deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3493
Published: 2006-07-10
Description: Buffer overflow in LsCreateLine function (mso_203) in mso.dll and mso9.dll, as used by Microsoft Word and possibly other products in Microsoft Office 2003, 2002, and 2000, allows remote user-assisted attackers to cause a denial of service (crash) via a crafted Word DOC or other Office file type.  NOTE: this issue was originally reported to allow code execution, but on 20060710 Microsoft stated that code execution is not possible, and the original researcher agrees.
CVSS Score: 5.1 (MEDIUM)
References: http://blogs.technet.com/msrc/archive/2006/07/10/441006.aspx; http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047732.html; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6820&w=2
CVE: CVE-2006-3494
Published: 2006-07-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the (1) cat_id parameter to (a) view_classifieds.php; (2) id parameter in (b) view_ad.php; (3) event_id parameter in (c) view_event.php, (d) delete_event.php, and (e) edit_event.php; and (4) group_id in (f) view_group.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20933; http://securityreason.com/securityalert/1209; http://www.osvdb.org/26979
CVE: CVE-2006-0007
Published: 2006-07-11
Description: Buffer overflow in GIFIMP32.FLT, as used in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted GIF image that triggers memory corruption when it is parsed.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/vulnwatch/2006-q3/0005.html; http://secunia.com/advisories/21013; http://securitytracker.com/id?1016470
CVE: CVE-2006-0033
Published: 2006-07-11
Description: Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted PNG image that triggers memory corruption when it is parsed.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/21013; http://securitytracker.com/id?1016470; http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-22.html
CVE: CVE-2006-1300
Published: 2006-07-11
Description: Microsoft .NET framework 2.0 (ASP.NET) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects "explicitly by name."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20999; http://securitytracker.com/id?1016465; http://www.osvdb.org/27153
CVE: CVE-2006-1314
Published: 2006-07-11
Description: Heap-based buffer overflow in the Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to execute arbitrary code via crafted first-class Mailslot messages that triggers memory corruption and bypasses size restrictions on second-class Mailslot messages.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21007; http://securityreason.com/securityalert/1212; http://www.kb.cert.org/vuls/id/189140
CVE: CVE-2006-1315
Published: 2006-07-11
Description: The Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to obtain sensitive information via crafted requests that leak information in SMB buffers, which are not properly initialized, aka "SMB Information Disclosure Vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21007; http://securitytracker.com/id?1016467; http://www.kb.cert.org/vuls/id/333636
CVE: CVE-2006-1316
Published: 2006-07-11
Description: Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via an Office file with malformed string that triggers memory corruption related to record lengths, aka "Microsoft Office Parsing Vulnerability," a different vulnerability than CVE-2006-2389.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/21012; http://securitytracker.com/id?1016469; http://www.kb.cert.org/vuls/id/580036
CVE: CVE-2006-2372
Published: 2006-07-11
Description: Buffer overflow in the DHCP Client service for Microsoft Windows 2000 SP4, Windows XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via a crafted DHCP response.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0222.html; http://secunia.com/advisories/21010; http://securityreason.com/securityalert/1201
CVE: CVE-2006-2389
Published: 2006-07-11
Description: Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via an Office file with a malformed property that triggers memory corruption related to record lengths, aka "Microsoft Office Property Vulnerability," a different vulnerability than CVE-2006-1316.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/21012; http://securitytracker.com/id?1016469; http://www.kb.cert.org/vuls/id/409316
CVE: CVE-2006-0026
Published: 2006-07-11
Description: Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP).
CVSS Score: 6.5 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0316.html; http://secunia.com/advisories/21006; http://securitytracker.com/id?1016466
CVE: CVE-2006-3510
Published: 2006-07-11
Description: The Remote Data Service Object (RDS.DataControl) in Microsoft Internet Explorer 6 on Windows 2000 allows remote attackers to cause a denial of service (crash) via a series of operations that result in an invalid length calculation when using SysAllocStringLen, then triggers a buffer over-read.
CVSS Score: 2.6 (LOW)
References: http://browserfun.blogspot.com/2006/07/mobb-8-rdsdatacontrol-url.html; http://www.osvdb.org/26955; http://www.securityfocus.com/bid/18900
CVE: CVE-2006-3511
Published: 2006-07-11
Description: Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the fonts property of the HtmlDlgSafeHelper object, which triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-11-htmldlgsafehelper-fonts.html; http://www.osvdb.org/27055; http://www.securityfocus.com/bid/18929
CVE: CVE-2006-3512
Published: 2006-07-11
Description: Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) by setting the Enabled property of a DXTFilter ActiveX object to true, which triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/27014; http://www.securityfocus.com/bid/18903; http://www.vupen.com/english/advisories/2006/2732
CVE: CVE-2006-3513
Published: 2006-07-11
Description: danim.dll in Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the Data property of a DirectAnimation DAUserData object before it is initialized, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-9-directanimationdauserdata-data.html; http://www.osvdb.org/27013; http://www.securityfocus.com/bid/18902
CVE: CVE-2006-3514
Published: 2006-07-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/actions.php in PHP-Blogger 2.2.5, and possibly earlier versions, allow remote attackers to execute arbitrary web script or HTML via the (1) name, (2) title, (3) news, (4) description, and (5) sitename parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20989; http://securityreason.com/securityalert/1202; http://www.securityfocus.com/archive/1/439440/100/0/threaded
CVE: CVE-2006-3515
Published: 2006-07-11
Description: SQL injection vulnerability in the loginADP function in ajaxp.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20985; http://securityreason.com/securityalert/1206; http://www.kapda.ir/advisory-355.html
CVE: CVE-2006-3516
Published: 2006-07-11
Description: Multiple SQL injection vulnerabilities in FreeHost allow remote attackers to execute arbitrary SQL commands via (1) readme parameter to FreeHost/misc.php or (2) index parameter to FreeHost/news.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1208; http://www.securityfocus.com/archive/1/438813/100/100/threaded; http://securityreason.com/securityalert/1208
CVE: CVE-2006-3517
Published: 2006-07-11
Description: PHP remote file inclusion vulnerability in stats.php in RW::Download, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1207; http://www.securityfocus.com/archive/1/439524/100/0/threaded; http://www.securityfocus.com/bid/18901
CVE: CVE-2006-3518
Published: 2006-07-11
Description: SQL injection vulnerability in SayfalaAltList.asp in Webvizyon Portal 2006 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1203; http://securitytracker.com/id?1016463; http://www.osvdb.org/28192
CVE: CVE-2006-3519
Published: 2006-07-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in The Banner Engine (tbe) 4.0 allow remote attackers to execute arbitrary web script or HTML via the (1) text parameter in a search action to (a) top.php, and the (2) adminpass or (3) adminlogin parameter to (b) signup.php.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20916; http://securityreason.com/securityalert/1204; http://securitytracker.com/id?1016432
CVE: CVE-2006-3520
Published: 2006-07-12
Description: PHP remote file inclusion vulnerability in skins/advanced/advanced1.php in Sabdrimer Pro 2.2.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pluginpath[0] parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/18907; http://www.vupen.com/english/advisories/2006/2717; https://exchange.xforce.ibmcloud.com/vulnerabilities/27627
CVE: CVE-2006-3521
Published: 2006-07-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in index/siteforge-bugs-action/proj.siteforge in SiteForge Collaborative Development Platform 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) _status, (2) _extra1, (3) _extra2, or (4) _extra3 parameters.
CVSS Score: 5.8 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/siteforge-collaborative-development_15.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/27223; http://pridels0.blogspot.com/2006/06/siteforge-collaborative-development_15.html
CVE: CVE-2006-3522
Published: 2006-07-12
Description: Cross-site scripting (XSS) vulnerability in Clearswift MIMEsweeper for Web before 5.1.15 Hotfix allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in an error message when trying to access a blocked web site.
CVSS Score: 4.3 (MEDIUM)
References: http://download.mimesweeper.com/www/TechnicalDocumentation/WebReadMeHotfix5115.htm; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4354&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1404&w=2
CVE: CVE-2006-3523
Published: 2006-07-12
Description: Clearswift MIMEsweeper for Web before 5.1.15 Hotfix allows remote attackers to cause a denial of service (crash) via an encrypted archived .RAR file, which triggers a scan error and causes the Web Policy Engine service to terminate.
CVSS Score: 5.0 (MEDIUM)
References: http://download.mimesweeper.com/www/TechnicalDocumentation/WebReadMeHotfix5115.htm; http://secunia.com/advisories/20998; http://www.vupen.com/english/advisories/2006/2731
CVE: CVE-2006-3524
Published: 2006-07-12
Description: Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a long CSeq field value in an INVITE message.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047757.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047794.html; http://secunia.com/advisories/20997
CVE: CVE-2006-3525
Published: 2006-07-12
Description: SQL injection vulnerability in category.php in PHCDownload 1.0.0 Final and 1.0.0 Release Candidate 6 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/phcdownload-sql-injection-vuln.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/27238; http://pridels0.blogspot.com/2006/06/phcdownload-sql-injection-vuln.html
CVE: CVE-2006-3526
Published: 2006-07-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in guestbook.php in Sport-slo Advanced Guestbook 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) name and (2) form parameters.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20977; http://securityreason.com/securityalert/1211; http://www.osvdb.org/27066
CVE: CVE-2006-3527
Published: 2006-07-12
Description: Multiple PHP remote file inclusion vulnerabilities in BosClassifieds Classified Ads allow remote attackers to execute arbitrary PHP code via a URL in the insPath parameter to (1) index.php, (2) recent.php, (3) account.php, (4) classified.php, or (5) search.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21056; http://securitytracker.com/id?1016447; http://www.jaascois.com/exploits/18602018/
CVE: CVE-2006-3528
Published: 2006-07-12
Description: Multiple PHP remote file inclusion vulnerabilities in Simpleboard Mambo module 1.1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the sbp parameter to (1) image_upload.php and (2) file_upload.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4966&w=2; http://secunia.com/advisories/20981; http://securitytracker.com/id?1016824
CVE: CVE-2006-3529
Published: 2006-07-12
Description: Memory leak in Juniper JUNOS 6.4 through 8.0, built before May 10, 2006, allows remote attackers to cause a denial of service (kernel packet memory consumption and crash) via crafted IPv6 packets whose buffers are not released after they are processed.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21003; http://securitytracker.com/id?1016460; http://www.juniper.net/support/security/alerts/EXT-PSN-2006-06-017.txt
CVE: CVE-2006-3403
Published: 2006-07-12
Description: The smdb daemon (smbd/service.c) in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of share connection requests.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
CVE: CVE-2006-3530
Published: 2006-07-12
Description: PHP remote file inclusion vulnerability in com_pccookbook/pccookbook.php in the PccookBook Component for Mambo and Joomla 0.3 and possibly up to 1.3.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://advisories.echo.or.id/adv/adv37-matdhule-2006.txt; http://secunia.com/advisories/21015; http://securityreason.com/securityalert/1215
CVE: CVE-2006-3531
Published: 2006-07-12
Description: includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates the authentication credentials from parameters, which allows remote attackers to obtain privileges and upload arbitrary files via modified (1) pass and (2) session parameters, and (3) pass and (4) userlevel indices of the (a) Pivot_Vars[] or (b) Users[] array parameters.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/pivot_130RC2_xpl.html; http://secunia.com/advisories/20962; http://securityreason.com/securityalert/1214
CVE: CVE-2006-3532
Published: 2006-07-12
Description: PHP file inclusion vulnerability in includes/edit_new.php in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a FTP URL or full file path in the Paths[extensions_path] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://retrogod.altervista.org/pivot_130RC2_xpl.html; http://secunia.com/advisories/20962; http://securityreason.com/securityalert/1214
CVE: CVE-2006-3533
Published: 2006-07-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) fg, (2) line1, (3) line2, (4) bg, (5) c1, (6) c2, (7) c3, and (8) c4 parameters in (a) includes/blogroll.php; (9) name and (10) js_name parameters in (b) includes/editor/edit_menu.php; and, even if register_globals is not enabled, the (11) h and (12) w parameters in (c) includes/photo.php.
CVSS Score: 5.8 (MEDIUM)
References: http://retrogod.altervista.org/pivot_130RC2_xpl.html; http://secunia.com/advisories/20962; http://securityreason.com/securityalert/1214
CVE: CVE-2006-3534
Published: 2006-07-12
Description: Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.6 filters directory traversal sequences before decoding, which allows remote attackers to read arbitrary files via encoded dot dot (%2E%2E) sequences in an HTTP GET request for a file path containing "/content".
CVSS Score: 7.8 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=136721; http://people.ksp.sk/~goober/advisory/001-shoutcast.html; http://secunia.com/advisories/20524
CVE: CVE-2006-3535
Published: 2006-07-12
Description: Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.7 allows remote attackers to read arbitrary files via unspecified vectors that are a "slight variation" of CVE-2006-3534.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=136721; http://people.ksp.sk/~goober/advisory/001-shoutcast.html; http://secunia.com/advisories/20524
CVE: CVE-2006-3536
Published: 2006-07-12
Description: Direct static code injection vulnerability in code/class_db_text.php in EJ3 TOPo 2.2.178 and earlier allows remote attackers to execute arbitrary PHP code via parameters such as (1) descripcion and (2) pais, which are stored directly in a PHP script.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party reports.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/18935; http://www.vupen.com/english/advisories/2006/2736; https://exchange.xforce.ibmcloud.com/vulnerabilities/27659
CVE: CVE-2006-3537
Published: 2006-07-12
Description: PHP remote file inclusion vulnerability in index.php in Randshop before 1.2 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter, a different vector than CVE-2006-3375.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1213; http://www.securityfocus.com/archive/1/439750/100/0/threaded; http://www.securityfocus.com/bid/18865
CVE: CVE-2006-3452
Published: 2006-07-12
Description: Adobe Reader and Acrobat 6.0.4 and earlier, on Mac OSX, has insecure file and directory permissions, which allows local users to gain privileges by overwriting program files.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21016; http://securitytracker.com/id?1016473; http://www.adobe.com/support/security/bulletins/apsb06-08.html
CVE: CVE-2006-3538
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in demo.php in BeatificFaith Eprayer Alpha allow remote attackers to inject arbitrary web script or HTML via the SRC attribute of a SCRIPT element in the (1) "Your name" field and (2) "Enter Prayer Request here" field.
CVSS Score: 5.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/437269/100/0/threaded; http://www.securityfocus.com/bid/18485; http://www.youfucktard.com/xsp/eprayer1.jpg
CVE: CVE-2006-3539
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in DKScript.com Dragon's Kingdom Script 1.0 allow remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the (1) Subject and (2) Message fields in a do=write (aka Send Mail Message) action in gamemail.php; the (3) Gender, (4) Country/Location, (5) MSN Messenger, (6) AOL Instant Messenger, (7) Yahoo Instant Messenger, and (8) ICQ fields in a do=onlinechar (aka Edit your Profile) action in index.php, as accessed by dk.php; a javascript URI in the SRC attribute of an IMG element in the (9) Title and (10) Message fields in a do=new (aka Create Thread) action in general.php; and a javascript URI in the SRC attribute of an IMG element in unspecified fields in (11) other Forum posts and (12) Forum replies.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20662; http://www.securityfocus.com/archive/1/437753/100/0/threaded; http://www.securityfocus.com/bid/18535
CVE: CVE-2006-3540
Published: 2006-07-13
Description: Check Point Zone Labs ZoneAlarm Internet Security Suite 6.5.722.000, 6.1.737.000, and possibly other versions do not properly validate RegSaveKey, RegRestoreKey, and RegDeleteKey function calls, which allows local users to cause a denial of service (system crash) via a certain combination of these function calls with an HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VETFDDNT\Enum argument.
CVSS Score: 4.9 (MEDIUM)
References: http://www.matousec.com/info/advisories/ZoneAlarm-Insufficient-protection-of-registry-key-VETFDDNT-Enum.php; http://www.securityfocus.com/archive/1/438970/100/0/threaded; http://www.securityfocus.com/bid/18789
CVE: CVE-2006-3541
Published: 2006-07-13
Description: SQL injection vulnerability in Meine Links (aka My Links) in Kyberna ky2help allows remote authenticated users to execute arbitrary SQL commands via unspecified "textboxes."
CVSS Score: 6.5 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047634.html; http://secunia.com/advisories/20924; http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2351
CVE: CVE-2006-3542
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Garry Glendown Shopping Cart 0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) shop name field in (a) editshop.php, (b) edititem.php, and (c) index.php; and via the (2) item field in editshop.php and edititem.php.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20957; http://securityreason.com/securityalert/1223; http://www.osvdb.org/27024