deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3890
Published: 2006-11-21
Description: Stack-based buffer overflow in the Sky Software FileView ActiveX control, as used in WinZip 10 before build 7245 and in certain other applications, allows remote attackers to execute arbitrary code via a long FilePattern attribute in a WZFILEVIEW object, a different vulnerability than CVE-2006-5198.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/22891; http://www.kb.cert.org/vuls/id/225217; http://www.securityfocus.com/archive/1/451566/100/0/threaded
CVE: CVE-2006-6007
Published: 2006-11-21
Description: save_profile.asp in WebEvents (Online Event Registration Template) 2.0 and earlier allows remote attackers to change the profiles, passwords, and other information for arbitrary users via a modified UserID parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1888; http://www.securityfocus.com/archive/1/451411/100/0/threaded; http://securityreason.com/securityalert/1888
CVE: CVE-2006-6008
Published: 2006-11-21
Description: ftpd in Linux Netkit (linux-ftpd) 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different vulnerability than CVE-2006-5778.
CVSS Score: 6.5 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454; http://bugs.gentoo.org/show_bug.cgi?id=150292; http://ftp.debian.org/debian/pool/main/l/linux-ftpd/linux-ftpd_0.17-22.diff.gz
CVE: CVE-2006-6009
Published: 2006-11-21
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) Swing library in JDK and JRE 5.0 Update 7 and earlier allows attackers to obtain certain information via unknown attack vectors, related to an untrusted applet accessing data in other applets.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22910; http://securitytracker.com/id?1017229; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1
CVE: CVE-2006-6010
Published: 2006-11-21
Description: SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerability than CVE-2003-0747.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1889; http://www.securityfocus.com/archive/1/451378/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/39997
CVE: CVE-2006-6011
Published: 2006-11-21
Description: Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to port 64999, aka "two bytes UDP crash," a different vulnerability than CVE-2006-5785.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1889; http://www.securityfocus.com/archive/1/451378/100/0/threaded; http://securityreason.com/securityalert/1889
CVE: CVE-2006-6012
Published: 2006-11-21
Description: Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbitrary web script or HTML via the p parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/4532; https://exchange.xforce.ibmcloud.com/vulnerabilities/30274; http://www.vupen.com/english/advisories/2006/4532
CVE: CVE-2006-6013
Published: 2006-11-21
Description: Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf->len in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0261.html; http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c; http://mail-index.netbsd.org/tech-security/2006/11/16/0001.html
CVE: CVE-2006-6014
Published: 2006-11-21
Description: The NetBSD-current kernel before 20061028 does not properly perform bounds checking of an unspecified userspace parameter in the ptrace system call during a PT_DUMPCORE request, which allows local users to have an unknown impact.
CVSS Score: 7.2 (HIGH)
References: http://mail-index.netbsd.org/current-users/2006/11/10/0000.html; http://mail-index.netbsd.org/current-users/2006/11/10/0000.html
CVE: CVE-2006-6015
Published: 2006-11-21
Description: Buffer overflow in the JavaScript implementation in Safari on Apple Mac OS X 10.4 allows remote attackers to cause a denial of service (application crash) via a long argument to the exec method of a regular expression.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/451542/100/0/threaded; http://www.securityfocus.com/archive/1/451823/100/0/threaded; http://www.securityfocus.com/bid/21053
CVE: CVE-2006-6016
Published: 2006-11-21
Description: wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified user_id parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://bugs.gentoo.org/show_bug.cgi?id=153303; http://trac.wordpress.org/ticket/3142; http://www.gentoo.org/security/en/glsa/glsa-200611-10.xml
CVE: CVE-2006-6017
Published: 2006-11-21
Description: WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service (application crash) via a string that represents a (1) malformed or (2) large serialized object, because the object triggers automatic unserialization for display.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://bugs.gentoo.org/show_bug.cgi?id=153303; http://trac.wordpress.org/ticket/2591; http://www.gentoo.org/security/en/glsa/glsa-200611-10.xml
CVE: CVE-2006-6018
Published: 2006-11-21
Description: PHP remote file inclusion vulnerability in mybic_server.php in Jim Plush My-BIC 0.6.5 allows remote attackers to execute arbitrary PHP code via a URL in the INC_PATH parameter, a different vector than CVE-2006-5089.  NOTE: this issue is disputed by CVE and third party researchers because INC_PATH is a constant
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2006-November/001127.html; http://osvdb.org/31542; http://securityreason.com/securityalert/1891
CVE: CVE-2006-6019
Published: 2006-11-21
Description: Cross-site scripting (XSS) vulnerability in extensions/googiespell/googlespell_proxy.php in Bill Roberts Bloo 1.0 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/451777/100/0/threaded; http://www.securityfocus.com/bid/21130; http://www.xmors.com/forum/index.php?topic=1175.msg5782%3Btopicsen
CVE: CVE-2006-6020
Published: 2006-11-21
Description: Cross-site scripting (XSS) vulnerability in announce.php in Blog Torrent Preview 0.92 allows remote attackers to inject arbitrary web script or HTML via the left parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1895; http://www.securityfocus.com/archive/1/451856/100/0/threaded; http://www.securityfocus.com/bid/21125
CVE: CVE-2006-6021
Published: 2006-11-21
Description: SQL injection vulnerability in the login component in BestWebApp Dating Site allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23017; http://securityreason.com/securityalert/1898; http://www.securityfocus.com/archive/1/451963/100/0/threaded
CVE: CVE-2006-6022
Published: 2006-11-21
Description: Cross-site scripting (XSS) vulnerability in login_form.asp in BestWebApp Dating Site allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23017; http://securityreason.com/securityalert/1898; http://www.securityfocus.com/archive/1/451963/100/0/threaded
CVE: CVE-2006-6023
Published: 2006-11-21
Description: PHP remote file inclusion vulnerability in phoo.base.php in Bill Roberts Bloo 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the descriptorFileList parameter.  NOTE: this issue is disputed by CVE since $descriptorFileList is used in a function definition within phoo.base.php
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1893; http://www.attrition.org/pipermail/vim/2006-November/001137.html; http://www.securityfocus.com/archive/1/451818/100/0/threaded
CVE: CVE-2006-6024
Published: 2006-11-21
Description: Multiple buffer overflows in Eudora Worldmail, possibly Worldmail 3 version 6.1.22.0, have unknown impact and attack vectors, as demonstrated by the (1) "Eudora WorldMail stack overflow" and (2) "Eudora WorldMail heap overflow" modules in VulnDisco Pack.  NOTE: Some of these details are obtained from third party information. As of 20061118, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://secunia.com/advisories/22832; http://web.archive.org/web/[PII_REDACTED]2657/http://www.gleg.net/vulndisco_pack_standard.shtml; http://www.securityfocus.com/bid/21095
CVE: CVE-2006-6025
Published: 2006-11-21
Description: QUALCOMM Eudora WorldMail 4.0 allows remote attackers to cause a denial of service, as demonstrated by a certain module in VulnDisco Pack.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. As of 20061118, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://secunia.com/advisories/22836; http://web.archive.org/web/[PII_REDACTED]2622/www.gleg.net/vulndisco_pack_professional.shtml; http://www.securityfocus.com/bid/21099
CVE: CVE-2006-6026
Published: 2006-11-21
Description: Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.0 and 11.1, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a DESCRIBE request that contains an invalid LoadTestPassword field.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://docs.real.com/docs/security/SecurityUpdate032107Server.pdf; http://gleg.net/helix.txt; http://lists.helixcommunity.org/pipermail/server-cvs/2007-January/003783.html
CVE: CVE-2006-6027
Published: 2006-11-21
Description: Adobe Reader (Adobe Acrobat Reader) 7.0 through 7.0.8 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument string to the LoadFile method in an AcroPDF ActiveX control.
CVSS Score: 9.3 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/21155-AcroPDF_DoS.html; http://research.eeye.com/html/alerts/zeroday/20061128.html; http://secunia.com/advisories/23138
CVE: CVE-2006-6028
Published: 2006-11-21
Description: Directory traversal vulnerability in textview.php in Anton Vlasov DoSePa 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) sequence or absolute file path in the file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22960; http://www.craigheffner.com/security/exploits/dosepa.txt; http://www.securityfocus.com/bid/21149
CVE: CVE-2006-6029
Published: 2006-11-21
Description: SQL injection vulnerability in vir_Login.asp in Property Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the UserName field.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1894; http://www.securityfocus.com/archive/1/451364/100/100/threaded; http://www.securityfocus.com/archive/1/474321/100/0/threaded
CVE: CVE-2006-6030
Published: 2006-11-21
Description: Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd (Password) fields in (a) admin/default.asp; or the (3) Event Title, (4) Location, or (5) Description field when making a search engine query in (b) search.asp.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22897; http://securityreason.com/securityalert/1897; http://www.securityfocus.com/archive/1/451729/100/0/threaded
CVE: CVE-2006-6031
Published: 2006-11-21
Description: Multiple SQL injection vulnerabilities in Greater Cincinnati Internet Solutions (GCIS) ASPCart allow remote attackers to execute arbitrary SQL commands via (1) the prodid parameter in (a) prodetails.asp; (2) the page parameter in (b) display.asp; the (3) custid, (4) item, (5) price, (6) custom, (7) department, (8) start, (9) quantity, (10) submit, (11) custom1, (12) custom2, or (13) custom3 parameters in (c) addcart.asp; or the (14) customerid parameter in (d) payment.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22946; http://securityreason.com/securityalert/1899; http://www.securityfocus.com/archive/1/451858/100/0/threaded
CVE: CVE-2006-6032
Published: 2006-11-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog (SPHPBlog), probably 0.4.8, allow remote attackers to inject arbitrary web script or HTML via (1) the action parameter in add_block.php or (2) the entry parameter in index.php, different vectors than CVE-2005-1135.  NOTE: this has been reported to affect 0.8, but as of 20061121, the most recent version is only 0.4.9.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1896; http://www.securityfocus.com/archive/1/451855/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30362
CVE: CVE-2006-6033
Published: 2006-11-21
Description: Multiple directory traversal vulnerabilities in Simple PHP Blog (SPHPBlog), probably 0.4.8, allow remote attackers to read arbitrary files and possibly include arbitrary PHP code via a .. (dot dot) sequence in the blog_theme parameter in (1) index.php, (2) add_cgi.php, (3) add_link.php, (4) login.php, (5) template.php, or (6) contact.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1892; http://www.securityfocus.com/archive/1/451954/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30383
CVE: CVE-2006-6034
Published: 2006-11-21
Description: Multiple SQL injection vulnerabilities in SitesOutlet E-commerce Kit-1 PayPal Edition allow remote attackers to execute arbitrary SQL commands via the (1) keyword or (2) cid parameter in (a) catalogue.asp, or the (3) pid parameter in (b) viewDetail.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22975; http://securityreason.com/securityalert/1900; http://www.securityfocus.com/archive/1/451771/100/0/threaded
CVE: CVE-2006-6035
Published: 2006-11-22
Description: Cross-site scripting (XSS) vulnerability in list.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the FADDR parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6907&w=2; http://secunia.com/advisories/23025; http://securitytracker.com/id?1017250
CVE: CVE-2006-6036
Published: 2006-11-22
Description: SQL injection vulnerability in OpenHuman before 1.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://freshmeat.net/projects/openhuman/?branch_id=67092&release_id=240896; http://www.osvdb.org/30337; http://www.vupen.com/english/advisories/2006/4574
CVE: CVE-2006-6037
Published: 2006-11-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dan Jensen Travelsized CMS 0.4.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) page, (2) page_id, or (3) language parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8248&w=2; http://secunia.com/advisories/23021; http://securitytracker.com/id?1017251
CVE: CVE-2006-6038
Published: 2006-11-22
Description: SQL injection vulnerability in editpoll.php in Powie's PHP Forum (pForum) 1.29a and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/22964; http://www.securityfocus.com/bid/21144; http://www.vupen.com/english/advisories/2006/4607
CVE: CVE-2006-6039
Published: 2006-11-22
Description: SQL injection vulnerability in matchdetail.php in Powie's PHP MatchMaker 4.05 and earlier allows remote attackers to execute arbitrary SQL commands via the edit parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22966; http://www.securityfocus.com/bid/21145; http://www.vupen.com/english/advisories/2006/4611
CVE: CVE-2006-6040
Published: 2006-11-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the prefs parameter in a buildnavprefs action or (2) the navprefs parameter in a savenavprefs action.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23011; http://securityreason.com/securityalert/1903; http://www.securityfocus.com/archive/1/451959/100/0/threaded
CVE: CVE-2006-6041
Published: 2006-11-22
Description: Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other versions before 3.0.4, allow remote attackers to execute arbitrary PHP code via a URL in the g_include parameter to (1) index.php, (2) module/forum/forum.php, (3) unspecified files under module/, and (4) unspecified files under administration/module/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/22963; http://securitytracker.com/id?1017249; http://www.securityfocus.com/archive/1/451860/100/200/threaded
CVE: CVE-2006-6042
Published: 2006-11-22
Description: PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the editor_insert_bottom parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23001; http://www.securityfocus.com/archive/1/470794/100/0/threaded; http://www.securityfocus.com/bid/21178
CVE: CVE-2006-6043
Published: 2006-11-22
Description: PHP file inclusion vulnerability in loginform-inc.php in Oliver (formerly Webshare) 1.2.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the conf[motdfile] parameter, which is accessed by the file_exists function.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23031; http://www.securityfocus.com/bid/21202/info; http://www.vupen.com/english/advisories/2006/4608
CVE: CVE-2006-6044
Published: 2006-11-22
Description: PHP remote file inclusion vulnerability in gallery_top.inc.php in PHPQuickGallery 1.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the textFile parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22989; http://securitytracker.com/id?1017256; http://www.securityfocus.com/archive/1/452104/100/100/threaded
CVE: CVE-2006-6045
Published: 2006-11-22
Description: Multiple PHP remote file inclusion vulnerabilities in Comdev One Admin Pro 4.1 allow remote attackers to execute arbitrary PHP code via a URL in the path[skin] parameter to (1) adminfoot.php, (2) adminhead.php, or (3) adminlogin.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22947; http://securityreason.com/securityalert/1902; http://securitytracker.com/id?1017247
CVE: CVE-2006-6046
Published: 2006-11-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in eggblog 3.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) edit parameter to (a) admin/articles.php or (b) admin/comments.php, or the (2) add parameter to admin/users.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8955&w=2; http://securitytracker.com/id?1017246; http://www.securityfocus.com/bid/21134
CVE: CVE-2006-6047
Published: 2006-11-22
Description: Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/22885; http://www.0xcafebabe.it/sploits/etm_0612_remote_com.pl; http://www.etomite.org/forums/index.php?showtopic=6388
CVE: CVE-2006-6048
Published: 2006-11-22
Description: SQL injection vulnerability in index.php in Etomite CMS 0.6.1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/22885; http://www.0xcafebabe.it/sploits/etm_0612_sqlinj.pl; http://www.etomite.org/forums/index.php?showtopic=6388
CVE: CVE-2006-6049
Published: 2006-11-22
Description: PHP remote file inclusion vulnerability in shambo2.php in the Shambo2 (com_shambo2) component for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22870; http://www.osvdb.org/30370; http://www.securityfocus.com/archive/1/451347/100/100/threaded
CVE: CVE-2006-6050
Published: 2006-11-22
Description: Multiple SQL injection vulnerabilities in ClickTech Texas Rank'em allow remote attackers to execute arbitrary SQL commands via the (1) selPlayer parameter to player.asp or the (2) tournament_id parameter to tournaments.asp.
CVSS Score: 7.5 (HIGH)
References: http://www.aria-security.com/forum/showthread.php?t=34; http://www.securityfocus.com/archive/1/452017/100/0/threaded; http://www.securityfocus.com/bid/21168
CVE: CVE-2006-6051
Published: 2006-11-22
Description: PHP remote file inclusion vulnerability in reporter.logic.php in the MosReporter (com_reporter) component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/451960/100/0/threaded; http://www.securityfocus.com/bid/21160; https://exchange.xforce.ibmcloud.com/vulnerabilities/30410
CVE: CVE-2006-6052
Published: 2006-11-22
Description: NetEpi Case Manager before 0.98 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.
CVSS Score: 5.0 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?release_id=463793; http://www.vupen.com/english/advisories/2006/4570; https://exchange.xforce.ibmcloud.com/vulnerabilities/30366
CVE: CVE-2006-5868
Published: 2006-11-22
Description: Multiple buffer overflows in Imagemagick 6.0 before 6.0.6.2, and 6.2 before 6.2.4.5, has unknown impact and user-assisted attack vectors via a crafted SGI image.
CVSS Score: 9.3 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://secunia.com/advisories/22998; http://secunia.com/advisories/23101