deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4443
Published: 2006-08-29
Description: PHP remote file inclusion vulnerability in myajaxphp.php in AlstraSoft Video Share Enterprise allows remote attackers to execute arbitrary PHP code via a URL in the config[BASE_DIR] parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1467; http://www.securityfocus.com/archive/1/444416/100/0/threaded; http://www.securityfocus.com/bid/19724
CVE: CVE-2006-4444
Published: 2006-08-29
Description: Multiple SQL injection vulnerabilities in Cybozu Garoon 2.1.0 for Windows allow remote authenticated users to execute arbitrary SQL commands via the (1) tid parameter in the (a) todo/view (aka TODO List View), (b) todo/modify (aka TODO List Modify), or (c) todo/delete functionality; the (2) pid parameter in the (d) workflow/view or (e) workflow/print functionality; the (3) uid parameter in the (f) schedule/user_view, (g) phonemessage/add, (h) phonemessage/history, or (i) schedule/view functionality; the (4) cid parameter in (j) todo/index; the (5) iid parameter in the (k) memo/view or (l) memo/print functionality; or the (6) event parameter in the (m) schedule/view functionality.
CVSS Score: 6.5 (MEDIUM)
References: http://cybozu.co.jp/products/dl/notice_060825/; http://secunia.com/advisories/21664; http://vuln.sg/cybozugaroon-en.html
CVE: CVE-2006-4445
Published: 2006-08-29
Description: Multiple PHP remote file inclusion vulnerabilities in CuteNews 1.3.x allow remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter to (1) show_news.php or (2) search.php.  NOTE: CVE analysis as of 20060829 has not identified any scenarios in which these vectors could result in remote file inclusion
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-09/0040.html; http://www.attrition.org/pipermail/vim/2006-August/001000.html; http://www.osvdb.org/29842
CVE: CVE-2006-4305
Published: 2006-08-30
Description: Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client.
CVSS Score: 10.0 (HIGH)
References: http://dev.mysql.com/doc/maxdb/changes/changes_7.6.00.32.html; http://secunia.com/advisories/21677; http://secunia.com/advisories/22518
CVE: CVE-2006-4446
Published: 2006-08-30
Description: Heap-based buffer overflow in DirectAnimation.PathControl COM object (daxctle.ocx) in Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a Spline function call whose first argument specifies a large number of points.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21910; http://securityreason.com/securityalert/1468; http://securitytracker.com/id?1016764
CVE: CVE-2006-4447
Published: 2006-08-30
Description: X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.
CVSS Score: 7.2 (HIGH)
References: http://lists.freedesktop.org/archives/xorg/2006-June/016146.html; http://mail.gnome.org/archives/beast/2006-December/msg00025.html; http://secunia.com/advisories/21650
CVE: CVE-2006-4448
Published: 2006-08-30
Description: Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[BASE_PATH] parameter in (a) admin/autoprompter.php and (b) includes/common.inc.php, and the (2) CONFIG[LANGUAGE_CPATH] parameter in (c) admin/autoprompter.php.
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/1471; http://www.securityfocus.com/archive/1/444526/100/0/threaded; http://www.securityfocus.com/bid/19739
CVE: CVE-2006-4449
Published: 2006-08-30
Description: Cross-site scripting (XSS) vulnerability in attachment.php in MyBulletinBoard (MyBB) 1.1.7 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via a GIF image that contains URL-encoded Javascript, which is rendered by Internet Explorer.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21645; http://securityreason.com/securityalert/1469; http://www.mybboard.com/archive.php?nid=18
CVE: CVE-2006-4450
Published: 2006-08-30
Description: usercp_avatar.php in PHPBB 2.0.20, when avatar uploading is enabled, allows remote attackers to use the server as a web proxy by submitting a URL to the avatarurl parameter, which is then used in an HTTP GET request.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0238.html; http://secunia.com/advisories/20093; http://securityreason.com/securityalert/1470
CVE: CVE-2006-4451
Published: 2006-08-30
Description: Direct static code injection vulnerability in CJ Tag Board 3.0 allows remote attackers to execute arbitrary PHP code via the (1) User-Agent HTTP header in tag.php, which is executed by all.php, and (2) the banned parameter in admin_index.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21561; http://secunia.com/secunia_research/2006-61/advisory/; http://www.securityfocus.com/bid/19748
CVE: CVE-2006-4452
Published: 2006-08-30
Description: PHP remote file inclusion vulnerability in security/include/_class.security.php in Web3news 0.95 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the PHPSECURITYADMIN_PATH parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21640; http://www.osvdb.org/28248; http://www.securityfocus.com/bid/19744
CVE: CVE-2006-4453
Published: 2006-08-30
Description: Cross-site scripting (XSS) vulnerability in PmWiki before 2.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "table markups".
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21667; http://www.osvdb.org/28268; http://www.pmichaud.com/wiki/PmWiki/ChangeLog
CVE: CVE-2006-4454
Published: 2006-08-30
Description: Cross-site scripting (XSS) vulnerability in hlstats.php in HLstats 1.34 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0741.html; http://secunia.com/advisories/21635; http://www.osvdb.org/28238
CVE: CVE-2006-4455
Published: 2006-08-30
Description: Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via unspecified vectors involving the PRIVMSG command.  NOTE: the vendor has disputed this vulnerability, stating that it does not affect 2.6.7 "or any recent version"
CVSS Score: 5.0 (MEDIUM)
References: http://forum.xchat.org/viewtopic.php?t=2918; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1922&w=2; http://securitytracker.com/id?1016687
CVE: CVE-2006-4244
Published: 2006-08-31
Description: SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/21689; http://securityreason.com/securityalert/1472; http://www.securityfocus.com/archive/1/444741/100/0/threaded
CVE: CVE-2006-4456
Published: 2006-08-31
Description: PHP remote file inclusion vulnerability in functions.php in phpECard 2.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21676; http://securitytracker.com/id?1016768; http://www.osvdb.org/28291
CVE: CVE-2006-4457
Published: 2006-08-31
Description: PHP remote file inclusion vulnerability in index.php in phpECard 2.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21676; http://www.vupen.com/english/advisories/2006/3411; http://secunia.com/advisories/21676
CVE: CVE-2006-4458
Published: 2006-08-31
Description: Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) sequence and trailing null (%00) byte in the GLOBALS[phpgw_info][user][preferences][common][country] parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/21687; http://www.securityfocus.com/bid/19751; http://www.vupen.com/english/advisories/2006/3414
CVE: CVE-2006-4460
Published: 2006-08-31
Description: Cross-site scripting (XSS) vulnerability in PHP iAddressBook before 0.96 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21730; http://wacha.ch/wiki/addressbook:changelog; http://www.securityfocus.com/bid/19845
CVE: CVE-2006-4461
Published: 2006-08-31
Description: Paessler IPCheck Server Monitor before 5.3.3.639/640 does not properly implement a "list of acceptable host IP addresses in the probe settings," which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.paessler.com/ipcheck/history; http://www.paessler.com/ipcheck/history
CVE: CVE-2006-4462
Published: 2006-08-31
Description: Gonafish.com LinksCaffe 2.0 and 3.0 do not properly restrict access to administrator functions, which allows remote attackers to gain full administration rights via a direct request to Admin/admin1953.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1484; http://securitytracker.com/id?1016767; http://www.securityfocus.com/archive/1/444636/100/0/threaded
CVE: CVE-2006-4463
Published: 2006-08-31
Description: SQL injection vulnerability in the administrator control panel in Jetstat.com JS ASP Faq Manager 1.10 allows remote attackers to execute arbitrary SQL commands via the pwd parameter (aka the Password field).
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21674; http://securityreason.com/securityalert/1483; http://www.osvdb.org/28266
CVE: CVE-2006-4464
Published: 2006-08-31
Description: The Nokia Browser, possibly Nokia Symbian 60 Browser 3rd edition, allows remote attackers to cause a denial of service (crash) via JavaScript that constructs a large Unicode string.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1485; http://www.securityfocus.com/archive/1/442990/100/200/threaded; http://www.securityfocus.com/bid/19484
CVE: CVE-2006-4465
Published: 2006-08-31
Description: Microsoft Terminal Server, when running an application session with the "Start program at logon" and "Override settings from user profile and Client Connection Manager wizard" options, allows local users to execute arbitrary code by forcing an Explorer error.  NOTE: a third-party researcher has stated that the options are "a convenience to users" and were not intended to restrict execution of arbitrary code
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/1486; http://wklpc.blogspot.com/2006/08/easy-ms-terminal-server-desktop-hack.html; http://www.securityfocus.com/archive/1/443364/100/200/threaded
CVE: CVE-2006-4466
Published: 2006-08-31
Description: Joomla! before 1.0.11 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to have an unspecified impact.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Joomla!.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.joomla.org/content/view/1841/78/; http://www.vupen.com/english/advisories/2006/3408; http://www.joomla.org/content/view/1841/78/
CVE: CVE-2006-4467
Published: 2006-08-31
Description: Simple Machines Forum (SMF) 1.1RCx before 1.1RC3, and 1.0.x before 1.0.8, does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to perform directory traversal attacks to read arbitrary local files, lock topics, and possibly have other security impacts.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Simple Machines Forum.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/smf_11rc2_local_incl.html; http://retrogod.altervista.org/smf_11rc2_lock.html; http://securityreason.com/securityalert/1475
CVE: CVE-2006-4468
Published: 2006-08-31
Description: Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow attackers to have an unknown impact via unspecified vectors involving the (1) mosMail, (2) JosIsValidEmail, and (3) josSpoofValue functions; (4) the lack of inclusion of globals.php in administrator/index.php; (5) the Admin User Manager; and (6) the poll module.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/21666; http://www.joomla.org/content/view/1841/78/; http://www.joomla.org/content/view/1843/74/
CVE: CVE-2006-4469
Published: 2006-08-31
Description: Unspecified vulnerability in PEAR.php in Joomla! before 1.0.11 allows remote attackers to perform "remote execution," related to "Injection Flaws."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21666; http://www.joomla.org/content/view/1841/78/; http://www.joomla.org/content/view/1843/74/
CVE: CVE-2006-4470
Published: 2006-08-31
Description: Joomla! before 1.0.11 omits some checks for whether _VALID_MOS is defined, which allows attackers to have an unknown impact, possibly resulting in PHP remote file inclusion.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21666; http://www.joomla.org/content/view/1841/78/; http://www.joomla.org/content/view/1843/74/
CVE: CVE-2006-4471
Published: 2006-08-31
Description: The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to upload files outside of the /images/stories/ directory via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: http://secunia.com/advisories/21666; http://www.joomla.org/content/view/1841/78/; http://www.joomla.org/content/view/1843/74/
CVE: CVE-2006-4472
Published: 2006-08-31
Description: Multiple unspecified vulnerabilities in Joomla! before 1.0.11 allow attackers to bypass user authentication via unknown vectors involving the (1) do_pdf command and the (2) emailform com_content task.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21666; http://www.joomla.org/content/view/1841/78/; http://www.joomla.org/content/view/1843/74/
CVE: CVE-2006-4473
Published: 2006-08-31
Description: Unspecified vulnerability in com_content in Joomla! before 1.0.11, when $mosConfig_hideEmail is set, allows attackers to perform the emailform and emailsend tasks.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21666; http://www.joomla.org/content/view/1841/78/; http://www.joomla.org/content/view/1843/74/
CVE: CVE-2006-4474
Published: 2006-08-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.11 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) Admin Module Manager, (2) Admin Help, and (3) Search.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21666; http://www.joomla.org/content/view/1841/78/; http://www.joomla.org/content/view/1843/74/
CVE: CVE-2006-4475
Published: 2006-08-31
Description: Joomla! before 1.0.11 does not limit access to the Admin Popups functionality, which has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/21666; http://www.joomla.org/content/view/1841/78/; http://www.joomla.org/content/view/1843/74/
CVE: CVE-2006-4476
Published: 2006-08-31
Description: Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to "Injection Flaws," allow attackers to have an unknown impact via (1) globals.php, which uses include_once() instead of require(); (2) the $options variable; (3) Admin Upload Image; (4) ->load(); (5) content submissions when frontpage is selected; (6) the mosPageNav constructor; (7) saveOrder functions; (8) the absence of "exploit blocking rules" in htaccess; and (9) the ACL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94, CWE-264
References: http://secunia.com/advisories/21666; http://www.joomla.org/content/view/1841/78/; http://www.joomla.org/content/view/1843/74/
CVE: CVE-2006-3125
Published: 2006-08-31
Description: Array index error in tetrinet.c in gtetrinet 0.7.8 and earlier allows remote attackers to execute arbitrary code via a packet specifying a negative number of players, which is used as an array index.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21691; http://secunia.com/advisories/21704; http://secunia.com/advisories/21749
CVE: CVE-2006-4477
Published: 2006-08-31
Description: Multiple PHP remote file inclusion vulnerabilities in Visual Shapers ezContents 2.0.3 allow remote attackers to execute arbitrary PHP code via an empty GLOBALS[rootdp] parameter and an ftps URL in the (1) GLOBALS[admin_home] parameter in (a) diary/event_list.php, (b) gallery/gallery_summary.php, (c) guestbook/showguestbook.php, (d) links/showlinks.php, and (e) reviews/review_summary.php; and the (2) GLOBALS[language_home] parameter in (f) calendar/calendar.php, (g) news/shownews.php, (h) poll/showpoll.php, (i) search/search.php, (j) toprated/toprated.php, and (k) whatsnew/whatsnew.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21703; http://securityreason.com/securityalert/1479; http://securitytracker.com/id?1016770
CVE: CVE-2006-4478
Published: 2006-08-31
Description: SQL injection vulnerability in headeruserdata.php in Visual Shapers ezContents 2.0.3 allows remote attackers to execute arbitrary SQL commands via the groupname parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21703; http://securityreason.com/securityalert/1479; http://securitytracker.com/id?1016770
CVE: CVE-2006-4479
Published: 2006-08-31
Description: Cross-site scripting (XSS) vulnerability in loginreq2.php in Visual Shapers ezContents 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the subgroupname parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21703; http://securityreason.com/securityalert/1479; http://securitytracker.com/id?1016770
CVE: CVE-2006-4480
Published: 2006-08-31
Description: Incomplete blacklist vulnerability in the nk_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS features and inject arbitrary web script or HTML via JavaScript in an attribute value that is not in the blacklist, as demonstrated using the STYLE attribute of a B element.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1478; http://www.securityfocus.com/archive/1/444749/100/0/threaded; http://securityreason.com/securityalert/1478
CVE: CVE-2006-4481
Published: 2006-08-31
Description: The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings.  NOTE: the error_log function is covered by CVE-2006-3011, and the imap_open function is covered by CVE-2006-1017.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/21546; http://secunia.com/advisories/21768; http://secunia.com/advisories/21842
CVE: CVE-2006-4482
Published: 2006-08-31
Description: Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.10&r2=1.445.2.14.2.11; http://rhn.redhat.com/errata/RHSA-2006-0688.html
CVE: CVE-2006-4483
Published: 2006-08-31
Description: The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache.
CVSS Score: 9.3 (HIGH)
CWE: CWE-862
References: http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7; http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?view=log; http://cvs.php.net/viewvc.cgi/php-src/ext/curl/streams.c?r1=1.14.2.2.2.3&r2=1.14.2.2.2.4
CVE: CVE-2006-4484
Published: 2006-08-31
Description: Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.
CVSS Score: 2.6 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://bugs.php.net/bug.php?id=38112; http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd_gif_in.c?r1=1.10&r2=1.11
CVE: CVE-2006-4485
Published: 2006-08-31
Description: The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2006-0688.html; http://secunia.com/advisories/21546; http://secunia.com/advisories/21842
CVE: CVE-2006-4486
Published: 2006-08-31
Description: Integer overflow in memory allocation routines in PHP before 5.1.6, when running on a 64-bit system, allows context-dependent attackers to bypass the memory_limit restriction.
CVSS Score: 2.6 (LOW)
CWE: CWE-189
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://rhn.redhat.com/errata/RHSA-2006-0688.html; http://secunia.com/advisories/21546
CVE: CVE-2006-4146
Published: 2006-08-31
Description: Buffer overflow in the (1) DWARF (dwarfread.c) and (2) DWARF2 (dwarf2read.c) debugging code in GNU Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block (DW_FORM_block) that contains a large number of operations.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://docs.info.apple.com/article.html?artnum=304669; http://lists.apple.com/archives/security-announce/2006/Oct/msg00000.html
CVE: CVE-2006-4487
Published: 2006-08-31
Description: DUware DUpoll 3.0 and 3.1 stores _private/Dupoll.mdb under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and passwords.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21670; http://securityreason.com/securityalert/1482; http://www.osvdb.org/28253
CVE: CVE-2006-4488
Published: 2006-08-31
Description: PHP remote file inclusion vulnerability in modules/userstop/userstop.php in ExBB Italia 0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the exbb[home_path] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://exbb.clans.it/forum/announcements.php; http://secunia.com/advisories/21681; http://www.osvdb.org/28251