deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-2358
Published: 2006-05-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in various scripts in Web-Labs CMS allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter and (2) unspecified fields related to e-mail alerts.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20060; http://www.securityfocus.com/bid/17956; http://www.vupen.com/english/advisories/2006/1783
CVE: CVE-2006-2359
Published: 2006-05-15
Description: Cross-site scripting (XSS) vulnerability in charts.php in the Chart mod for phpBB allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this issue might be resultant from SQL injection.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/433715/100/0/threaded; http://www.securityfocus.com/archive/1/433848/100/0/threaded; http://www.securityfocus.com/archive/1/434461/100/0/threaded
CVE: CVE-2006-2360
Published: 2006-05-15
Description: SQL injection vulnerability in charts.php in the Chart mod for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/433715/100/0/threaded; http://www.securityfocus.com/archive/1/433848/100/0/threaded; http://www.securityfocus.com/archive/1/434461/100/0/threaded
CVE: CVE-2006-2361
Published: 2006-05-15
Description: PHP remote file inclusion vulnerability in pafiledb_constants.php in Download Manager (mxBB pafiledb) integration, as used with phpBB, allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20062; http://www.osvdb.org/25507; http://www.securityfocus.com/bid/17930
CVE: CVE-2006-2362
Published: 2006-05-15
Description: Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787, CWE-787
References: http://lists.apple.com/archives/security-announce/2007/Oct/msg00001.html; http://secunia.com/advisories/20188; http://secunia.com/advisories/20531
CVE: CVE-2006-2363
Published: 2006-05-15
Description: SQL injection vulnerability in the weblinks option (weblinks.html.php) in Limbo CMS allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-16, CWE-89
References: http://forum.limboforge.org/index.php?topic=6.0; http://secunia.com/advisories/19891; http://securityreason.com/securityalert/893
CVE: CVE-2006-2364
Published: 2006-05-15
Description: Cross-site scripting (XSS) vulnerability in the validation feature in Macromedia ColdFusion 5 and earlier allows remote attackers to inject arbitrary web script or HTML via a "_required" field when the associated normal field is missing or empty, which is not sanitized before being presented in an error message.
CVSS Score: 5.8 (MEDIUM)
References: http://securityreason.com/securityalert/894; http://www.securityfocus.com/archive/1/433819; http://www.securityfocus.com/bid/17938
CVE: CVE-2006-2365
Published: 2006-05-15
Description: Cross-site scripting (XSS) vulnerability in a_login.php in Vizra allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://www.securityfocus.com/bid/17949; http://www.securityfocus.com/data/vulnerabilities/exploits/Vizra-0511-xss.txt; http://www.securityfocus.com/bid/17949
CVE: CVE-2006-2366
Published: 2006-05-15
Description: ircp_io.c in libopenobex for ircp 1.2, when ircp is run with the -r option, does not prompt the user when overwriting files, which allows user-assisted remote attackers to overwrite dangerous files via an arbitrary destination file name in an OBEX File Transfer session.
CVSS Score: 2.6 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=366484; http://secunia.com/advisories/20302; http://www.securityfocus.com/bid/17921
CVE: CVE-2006-2367
Published: 2006-05-15
Description: Cross-site scripting (XSS) vulnerability in index.php in Clansys (aka Clanpage System) 1.0 and 1.1 allows remote attackers to inject arbitrary web script or HTML via the func parameter in a search function.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0238.html; http://secunia.com/advisories/19609; http://securityreason.com/securityalert/892
CVE: CVE-2006-2368
Published: 2006-05-15
Description: Cross-site scripting (XSS) vulnerability in index.php in Clansys (aka Clanpage System) 1.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0238.html; http://secunia.com/advisories/19609; http://securityreason.com/securityalert/892
CVE: CVE-2006-2369
Published: 2006-05-15
Description: RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1131&w=2; http://marc.info/?l=vnc-list&m=[PII_REDACTED]0188&w=2; http://seclists.org/fulldisclosure/2022/May/29
CVE: CVE-2006-2390
Published: 2006-05-16
Description: Cross-site scripting (XSS) vulnerability in OZJournals 1.2 allows remote attackers to inject arbitrary web script or HTML via the vname parameter in the comments functionality.
CVSS Score: 5.8 (MEDIUM)
References: http://kiki91.altervista.org/exploit/ozjournals.txt; http://secunia.com/advisories/20091; http://www.securityfocus.com/bid/17954
CVE: CVE-2006-2391
Published: 2006-05-16
Description: Buffer overflow in EMC Retrospect Client 5.1 through 7.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet to port 497.
CVSS Score: 7.5 (HIGH)
References: http://kb.dantz.com/display/2n/articleDirect/index.asp?aid=9511; http://secunia.com/advisories/20080; http://securitytracker.com/id?1016063
CVE: CVE-2006-2392
Published: 2006-05-16
Description: PHP remote file inclusion vulnerability in public_includes/pub_popup/popup_finduser.php in PHP Blue Dragon Platinum 2.8.0 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20115; http://www.osvdb.org/25533; http://www.securityfocus.com/bid/17977
CVE: CVE-2006-2393
Published: 2006-05-16
Description: The client_cmd function in Empire 4.3.2 and earlier allows remote attackers to cause a denial of service (application crash) by causing long text strings to be appended to the player->client buffer, which causes an invalid memory access.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/empiredos-adv.txt; http://empserver.cvs.sourceforge.net/empserver/empserver/src/lib/player/; http://secunia.com/advisories/20094
CVE: CVE-2006-2394
Published: 2006-05-16
Description: Cross-site scripting (XSS) vulnerability in chat.php in PHP Live Helper allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://securityreason.com/securityalert/895; http://www.securityfocus.com/archive/1/433888/100/0/threaded; http://www.securityfocus.com/bid/17960
CVE: CVE-2006-2395
Published: 2006-05-16
Description: PHP remote file inclusion vulnerability in resources/includes/popp.config.loader.inc.php in PopSoft Digital PopPhoto Studio 3.5.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter (cfg['popphoto_base_path'] variable).  NOTE: Pixaria has notified CVE that "PopPhoto is NOT a product of Pixaria.  It was a product of PopSoft Digital and is only hosted by Pixaria as a courtesy... The vulnerability listed was patched by the previous vendor and all previous users have received this update."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://pridels0.blogspot.com/2006/05/popphoto-remote-file-inclusion-vuln.html; http://secunia.com/advisories/20087; http://securitytracker.com/id?1016092
CVE: CVE-2006-2396
Published: 2006-05-16
Description: Cross-site scripting (XSS) vulnerability in phpODP 1.5h allows remote attackers to inject arbitrary web script via the browse parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://kiki91.altervista.org/exploit/open.txt; http://secunia.com/advisories/20111; http://www.osvdb.org/25496
CVE: CVE-2006-2397
Published: 2006-05-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in GPhotos 1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) rep parameter to (a) index.php or (b) diapo.php or (2) image parameter to (c) affich.php.  NOTE: item 1a might be resultant from directory traversal.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20095; http://securityreason.com/securityalert/906; http://www.osvdb.org/25497
CVE: CVE-2006-2398
Published: 2006-05-16
Description: Directory traversal vulnerability in index.php in GPhotos 1.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the rep parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20095; http://securityreason.com/securityalert/906; http://www.osvdb.org/25500
CVE: CVE-2006-2399
Published: 2006-05-16
Description: Stack-based buffer overflow in the ServerNetworking::incoming_client_data function in servnet.cpp in Outgun 1.0.3 bot 2 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a data_file_request command with a long (1) type or (2) name string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/outgunx-adv.txt; http://secunia.com/advisories/20098; http://securityreason.com/securityalert/898
CVE: CVE-2006-2400
Published: 2006-05-16
Description: The leetnet functions (leetnet/rudp.cpp) in Outgun 1.0.3 bot 2 and earlier allow remote attackers to cause a denial of service (game interruption) via large packets, which cause an exception to be thrown.
CVSS Score: 7.8 (HIGH)
References: http://aluigi.altervista.org/adv/outgunx-adv.txt; http://secunia.com/advisories/20098; http://securityreason.com/securityalert/898
CVE: CVE-2006-2401
Published: 2006-05-16
Description: The leetnet functions (leetnet/rudp.cpp) in Outgun 1.0.3 bot 2 and earlier allow remote attackers to cause a denial of service (application crash) via packets with incorrect message sizes, which triggers a buffer over-read.
CVSS Score: 7.8 (HIGH)
References: http://aluigi.altervista.org/adv/outgunx-adv.txt; http://secunia.com/advisories/20098; http://securityreason.com/securityalert/898
CVE: CVE-2006-2402
Published: 2006-05-16
Description: Buffer overflow in the changeRegistration function in servernet.cpp for Outgun 1.0.3 bot 2 and earlier allows remote attackers to change the registration information of other players via a long string.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/outgunx-adv.txt; http://secunia.com/advisories/20098; http://securityreason.com/securityalert/898
CVE: CVE-2006-2403
Published: 2006-05-16
Description: Buffer overflow in FileZilla before 2.2.23 allows remote attackers to execute arbitrary commands via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20086; http://sourceforge.net/project/shownotes.php?release_id=416790; http://www.osvdb.org/29970
CVE: CVE-2006-2404
Published: 2006-05-16
Description: Directory traversal vulnerability in popup.php in RadScripts RadLance Gold 7.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the read parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/RadLance-0515-lfi.pl; http://secunia.com/advisories/20133; http://www.osvdb.org/25522
CVE: CVE-2006-2405
Published: 2006-05-16
Description: Directory traversal vulnerability in unb_lib/abbc.conf.php in Unclassified NewsBoard (UNB) 1.6.1 patch 1 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing null byte (%00) in the ABBC[Config][smileset] parameter to unb_lib/abbc.css.php.
CVSS Score: 6.8 (MEDIUM)
References: http://newsboard.unclassified.de/forum/post/6499; http://retrogod.altervista.org/unb_161p1_incl_xpl.html; http://secunia.com/advisories/20090
CVE: CVE-2006-2406
Published: 2006-05-16
Description: Directory traversal vulnerability in bb_lib/abbc.css.php in Unclassified NewsBoard (UNB) 1.5.3-d and possibly earlier versions, when register_globals is enabled, allows remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing null byte (%00) in the design_path parameter.  NOTE: this is closely related, but a different vulnerability than the ABBC[Config][smileset] parameter.
CVSS Score: 2.6 (LOW)
References: http://attrition.org/pipermail/vim/2006-May/000769.html; http://newsboard.unclassified.de/forum/post/6499; http://www.osvdb.org/25494
CVE: CVE-2006-2407
Published: 2006-05-16
Description: Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10, allows remote attackers to execute arbitrary code via a long key exchange algorithm string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2488&w=2; http://secunia.com/advisories/19845; http://secunia.com/advisories/19846
CVE: CVE-2006-2408
Published: 2006-05-16
Description: Multiple buffer overflows in Raydium before SVN revision 310 allow remote attackers to execute arbitrary code via a large packet when logged via (1) the raydium_log function in log.c or (2) the raydium_console_line_add function in console.c, possibly from a long player name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/raydiumx-adv.txt; http://raydium.org/svn.php; http://secunia.com/advisories/20097
CVE: CVE-2006-2409
Published: 2006-05-16
Description: Format string vulnerability in the raydium_log function in console.c in Raydium before SVN revision 310 allows local users to execute arbitrary code via format string specifiers in the format parameter, which are not properly handled in a call to raydium_console_line_add.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/raydiumx-adv.txt; http://raydium.org/svn.php; http://secunia.com/advisories/20097
CVE: CVE-2006-2410
Published: 2006-05-16
Description: raydium_network_netcall_exec function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to cause a denial of service (application crash) via a packet of type 0xFF, which causes a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/raydiumx-adv.txt; http://secunia.com/advisories/20097; http://securityreason.com/securityalert/900
CVE: CVE-2006-2411
Published: 2006-05-16
Description: Buffer overflow in raydium_network_read function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to execute arbitrary code by sending packets with long global variables to the client.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/raydiumx-adv.txt; http://secunia.com/advisories/20097; http://securityreason.com/securityalert/900
CVE: CVE-2006-2412
Published: 2006-05-16
Description: The raydium_network_read function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to cause a denial of service (application crash) via a large ID, which causes an invalid memory access (buffer over-read).
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/raydiumx-adv.txt; http://secunia.com/advisories/20097; http://securityreason.com/securityalert/900
CVE: CVE-2006-2413
Published: 2006-05-16
Description: GNUnet before SVN revision 2781 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an empty UDP datagram, possibly involving FIONREAD errors.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/gnunetzero-adv.txt; http://secunia.com/advisories/20096; http://securityreason.com/securityalert/907
CVE: CVE-2006-2414
Published: 2006-05-16
Description: Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command.
CVSS Score: 5.0 (MEDIUM)
References: http://dovecot.org/list/dovecot-cvs/2006-May/005563.html; http://secunia.com/advisories/20308; http://secunia.com/advisories/20315
CVE: CVE-2006-2415
Published: 2006-05-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in FlexChat 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) CFTOKEN parameter in (a) index.cfm and (3) CFTOKEN and (4) CFID parameter in (b) chat.cfm.
CVSS Score: 5.8 (MEDIUM)
References: http://pridels0.blogspot.com/2006/05/flexchat-xss.html; http://secunia.com/advisories/20101; http://securitytracker.com/id?1016104
CVE: CVE-2006-2416
Published: 2006-05-16
Description: SQL injection vulnerability in class2.php in e107 0.7.2 and earlier allows remote attackers to execute arbitrary SQL commands via a cookie as defined in $pref['cookie_name'].
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/20089; http://securityreason.com/securityalert/905; http://www.osvdb.org/25521
CVE: CVE-2006-2417
Published: 2006-05-16
Description: Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 allows remote attackers to inject arbitrary web script or HTML via the theme parameter in unknown scripts.  NOTE: the lang parameter is already covered by CVE-2006-2031.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html; http://secunia.com/advisories/20113; http://secunia.com/advisories/20627
CVE: CVE-2006-2418
Published: 2006-05-16
Description: Cross-site scripting (XSS) vulnerabilities in certain versions of phpMyAdmin before 2.8.0.4 allow remote attackers to inject arbitrary web script or HTML via the db parameter in unknown scripts.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html; http://secunia.com/advisories/20113; http://secunia.com/advisories/20627
CVE: CVE-2006-2419
Published: 2006-05-16
Description: Cross-site scripting (XSS) vulnerability in index.php in Directory Listing Script allows remote attackers to inject arbitrary web script or HTML via the dir parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://kiki91.altervista.org/exploit/dir.txt; http://secunia.com/advisories/20118; http://www.vupen.com/english/advisories/2006/1803
CVE: CVE-2006-2420
Published: 2006-05-16
Description: Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with HTML encoded sequences such as "&gt;", which are automatically decoded by some RSS readers.  NOTE: this issue is not in Bugzilla itself, but rather due to design or documentation inconsistencies within RSS, or implementation vulnerabilities in RSS readers.  While this issue normally would not be included in CVE, it is being identified since the Bugzilla developers have addressed it.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5484&w=2; http://secunia.com/advisories/18979; http://www.bugzilla.org/security/2.18.4
CVE: CVE-2006-1953
Published: 2006-05-17
Description: Directory traversal vulnerability in Caucho Resin 3.0.17 and 3.0.18 for Windows allows remote attackers to read arbitrary files via a "C:%5C" (encoded drive letter) in a URL.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0026.html; http://secunia.com/advisories/20125; http://securityreason.com/securityalert/904
CVE: CVE-2006-2421
Published: 2006-05-17
Description: Stack-based buffer overflow in Pragma FortressSSH 4.0.7.20 allows remote attackers to execute arbitrary code via long SSH_MSG_KEXINIT messages, which may cause an overflow when being logged.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20114; http://www.securityfocus.com/bid/17991; http://www.vupen.com/english/advisories/2006/1820
CVE: CVE-2006-2422
Published: 2006-05-17
Description: phpCOIN 1.2.3 and earlier stores messages based upon e-mail addresses, which allows remote authenticated users to read messages for other users by adding the sender's e-mail address as an "additional contact".
CVSS Score: 5.0 (MEDIUM)
References: http://forums.phpcoin.com/index.php?showtopic=5941; http://secunia.com/advisories/20088; http://www.securityfocus.com/bid/17959
CVE: CVE-2006-2423
Published: 2006-05-17
Description: Cross-site scripting (XSS) vulnerability in ftplogin/index.php in Confixx 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the login parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20105; http://securityreason.com/securityalert/687; http://securityreason.com/securityalert/903
CVE: CVE-2006-2424
Published: 2006-05-17
Description: PHP remote file inclusion vulnerability in ezUserManager 1.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the ezUserManager_Path parameter to ezusermanager_pwd_forgott.php, possibly due to an issue in ezusermanager_core.inc.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20103; http://www.ezusermanager.com/security.php; http://www.osvdb.org/25540
CVE: CVE-2006-2425
Published: 2006-05-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in PRV.php in PhpRemoteView, possibly 2003-10-23 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) f, (2) d, and (3) ref parameters, and the (4) "MAKE DIR" and (5) "Full file name" fields.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20141; http://securityreason.com/securityalert/902; http://soot.shabgard.org/bugs/phpremoteview.txt
CVE: CVE-2006-2426
Published: 2006-05-17
Description: Sun Java Runtime Environment (JRE) 1.5.0_6 and earlier, JDK 1.5.0_6 and earlier, and SDK 1.5.0_6 and earlier allows remote attackers to cause a denial of service (disk consumption) by using the Font.createFont function to create temporary files of arbitrary size in the %temp% directory.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20132; http://secunia.com/advisories/20457; http://secunia.com/advisories/34489
CVE: CVE-2006-2427
Published: 2006-05-17
Description: freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file command line option, which allows local users to read portions of arbitrary files when an error message displays the first line of the target file.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/20085; http://securityreason.com/securityalert/912; http://securitytracker.com/id?1016086