deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1255
Published: 2006-03-19
Description: Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string to the (1) LOGIN or (2) SELECT command, a different set of attack vectors and possibly a different vulnerability than CVE-2003-1177.
CVSS Score: 10.0 (HIGH)
References: http://seclists.org/fulldisclosure/2006/Mar/1111; http://seclists.org/fulldisclosure/2006/Mar/1167; http://secunia.com/advisories/19267
CVE: CVE-2006-1256
Published: 2006-03-19
Description: Cross-site scripting (XSS) vulnerability in guestbook.php in Soren Boysen (SkullSplitter) PHP Guestbook 2.6 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 2.6 (LOW)
References: http://attrition.org/pipermail/vim/2006-March/000613.html; http://evuln.com/vulns/104/summary.html; http://secunia.com/advisories/19268
CVE: CVE-2006-1257
Published: 2006-03-19
Description: The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
CVSS Score: 7.5 (HIGH)
References: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securityconcepts_cbgw.asp; http://securityreason.com/securityalert/594; http://www.osvdb.org/24121
CVE: CVE-2006-1258
Published: 2006-03-19
Description: Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.1 allows remote attackers to inject arbitrary web script or HTML via the set_theme parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19277; http://securitytracker.com/id?1015776; http://www.osvdb.org/23943
CVE: CVE-2006-1259
Published: 2006-03-19
Description: Multiple SQL injection vulnerabilities in Maian Support 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) pass parameter to admin/index.php.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/103/summary.html; http://secunia.com/advisories/19275; http://securityreason.com/securityalert/645
CVE: CVE-2006-1260
Published: 2006-03-19
Description: Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/043657.html; http://secunia.com/advisories/19246; http://secunia.com/advisories/19528
CVE: CVE-2006-1261
Published: 2006-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in ASPPortal 3.00 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/1517.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9338&w=2; http://secunia.com/advisories/19247
CVE: CVE-2006-1262
Published: 2006-03-19
Description: Multiple SQL injection vulnerabilities in ASPPortal 3.00 have unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/1517.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9338&w=2; http://secunia.com/advisories/19247
CVE: CVE-2006-1263
Published: 2006-03-19
Description: Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://wordpress.org/development/2006/03/security-202/; http://www.securityfocus.com/bid/17069; http://wordpress.org/development/2006/03/security-202/
CVE: CVE-2006-1264
Published: 2006-03-19
Description: Cross-site scripting (XSS) vulnerability in xhawk.net discussion 2.0 beta2 allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in a BBCode img tag.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/92/summary.html; http://www.osvdb.org/23970; http://www.securityfocus.com/archive/1/427729/100/0/threaded
CVE: CVE-2006-1265
Published: 2006-03-19
Description: SQL injection vulnerability in discussion.class.php in xhawk.net discussion 2.0 beta2 allows remote attackers to execute arbitrary SQL commands via the view parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/92/summary.html; http://www.osvdb.org/23971; http://www.securityfocus.com/archive/1/427729/100/0/threaded
CVE: CVE-2006-1266
Published: 2006-03-19
Description: Cross-site scripting (XSS) vulnerability in Service_Requests.asp in VPMi Enterprise 3.3 allows remote attackers to inject arbitrary web script or HTML via the Request_Name_Display parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-March/000605.html; http://secunia.com/advisories/19297; http://www.osvdb.org/23916
CVE: CVE-2006-1267
Published: 2006-03-19
Description: Invision Power Board 2.1.4 allows remote attackers to hijack sessions and possibly gain administrative privileges by obtaining the session ID from the s parameter, then replaying it in another request.
CVSS Score: 5.1 (MEDIUM)
References: http://www.securityfocus.com/archive/1/427751/100/0/threaded; http://www.securityfocus.com/archive/1/427847/100/0/threaded; http://www.securityfocus.com/archive/1/427751/100/0/threaded
CVE: CVE-2006-1268
Published: 2006-03-19
Description: The Internet Key Exchange implementation in Funkwerk X2300 7.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite.  NOTE: due to the lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/19233; http://www.funkwerk-ec.com/portal/downloadcenter/dateien/x2300/r7201p09/readme_721p9.pdf; http://www.securityfocus.com/bid/17124
CVE: CVE-2006-1269
Published: 2006-03-19
Description: Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command line arguments, which are not properly handled during archive creation.  NOTE: since this issue is local and not setuid, the set of attack scenarios is limited, although is reasonable to expect that there are some situations in which the zoo user might automatically list attacker-controlled filenames to add to the zoo archive.
CVSS Score: 6.2 (MEDIUM)
References: http://secunia.com/advisories/19250; http://secunia.com/advisories/19254; http://www.gentoo.org/security/en/glsa/glsa-200603-12.xml
CVE: CVE-2006-1270
Published: 2006-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in zones.php in Inprotect 0.21 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Description field.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 3.5 (LOW)
References: http://secunia.com/advisories/19248; http://www.osvdb.org/23936; http://www.securityfocus.com/bid/17141
CVE: CVE-2006-1271
Published: 2006-03-19
Description: SQL injection vulnerability in index.php in OxyNews allows remote attackers to execute arbitrary SQL commands via the oxynews_comment_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://biyosecurity.be/bugs/oxynews.txt; http://secunia.com/advisories/19255; http://www.osvdb.org/23940
CVE: CVE-2006-1272
Published: 2006-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in member.php in MyBulletin Board (MyBB) 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) aim, (2) yahoo, (3) msn, or (4) website field.
CVSS Score: 4.3 (MEDIUM)
References: http://community.mybboard.net/showthread.php?tid=7368; http://kapda.ir/advisory-297.html; http://www.osvdb.org/23935
CVE: CVE-2006-1273
Published: 2006-03-19
Description: Mozilla Firefox 1.0.7 and 1.5.0.1 allows remote attackers to cause a denial of service (crash) via an HTML tag with a large number of script action handlers such as onload and onmouseover, which triggers the crash when the user views the page source.  NOTE: Red Hat has disputed this issue, suggesting that "It is likely the reporter was running the IE Tab extension," and Mozilla also confirmed that this is not an issue in Firefox itself
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/31833; http://securityreason.com/securityalert/593; http://www.securityfocus.com/archive/1/427977/100/0/threaded
CVE: CVE-2006-1274
Published: 2006-03-19
Description: Classic Planer in AntiVir PersonalEdition Classic 7 does not drop privileges before executing external programs, which allows local users to gain privileges via notepad.exe, which is used to display scan reports.
CVSS Score: 7.2 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/042868.html; http://secunia.com/advisories/19217; http://securityreason.com/securityalert/573
CVE: CVE-2006-1275
Published: 2006-03-19
Description: GGZ Gaming Zone 0.0.12 allows remote attackers to cause a denial of service (client disconnect) via inputs that produce malformed XML, including (1) trailing ' (apostrophe) character on the ID attribute in a PLAYER XML tag, (2) joining with a long ID attribute or non-trailing ' characters, which causes a <none> name to be assigned, and then disconnecting, or (3) a long CDATA message attribute, which prevents closing tags from being added to the string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/ggzcdos-adv.txt; http://secunia.com/advisories/19212; http://www.osvdb.org/23848
CVE: CVE-2006-1276
Published: 2006-03-19
Description: admin.php in Himpfen Consulting Company PHP SimpleNEWS 1.0.0 allows remote attackers to bypass authentication by setting the admin parameter in a cookie.
CVSS Score: 10.0 (HIGH)
References: http://evuln.com/vulns/94/summary.html; http://secunia.com/advisories/19195; http://securityreason.com/securityalert/613
CVE: CVE-2006-1277
Published: 2006-03-19
Description: Cross-site scripting (XSS) vulnerability in signup.php in @1 File Store 2006.03.07 allows remote attackers to inject arbitrary web script or HTML via the (1) real_name, (2) email, and (3) login parameters.
CVSS Score: 5.8 (MEDIUM)
References: http://evuln.com/vulns/95/summary.html; http://secunia.com/advisories/19224; http://securitytracker.com/id?1015826
CVE: CVE-2006-1278
Published: 2006-03-19
Description: SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php.  NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://evuln.com/vulns/95/summary.html; http://osvdb.org/47017; http://osvdb.org/47018
CVE: CVE-2006-1279
Published: 2006-03-19
Description: CGI::Session 4.03-1 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by (1) Driver::File, (2) Driver::db_file, and possibly (3) Driver::sqlite.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555; http://secunia.com/advisories/19211; http://www.osvdb.org/23865
CVE: CVE-2006-1280
Published: 2006-03-19
Description: CGI::Session 4.03-1 does not set proper permissions on temporary files created in (1) Driver::File and (2) Driver::db_file, which allows local users to obtain privileged information, such as session keys, by viewing the files.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555; http://secunia.com/advisories/19211; http://www.osvdb.org/23866
CVE: CVE-2006-1281
Published: 2006-03-19
Description: Cross-site scripting (XSS) vulnerability in member.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272.  NOTE: 1.10 was later reported to be vulnerable.
CVSS Score: 3.5 (LOW)
References: http://community.mybboard.net/showthread.php?tid=7368; http://kapda.ir/advisory-296.html; http://myimei.com/security/2006-03-09/mybb104memberphpxss-after-login.html
CVE: CVE-2006-1282
Published: 2006-03-19
Description: CRLF injection vulnerability in inc/function.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to conduct cross-site scripting (XSS), poison caches, or hijack pages via CRLF (%0A%0D) sequences in the Referrer HTTP header field, possibly when redirecting to other web pages.
CVSS Score: 4.3 (MEDIUM)
References: http://community.mybboard.net/showthread.php?tid=7368; http://kapda.ir/advisory-295.html; http://myimei.com/security/2006-03-10/mybb104redirectfunctionheaderinjection.html
CVE: CVE-2006-1284
Published: 2006-03-19
Description: The installation of SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, includes a default administrator login account and password, which allows local users to gain privileges or modify tasks.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/19171; http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html; http://securitytracker.com/id?1015733
CVE: CVE-2006-1285
Published: 2006-03-19
Description: SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, gives read and write permissions to all users for database shared memory sections, which allows local users to access and possibly modify certain information.
CVSS Score: 3.2 (LOW)
References: http://secunia.com/advisories/19171; http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html; http://securitytracker.com/id?1015733
CVE: CVE-2006-1286
Published: 2006-03-19
Description: Buffer overflow in the login dialog in dbisqlc.exe in SQLAnywhere for Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, might allow local users to read certain sensitive information from the database.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19171; http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html; http://securitytracker.com/id?1015733
CVE: CVE-2006-1287
Published: 2006-03-19
Description: Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060130 allows remote attackers to steal cookies and probably conduct other activities when the victim is using Internet Explorer.
CVSS Score: 5.8 (MEDIUM)
References: http://forums.invisionpower.com/index.php?showtopic=206790; http://secunia.com/advisories/19141; http://www.vupen.com/english/advisories/2006/0861
CVE: CVE-2006-1288
Published: 2006-03-19
Description: Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to (1) arrays of id/stamp pairs and (2) the keys in arrays of key/value pairs in ipsclass.php; (3) the topics variable in usercp.php; and the topicsread cookie in (4) topics.php, (5) search.php, and (6) forums.php.
CVSS Score: 7.5 (HIGH)
References: http://forums.invisionpower.com/index.php?act=Attach&type=post&id=9642; http://forums.invisionpower.com/index.php?showtopic=204627; http://secunia.com/advisories/19141
CVE: CVE-2006-1289
Published: 2006-03-19
Description: Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) password, (3) team, (4) level, (5) status, (6) teamname, and (7) teamlead parameters in (a) auth.php; the (8) username, (9) action, and (10) filter parameters in (b) authuser.php; the (11) username parameter in (c) utils.php; the (12) id and (13) date parameters in (d) traffic.php; the (14) username parameter in (e) userstatistics.php; and the (15) USERNAME and (16) PASSWORD parameters in a cookie to (f) chgpwd.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19258; http://securitytracker.com/id?1015778; http://www.osvdb.org/23925
CVE: CVE-2006-1290
Published: 2006-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) ipAddress, (2) act, (3) username, and (4) unspecified other parameters in (a) authuser.php; and the (5) username and (6) unspecified other parameters in (b) userstatistics.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19258; http://securitytracker.com/id?1015778; http://www.osvdb.org/23932
CVE: CVE-2006-1291
Published: 2006-03-19
Description: publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and a trailing null character.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/php-iCalendar-221.upload.php; http://secunia.com/advisories/19285; http://www.securityfocus.com/bid/17129
CVE: CVE-2006-1292
Published: 2006-03-19
Description: Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19285; http://www.securityfocus.com/bid/17125; http://www.vupen.com/english/advisories/2006/1019
CVE: CVE-2006-1293
Published: 2006-03-19
Description: Cross-site scripting (XSS) vulnerability in index.php in Contrexx CMS 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF).
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19294; http://securityreason.com/securityalert/599; http://soot.shabgard.org/Contrexx-CMS.txt
CVE: CVE-2006-1294
Published: 2006-03-19
Description: PHP remote file include vulnerability in PageController.php in KnowledgebasePublisher 1.2 allows remote attackers to include and execute arbitrary PHP code via a URL in the dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19298; http://sourceforge.net/project/shownotes.php?release_id=402179&group_id=144153; http://www.osvdb.org/24002
CVE: CVE-2006-1295
Published: 2006-03-19
Description: Cross-site scripting (XSS) vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/17130; http://www.silitix.com/spip-xss.html; http://www.zone-h.fr/advisories/read/id=1105
CVE: CVE-2006-1296
Published: 2006-03-19
Description: Untrusted search path vulnerability in Beagle 0.2.2.1 might allow local users to gain privileges via a malicious beagle-info program in the current working directory, or possibly directories specified in the PATH.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=357392; http://secunia.com/advisories/19278; http://secunia.com/advisories/19336
CVE: CVE-2006-1297
Published: 2006-03-19
Description: Unspecified vulnerability in Veritas Backup Exec for Windows Server Remote Agent 9.1 through 10.1, for Netware Servers and Remote Agent 9.1 and 9.2, and Remote Agent for Linux Servers 10.0 and 10.1 allow attackers to cause a denial of service (application crash or unavailability) due to "memory errors."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19242; http://securityreason.com/securityalert/597; http://securitytracker.com/id?1015784
CVE: CVE-2006-1298
Published: 2006-03-19
Description: Format string vulnerability in the Job Engine service (bengine.exe) in the Media Server in Veritas Backup Exec 10d (10.1) for Windows Servers rev. 5629, Backup Exec 10.0 for Windows Servers rev. 5520, Backup Exec 10.0 for Windows Servers rev. 5484, and Backup Exec 9.1 for Windows Servers rev. 4691, when the job log mode is Full Detailed (aka Full Details), allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted filename on a machine that is backed up by Backup Exec.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/19242; http://securitytracker.com/id?1015785; http://support.veritas.com/docs/282254
CVE: CVE-2006-1319
Published: 2006-03-20
Description: chpst in runit 1.3.3-1 for Debian GNU/Linux, when compiled on little endian i386 machines against dietlibc, does not properly handle when multiple groups are specified in the -u option, which causes chpst to assign permissions for the root group due to inconsistent bit sizes for the gid_t type.
CVSS Score: 6.2 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356016; http://secunia.com/advisories/19323; http://www.securityfocus.com/bid/17179
CVE: CVE-2006-1320
Published: 2006-03-20
Description: util.c in rssh 2.3.0 in Debian GNU/Linux does not use braces to make a block, which causes a check for CVS to always succeed and allows rsync and rdist to bypass intended access restrictions in rssh.conf.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346322; http://secunia.com/advisories/21087; http://www.debian.org/security/2006/dsa-1109
CVE: CVE-2006-1321
Published: 2006-03-20
Description: Cross-site scripting (XSS) vulnerability in webcheck before 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the (1) url, (2) title, or (3) author name in a crawled page, which is not properly sanitized in the tooltips of a report.
CVSS Score: 4.3 (MEDIUM)
References: http://ch.tudelft.nl/~arthur/webcheck/news.html#20060130; http://secunia.com/advisories/19309; http://www.securityfocus.com/bid/17212
CVE: CVE-2006-1322
Published: 2006-03-20
Description: Novell Netware NWFTPD 5.06.05 allows remote attackers to cause a denial of service (ABEND) via an MDTM command that uses a long path for the target file, possibly due to a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19265; http://securitytracker.com/id?1015781; http://support.novell.com/cgi-bin/search/searchtid.cgi?/2973435.htm
CVE: CVE-2006-1323
Published: 2006-03-20
Description: Directory traversal vulnerability in WinHKI 1.6 and earlier allows user-assisted attackers to overwrite arbitrary files via a (1) RAR, (2) TAR, (3) ZIP, or (4) TAR.GZ archive with a file whose file name contains ".." sequences.
CVSS Score: 5.1 (MEDIUM)
References: http://hamid.ir/security/winhki.txt; http://secunia.com/advisories/19296; http://www.securityfocus.com/archive/1/428433/100/0/threaded
CVE: CVE-2006-1061
Published: 2006-03-21
Description: Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1326.html; http://curl.haxx.se/docs/adv_20060320.html; http://secunia.com/advisories/19271