deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4612
Published: 2006-09-07
Description: SQL injection vulnerability in ReplyNew.asp in ZIXForum 1.12 allows remote attackers to execute arbitrary SQL commands via the RepId parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21766; http://securityreason.com/securityalert/1507; http://securitytracker.com/id?1016796
CVE: CVE-2006-4613
Published: 2006-09-07
Description: Multiple unspecified vulnerabilities in SnapGear before 3.1.4u1 allow remote attackers to cause a denial of service via unspecified vectors involving (1) IPSec replay windows and (2) the use of vulnerable versions of ClamAV before 0.88.4.  NOTE: it is possible that vector 2 is related to CVE-2006-4018.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/21707; http://www.cyberguard.info/snapgear/releases.html; http://www.securityfocus.com/bid/19805
CVE: CVE-2006-4614
Published: 2006-09-07
Description: PDAapps Verichat for Pocket PC 1.30bh stores usernames and passwords in plaintext in the Windows Mobile registry, which allows local users to obtain sensitive information via keys under \HKEY_CURRENT_USER\Software\PDAapps\VeriChat.
CVSS Score: 4.9 (MEDIUM)
References: http://airscanner.com/security/05081201_verichat.htm; http://securityreason.com/securityalert/1504; http://securitytracker.com/id?1016786
CVE: CVE-2006-4615
Published: 2006-09-07
Description: Shape Services IM+ Mobile Instant Messenger for Pocket PC 3.10 stores usernames and passwords in plaintext in %PROGRAMFILES%\IMPlus\implus.cfg, which allows local users to obtain sensitive information by reading the file.
CVSS Score: 4.9 (MEDIUM)
References: http://airscanner.com/security/05081701_implus.htm; http://securityreason.com/securityalert/1518; http://www.securityfocus.com/archive/1/445082/100/0/threaded
CVE: CVE-2006-4616
Published: 2006-09-07
Description: SMTP service in MailEnable Standard, Professional, and Enterprise before ME-10014 (20060904) allows remote attackers to cause a denial of service via an SPF lookup for a domain with a large number of records, which triggers a null pointer exception.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21998; http://securitytracker.com/id?1016792; http://www.mailenable.com/hotfix/
CVE: CVE-2006-4617
Published: 2006-09-07
Description: Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/28459; http://www.security-net.biz/adv/D3906a.txt; http://www.osvdb.org/28459
CVE: CVE-2006-4618
Published: 2006-09-07
Description: PHP remote file inclusion vulnerability in adodb-postgres7.inc.php in John Lim ADOdb, possibly 4.01 and earlier, as used in Intechnic In-link 2.3.4, allows remote attackers to execute arbitrary PHP code via a URL in the ADODB_DIR parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://adodb.cvs.sourceforge.net/adodb/adodb_official/adodb-postgres7.inc.php?revision=1.1&view=markup; http://prdownloads.sourceforge.net/adodb/adodb492.tgz?download; http://securityreason.com/securityalert/1517
CVE: CVE-2006-4619
Published: 2006-09-07
Description: The start update window in update.exe in Avira AntiVir PersonalEdition Classic 7.0 build 151 allows local users to gain system privileges via a "Shatter" style attack on the (1) IParam parameter, and the (2) PBM_GETRANGE and (3) PBM_SETRANGE messages in an unspecified progress bar.  NOTE: some details are obtained from third party information.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21764; http://www.securityfocus.com/archive/1/445205/100/0/threaded; http://www.securityfocus.com/archive/1/445263/100/0/threaded
CVE: CVE-2006-4620
Published: 2006-09-07
Description: The useredit_account.wdm module in Alt-N WebAdmin 3.2.5 running with MDaemon 9.0.6, and possibly earlier versions, allows remote authenticated domain administrators to gain privileges and obtain access to the system mail queue by modifying the mailbox of the MDaemon user account to use the mailbox of another account.
CVSS Score: 4.6 (MEDIUM)
References: http://files.altn.com/WebAdmin/Release/RelNotes_en.txt; http://secunia.com/advisories/21727; http://securityreason.com/securityalert/1516
CVE: CVE-2006-4621
Published: 2006-09-07
Description: PHP remote file inclusion vulnerability in settings.php in Pheap 1.2, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information. The lib/config.php vector is already covered by CVE-2006-4531.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21678; http://www.vupen.com/english/advisories/2006/3426; http://secunia.com/advisories/21678
CVE: CVE-2006-4622
Published: 2006-09-07
Description: PHP remote file inclusion vulnerability in annonce.php in AnnonceV (aka annoncesV) 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 7.5 (HIGH)
References: http://kurdishsecurity.blogspot.com/2006/09/kurdish-security-26-annoncev-news.html; http://secunia.com/advisories/21772; http://securityreason.com/securityalert/1515
CVE: CVE-2006-4624
Published: 2006-09-07
Description: CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting malicious URLs via CRLF sequences in the URI.
CVSS Score: 2.6 (LOW)
CWE: CWE-94
References: http://mail.python.org/pipermail/mailman-announce/2006-September/000087.html; http://moritz-naumann.com/adv/0013/mailmanmulti/0013.txt; http://secunia.com/advisories/21732
CVE: CVE-2006-4626
Published: 2006-09-07
Description: Heap-based buffer overflow in alwil avast! Anti-virus Engine before 4.7.869 allows remote attackers to execute arbitrary code via a crafted LHA file that contains extended headers with file and directory names whose concatenation triggers the overflow.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21794; http://www.hustlelabs.com/advisories/04072006_alwil.pdf; http://www.securityfocus.com/bid/19903
CVE: CVE-2006-4627
Published: 2006-09-07
Description: System Information ActiveX control (msinfo.dll), when accessed via Microsoft Internet Explorer, allows remote attackers to cause a denial of service (crash) via a SaveFile function with a long (1) computer and possibly (2) filename and (3) category argument.
CVSS Score: 5.0 (MEDIUM)
References: http://noderat.spaces.live.com/blog/cns%216ADE4614B66EADD2%211150.entry; http://www.blogger.com/comment.g?blogID=30557436&postID=[PII_REDACTED]7529918; http://www.osvdb.org/28381
CVE: CVE-2006-4628
Published: 2006-09-08
Description: Cross-site scripting (XSS) vulnerability in VCD-db before 0.983 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when handling comments.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21781; http://sourceforge.net/project/shownotes.php?release_id=445066; http://www.securityfocus.com/bid/19871
CVE: CVE-2006-4629
Published: 2006-09-08
Description: PHP remote file inclusion vulnerability in affichage/commentaires.php in C-News.fr C-News 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21758; http://www.osvdb.org/28552; http://www.securityfocus.com/bid/19861
CVE: CVE-2006-4630
Published: 2006-09-08
Description: PHP remote file inclusion vulnerability in jscript.php in Sky GUNNING MySpeach 3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the my_ms[root] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21777; http://www.comscripts.com/scripts/php.myspeach.1386.html; http://www.securityfocus.com/bid/19851
CVE: CVE-2006-4631
Published: 2006-09-08
Description: Direct static code injection vulnerability in admin/save_opt.php in SoftBB 0.1, and possibly earlier, allows remote authenticated users to upload and execute arbitrary PHP code via the cache_forum parameter, which saves the code to info_options.php, which is accessible via a direct request.
CVSS Score: 6.5 (MEDIUM)
References: http://acid-root.new.fr/advisories/10060904.txt; http://secunia.com/advisories/21761; http://securityreason.com/securityalert/1521
CVE: CVE-2006-4632
Published: 2006-09-08
Description: Multiple SQL injection vulnerabilities in SoftBB 0.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) groupe parameter in addmembre.php and the (2) select parameter in moveto.php.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/advisories/10060904.txt; http://secunia.com/advisories/21761; http://securityreason.com/securityalert/1521
CVE: CVE-2006-4633
Published: 2006-09-08
Description: index.php in SoftBB 0.1, and possibly earlier, allows remote attackers to obtain the installation path via a null or invalid page[] parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://acid-root.new.fr/advisories/10060904.txt; http://securityreason.com/securityalert/1521; http://securitytracker.com/id?1016785
CVE: CVE-2006-4634
Published: 2006-09-08
Description: Cross-site scripting (XSS) vulnerability in index.php in VBZooM allows remote attackers to inject arbitrary web script or HTML via the UserID parameter, a different vector than CVE-2006-1133 and CVE-2005-2441.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/16220; http://securityreason.com/securityalert/1520; http://www.securityfocus.com/archive/1/445000/100/0/threaded
CVE: CVE-2006-4635
Published: 2006-09-08
Description: Unspecified vulnerability in MySource Classic 2.14.6, and possibly earlier, allows remote authenticated users, with superuser privileges, to inject arbitrary PHP code via unspecified vectors related to the Equation attribute in Web_Extensions - Notitia (I/II).  NOTE: due to lack of details, it is not clear whether this issue is file inclusion, static code injection, or another type of issue.
CVSS Score: 6.5 (MEDIUM)
References: http://classic.squiz.net/download/changelogs/change_log_2.14.8; http://secunia.com/advisories/21757; http://www.securityfocus.com/bid/19868
CVE: CVE-2006-4636
Published: 2006-09-08
Description: Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter, as demonstrated by parameter values naming Apache HTTP Server log files that apparently contain PHP code.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21753; http://www.securityfocus.com/bid/19867; http://www.vupen.com/english/advisories/2006/3472
CVE: CVE-2006-4637
Published: 2006-09-08
Description: Multiple PHP remote file inclusion vulnerabilities in ACGV News 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the PathNews parameter in (1) header.php or (2) news.php.  NOTE: portions of these details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21765; http://securitytracker.com/id?1016816; http://www.securityfocus.com/archive/1/445575/100/0/threaded
CVE: CVE-2006-4638
Published: 2006-09-08
Description: PHP remote file inclusion vulnerability in article.php in ACGV News 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PathNews parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21765; http://www.osvdb.org/28555; http://www.securityfocus.com/bid/19882
CVE: CVE-2006-4639
Published: 2006-09-08
Description: Multiple PHP remote file inclusion vulnerabilities in C-News.fr C-News 1.0.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path parameter in (1) formulaire_commentaires.php, (2) affichage/liste_news.php, (3) affichage/news_complete.php, or (4) affichage/pagination.php.  NOTE: the provenance of some of this information is unknown; some details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21758; http://www.securityfocus.com/archive/1/445781/100/0/threaded; http://www.vupen.com/english/advisories/2006/3471
CVE: CVE-2006-2482
Published: 2006-09-08
Description: Heap-based buffer overflow in the TZipTV component in (1) ZipTV for Delphi 7 2006.1.26 and for C++ Builder 2006-1.16, (2) PentaZip 8.5.1.190 and PentaSuite-PRO 8.5.1.221, and possibly other products, allows user-assisted attackers to execute arbitrary code via an ARJ archive with a long header. NOTE: the ACE archive vector is covered by CVE-2005-2856.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/20270; http://secunia.com/advisories/21458; http://secunia.com/secunia_research/2006-50/advisory/
CVE: CVE-2006-4379
Published: 2006-09-08
Description: Stack-based buffer overflow in the SMTP Daemon in Ipswitch Collaboration 2006 Suite Premium and Standard Editions, IMail, IMail Plus, and IMail Secure allows remote attackers to execute arbitrary code via a long string located after an '@' character and before a ':' character.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21795; http://securitytracker.com/id?1016803; http://securitytracker.com/id?1016804
CVE: CVE-2006-4641
Published: 2006-09-08
Description: SQL injection vulnerability in kategori.asp in Muratsoft Haber Portal 3.6 allows remote attackers to execute arbitrary SQL commands via the kat parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19821; https://exchange.xforce.ibmcloud.com/vulnerabilities/28724; https://www.exploit-db.com/exploits/2294
CVE: CVE-2006-4642
Published: 2006-09-08
Description: AuditWizard 6.3.2, when using "Remote Audit," logs the administrator password in plaintext to LaytonCmdSvc.log, which allows local users to obtain sensitive information by reading the file.
CVSS Score: 1.7 (LOW)
References: http://secunia.com/advisories/21773; http://securityreason.com/securityalert/1525; http://securitytracker.com/id?1016795
CVE: CVE-2006-4643
Published: 2006-09-08
Description: SQL injection vulnerability in consult/joueurs.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to execute arbitrary SQL commands via the id_joueur parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21789; http://www.securityfocus.com/bid/19880; http://www.vupen.com/english/advisories/2006/3500
CVE: CVE-2006-4644
Published: 2006-09-08
Description: PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the repmod parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21805; http://www.securityfocus.com/bid/19875; http://www.vupen.com/english/advisories/2006/3493
CVE: CVE-2006-4645
Published: 2006-09-08
Description: PHP remote file inclusion vulnerability in akarru.gui/main_content.php in Akarru Social BookMarking Engine 0.4.3.34 and earlier, and possibly 0.4.4.120, allows remote attackers to execute arbitrary PHP code via a URL in the bm_content parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21784; http://securityreason.com/securityalert/1543; http://www.securityfocus.com/archive/1/445605/100/0/threaded
CVE: CVE-2006-4646
Published: 2006-09-08
Description: Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Pathauto module before pathauto_node.inc 1.17.2.1 and the Drupal 4.6 Pathauto module before pathauto_node.inc 1.14.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://drupal.org/node/82527; http://secunia.com/advisories/21779; http://www.securityfocus.com/bid/19876
CVE: CVE-2006-4647
Published: 2006-09-08
Description: PHP remote file inclusion vulnerability in news.php in Sponge News 2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sndir parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21760; http://www.osvdb.org/28554; http://www.securityfocus.com/bid/19862
CVE: CVE-2006-4648
Published: 2006-09-08
Description: PHP remote file inclusion vulnerability in bp_ncom.php in BinGo News (BP News) 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21804; http://securitytracker.com/id?1016811; http://www.securityfocus.com/archive/1/445506/100/0/threaded
CVE: CVE-2006-4649
Published: 2006-09-08
Description: PHP remote file inclusion vulnerability in bp_news.php in BinGo News (BP News) 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1016811; http://www.securityfocus.com/archive/1/445506/100/0/threaded; http://www.vupen.com/english/advisories/2006/3494
CVE: CVE-2006-4294
Published: 2006-09-09
Description: Directory traversal vulnerability in viewfile in TWiki 4.0.0 through 4.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21829; http://securitytracker.com/id?1016805; http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2006-4294
CVE: CVE-2006-4650
Published: 2006-09-09
Description: Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/21783; http://securityreason.com/securityalert/1526; http://securitytracker.com/id?1016799
CVE: CVE-2006-4651
Published: 2006-09-09
Description: Directory traversal vulnerability in download/index.php, and possibly download.php, in threesquared.net (aka Ben Speakman) Php download allows remote attackers to overwrite arbitrary local files via .. (dot dot) sequence in the file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21774; http://securityreason.com/securityalert/1528; http://www.securityfocus.com/archive/1/445269/100/0/threaded
CVE: CVE-2006-4652
Published: 2006-09-09
Description: (1) Amazing Little Poll and (2) Amazing Little Picture Poll have a default password of "dsapoll", which allows remote attackers to create a new poll by entering default credentials via lp_admin.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1527; http://www.securityfocus.com/archive/1/445081/100/0/threaded; http://www.securityfocus.com/bid/19837
CVE: CVE-2006-4653
Published: 2006-09-09
Description: (1) Amazing Little Poll and (2) Amazing Little Picture Poll store sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password via a direct request for the lp_settings file (lp_settings.inc or lp_settings.php).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21997; http://securityreason.com/securityalert/1527; http://www.securityfocus.com/archive/1/445081/100/0/threaded
CVE: CVE-2006-4654
Published: 2006-09-09
Description: Format string vulnerability in Easy Address Book Web Server 1.2 allows remote attackers to cause a denial of service (crash) or "compromise the server" via encoded format string specifiers in the query string.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21959; http://securityreason.com/securityalert/1529; http://www.securityfocus.com/archive/1/445262/100/0/threaded
CVE: CVE-2006-4655
Published: 2006-09-09
Description: Buffer overflow in the Strcmp function in the XKEYBOARD extension in X Window System X11R6.4 and earlier, as used in SCO UnixWare 7.1.3 and Sun Solaris 8 through 10, allows local users to gain privileges via a long _XKB_CHARSET environment variable value.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21815; http://secunia.com/advisories/21845; http://secunia.com/advisories/21856
CVE: CVE-2006-4656
Published: 2006-09-09
Description: PHP remote file inclusion vulnerability in admin/editeur/spaw_control.class.php in Web Provence SL_Site 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter.  NOTE: CVE analysis suggests that this issue is actually in a third party product, SPAW Editor PHP Edition.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1522; http://securitytracker.com/id?1016814; http://spaw.cvs.sourceforge.net/spaw/spaw/docs/ChangeLog.txt?view=markup
CVE: CVE-2006-4657
Published: 2006-09-09
Description: Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 stores service executables under the product's installation directory with weak permissions, which allows local users to obtain LocalSystem privileges by modifying (1) WebProxy.exe or (2) PAVSRV51.EXE.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/21769; http://securityreason.com/securityalert/1524; http://www.security.nnov.ru/advisories/pandais.asp
CVE: CVE-2006-4658
Published: 2006-09-09
Description: Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 uses sequential message numbers in generated URLs that are not filtered if the user replies to a message, which might allow remote attackers to determine mail usage patterns.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21769; http://securityreason.com/securityalert/1524; http://www.security.nnov.ru/advisories/pandais.asp
CVE: CVE-2006-4659
Published: 2006-09-09
Description: The Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 uses predictable URLs for the spam classification of each message, which allows remote attackers to cause Panda to classify arbitrary messages as spam via a web page that contains IMG tags with the predictable URLs.  NOTE: this issue could also be regarded as a cross-site request forgery (CSRF) vulnerability.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21769; http://securityreason.com/securityalert/1524; http://www.security.nnov.ru/advisories/pandais.asp
CVE: CVE-2006-4660
Published: 2006-09-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer (toolbaru.dll) allow remote attackers to process arbitrary web script or HTML in the Feeds interface context via the (1) title and (2) description elements within an item element in an RSS feed.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/21809; http://securityreason.com/securityalert/1523; http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1510
CVE: CVE-2006-4661
Published: 2006-09-09
Description: AOL ICQ Toolbar 1.3 for Internet Explorer (toolbaru.dll) does not properly validate the origin of the configuration web page (options2.html), which allows user-assisted remote attackers to provide a web page that contains disguised checkboxes that trick the user into reconfiguring the toolbar.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/21809; http://securityreason.com/securityalert/1523; http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1510