deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1301
Published: 2006-07-13
Description: Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted SELECTION record that triggers memory corruption, a different vulnerability than CVE-2006-1302.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1016472; http://www.securityfocus.com/bid/18853; http://www.vupen.com/english/advisories/2006/2755
CVE: CVE-2006-1308
Published: 2006-07-13
Description: Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted FNGROUPCOUNT value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047837.html; http://securitytracker.com/id?1016472; http://www.securityfocus.com/bid/18890
CVE: CVE-2006-1309
Published: 2006-07-13
Description: Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted LABEL record that triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1016472; http://www.securityfocus.com/bid/18910; http://www.vupen.com/english/advisories/2006/2755
CVE: CVE-2006-3590
Published: 2006-07-14
Description: mso.dll, as used by Microsoft PowerPoint 2000 through 2003, allows user-assisted attackers to execute arbitrary commands via a malformed shape container in a PPT file that leads to memory corruption, as exploited by Trojan.PPDropper.B, a different issue than CVE-2006-1540 and CVE-2006-3493.
CVSS Score: 5.1 (MEDIUM)
References: http://blogs.securiteam.com/?p=508; http://isc.sans.org/diary.php?storyid=1484; http://secunia.com/advisories/21040
CVE: CVE-2006-3591
Published: 2006-07-18
Description: Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the URL property of a TriEditDocument.TriEditDocument object before it has been initialized, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-12-trieditdocument-url.html; http://www.osvdb.org/27056; http://www.securityfocus.com/bid/18946
CVE: CVE-2006-3592
Published: 2006-07-18
Description: Unspecified vulnerability in the command line interface (CLI) in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows local users to execute arbitrary commands with elevated privileges via unspecified vectors, involving "certain CLI commands," aka bug CSCse11005.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21030; http://securitytracker.com/id?1016475; http://www.cisco.com/warp/public/707/cisco-sa-20060712-cucm.shtml
CVE: CVE-2006-3593
Published: 2006-07-18
Description: The command line interface (CLI) in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows local users to overwrite arbitrary files by redirecting a command's output to a file or folder, aka bug CSCse31704.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/21030; http://securitytracker.com/id?1016475; http://www.cisco.com/en/US/products/products_security_advisory09186a00806e0b9f.shtml
CVE: CVE-2006-3594
Published: 2006-07-18
Description: Buffer overflow in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows remote attackers to execute arbitrary code via a long hostname in a SIP request, aka bug CSCsd96542.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21030; http://securitytracker.com/id?1016475; http://www.cisco.com/warp/public/707/cisco-sa-20060712-cucm.shtml
CVE: CVE-2006-3595
Published: 2006-07-18
Description: The default configuration of IOS HTTP server in Cisco Router Web Setup (CRWS) before 3.3.0 build 31 does not require credentials, which allows remote attackers to access the server with arbitrary privilege levels, aka bug CSCsa78190.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21028; http://securitytracker.com/id?1016476; http://www.cisco.com/warp/public/707/cisco-sa-20060712-crws.shtml
CVE: CVE-2006-3596
Published: 2006-07-18
Description: The device driver for Intel-based gigabit network adapters in Cisco Intrusion Prevention System (IPS) 5.1(1) through 5.1(p1), as installed on various Cisco Intrusion Prevention System 42xx appliances, allows remote attackers to cause a denial of service (kernel panic and possibly network outage) via a crafted IP packet.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21029; http://securitytracker.com/id?1016474; http://www.cisco.com/warp/public/707/cisco-sa-20060712-ips.shtml
CVE: CVE-2006-3597
Published: 2006-07-18
Description: passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the "Go Back" option after the final "Installation complete" message and uses the main menu, which causes the password to be zeroed out in the installer's memory.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/21022; http://www.osvdb.org/27091; http://www.ubuntu.com/usn/usn-316-1
CVE: CVE-2006-3598
Published: 2006-07-18
Description: SQL injection vulnerability in the Sections module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle op.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/438596/100/200/threaded; http://www.securityfocus.com/bid/27879; https://exchange.xforce.ibmcloud.com/vulnerabilities/27501
CVE: CVE-2006-3599
Published: 2006-07-18
Description: SQL injection vulnerability in the Nuke Advanced Classifieds module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id_ads parameter in an EditAds op.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/438817/100/100/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/27501; http://www.securityfocus.com/archive/1/438817/100/100/threaded
CVE: CVE-2006-3600
Published: 2006-07-18
Description: Multiple stack-based buffer overflows in the LookupTRM::lookup function in libtunepimp (TunePimp) 0.4.2 allow remote user-assisted attackers to cause a denial of service (application crash) and possibly execute code via a long (1) Album release date (MBE_ReleaseGetDate), (2) data, or (3) error strings.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://bugs.musicbrainz.org/ticket/1764; http://secunia.com/advisories/21026; http://secunia.com/advisories/21027
CVE: CVE-2006-3601
Published: 2006-07-18
Description: ** UNVERIFIABLE **  Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke (.net nuke) allows remote attackers to gain privileges via unspecified vectors, as used in an attack against the Microsoft France web site.  NOTE: due to the lack of details and uncertainty about which product is affected, this claim is not independently verifiable.
CVSS Score: 10.0 (HIGH)
References: http://securitytracker.com/id?1016332; http://www.securityfocus.com/bid/18522; http://www.zone-h.org/content/view/4770/31/
CVE: CVE-2006-3602
Published: 2006-07-18
Description: Directory traversal vulnerability in jscripts/tiny_mce/tiny_mce_gzip.php in FarsiNews 3.0 BETA 1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the language parameter in the advanced theme.
CVSS Score: 5.0 (MEDIUM)
References: http://forum.farsinewsteam.com/showthread.php?p=16; http://securitytracker.com/id?1016464; http://www.securityfocus.com/archive/1/439664/100/0/threaded
CVE: CVE-2006-3603
Published: 2006-07-18
Description: Cross-site scripting (XSS) vulnerability in index.php in FlexWATCH Network Camera 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20994; http://www.digitalarmaments.com/[PII_REDACTED].html; http://www.securityfocus.com/archive/1/439648/100/0/threaded
CVE: CVE-2006-3604
Published: 2006-07-18
Description: Directory traversal vulnerability in FlexWATCH Network Camera 3.0 and earlier allows remote attackers to bypass access restrictions for (1) admin/aindex.asp or (2) admin/aindex.html via a .. (dot dot) and encoded / (%2f) sequence in the URL.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20994; http://www.digitalarmaments.com/[PII_REDACTED].html; http://www.securityfocus.com/archive/1/439648/100/0/threaded
CVE: CVE-2006-3605
Published: 2006-07-18
Description: Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Transition property on an uninitialized DXImageTransform.Microsoft.RevealTrans.1 ActiveX Object, which triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-13-revealtrans-transition.html; http://www.osvdb.org/27057; http://www.securityfocus.com/bid/18960
CVE: CVE-2006-2450
Published: 2006-07-18
Description: auth.c in LibVNCServer 0.7.1 allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, a different issue than CVE-2006-2369.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=376824; http://libvncserver.cvs.sourceforge.net/libvncserver/libvncserver/libvncserver/auth.c?r1=1.11&r2=1.14&diff_format=u; http://seclists.org/fulldisclosure/2022/May/29
CVE: CVE-2006-3606
Published: 2006-07-18
Description: Unspecified vulnerability in Sun Solaris X Inter Client Exchange library (libICE) on Solaris 8 and 9 allows context-dependent attackers to cause a denial of service (application crash) to applications that use the library.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21048; http://securitytracker.com/id?1016495; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102503-1
CVE: CVE-2006-3607
Published: 2006-07-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the city parameter in (a) insertmember.php, and (2) a PHPSESSID cookie in (b) lostpassword.php, (c) gen_confirm_mem.php, and (d) index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://ellsec.org/print.php?type=N&item_id=141; http://www.securityfocus.com/archive/1/438705/100/200/threaded; http://www.securityfocus.com/bid/18735
CVE: CVE-2006-3608
Published: 2006-07-18
Description: The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled, does not restrict the extensions of uploaded files that begin with a GIF header, which allows remote authenticated users to execute arbitrary PHP code via an uploaded .php file.
CVSS Score: 4.6 (MEDIUM)
References: http://retrogod.altervista.org/flatnuke257_adv.html; http://secunia.com/advisories/21051; http://securitytracker.com/id?1016499
CVE: CVE-2006-3609
Published: 2006-07-18
Description: Cross-site scripting (XSS) vulnerability in index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to inject arbitrary web script or HTML via the page_name parameter with an IMG tag containing a javascript URI in the SRC attribute.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21052; http://securitytracker.com/id?1016490; http://www.securityfocus.com/archive/1/439970/100/0/threaded
CVE: CVE-2006-3610
Published: 2006-07-18
Description: index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to obtain sensitive information (partial database schema) via a modified page_name parameter, which reflects portions of an SQL query in the result.  NOTE: it is not clear whether the information is target-specific. If not, then this issue is not an exposure.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/439970/100/0/threaded; http://www.securityfocus.com/archive/1/439970/100/0/threaded
CVE: CVE-2006-3611
Published: 2006-07-18
Description: Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php.
CVSS Score: 5.5 (MEDIUM)
References: http://retrogod.altervista.org/phorum5_local_incl_xpl.html; http://www.phorum.org/phorum5/read.php?14%2C114358; http://www.securityfocus.com/archive/1/439976/100/0/threaded
CVE: CVE-2006-3612
Published: 2006-07-18
Description: Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.6 (LOW)
References: http://www.phorum.org/phorum5/read.php?14%2C114358; http://www.phorum.org/phorum5/read.php?14%2C114358
CVE: CVE-2006-3613
Published: 2006-07-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Chamberland Technology ezWaiter 3.0 Online and possibly Enterprise Software (aka enterprise edition) allow remote attackers to inject arbitrary web script or HTML via the (1) itemfor (aka "Who is this item for?") and (2) special (aka "Special Instructions") parameters to item.php, which is accessed from showorder.php, or (3) unspecified parameters to the login form at login.php.
CVSS Score: 5.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/438792/100/0/threaded; http://www.securityfocus.com/bid/18746; https://exchange.xforce.ibmcloud.com/vulnerabilities/27587
CVE: CVE-2006-3614
Published: 2006-07-18
Description: index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to trigger a SQL error via the page_name parameter, possibly due to a SQL injection vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21052; http://securitytracker.com/id?1016490; http://www.securityfocus.com/archive/1/439970/100/0/threaded
CVE: CVE-2006-3615
Published: 2006-07-18
Description: Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html; http://archives.neohapsis.com/archives/bugtraq/2006-07/0200.html; http://retrogod.altervista.org/phorum5_local_incl_xpl.html
CVE: CVE-2006-3616
Published: 2006-07-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the show parameter in codes-english.php and (2) the img parameter in picture.php, after the name of an existing file.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21034; http://securitytracker.com/id?1016486; http://www.osvdb.org/27089
CVE: CVE-2006-3617
Published: 2006-07-18
Description: Cross-site scripting (XSS) vulnerability in pblguestbook.php in Pixelated By Lev (PBL) Guestbook 1.32 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) message (aka comments), (3) website, and (4) email parameters, which bypasses XSS protection mechanisms that check for SCRIPT tags but not others, as demonstrated by a javascript URI in an onMouseOver attribute and the src attribute in an iframe tag.  NOTE: some vectors might overlap CVE-2006-2975, although the use of alternate manipulations makes it unclear.
CVSS Score: 5.8 (MEDIUM)
References: http://www.neosecurityteam.net/index.php?action=advisories&id=23; http://www.securityfocus.com/archive/1/439486/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/27006
CVE: CVE-2006-3620
Published: 2006-07-18
Description: Cross-site scripting (XSS) vulnerability in the showtopic module in Koobi Pro CMS 5.6 allows remote attackers to inject arbitrary web script or HTML via the toid parameter.
CVSS Score: 2.6 (LOW)
References: http://securitytracker.com/id?1016485; http://www.securityfocus.com/archive/1/443294/100/100/threaded; http://www.securityfocus.com/bid/18970
CVE: CVE-2006-3621
Published: 2006-07-18
Description: SQL injection vulnerability in the showtopic module in Koobi Pro CMS 5.6 allows remote attackers to execute arbitrary SQL commands via the toid parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1016485; http://www.securityfocus.com/archive/1/443294/100/100/threaded; http://www.securityfocus.com/bid/18970
CVE: CVE-2006-3622
Published: 2006-07-18
Description: The showtopic module in Koobi Pro CMS 5.6 allows remote attackers to obtain sensitive information via a ' (single quote) in the p parameter, which displays the path in an error message.  NOTE: it is not clear whether this is SQL injection or a forced SQL error.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1016485; http://www.securityfocus.com/archive/1/443294/100/100/threaded; http://securitytracker.com/id?1016485
CVE: CVE-2006-3623
Published: 2006-07-18
Description: Directory traversal vulnerability in Framework Service component in McAfee ePolicy Orchestrator agent 3.5.0.x and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the directory and filename in a PropsResponse (PackageType) request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21037; http://securitytracker.com/id?1016501; http://www.eeye.com/html/research/advisories/AD20060713.html
CVE: CVE-2006-3624
Published: 2006-07-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in FLV Players 8 allow remote attackers to inject arbitrary web script or HTML via the url parameter to (1) player.php or (2) popup.php.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/439886/100/0/threaded; http://www.securityfocus.com/bid/18954; https://exchange.xforce.ibmcloud.com/vulnerabilities/27727
CVE: CVE-2006-3625
Published: 2006-07-18
Description: FLV Players 8 allows remote attackers to obtain sensitive information via (1) a direct request to paginate.php or (2) an invalid p parameter to player.php, which reveal the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/439886/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/27726; http://www.securityfocus.com/archive/1/439886/100/0/threaded
CVE: CVE-2006-3626
Published: 2006-07-18
Description: Race condition in Linux kernel 2.6.17.4 and earlier allows local users to gain root privileges by using prctl with PR_SET_DUMPABLE in a way that causes /proc/self/environ to become setuid root.
CVSS Score: 6.2 (MEDIUM)
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.17.5; http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047907.html; http://secunia.com/advisories/21041
CVE: CVE-2006-3618
Published: 2006-07-18
Description: SQL injection vulnerability in pblguestbook.php in Pixelated By Lev (PBL) Guestbook 1.32 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) website, (4) comments, (5) rate, and (6) private parameters.
CVSS Score: 7.5 (HIGH)
References: http://www.neosecurityteam.net/index.php?action=advisories&id=23; http://www.securityfocus.com/archive/1/439486/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/27624
CVE: CVE-2006-3652
Published: 2006-07-18
Description: Microsoft Internet Security and Acceleration (ISA) Server 2004 allows remote attackers to bypass file extension filters via a request with a trailing "#" character.  NOTE: as of 20060715, this could not be reproduced by third parties.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1016506; http://www.securityfocus.com/archive/1/440105/100/0/threaded; http://www.securityfocus.com/archive/1/440247/100/0/threaded
CVE: CVE-2006-3653
Published: 2006-07-18
Description: wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allows remote attackers to cause a denial of service (CPU consumption or crash) via crafted (1) Works, (2) Excel, and (3) Lotus 1-2-3 files.
CVSS Score: 2.6 (LOW)
References: http://securitytracker.com/id?1016504; http://www.securityfocus.com/archive/1/440056/100/0/threaded; http://www.securityfocus.com/bid/18989
CVE: CVE-2006-3654
Published: 2006-07-18
Description: Buffer overflow in wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allows remote attackers to cause a denial of service (CPU consumption or crash) via crafted Excel files.
CVSS Score: 2.6 (LOW)
References: http://securitytracker.com/id?1016504; http://www.securityfocus.com/archive/1/440056/100/0/threaded; http://www.securityfocus.com/bid/18989
CVE: CVE-2006-3655
Published: 2006-07-18
Description: Unspecified vulnerability in mso.dll in Microsoft PowerPoint 2003 allows user-assisted attackers to execute arbitrary code via a crafted PowerPoint file.  NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3656, CVE-2006-3660, and CVE-2006-3590, although it is possible that they are all different.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21061; http://www.osvdb.org/27325; http://www.securityfocus.com/archive/1/440107/100/0/threaded
CVE: CVE-2006-3656
Published: 2006-07-18
Description: Unspecified vulnerability in Microsoft PowerPoint 2003 allows user-assisted attackers to cause memory corruption via a crafted PowerPoint file, which triggers the corruption when the file is closed.  NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3655, CVE-2006-3660, and CVE-2006-3590, although it is possible that they are all different.
CVSS Score: 2.6 (LOW)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/PP2003sp2patched_fr_exploit-method.txt; http://packetstormsecurity.org/0607-exploits/mspp-poc3.txt; http://secunia.com/advisories/21061
CVE: CVE-2006-3657
Published: 2006-07-18
Description: Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (stack overflow exception) via a DXImageTransform.Microsoft.Gradient ActiveX object with a long (1) StartColorStr or (2) EndColorStr property.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-17-dximagetransformmicrosoftgradi.html; http://www.osvdb.org/27109; http://www.securityfocus.com/bid/19029
CVE: CVE-2006-3658
Published: 2006-07-18
Description: Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by accessing the object references of a FolderItem ActiveX object, which triggers a null dereference in the security check.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-15-folderitem-access.html; http://www.osvdb.org/27059; http://www.vupen.com/english/advisories/2006/2814
CVE: CVE-2006-3659
Published: 2006-07-18
Description: Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the location or URL property of a MHTMLFile ActiveX object.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-16-mhtmlfile-location.html; http://www.osvdb.org/27108; http://www.securityfocus.com/bid/19013
CVE: CVE-2006-3660
Published: 2006-07-18
Description: Unspecified vulnerability in Microsoft PowerPoint 2003 has unknown impact and user-assisted attack vectors related to powerpnt.exe. NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3655, CVE-2006-3656, and CVE-2006-3590, although it is possible that they are all different.
CVSS Score: 7.6 (HIGH)
References: http://secunia.com/advisories/21061; http://www.securityfocus.com/archive/1/440106/30/30/threaded; http://www.securityfocus.com/archive/1/440370/100/0/threaded