aminprice, (10) amaxprice, and (11) abedrooms parameters to (g) result.asp.
CVSS Score: 7.5 (HIGH)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=50; http://secunia.com/advisories/23016; http://securityreason.com/securityalert/1942
CVE: CVE-2006-6205
Published: 2006-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in result.asp in Enthrallweb eHomes allow remote attackers to inject arbitrary web script or HTML via the (1) city or (2) State parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=50; http://secunia.com/advisories/23016; http://securityreason.com/securityalert/1942
CVE: CVE-2006-6206
Published: 2006-12-01
Description: SQL injection vulnerability in item.asp in WarHound General Shopping Cart allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23140; http://securityreason.com/securityalert/1932; http://www.aria-security.com/forum/showthread.php?t=48
CVE: CVE-2006-6207
Published: 2006-12-01
Description: SQL injection vulnerability in products.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the partno parameter.  NOTE: the vendor disputes this issue, stating that it is a forced SQL error
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1933; http://www.securityfocus.com/archive/1/452706/100/0/threaded; http://www.securityfocus.com/archive/1/453549/100/0/threaded
CVE: CVE-2006-6208
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in Enthrallweb eClassifieds allow remote attackers to execute arbitrary SQL commands via the (1) AD_ID, (2) cat_id, (3) sub_id, and (4) ad_id parameters to (a) ad.asp, the (5) cid parameter to (b) dircat.asp, and the (6) sid parameter to (c) dirSub.asp.
CVSS Score: 7.5 (HIGH)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=46; http://secunia.com/advisories/23050; http://securityreason.com/securityalert/1943
CVE: CVE-2006-6209
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) id2006quant parameter to (a) item_show.asp, or the (2) maingroup or (3) secondgroup parameter to (b) item_list.asp.  NOTE: the code_no parameter to Item_Show.asp is covered by CVE-2005-2601.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1947; http://www.aria-security.com/forum/showthread.php?t=42; http://www.securityfocus.com/archive/1/452557/100/0/threaded
CVE: CVE-2006-6210
Published: 2006-12-01
Description: SQL injection vulnerability in listpics.asp in ASP ListPics 5.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1946; http://www.aria-security.com/forum/showthread.php?t=41; http://www.securityfocus.com/archive/1/452569/100/0/threaded
CVE: CVE-2006-6211
Published: 2006-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter to (a) admin/admincore.php, the (2) month parameter to (b) admin/comments.php or (c) admin/entries.php, or the (3) page parameter to (d) admin/logs.php, different vectors than CVE-2006-5064.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1945; http://www.securityfocus.com/archive/1/452084/100/200/threaded; http://www.securityfocus.com/bid/21184
CVE: CVE-2006-6212
Published: 2006-12-01
Description: PHP remote file inclusion vulnerability in centre.php in Site News (site_news) 2.00, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/23082; http://www.securityfocus.com/bid/21269; http://www.vupen.com/english/advisories/2006/4685
CVE: CVE-2006-6213
Published: 2006-12-01
Description: index.php in PEGames uses the extract function to overwrite critical variables, which allows remote attackers to conduct PHP remote file inclusion attacks via the abs_url parameter, which is later extracted to overwrite a previously uncontrolled value.
CVSS Score: 7.5 (HIGH)
References: http://www.attrition.org/pipermail/vim/2006-November/001153.html; http://www.securityfocus.com/bid/21266; https://exchange.xforce.ibmcloud.com/vulnerabilities/30517
CVE: CVE-2006-6214
Published: 2006-12-01
Description: SQL injection vulnerability in wallpaper.php in Wallpaper Website (Wallpaper Complete Website) 1.0.09 allows remote attackers to execute arbitrary SQL commands via the wallpaperid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23084; http://www.securityfocus.com/bid/21274; http://www.vupen.com/english/advisories/2006/4687
CVE: CVE-2006-6215
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in Wallpaper Website (Wallpaper Complete Website) 1.0.09 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login or (2) password parameter to (a) process.php, or the (3) wallpaperid parameter to (b) dlwallpaper.php.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/4687; http://www.vupen.com/english/advisories/2006/4687
CVE: CVE-2006-6216
Published: 2006-12-01
Description: SQL injection vulnerability in admin_hacks_list.php in the Nivisec Hacks List 1.21 and earlier phpBB module allows remote attackers to execute arbitrary SQL commands via the hack_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21290; https://exchange.xforce.ibmcloud.com/vulnerabilities/30533; https://www.exploit-db.com/exploits/2851
CVE: CVE-2006-6217
Published: 2006-12-01
Description: PHP remote file inclusion vulnerability in formdisp.php in the Mermaid 1.2 module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the module_name parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/452616/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30523; http://www.securityfocus.com/archive/1/452616/100/0/threaded
CVE: CVE-2006-6218
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in index.php in dev4u CMS allow remote attackers to execute arbitrary SQL commands via the (1) seite_id, (2) gruppe_id.php, and (3) go_target parameters.
CVSS Score: 7.5 (HIGH)
References: http://www.majorsecurity.de/index_2.php?major_rls=major_rls36; http://www.securityfocus.com/archive/1/452008/100/200/threaded; http://www.securityfocus.com/bid/21170
CVE: CVE-2006-6219
Published: 2006-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in dev4u CMS allow remote attackers to inject arbitrary web script or HTML via the (1) user_name, (2) passwort, and (3) go_target parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://www.majorsecurity.de/index_2.php?major_rls=major_rls36; http://www.securityfocus.com/archive/1/452008/100/200/threaded; http://www.securityfocus.com/bid/21170
CVE: CVE-2006-6220
Published: 2006-12-01
Description: Multiple SQL injection vulnerabilities in Recipes Website (Recipes Complete Website) 1.1.14 allow remote attackers to execute arbitrary SQL commands via the (1) recipeid parameter to recipe.php or the (2) categoryid parameter to list.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23083; http://www.securityfocus.com/bid/21270; http://www.vupen.com/english/advisories/2006/4686
CVE: CVE-2006-5751
Published: 2006-12-02
Description: Integer overflow in the get_fdb_entries function in net/bridge/br_ioctl.c in the Linux kernel before 2.6.18.4 allows local users to execute arbitrary code via a large maxnum value in an ioctl request.
CVSS Score: 7.2 (HIGH)
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.18.4; http://projects.info-pull.com/mokb/MOKB-29-11-2006.html; http://rhn.redhat.com/errata/RHSA-2007-0014.html
CVE: CVE-2006-6071
Published: 2006-12-02
Description: TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with a valid username and invalid password.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/23189; http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2006-6071; http://www.securityfocus.com/bid/21381
CVE: CVE-2006-6223
Published: 2006-12-02
Description: Cross-site scripting (XSS) vulnerability in Google Search Appliance and Google Mini allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/23239; http://securitytracker.com/id?1017317; http://sla.ckers.org/forum/read.php?3%2C3109
CVE: CVE-2006-6224
Published: 2006-12-02
Description: PHP remote file inclusion vulnerability in the installation scripts in Puntal before 1.8.5 allows remote attackers to execute arbitrary PHP code via the GLOBALS array.
CVSS Score: 7.5 (HIGH)
References: http://www.puntal.fr/forums/viewtopic.php?id=610; http://www.securityfocus.com/bid/21357; http://www.vupen.com/english/advisories/2006/4767
CVE: CVE-2006-6225
Published: 2006-12-02
Description: Multiple PHP remote file inclusion vulnerabilities in GeekLog 1.4 allow remote attackers to execute arbitrary code via a URL in the _CONF[path] parameter to (1) links/functions.inc, (2) polls/functions.inc, (3) spamx/BlackList.Examine.class.php, (4) spamx/DeleteComment.Action.class.php, (5) spamx/EditIPofURL.Admin.class.php, (6) spamx/MTBlackList.Examine.class.php, (7) spamx/MassDelete.Admin.class.php, (8) spamx/MailAdmin.Action.class.php, (9) spamx/MassDelTrackback.Admin.class.php, (10) spamx/EditHeader.Admin.class.php, (11) spamx/EditIP.Admin.class.php, (12) spamx/IPofUrl.Examine.class.php, (13) spamx/Import.Admin.class.php, (14) spamx/LogView.Admin.class.php, and (15) staticpages/functions.inc, in the plugins/ directory.
CVSS Score: 5.1 (MEDIUM)
References: http://www.securityfocus.com/bid/18740; https://exchange.xforce.ibmcloud.com/vulnerabilities/27469; https://www.exploit-db.com/exploits/1963
CVE: CVE-2006-6226
Published: 2006-12-02
Description: Multiple format string vulnerabilities in NeoEngine 0.8.2 and earlier, and CVS 3422, allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) Console::Render in neoengine/console.cpp and (2) TextArea::Render in neowtk/textarea.cpp.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/neoenginex-adv.txt; http://www.osvdb.org/27926; http://www.securiteam.com/securitynews/5MP0N2AIUC.html
CVE: CVE-2006-6227
Published: 2006-12-02
Description: The Core::Receive function in neonet/core.cpp for NeoEngine 0.8.2 and earlier, and CVS 3422, allow remote attackers to cause a denial of service (engine crash) via a message with a large uiMessageLength that produces a failed memory allocation and a null pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/neoenginex-adv.txt; http://www.osvdb.org/27927; http://www.securiteam.com/securitynews/5MP0N2AIUC.html
CVE: CVE-2006-6228
Published: 2006-12-02
Description: Cross-site scripting (XSS) vulnerability in Codewalkers ltwCalendar (aka PHP Event Calendar) before 4.2.1 allows remote attackers to inject arbitrary HTML or web script via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://ltwcalendar.sourceforge.net/changelog.php; http://ltwcalendar.sourceforge.net/changelog.php
CVE: CVE-2006-6229
Published: 2006-12-02
Description: Codewalkers ltwCalendar (aka PHP Event Calendar) before 4.2.1 logs failed passwords, which might allow attackers to infer correct passwords from the log file.
CVSS Score: 5.0 (MEDIUM)
References: http://ltwcalendar.sourceforge.net/changelog.php; http://ltwcalendar.sourceforge.net/changelog.php
CVE: CVE-2006-6230
Published: 2006-12-02
Description: SQL injection vulnerability in vuBB 0.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a register action to index.php, a different vulnerability than CVE-2006-0962.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1948; http://www.acid-root.new.fr/advisories/vubb021b.txt; http://www.securityfocus.com/archive/1/437657/100/200/threaded
CVE: CVE-2006-6231
Published: 2006-12-02
Description: vuBB 0.2.1 and earlier allows remote attackers to obtain sensitive information via a direct request to includes/vubb.php, which leaks the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1948; http://www.acid-root.new.fr/advisories/vubb021b.txt; http://www.securityfocus.com/archive/1/437657/100/200/threaded
CVE: CVE-2006-6232
Published: 2006-12-02
Description: PHP remote file inclusion vulnerability in admin/index.php in DreamAccount 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20468; http://securityreason.com/securityalert/1949; http://www.osvdb.org/27597
CVE: CVE-2006-6233
Published: 2006-12-02
Description: SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewdownloaddetails operation. NOTE: this issue might have been in the viewdownloaddetails function in dl-downloaddetails.php, but PostNuke 0.764 does not appear to have this issue.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1952; http://www.securityfocus.com/archive/1/437832/100/200/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/27501
CVE: CVE-2006-6234
Published: 2006-12-02
Description: Multiple SQL injection vulnerabilities in the Content module in PHP-Nuke 6.0, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via (1) the cid parameter in a list_pages_categories action or (2) the pid parameter in a showpage action.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1953; http://www.attrition.org/pipermail/vim/2006-December/001157.html; http://www.securityfocus.com/archive/1/437835/100/200/threaded
CVE: CVE-2006-5854
Published: 2006-12-03
Description: Multiple buffer overflows in the Spooler service (nwspool.dll) in Novell Netware Client 4.91 through 4.91 SP2 allow remote attackers to execute arbitrary code via a long argument to the (1) EnumPrinters and (2) OpenPrinter functions.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23027; http://securitytracker.com/id?1017263; http://securitytracker.com/id?1017315
CVE: CVE-2006-6120
Published: 2006-12-03
Description: Integer overflow in the KPresenter import filter for Microsoft PowerPoint files (filters/olefilters/lib/klaola.cc) in KOffice before 1.6.1 allows user-assisted remote attackers to execute arbitrary code via a crafted PPT file, which results in a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23143; http://secunia.com/advisories/23162; http://secunia.com/advisories/23220
CVE: CVE-2006-6236
Published: 2006-12-03
Description: Adobe Reader (Adobe Acrobat Reader) 7.0 through 7.0.8 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument string to the (1) src, (2) setPageMode, (3) setLayoutMode, and (4) setNamedDest methods in an AcroPDF ActiveX control, a different set of vectors than CVE-2006-6027.
CVSS Score: 9.3 (HIGH)
References: http://research.eeye.com/html/alerts/zeroday/20061128.html; http://secunia.com/advisories/23138; http://www.adobe.com/support/security/advisories/apsa06-02.html
CVE: CVE-2006-6237
Published: 2006-12-03
Description: SQL injection vulnerability in the decode_cookie function in thread.php in Woltlab Burning Board Lite 1.0.2 allows remote attackers to execute arbitrary SQL commands via the threadvisit Cookie parameter.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/wbblite_102_sql_mqg_bypass.html; http://secunia.com/advisories/23077; http://securityreason.com/securityalert/1955
CVE: CVE-2006-6238
Published: 2006-12-03
Description: The AutoFill feature in Apple Safari 2.0.4 does not properly verify that all automatically populated form fields are visible to the user, which allows remote attackers to obtain sensitive information, such as usernames and passwords, via input fields of zero width, a variant of CVE-2006-6077.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23066; http://tearesolutions.com/2006/11/how_to_steal_passwords_from_safaris_autofill.html; http://www.securityfocus.com/bid/21329
CVE: CVE-2006-6239
Published: 2006-12-03
Description: webadmin in MailEnable NetWebAdmin Professional 2.32 and Enterprise 2.32 allows remote attackers to authenticate using an empty password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/23105; http://securitytracker.com/id?1017287; http://www.mailenable.com/hotfix/
CVE: CVE-2006-6240
Published: 2006-12-03
Description: Directory traversal vulnerability in Sorin Chitu Telnet-FTP Server 1.0 allows remote authenticated users to list contents of arbitrary directories and download arbitrary files via a .. (dot dot) sequence in an FTP command argument, as demonstrated by RETR (GET) or STOR (PUT).  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/22921; http://www.securityfocus.com/bid/21339; http://www.vupen.com/english/advisories/2006/4765
CVE: CVE-2006-6241
Published: 2006-12-03
Description: Sorin Chitu Telnet-FTP Server 1.0 allows remote authenticated users to cause a denial of service (crash) via consecutive RETR commands.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/22921; http://www.securityfocus.com/bid/21340; http://www.vupen.com/english/advisories/2006/4765