deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3030
Published: 2006-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in DwZone Shopping Cart 1.1.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ToCategory and (2) FromCategory parameters to (a) ProductDetailsForm.asp and (3) UserName and (4) Password parameters to (b) LogIn/VerifyUserLog.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/dwzone-shopping-cart-xss-vuln.html; http://secunia.com/advisories/20603; http://www.osvdb.org/26401
CVE: CVE-2006-3031
Published: 2006-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.asp in fipsCMS 4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) w, (2) phcat, (3) dayid, and (4) calw parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/fipscms-v45-xss-vuln.html; http://secunia.com/advisories/20617; http://www.vupen.com/english/advisories/2006/2293
CVE: CVE-2006-3032
Published: 2006-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Xtreme ASP Photo Gallery 1.05 and earlier, and possibly 2.0 (trial), allow remote attackers to inject arbitrary web script or HTML via the (1) catname and (2) total parameters in (a) displaypic.asp, and the (3) catname parameter in (b) displaythumbs.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/xtreme-asp-photo-gallery-xss-vuln.html; http://secunia.com/advisories/20604; http://www.osvdb.org/26398
CVE: CVE-2006-3033
Published: 2006-06-15
Description: Cross-site scripting (XSS) vulnerability in MyScrapbook 3.1 allows remote attackers to inject arbitrary web script or HTML via the input box in singlepage.php when submitting scrapbook pages.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20599; http://www.osvdb.org/26413; http://www.securityfocus.com/archive/1/436792/100/0/threaded
CVE: CVE-2006-3034
Published: 2006-06-15
Description: MyScrapbook 3.1 allows remote attackers to obtain sensitive information via a direct request to files in the txt-db-api directory such as txt-db-api/sql.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20599; http://www.osvdb.org/26414; http://www.securityfocus.com/archive/1/436792/100/0/threaded
CVE: CVE-2006-3035
Published: 2006-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in addwords.php in MyScrapbook 3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) comment parameters.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.8 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/2311; http://www.vupen.com/english/advisories/2006/2311
CVE: CVE-2006-3036
Published: 2006-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) imgdir parameter in (a) index.php, and the (2) w, (3) h, and (4) t parameters in (b) popup.php.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20652; http://securityreason.com/securityalert/1100; http://www.osvdb.org/26507
CVE: CVE-2006-3037
Published: 2006-06-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in publish.php in ST AdManager Lite allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) description, (3) article, (4) bio, and (5) name parameters.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20598; http://www.securityfocus.com/archive/1/436657/30/0/threaded; http://www.vupen.com/english/advisories/2006/2303
CVE: CVE-2006-3038
Published: 2006-06-15
Description: Cross-site scripting (XSS) vulnerability in index.php in Cescripts Realty Room Rent allows remote attackers to inject arbitrary web script or HTML via the sel_menu parameter.  NOTE: the vendor notified CVE on 20060823 that "All issues concerning this script and others at cescripts.com have been addressed and fixed."
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20586; http://www.attrition.org/pipermail/vim/2006-August/000983.html; http://www.securityfocus.com/archive/1/436805
CVE: CVE-2006-3039
Published: 2006-06-15
Description: Cross-site scripting (XSS) vulnerability in index.php in Cescripts Realty Home Rent allows remote attackers to inject arbitrary web script or HTML via the sel_menu parameter.  NOTE: the vendor notified CVE on 20060823 that "All issues concerning this script and others at cescripts.com have been addressed and fixed."
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20584; http://www.attrition.org/pipermail/vim/2006-August/000983.html; http://www.securityfocus.com/archive/1/436805
CVE: CVE-2006-3040
Published: 2006-06-15
Description: PHP remote file inclusion vulnerability in talkbox.php in Amr Talkbox allows remote attackers to execute arbitrary PHP code via a URL in the direct parameter.  NOTE: this issue has been disputed by CVE, since the $direct variable is set to a static value just before the include statement
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1105; http://www.osvdb.org/27455; http://www.securityfocus.com/archive/1/436993/100/0/threaded
CVE: CVE-2006-3041
Published: 2006-06-15
Description: PHP remote file inclusion vulnerability in Ltwcalendar/calendar.php in Codewalkers Ltwcalendar 4.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the ltw_config[include_dir] parameter. NOTE: CVE disputes this claim, since the $ltw_config[include_dir] variable is defined as a static value in an include file before it is referenced in an include() statement
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1099; http://www.attrition.org/pipermail/vim/2006-June/000866.html; http://www.osvdb.org/27452
CVE: CVE-2006-3042
Published: 2006-06-15
Description: Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][classes_root] parameter in (a) server.inc.php, and the (2) go_info[server][classes_root] parameter in (b) app.inc.php, (c) login.php, and (d) trylogin.php.  NOTE: this issue has been disputed by the vendor, who states that the original researcher "reviewed the installation tarball that is not identical with the resulting system after installtion.  The file, where the $go_info array is declared ... is created by the installer.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1098; http://www.osvdb.org/27474; http://www.securityfocus.com/archive/1/437117/100/0/threaded
CVE: CVE-2006-2909
Published: 2006-06-16
Description: Stack-based buffer overflow in the info tip shell extension (zipinfo.dll) in PicoZip 4.01 allows remote attackers to execute arbitrary code via a long filename in an (1) ACE, (2) RAR, or (3) ZIP archive, which is triggered when the user moves the mouse over the archive.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20481; http://secunia.com/secunia_research/2006-42/advisory/; http://securityreason.com/securityalert/1104
CVE: CVE-2006-3043
Published: 2006-06-16
Description: Cross-site scripting (XSS) vulnerability in search.cfm in CreaFrameXe (CFXe) CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the voltext_suche parameter.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0149.html; http://secunia.com/advisories/20582; http://securitytracker.com/id?1016277
CVE: CVE-2006-3044
Published: 2006-06-16
Description: Cross-site scripting (XSS) vulnerability in LogiSphere 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected in an error page.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20578; http://securitytracker.com/id?1016268; http://www.osvdb.org/26324
CVE: CVE-2006-3045
Published: 2006-06-16
Description: PHP remote file inclusion vulnerability in manage_songs.php in Foing 0.7.0e and earlier allows remote attackers to execute arbitrary PHP code via a URL in the foing_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/436793/100/0/threaded; http://www.securityfocus.com/bid/18392; https://exchange.xforce.ibmcloud.com/vulnerabilities/27191
CVE: CVE-2006-3046
Published: 2006-06-16
Description: Unspecified vulnerability in the admin login feature in Subtext 1.5, in a multiblog setup, allows remote administrators of one blog to login to another blog.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/20580; http://sourceforge.net/project/shownotes.php?release_id=423716; http://www.vupen.com/english/advisories/2006/2295
CVE: CVE-2006-3047
Published: 2006-06-16
Description: Cross-site scripting (XSS) vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20648; http://secunia.com/advisories/20850; http://securityreason.com/securityalert/1102
CVE: CVE-2006-3048
Published: 2006-06-16
Description: SQL injection vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/20648; http://secunia.com/advisories/20850; http://securityreason.com/securityalert/1102
CVE: CVE-2006-3049
Published: 2006-06-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in booking3.php in Mole Group Ticket Booking Script allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) address1, (3) address2, (4) county, (5) postcode, (6) email, (7) phone, or (8) mobile parameters to booking2.php.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0111.html; http://secunia.com/advisories/20612; http://www.attrition.org/pipermail/vim/2006-June/000868.html
CVE: CVE-2006-3050
Published: 2006-06-16
Description: Directory traversal vulnerability in detail.php in SixCMS 6.0, and other versions before 6.0.6patch2, allows remote attackers to read arbitrary files via a ..  (dot dot) sequence and trailing null (%00) byte in the template parameter.
CVSS Score: 2.6 (LOW)
References: http://securityreason.com/securityalert/1101; http://securitytracker.com/id?1016282; http://www.majorsecurity.de/advisory/major_rls17.txt
CVE: CVE-2006-3051
Published: 2006-06-16
Description: Cross-site scripting (XSS) vulnerability in list.php in SixCMS 6.0, and other versions before 6.0.6patch2, allows remote attackers to inject arbitrary script code or HTML via the page parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20655; http://securityreason.com/securityalert/1101; http://securitytracker.com/id?1016282
CVE: CVE-2006-3052
Published: 2006-06-16
Description: Cross-site scripting (XSS) vulnerability in Event Registration allows remote attackers to inject arbitrary web script or HTML via the (1) event_id parameter to view-event-details.php or (2) select_events parameter to event-registration.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20640; http://www.osvdb.org/26490; http://www.osvdb.org/26491
CVE: CVE-2006-3053
Published: 2006-06-16
Description: PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter.  NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum."  CVE analysis concurs with the vendor
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1103; http://www.securityfocus.com/archive/1/436863/100/0/threaded; http://www.securityfocus.com/archive/1/437988/100/0/threaded
CVE: CVE-2006-3054
Published: 2006-06-16
Description: Multiple SQL injection vulnerabilities in VBZooM 1.11 allow remote attackers to execute arbitrary SQL commands via the (1) sobjectID or (2) MAINID parameters to (a) show.php or (3) MainID parameter to (b) subject.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/436938/100/0/threaded; http://www.securityfocus.com/archive/1/436940/100/0/threaded; http://www.securityfocus.com/bid/18403
CVE: CVE-2006-3055
Published: 2006-06-16
Description: Multiple SQL injection vulnerabilities in VBZooM 1.02 allow remote attackers to execute arbitrary SQL commands via the (1) QuranID, (2) ShowByQuranID, or (3) Action parameters to meaning.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/436939/100/0/threaded; http://www.securityfocus.com/bid/18403; https://exchange.xforce.ibmcloud.com/vulnerabilities/27170
CVE: CVE-2006-3056
Published: 2006-06-16
Description: SQL injection vulnerability in language.php in VBZooM 1.01 allows remote attackers to execute arbitrary SQL commands via the Action parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/436946/100/0/threaded; http://www.securityfocus.com/bid/18403; https://exchange.xforce.ibmcloud.com/vulnerabilities/27169
CVE: CVE-2006-3057
Published: 2006-06-16
Description: Unspecified vulnerability in NetworkManager daemon for DHCP (dhcdbd) allows remote attackers to cause a denial of service (crash) via certain invalid DHCP responses that trigger memory corruption.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20754; http://secunia.com/advisories/20899; http://www.novell.com/linux/security/advisories/2006_38_security.html
CVE: CVE-2006-3059
Published: 2006-06-17
Description: Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors.  NOTE: this is a different vulnerability than CVE-2006-3086.
CVSS Score: 9.3 (HIGH)
References: http://blogs.securiteam.com/?p=451; http://blogs.technet.com/msrc/archive/2006/06/16/436174.aspx; http://isc.sans.org/diary.php?storyid=1420
CVE: CVE-2006-3012
Published: 2006-06-19
Description: SQL injection vulnerability in phpBannerExchange before 2.0 Update 6 allows remote attackers to execute arbitrary SQL commands via the (1) login parameter in (a) client/stats.php and (b) admin/stats.php, or the (2) pass parameter in client/stats.php.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046954.html; http://www.eschew.net/scripts/phpbe/2.0/releasenotes.php; http://www.osvdb.org/26510
CVE: CVE-2006-3013
Published: 2006-06-19
Description: Interpretation conflict in resetpw.php in phpBannerExchange before 2.0 Update 6 allows remote attackers to execute arbitrary SQL commands via an email parameter containing a null (%00) character after a valid e-mail address, which passes the validation check in the eregi PHP command.  NOTE: it could be argued that this vulnerability is due to a bug in the eregi PHP command and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpBannerExchange.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046953.html; http://secunia.com/advisories/20687; http://www.eschew.net/scripts/phpbe/2.0/releasenotes.php
CVE: CVE-2006-3060
Published: 2006-06-19
Description: Cross-site scripting (XSS) vulnerability in P.A.I.D 2.2 allows remote attackers to inject arbitrary web script or HTML via the (1) read parameter in index.php, (2) farea parameter in faq.php, and (3) unspecified input fields on the "My Account" login page.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20601; http://securityreason.com/securityalert/1108; http://www.securityfocus.com/archive/1/436650/100/0/threaded
CVE: CVE-2006-3061
Published: 2006-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in 5 Star Review allow remote attackers to inject arbitrary web script or HTML via the (1) sort parameter in index2.php, (2) item_id parameter in report.php, (3) search_term parameter (aka the "search box") in search_reviews.php, (4) the profile field in usercp/profile_edit1.php, and the (5) review field in review_form.php.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/20613; http://securityreason.com/securityalert/1107; http://www.osvdb.org/26496
CVE: CVE-2006-3062
Published: 2006-06-19
Description: Cross-site scripting (XSS) vulnerability in index.php in myPHP Guestbook 2.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20572; http://securityreason.com/securityalert/1110; http://www.securityfocus.com/archive/1/436842/100/0/threaded
CVE: CVE-2006-3063
Published: 2006-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in myPHP Guestbook 1.x through 2.0.0-r1 and before 2.0.1 RC5 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) email, (3) homepage, (4) id, (5) name, and (6) text parameters in (a) index.php, the (7) comment, (8) email, (9) homepage, (10) number, (11) name, and (12) text parameters in (b) admin/guestbook.php, and the (13) email, (14) homepage, (15) icq, (16) name, and (17) text parameters in (c) admin/edit.php.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20764; http://www.networkarea.ch/forum/topic.php?id=4&s=9106beea248ecd1a552439168ada227e; http://www.securityfocus.com/bid/18582
CVE: CVE-2006-3064
Published: 2006-06-19
Description: SQL injection vulnerability in the add_hit function in include/function.inc.php in Coppermine Photo Gallery (CPG) 1.4.8, when "Keep detailed hit statistics" is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) referer and (2) user-agent HTTP headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://myimei.com/security/2006-06-11/copperminephotogallery148-addhit-function-sqlinjection-attack.html; http://secunia.com/advisories/20597; http://www.securityfocus.com/archive/1/436799/30/4470/threaded
CVE: CVE-2006-3065
Published: 2006-06-19
Description: SQL injection vulnerability in engine/shards/blog.php in blur6ex 0.3.462 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a proc_reply action in the blog shard.  NOTE: This is a similar vulnerability to CVE-2006-1763, but the affected code and versions are different.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20646; http://securityreason.com/securityalert/1113; http://www.securityfocus.com/archive/1/437015/100/0/threaded
CVE: CVE-2006-3066
Published: 2006-06-19
Description: Buffer overflow in the TCP/IP listener in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allows remote attackers to cause a denial of service (application crash) via a long MGRLVLLS message inside of an EXCSAT message when establishing a connection.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20579; http://www-1.ibm.com/support/docview.wss?uid=swg1IY84096; http://www.osvdb.org/29861
CVE: CVE-2006-3067
Published: 2006-06-19
Description: Multiple unspecified vulnerabilities in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allow remote attackers to cause a denial of service (application crash) via a (1) "long column list" in the (a) REPLACE INTO and (b) INSERT INTO portions of the LOAD command or a (2) large number of values in an IN clause, possibly related to a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20579; http://www-1.ibm.com/support/docview.wss?uid=swg1IY76767; http://www-1.ibm.com/support/docview.wss?uid=swg1IY82725
CVE: CVE-2006-3068
Published: 2006-06-19
Description: IBM DB2 Universal Database (UDB) before 8.2 FixPak 12 allows remote attackers to cause a denial of service (application crash) by sending "incorrect information ... regarding the package name/creator," which leads to a "memory overwrite."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/20579; http://www-1.ibm.com/support/docview.wss?uid=swg1IY79204; http://www.osvdb.org/29862
CVE: CVE-2006-3069
Published: 2006-06-19
Description: PHP remote file inclusion vulnerability in DoubleSpeak 0.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the config[private] parameter in multiple files, as demonstrated by (1) index.php, (2) faq.php, and (3) hardware.php. NOTE: this issue has been disputed by multiple third-party researchers, who state that config[private] is initialized in an include file before being used
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0184.html; http://attrition.org/pipermail/vim/2006-July/000935.html; http://securitytracker.com/id?1016278
CVE: CVE-2006-3070
Published: 2006-06-19
Description: write_ok.php in Zeroboard 4.1 pl8, when installed on Apache with mod_mime, allows remote attackers to bypass restrictions for uploading files with executable extensions by uploading a .htaccess file that with an AddType directive that assigns an executable module to files with assumed-safe extensions, as demonstrated by assigning the txt extension to be handled by application/x-httpd-php.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1726&w=2; http://secunia.com/advisories/20592; http://securecast.wins21.com/zerovul.html
CVE: CVE-2006-3071
Published: 2006-06-19
Description: Cross-site scripting (XSS) vulnerability in index.php in MP3 Search/Archive 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter, as used by the "search box", and (2) res parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20664; http://securityreason.com/securityalert/1112; http://www.osvdb.org/26530
CVE: CVE-2006-3072
Published: 2006-06-19
Description: M4 Macro Library in Symantec Security Information Manager before 4.0.2.29 HOTFIX 1 allows local users to execute arbitrary commands via crafted "rule definitions", which produces dangerous Java code during M4 transformation.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/20647; http://securityresponse.symantec.com/avcenter/security/Content/2006.06.13b.html; http://securitytracker.com/id?1016296
CVE: CVE-2006-3073
Published: 2006-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA), when in WebVPN clientless mode, allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) dnserror.html and (2) connecterror.html, aka bugid CSCsd81095 (VPN3k) and CSCse48193 (ASA). NOTE: the vendor states that "WebVPN full-network-access mode" is not affected, despite the claims by the original researcher.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20644; http://securitytracker.com/id?1016252; http://www.cisco.com/warp/public/707/cisco-sr-20060613-webvpn-xss.shtml