deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6667
Published: 2006-12-20
Description: Multiple SQL injection vulnerabilities in VerliAdmin 0.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) nick_mod or (2) nick parameter to (a) repass.php or (b) verify.php. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/5059; http://www.vupen.com/english/advisories/2006/5059
CVE: CVE-2006-6668
Published: 2006-12-20
Description: Cross-site scripting (XSS) vulnerability in VerliAdmin 0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/5059; http://www.vupen.com/english/advisories/2006/5059
CVE: CVE-2006-6669
Published: 2006-12-20
Description: Cross-site scripting (XSS) vulnerability in export_handler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23341; http://secunia.com/advisories/24974; http://securityreason.com/securityalert/2054
CVE: CVE-2006-6670
Published: 2006-12-20
Description: Unspecified vulnerability in Nortel CallPilot 4.x Server has unknown impact and attack vectors, aka P-2006-0011-GLOBAL.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23403; http://www.securityfocus.com/bid/21660; http://www.vupen.com/english/advisories/2006/5070
CVE: CVE-2006-6671
Published: 2006-12-21
Description: SQL injection vulnerability in down.asp in Burak Yylmaz Download Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23447; http://securityreason.com/securityalert/2055; http://www.securityfocus.com/archive/1/454857/100/0/threaded
CVE: CVE-2006-6672
Published: 2006-12-21
Description: Multiple SQL injection vulnerabilities in Burak Yylmaz Download Portal allow remote attackers to execute arbitrary SQL commands via the (1) kid or possibly (2) id parameter to (a) HABERLER.ASP and (b) ASPKAT.ASP.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/5085; http://www.vupen.com/english/advisories/2006/5085
CVE: CVE-2006-6673
Published: 2006-12-21
Description: WinFtp Server 2.0.2 allows remote attackers to cause a denial of service (crash) via long (1) PASV, (2) LIST, (3) USER, (4) PORT, and possibly other commands.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23412; http://www.vupen.com/english/advisories/2006/5069; https://www.exploit-db.com/exploits/2952
CVE: CVE-2006-6674
Published: 2006-12-21
Description: Ozeki HTTP-SMS Gateway 1.0, and possibly earlier, stores usernames and passwords in plaintext in the HKLM\Software\Ozeki\SMSServer\CurrentVersion\Plugins\httpsmsgate registry key, which allows local users to obtain sensitive information.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://bb.domaindlx.com/bingung/shellcore/advisories.asp?bug_report=display&infamous_group=106; http://secunia.com/advisories/23339; http://www.securityfocus.com/bid/21679
CVE: CVE-2006-6675
Published: 2006-12-21
Description: Cross-site scripting (XSS) vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in Welcome web-app.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23406; http://www.securityfocus.com/bid/21678; http://www.vupen.com/english/advisories/2006/5090
CVE: CVE-2006-6676
Published: 2006-12-21
Description: Integer overflow in the (a) OLE2 and (b) CHM parsers for ESET NOD32 Antivirus before 1.1743 allows remote attackers to execute arbitrary code via a crafted (1) .DOC or (2) .CAB file that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://eset.com/support/updates.php?pageno=63; http://secunia.com/advisories/23459; http://securityreason.com/securityalert/2079
CVE: CVE-2006-6677
Published: 2006-12-21
Description: ESET NOD32 Antivirus before 1.1743 allows remote attackers to cause a denial of service (crash) via a crafted .CHM file that triggers a divide-by-zero error.
CVSS Score: 2.6 (LOW)
References: http://eset.com/support/updates.php?pageno=63; http://secunia.com/advisories/23459; http://securityreason.com/securityalert/2079
CVE: CVE-2006-6678
Published: 2006-12-21
Description: The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
CVSS Score: 7.5 (HIGH)
References: http://netrik.cvs.sourceforge.net/netrik/netrik/form-file.c?r1=1.3&r2=1.4; http://secunia.com/advisories/23822; http://sourceforge.net/project/shownotes.php?release_id=472131&group_id=23183
CVE: CVE-2006-6104
Published: 2006-12-21
Description: The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.
CVSS Score: 5.0 (MEDIUM)
References: http://fedoranews.org/cms/node/2400; http://fedoranews.org/cms/node/2401; http://lists.suse.com/archive/suse-security-announce/2007-Jan/0002.html
CVE: CVE-2006-6679
Published: 2006-12-21
Description: Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL, which allows remote attackers to gain unauthorized access by spoofing this header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5564&w=2; http://secunia.com/advisories/22967
CVE: CVE-2006-6680
Published: 2006-12-21
Description: Pedro Lineu Orso chetcpasswd before 2.3.1 does not document the need for 0400 permissions on /etc/chetcpasswd.allow, which might allow local users to gain sensitive information by reading this file.
CVSS Score: 4.6 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?group_id=68912&release_id=466649; http://sourceforge.net/project/shownotes.php?group_id=68912&release_id=466649
CVE: CVE-2006-6681
Published: 2006-12-21
Description: Pedro Lineu Orso chetcpasswd 2.3.3 does not have a rate limit for client requests, which might allow remote attackers to determine passwords via a dictionary attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5564&w=2; http://secunia.com/advisories/22967
CVE: CVE-2006-6682
Published: 2006-12-21
Description: Pedro Lineu Orso chetcpasswd 2.3.3 provides a different error message when a request with a valid username fails, compared to a request with an invalid username, which allows remote attackers to determine valid usernames on the system.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-388
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5564&w=2; http://secunia.com/advisories/22967
CVE: CVE-2006-6683
Published: 2006-12-21
Description: Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454; http://www.securityfocus.com/bid/21102; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454
CVE: CVE-2006-6684
Published: 2006-12-21
Description: Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd before 2.4 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long X-Forwarded-For HTTP header.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454; http://secunia.com/advisories/22967; http://www.osvdb.org/30546
CVE: CVE-2006-6685
Published: 2006-12-21
Description: Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd 2.3.3 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long REMOTE_ADDR environment variable.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/22967; http://secunia.com/advisories/22967
CVE: CVE-2006-6686
Published: 2006-12-21
Description: PHP remote file inclusion vulnerability in sender.php in Carsen Klock TextSend 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23458; http://www.securityfocus.com/bid/21690; http://www.vupen.com/english/advisories/2006/5097
CVE: CVE-2006-6687
Published: 2006-12-21
Description: Cross-site scripting (XSS) vulnerability in Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Network Edition (NE) (aka WebAPP.NET), allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/21684; http://www.securityfocus.com/bid/21684
CVE: CVE-2006-6688
Published: 2006-12-21
Description: Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Network Edition (NE) (aka WebAPP.NET) allows remote attackers to bypass filtering mechanisms via unknown vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21684; http://www.web-app.net/downloads/security/19092006_security_fix.txt; http://www.securityfocus.com/bid/21684
CVE: CVE-2006-6689
Published: 2006-12-21
Description: Multiple PHP remote file inclusion vulnerabilities in Paristemi 0.8.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the SERVER_DIRECTORY parameter to unspecified scripts, a different vector than CVE-2006-6739.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.vupen.com/english/advisories/2006/5086; http://www.vupen.com/english/advisories/2006/5086
CVE: CVE-2006-6690
Published: 2006-12-21
Description: rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.
CVSS Score: 7.5 (HIGH)
References: http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html; http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html; http://secunia.com/advisories/23446
CVE: CVE-2006-6691
Published: 2006-12-21
Description: Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the commonIncludePath parameter to (1) admin/include/common.php, (2) include/common.php, or (3) common_include/common.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23464; http://www.securityfocus.com/bid/21685; http://www.vupen.com/english/advisories/2006/5101
CVE: CVE-2006-6692
Published: 2006-12-21
Description: Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in information that would be recorded in the system log using (1) zabbix_log or (2) zabbix_syslog.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi/zabbix.security.patch?bug=391388%3Bmsg=5%3Batt=1; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=391388; http://secunia.com/advisories/22313
CVE: CVE-2006-6693
Published: 2006-12-21
Description: Multiple buffer overflows in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long strings to the (1) zabbix_log and (2) zabbix_syslog functions.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi/zabbix.security.patch?bug=391388%3Bmsg=5%3Batt=1; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=391388; http://secunia.com/advisories/22313
CVE: CVE-2006-6694
Published: 2006-12-21
Description: Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a .. (dot dot) in the language parameter, as demonstrated by uploading a .JPG file containing PHP code, then accessing the file via config.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22314; http://www.rahim.webd.pl/exploity/Exploits/99.txt; http://www.securityfocus.com/bid/20481
CVE: CVE-2006-6695
Published: 2006-12-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Carsen Klock TextSend 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) error or (2) success parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/5097; http://www.vupen.com/english/advisories/2006/5097
CVE: CVE-2006-6696
Published: 2006-12-22
Description: Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://blogs.technet.com/msrc/archive/2006/12/22/new-report-of-a-windows-vulnerability.aspx; http://groups.google.ca/group/microsoft.public.win32.programmer.kernel/browse_thread/thread/c5946bf40f227058/7bd7b5d66a4e5aff; http://isc.sans.org/diary.php?n&storyid=1965
CVE: CVE-2006-6697
Published: 2006-12-22
Description: CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2238&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4901&w=2; http://secunia.com/advisories/23461
CVE: CVE-2006-6698
Published: 2006-12-22
Description: The GConf daemon (gconfd) in GConf 2.14.0 creates temporary files under directories with names based on the username, even when GCONF_GLOBAL_LOCKS is not set, which allows local users to cause a denial of service by creating the directories ahead of time, which prevents other users from using Gnome.
CVSS Score: 1.9 (LOW)
References: http://bugzilla.gnome.org/show_bug.cgi?id=167030; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=219279; http://secunia.com/advisories/23452
CVE: CVE-2006-6699
Published: 2006-12-23
Description: Multiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter to (1) calendarDialog.jsp or (2) fred.jsp.  NOTE: the calendar.jsp vector is covered by CVE-2006-6697.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/455106/100/0/threaded; http://www.securityfocus.com/archive/1/455106/100/0/threaded
CVE: CVE-2006-6700
Published: 2006-12-23
Description: Cross-site scripting (XSS) vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23472; http://securitytracker.com/id?1017435; http://www.netragard.com/html/recent_research.html
CVE: CVE-2006-6701
Published: 2006-12-23
Description: Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG element in an HTML e-mail.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0512.html; http://secunia.com/advisories/23472; http://secunia.com/advisories/25328
CVE: CVE-2006-6702
Published: 2006-12-23
Description: Cross-site scripting (XSS) vulnerability in Global.pm in @Mail before 4.61 allows remote attackers to inject arbitrary web script or HTML via crafted e-mail messages.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://kb.atmail.com/view_article.php?num=669; http://support.atmail.com/changelog.html; http://www.vupen.com/english/advisories/2006/5127
CVE: CVE-2006-6703
Published: 2006-12-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Oracle Portal 9i and 10g allow remote attackers to inject arbitrary JavaScript via the tc parameter in webapp/jsp/container_tabs.jsp, and other unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/455143/100/0/threaded; http://www.securityfocus.com/bid/21717; http://www.vupen.com/english/advisories/2006/5143
CVE: CVE-2006-6704
Published: 2006-12-23
Description: Cross-site scripting (XSS) vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "unescaped data in the database."
CVSS Score: 6.8 (MEDIUM)
References: http://terra.calacode.com/mail/docs/changelog.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/31260; http://terra.calacode.com/mail/docs/changelog.html
CVE: CVE-2006-6705
Published: 2006-12-23
Description: Multiple unspecified vulnerabilities in the template files in Soumu Workflow for Groupmax 01-00 through 01-01, Soumu Workflow 02-00 through 03-03, and Koukyoumuke Soumu Workflow 01-00 through 01-01 allow remote attackers to bypass authentication mechanisms on web pages via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/23399; http://www.hitachi-support.com/security_e/vuls_e/HS06-016_e/01-e.html; http://www.vupen.com/english/advisories/2006/5114
CVE: CVE-2006-6706
Published: 2006-12-23
Description: SQL injection vulnerability in Soumu Workflow for Groupmax 01-00 through 01-01, Soumu Workflow 02-00 through 03-03, and Koukyoumuke Soumu Workflow 01-00 through 01-01 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors in certain web pages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/23399; http://www.hitachi-support.com/security_e/vuls_e/HS06-016_e/01-e.html; http://www.vupen.com/english/advisories/2006/5114
CVE: CVE-2006-6707
Published: 2006-12-23
Description: Stack-based buffer overflow in the NeoTraceExplorer.NeoTraceLoader ActiveX control (NeoTraceExplorer.dll) in NeoTrace Express 3.25 and NeoTrace Pro (aka McAfee Visual Trace) 3.25 allows remote attackers to execute arbitrary code via a long argument string to the TraceTarget method.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23463; http://www.securityfocus.com/bid/21697; http://secunia.com/advisories/23463
CVE: CVE-2006-6708
Published: 2006-12-23
Description: Cross-site scripting (XSS) vulnerability in listings.asp in MGinternet Property Site Manager allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2078; http://www.securityfocus.com/archive/1/451565; http://www.securityfocus.com/bid/21073
CVE: CVE-2006-6709
Published: 2006-12-23
Description: Multiple SQL injection vulnerabilities in MGinternet Property Site Manager allow remote attackers to execute arbitrary SQL commands via the (1) p parameter to (a) detail.asp; the (2) l, (3) typ, or (4) loc parameter to (b) listings.asp; or the (5) Password or (6) Username parameter to (c) admin_login.asp.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2078; http://www.securityfocus.com/archive/1/451565; http://www.securityfocus.com/bid/21073
CVE: CVE-2006-6710
Published: 2006-12-23
Description: Multiple PHP remote file inclusion vulnerabilities in PgmReloaded 0.8.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang parameter to (a) index.php, the (2) CFG[libdir] and (3) CFG[localedir] parameters to (b) common.inc.php, and the CFG[localelangdir] parameter to (c) form_header.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/23480; http://www.securityfocus.com/bid/21696; http://www.vupen.com/english/advisories/2006/5116
CVE: CVE-2006-6711
Published: 2006-12-23
Description: PHP remote file inclusion vulnerability in compteur/mapage.php in Newxooper 0.9.1 allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23479; http://www.securityfocus.com/bid/21699; http://www.vupen.com/english/advisories/2006/5118
CVE: CVE-2006-6712
Published: 2006-12-23
Description: Cross-site scripting (XSS) vulnerability in SugarCRM Open Source 4.5.0f and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in crafted email messages.
CVSS Score: 6.8 (MEDIUM)
References: http://dl.sugarforge.org/sugardocs/Notes/ReleaseNotes/SugarOpenSource_ReleaseNotes_4.5.0g.pdf; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/23424
CVE: CVE-2006-6713
Published: 2006-12-23
Description: Buffer overflow in Hitachi Directory Server 2 P-2444-A124 before 02-11-/K on Windows, and P-1B44-A121 before 02-10-/V on HP-UX, allows remote attackers to execute arbitrary code via crafted LDAP requests.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23421; http://www.hitachi-support.com/security_e/vuls_e/HS06-018_e/01-e.html; http://www.securityfocus.com/bid/21692
CVE: CVE-2006-6714
Published: 2006-12-23
Description: Multiple memory leaks in Hitachi Directory Server 2 P-2444-A124 before 02-11-/K on Windows, and P-1B44-A121 before 02-10-/V on HP-UX, allow remote attackers to cause a denial of service (memory consumption) via invalid LDAP requests.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/23421; http://www.hitachi-support.com/security_e/vuls_e/HS06-018_e/01-e.html; http://www.securityfocus.com/bid/21692