deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0846
Published: 2006-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Leif M. Wright's Blog 3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) Referer and (2) User-Agent HTTP headers, which are stored in a log file and not sanitized when the administrator views the "Log" page, possibly using the ViewCommentsLog function.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18923; http://securityreason.com/securityalert/522; http://www.evuln.com/vulns/82/summary.html
CVE: CVE-2006-0847
Published: 2006-02-22
Description: Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://groups.google.com/group/cherrypy-announce/browse_thread/thread/92b2972f774fe6df/2f63afc9433dc306#2f63afc9433dc306; http://secunia.com/advisories/18944; http://secunia.com/advisories/20344
CVE: CVE-2006-0848
Published: 2006-02-22
Description: The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which automatically interprets the script using bash, as demonstrated using a ZIP file that contains a script with a safe file extension.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-16
References: http://docs.info.apple.com/article.html?artnum=303382; http://secunia.com/advisories/18963; http://securitytracker.com/id?1015652
CVE: CVE-2006-0850
Published: 2006-02-23
Description: SQL injection vulnerability in include/includes/user/login.php in ilchClan before 1.05g allows remote attackers to execute arbitrary SQL commands via the login_name parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18951; http://www.ilch.de/news-134.html; http://www.osvdb.org/23370
CVE: CVE-2006-0851
Published: 2006-02-23
Description: SQL injection vulnerability in the forum module of ilchClan 1.05g and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter, when creating a newpost.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18951; http://www.osvdb.org/23369; http://www.securityfocus.com/bid/16735
CVE: CVE-2006-0852
Published: 2006-02-23
Description: Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via the X-Forwarded-For HTTP header field, which is inserted into content-data.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18930; http://www.securityfocus.com/bid/16753; http://www.vupen.com/english/advisories/2006/0663
CVE: CVE-2006-0853
Published: 2006-02-23
Description: Buffer overflow in the IMAP service of TrueNorth Internet Anywhere (IA) eMailserver 5.3.4 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long SEARCH argument.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/18986; http://securitytracker.com/id?1015664; http://www.osvdb.org/23377
CVE: CVE-2006-0854
Published: 2006-02-23
Description: PHP remote file inclusion vulnerability in common.php in Intensive Point iUser Ecommerce allows remote attackers to include arbitrary files via a URL in the include_path variable, which is not initialized before being used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0339.html; http://secunia.com/advisories/18903; http://www.osvdb.org/23429
CVE: CVE-2006-0803
Published: 2006-02-23
Description: The signature verification functionality in the YaST Online Update (YOU) script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used.
CVSS Score: 5.0 (MEDIUM)
References: http://www.novell.com/linux/security/advisories/2006_09_gpg.html; http://www.novell.com/linux/security/advisories/2006_13_gpg.html; http://www.securityfocus.com/bid/16889
CVE: CVE-2006-0812
Published: 2006-02-23
Description: The VisNetic AntiVirus Plug-in (DKAVUpSch.exe) for Mail Server 4.6.0.4, 4.6.1.1, and possibly other versions before 4.6.1.2, does not drop privileges before executing other programs, which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/16583; http://secunia.com/secunia_research/2005-65/advisory/; http://securitytracker.com/id?1015670
CVE: CVE-2006-0720
Published: 2006-02-23
Description: Stack-based buffer overflow in Nullsoft Winamp 5.12 and 5.13 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .m3u file that causes an incorrect strncpy function call when the player pauses or stops the file.
CVSS Score: 7.6 (HIGH)
References: http://forums.winamp.com/showthread.php?threadid=238648; http://securityreason.com/securityalert/476; http://securitytracker.com/id?1015675
CVE: CVE-2006-0855
Published: 2006-02-23
Description: Stack-based buffer overflow in the fullpath function in misc.c for zoo 2.10 and earlier, as used in products such as Barracuda Spam Firewall, allows user-assisted attackers to execute arbitrary code via a crafted ZOO file that causes the combine function to return a longer string than expected.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0061.html; http://secunia.com/advisories/19002; http://secunia.com/advisories/19130
CVE: CVE-2006-0856
Published: 2006-02-23
Description: SQL injection vulnerability in login.php in Scriptme SmE GB Host 1.21 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the Username parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18823; http://www.evuln.com/vulns/66/summary.html; http://www.securityfocus.com/archive/1/425317/100/0/threaded
CVE: CVE-2006-0857
Published: 2006-02-23
Description: Cross-site scripting (XSS) vulnerability in Chatbox Plugin 1.0 in e107 0.7.2 allows remote attackers to inject arbitrary HTML or web script via a Chatbox, as demonstrated using a SCRIPT element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/425388/100/0/threaded; http://www.securityfocus.com/bid/16719; https://exchange.xforce.ibmcloud.com/vulnerabilities/24815
CVE: CVE-2006-0858
Published: 2006-02-23
Description: Unquoted Windows search path vulnerability in (1) snsmcon.exe, (2) the autostartup mechanism, and (3) an unspecified installation component in StarForce Safe'n'Sec Personal + Anti-Spyware 2.0 and earlier, and possibly other StarForce Safe'n'Sec products, might allow local users to gain privileges via a malicious "program" file in the C: folder.
CVSS Score: 7.2 (HIGH)
References: http://secdev.zoller.lu/research/safnsec.htm; http://www.securityfocus.com/archive/1/425504/100/0/threaded; http://www.securityfocus.com/bid/16762
CVE: CVE-2006-0859
Published: 2006-02-23
Description: Michael Salzer Guestbox 0.6, and other versions before 0.8, allows remote attackers to post an admin comment to a guestbook entry via a certain modified form, possibly related to the nummer parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/18946; http://www.osvdb.org/23374; http://www.securityfocus.com/archive/1/425495/100/0/threaded
CVE: CVE-2006-0860
Published: 2006-02-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Michael Salzer Guestbox 0.6, and other versions before 0.8, allow remote attackers to inject arbitrary web script or HTML via (1) HTML tags that follow a "http://" string, which bypasses a regular expression check, and (2) other unspecified attack vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/18946; http://www.osvdb.org/23375; http://www.securityfocus.com/archive/1/425495/100/0/threaded
CVE: CVE-2006-0861
Published: 2006-02-23
Description: Michael Salzer Guestbox 0.6, and other versions before 0.8, allows remote attackers to obtain the source IP addresses of guestbook entries via a direct request to /gb/gblog.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/18946; http://securityreason.com/securityalert/460; http://www.osvdb.org/23376
CVE: CVE-2006-0862
Published: 2006-02-23
Description: Unspecified vulnerability in InfoVista PortalSE 2.0 Build 20087 on Solaris 8 without the IV00038969 hotfix allows remote attackers to read arbitrary files via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18994; http://securitytracker.com/id?1015669; http://www.irmplc.com/advisory017.htm
CVE: CVE-2006-0863
Published: 2006-02-23
Description: InfoVista PortalSE 2.0 Build 20087 on Solaris 8 allows remote attackers to obtain sensitive information by specifying a nonexistent server in the server field, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18994; http://securityreason.com/securityalert/473; http://securitytracker.com/id?1015669
CVE: CVE-2006-0864
Published: 2006-02-23
Description: filescan in Global Hauri ViRobot 2.0 20050817 does not verify the Cookie HTTP header, which allows remote attackers to gain administrative privileges via an arbitrary cookie value.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18974; http://securitytracker.com/id?1015658; http://www.securityfocus.com/archive/1/425788/100/0/threaded
CVE: CVE-2006-0865
Published: 2006-02-23
Description: PunBB 1.2.10 and earlier allows remote attackers to cause a denial of service (resource consumption) by registering many user accounts quickly.
CVSS Score: 5.0 (MEDIUM)
References: http://www.neosecurityteam.net/advisories/Advisory-15.txt; http://www.securityfocus.com/archive/1/425630/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24837
CVE: CVE-2006-0866
Published: 2006-02-23
Description: PunBB 1.2.10 and earlier allows remote attackers to conduct brute force guessing attacks for an account's password, which may be as short as 4 characters.
CVSS Score: 5.0 (MEDIUM)
References: http://www.neosecurityteam.net/advisories/Advisory-15.txt; http://www.securityfocus.com/archive/1/425630/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24838
CVE: CVE-2006-0867
Published: 2006-02-23
Description: Buffer overflow in certain versions of South River (aka SRT) WebDrive, possibly version 6.08 build 1131 and version 8, allows remote attackers to cause a denial of service (application crash and persistent erratic behavior) via a long string in the name entry field.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/425785/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24903; http://www.securityfocus.com/archive/1/425785/100/0/threaded
CVE: CVE-2006-0868
Published: 2006-02-23
Description: Multiple unspecified injection vulnerabilities in unspecified Auth Container back ends for PEAR::Auth before 1.2.4, and 1.3.x before 1.3.0r4, allow remote attackers to "falsify authentication credentials," related to the "underlying storage containers."
CVSS Score: 7.5 (HIGH)
References: http://pear.php.net/package/Auth/download/1.2.4; http://pear.php.net/package/Auth/download/1.3.0r4; http://secunia.com/advisories/19008
CVE: CVE-2006-0869
Published: 2006-02-23
Description: Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository (PEAR) LiveUser 0.16.8 and earlier allows remote attackers to determine file existence, and possibly delete arbitrary files with short pathnames or possibly read arbitrary files, via a .. (dot dot) in the store_id value of a cookie.
CVSS Score: 6.4 (MEDIUM)
References: http://pear.php.net/package/LiveUser/download/; http://securityreason.com/securityalert/466; http://securitytracker.com/id?1015659
CVE: CVE-2006-0870
Published: 2006-02-23
Description: SQL injection vulnerability in pages.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: version 2.3 was later reported to be vulnerable as well.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18439; http://www.nukedx.com/?viewdoc=9; http://www.osvdb.org/23438
CVE: CVE-2006-0188
Published: 2006-02-24
Description: webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter.  NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS.
CVSS Score: 4.3 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://secunia.com/advisories/18985; http://secunia.com/advisories/19130
CVE: CVE-2006-0195
Published: 2006-02-24
Description: Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/*" and "*/" comments, or (2) a newline in a "url" specifier, which is processed by certain web browsers including Internet Explorer.
CVSS Score: 4.3 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://secunia.com/advisories/18985; http://secunia.com/advisories/19130
CVE: CVE-2006-0300
Published: 2006-02-24
Description: Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute code via unspecified vectors involving PAX extended headers.
CVSS Score: 5.1 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305214; http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html
CVE: CVE-2006-0377
Published: 2006-02-24
Description: CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection."
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://secunia.com/advisories/18985; http://secunia.com/advisories/19130
CVE: CVE-2006-0813
Published: 2006-02-24
Description: Heap-based buffer overflow in WinACE 2.60 allows user-assisted attackers to execute arbitrary code via a large header block in an ARJ archive.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/17251; http://secunia.com/secunia_research/2005-67/advisory/; http://securityreason.com/securityalert/479
CVE: CVE-2006-0871
Published: 2006-02-24
Description: Directory traversal vulnerability in the _setTemplate function in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to read and include arbitrary files via the mos_change_template parameter.  NOTE: CVE-2006-1794 has been assigned to the SQL injection vector.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0463.html; http://secunia.com/advisories/18935; http://securityreason.com/securityalert/493
CVE: CVE-2006-0872
Published: 2006-02-24
Description: Directory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the lang parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://coppermine-gallery.net/forum/index.php?topic=28062.0; http://retrogod.altervista.org/cpg_143_adv.html; http://retrogod.altervista.org/cpg_143_incl_xpl.html
CVE: CVE-2006-0873
Published: 2006-02-24
Description: Absolute path traversal vulnerability in docs/showdocs.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via the f parameter, and possibly remote files using UNC share pathnames.
CVSS Score: 5.0 (MEDIUM)
References: http://coppermine-gallery.net/forum/index.php?topic=28062.0; http://retrogod.altervista.org/cpg_143_adv.html; http://secunia.com/advisories/18941
CVE: CVE-2006-0874
Published: 2006-02-24
Description: Multiple unspecified vulnerabilities in Intensive Point iUser Ecommerce before 2.2 have unspecified vectors and impact, as addressed by "Urgent secure fixes".  NOTE: this might be a duplicate of CVE-2006-0854, but the vendor announcement for this issue (from January 8, 2005) is too vague to be sure, and CVE-2006-0854 does not provide version information.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/19003; http://www.intensivepoint.com/iuser-document.shtml; http://www.securityfocus.com/bid/16787
CVE: CVE-2006-0875
Published: 2006-02-24
Description: Cross-site scripting vulnerability in ratefile.php in RunCMS 1.3a5 allows remote attackers to inject arbitrary web script or HTML via the lid parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://kapda.ir/advisory-267.html; http://secunia.com/advisories/18997; http://securitytracker.com/id?1015663
CVE: CVE-2006-0876
Published: 2006-02-24
Description: POPFile before 0.22.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving character sets within e-mail messages.
CVSS Score: 5.0 (MEDIUM)
References: http://popfile.sourceforge.net/cgi-bin/wiki.pl?ReleaseNotes/0.22.4; http://secunia.com/advisories/18975; http://secunia.com/advisories/20205
CVE: CVE-2006-0877
Published: 2006-02-24
Description: Cross-site scripting vulnerability in Easy Forum 2.5 allows remote attackers to inject arbitrary web script or HTML via the image variable.
CVSS Score: 5.0 (MEDIUM)
References: http://evuln.com/vulns/85/summary.html; http://hot-things.net/forum/show.php?f=2&topic=[PII_REDACTED]0919; http://secunia.com/advisories/18996
CVE: CVE-2006-0878
Published: 2006-02-24
Description: Noah's Classifieds 1.3 allows remote attackers to obtain the installation path via a direct request to include files, as demonstrated by classifieds/gorum/category.php.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1015667; http://www.kapda.ir/advisory-268.html; http://www.securityfocus.com/archive/1/425783/100/0/threaded
CVE: CVE-2006-0879
Published: 2006-02-24
Description: SQL injection vulnerability in the search tool in Noah's Classifieds 1.3 allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1015667; http://www.kapda.ir/advisory-268.html; http://www.securityfocus.com/archive/1/425783/100/0/threaded
CVE: CVE-2006-0880
Published: 2006-02-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Noah's Classifieds 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) inf parameter; or, when register_globals is enabled, the (2) upperTemplate and (3) lowerTemplate parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1015667; http://www.kapda.ir/advisory-268.html; http://www.securityfocus.com/archive/1/425783/100/0/threaded
CVE: CVE-2006-0881
Published: 2006-02-24
Description: Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when register_globals is enabled, allow remote attackers to include arbitrary PHP files via the (1) upperTemplate and (2) lowerTemplate parameters, as demonstrated using the lowerTemplate parameter to index.php.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1015667; http://www.kapda.ir/advisory-268.html; http://www.securityfocus.com/archive/1/425783/100/0/threaded
CVE: CVE-2006-0882
Published: 2006-02-24
Description: Directory traversal vulnerability in include.php in Noah's Classifieds 1.3 allows remote attackers to include arbitrary local files via the otherTemplate parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1015667; http://www.kapda.ir/advisory-268.html; http://www.securityfocus.com/archive/1/425783/100/0/threaded
CVE: CVE-2006-0884
Published: 2006-02-24
Description: The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-0885
Published: 2006-02-25
Description: Cross-site scripting (XSS) vulnerability in show_news.php in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the show parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://myimei.com/security/2006-02-20/cutenews141addcommentforprotectedusernamesxss-attack.html; http://secunia.com/advisories/18981; http://www.osvdb.org/23400
CVE: CVE-2006-0886
Published: 2006-02-25
Description: Cross-site scripting (XSS) vulnerability in register.php in DEV web management system 1.5 allows remote attackers to inject arbitrary web script or HTML via the "City/Region" field (mesto variable).  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18714; http://www.osvdb.org/23468; http://www.securityfocus.com/bid/16812
CVE: CVE-2006-0887
Published: 2006-02-25
Description: Eval injection vulnerability in sessions.inc in PHP Base Library (PHPLib) before 7.4a, when index.php3 from the PHPLib distribution is available on the server, allows remote attackers to execute arbitrary PHP code by including a base64-encoded representation of the code in a cookie.  NOTE: this description was significantly updated on 20060605 to reflect new details after an initial vague advisory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/16902; http://securitytracker.com/id?1016123; http://sourceforge.net/project/shownotes.php?group_id=31885&release_id=396091
CVE: CVE-2006-0888
Published: 2006-02-25
Description: index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unspecified denial of service by registering a large number of users.
CVSS Score: 2.6 (LOW)
References: http://www.securityfocus.com/bid/16616; https://www.exploit-db.com/exploits/1489; http://www.securityfocus.com/bid/16616
CVE: CVE-2006-0889
Published: 2006-02-25
Description: Cross-site scripting (XSS) vulnerability in Calcium 3.10.1 allows remote attackers to inject arbitrary web script or HTML via the EventText parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19007; http://www.osvdb.org/23471; http://www.securityfocus.com/bid/16851
CVE: CVE-2006-0890
Published: 2006-02-25
Description: Directory traversal vulnerability in SpeedProject Squeez 5.1, as used in (1) ZipStar 5.1 and (2) SpeedCommander 11.01.4450, allows remote attackers to overwrite arbitrary files via unspecified manipulations in a (1) JAR or (2) ZIP archive.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19006; http://www.osvdb.org/23465; http://www.securityfocus.com/archive/1/425973/100/0/threaded