deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3543
Published: 2006-07-13
Description: Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and (2) code parameters in a ketqua action in index.php; the id parameter in a (3) Attach and (4) ref action in index.php; the CODE parameter in a (5) Profile, (6) Login, and (7) Help action in index.php; and the (8) member_id parameter in coins_list.php.  NOTE: the developer has disputed this issue, stating that the "CODE attribute is never present in an SQL query" and the "'ketqua' [action] and file 'coin_list.php' are not standard IPB 2.x features".  It is unknown whether these vectors are associated with an independent module or modification of IPB
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1231; http://www.osvdb.org/30084; http://www.securityfocus.com/archive/1/439145/100/0/threaded
CVE: CVE-2006-3544
Published: 2006-07-13
Description: Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.3 Final allow remote attackers to execute arbitrary SQL commands via the CODE parameter in a (1) Stats, (2) Mail, and (3) Reg action in index.php. NOTE: the developer has disputed this issue, stating that "At no point does the CODE parameter touch the database. The CODE parameter is used in a SWITCH statement to determine which function to run.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1225; http://www.osvdb.org/30084; http://www.securityfocus.com/archive/1/438961/100/0/threaded
CVE: CVE-2006-3545
Published: 2006-07-13
Description: Microsoft Internet Explorer 7.0 Beta allows remote attackers to cause a denial of service (application crash) via a web page with multiple empty APPLET start tags.  NOTE: a third party has disputed this issue, stating that the crash does not occur with Microsoft Internet Explorer 7.0 Beta3
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/438754/100/0/threaded; http://www.securityfocus.com/archive/1/438865/100/0/threaded; http://www.securityfocus.com/bid/18736
CVE: CVE-2006-3546
Published: 2006-07-13
Description: Patrice Freydiere ImgSvr (aka ADA Image Server) allows remote attackers to cause a denial of service (daemon crash) via a long HTTP POST request.  NOTE: this might be the same issue as CVE-2004-2463.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1232; http://www.securityfocus.com/archive/1/438971/100/0/threaded; http://www.securityfocus.com/bid/18784
CVE: CVE-2006-3547
Published: 2006-07-13
Description: EMC VMware Player allows user-assisted attackers to cause a denial of service (unrecoverable application failure) via a long value of the ide1:0.fileName parameter in the .vmx file of a virtual machine.  NOTE: third parties have disputed this issue, saying that write access to the .vmx file enables other ways of stopping the virtual machine, so no privilege boundaries are crossed
CVSS Score: 5.5 (MEDIUM)
References: http://www.osvdb.org/27524; http://www.securityfocus.com/archive/1/437756/100/200/threaded; http://www.securityfocus.com/archive/1/437806/100/200/threaded
CVE: CVE-2006-3548
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047687.html; http://lists.horde.org/archives/announce/2006/000287.html; http://lists.horde.org/archives/announce/2006/000288.html
CVE: CVE-2006-3549
Published: 2006-07-13
Description: services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.horde.org/archives/announce/2006/000287.html; http://lists.horde.org/archives/announce/2006/000288.html; http://moritz-naumann.com/adv/0011/hordemulti/0011.txt
CVE: CVE-2006-3550
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified "writable form fields and hidden fields," including "authentication frontends."
CVSS Score: 2.6 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.html; http://securityreason.com/securityalert/1237; http://securitytracker.com/id?1016431
CVE: CVE-2006-3551
Published: 2006-07-13
Description: NCP Secure Enterprise Client (aka VPN/PKI client) 8.30 Build 59, and possibly earlier versions, when the Link Firewall and Personal Firewall are both configured to block all inbound and outbound network traffic, allows context-dependent attackers to send inbound UDP traffic with source port 67 and destination port 68, and outbound UDP traffic with source port 68 and destination port 67.
CVSS Score: 1.2 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047547.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/27484; http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047547.html
CVE: CVE-2006-3552
Published: 2006-07-13
Description: Premium Anti-Spam in Ipswitch IMail Secure Server 2006 and Collaboration Suite 2006 Premium, when using a certain .dat file in the StarEngine /data directory from 20060630 or earlier, does not properly receive and implement bullet signature updates, which allows context-dependent attackers to use the server for spam transmission.
CVSS Score: 6.4 (MEDIUM)
References: http://ipswitch.com/support/ics/updates/security_advisory_20060630.asp; http://ipswitch.com/support/imail/releases/security_advisory_20060630.asp; http://securitytracker.com/id?1016419
CVE: CVE-2006-3553
Published: 2006-07-13
Description: PlaNet Concept planetNews allows remote attackers to bypass authentication and execute arbitrary code via a direct request to news/admin/planetnews.php.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/1222; http://securitytracker.com/id?1016385; http://www.securityfocus.com/archive/1/438344/100/100/threaded
CVE: CVE-2006-3554
Published: 2006-07-13
Description: Directory traversal vulnerability in index.php in MKPortal 1.0.1 Final allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language cookie, as demonstrated by using a gl_session cookie to inject PHP sequences into the error.log file, which is then included by index.php with malicious commands accessible by the ind parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20884; http://securityreason.com/securityalert/1234; http://securitytracker.com/id?1016403
CVE: CVE-2006-3555
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer.
CVSS Score: 5.8 (MEDIUM)
References: http://php-fusion.co.uk/news.php; http://secunia.com/advisories/20904; http://securityreason.com/securityalert/1224
CVE: CVE-2006-3556
Published: 2006-07-13
Description: PHP remote file inclusion vulnerability in extcalendar.php in Mohamed Moujami ExtCalendar 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://advisories.echo.or.id/adv/adv36-matdhule-2006.txt; http://securityreason.com/securityalert/1227; http://www.securityfocus.com/archive/1/439451/100/0/threaded
CVE: CVE-2006-3557
Published: 2006-07-13
Description: MT Orumcek Toplist 2.2 stores DB/orumcektoplist.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1235; http://www.securityfocus.com/archive/1/439611/100/0/threaded; http://securityreason.com/securityalert/1235
CVE: CVE-2006-3558
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Arif Supriyanto auraCMS 1.62 allow remote attackers to inject arbitrary web script or HTML via (1) the judul_artikel parameter in teman.php and (2) the title of an article sent to admin, which is displayed when unauthenticated users visit index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://h1.ripway.com/lintah/adv/txt/01-iFX-2006-AuraCMS-v1.62-XSS-Bug.txt; http://securityreason.com/securityalert/1226; http://www.osvdb.org/28200
CVE: CVE-2006-3559
Published: 2006-07-13
Description: Multiple SQL injection vulnerabilities in Arif Supriyanto auraCMS 1.62 allow remote attackers to execute arbitrary SQL commands and delete all shoutbox messages via the (1) name and (2) pesan parameters.
CVSS Score: 7.5 (HIGH)
References: http://h1.ripway.com/lintah/adv/txt/01-iFX-2006-AuraCMS-v1.62-XSS-Bug.txt; http://securityreason.com/securityalert/1226; http://www.osvdb.org/28201
CVE: CVE-2006-3560
Published: 2006-07-13
Description: SQL injection vulnerability in topics.php in Blue Dojo Graffiti Forums 1.0 allows remote attackers to execute arbitrary SQL commands via the f parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21017; http://securityreason.com/securityalert/1221; http://www.neosecurityteam.net/index.php?action=advisories&id=24
CVE: CVE-2006-3561
Published: 2006-07-13
Description: BT Voyager 2091 Wireless firmware 2.21.05.08m_A2pB018c1.d16d and earlier, and 3.01m and earlier, allow remote attackers to bypass the authentication process and gain sensitive information, such as configuration information via (1) /btvoyager_getconfig.sh, PPP credentials via (2) btvoyager_getpppcreds.sh, and decode configuration credentials via (3) btvoyager_decoder.c.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://ikwt.dyndns.org/projects/btvoyager-getconfig.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047733.html; http://secunia.com/advisories/20982
CVE: CVE-2006-3562
Published: 2006-07-13
Description: PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to execute arbitrary PHP code via a URL in the _PX_config[manager_path] parameter to (1) index.php, (2) rss.php, or (3) search.php, a different set of vectors and versions than CVE-2006-2645 and CVE-2006-0725.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/1220; http://securitytracker.com/id?1016426; http://www.securityfocus.com/archive/1/438948/100/100/threaded
CVE: CVE-2006-3563
Published: 2006-07-13
Description: Cross-site scripting (XSS) vulnerability in gallery/thumb.php in Winged Gallery 1.0 allows remote attackers to inject arbitrary web script or HTML via the image parameter.
CVSS Score: 2.6 (LOW)
References: http://securityreason.com/securityalert/1219; http://www.securityfocus.com/archive/1/438435/100/200/threaded; http://www.securityfocus.com/bid/18629
CVE: CVE-2006-3564
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the email, (2) cond, or (3) name parameters to (a) addressbook.view.php, (4) the daysprune parameter to (b) index.php, (5) the data[to] parameter to (c) compose.email.php, and (6) the markas parameter to (d) read.markas.php.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/07/hivemail-vuln.html; http://secunia.com/advisories/20993; http://securitytracker.com/id?1016531
CVE: CVE-2006-3565
Published: 2006-07-13
Description: SQL injection vulnerability in search.results.php in HiveMail 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the fields[] parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/07/hivemail-vuln.html; http://secunia.com/advisories/20993; http://securitytracker.com/id?1016531
CVE: CVE-2006-3566
Published: 2006-07-13
Description: search.results.php in HiveMail 3.1 and earlier allows remote attackers to obtain the installation path via certain manipulations related to the (1) searchdate and (2) folderids parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2006/07/hivemail-vuln.html; http://securitytracker.com/id?1016531; http://www.osvdb.org/27104
CVE: CVE-2006-3567
Published: 2006-07-13
Description: Cross-site scripting (XSS) vulnerability in the web administration interface logging feature in Juniper Networks (Redline) DX 5.1.x, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the username login field.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20990; http://securityreason.com/securityalert/1218; http://securitytracker.com/id?1016462
CVE: CVE-2006-3568
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in guestbook.php in Fantastic Guestbook 2.0.1, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) first_name, (2) last_name, or (3) nickname parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://it.security.netsons.org/exploit/FGB.txt; http://secunia.com/advisories/21024; http://www.osvdb.org/27107
CVE: CVE-2006-3569
Published: 2006-07-13
Description: Unspecified vulnerability in NetApp Data ONTAP 7.0x through 7.0.4P8D9, 7.1x, 7.1.0.1x, and 7.2RC1, RC2, and RC3, as used in IBM N series Filers and other products, allows unauthorized users to gain access to privileged commands via unknown vectors, probably related to incorrect capabilities with the audit role.
CVSS Score: 4.6 (MEDIUM)
References: http://now.netapp.com/NOW/products/vulnerability_0601/; http://secunia.com/advisories/20984; http://www-1.ibm.com/support/docview.wss?rs=0&uid=ssg1S1002910
CVE: CVE-2006-3570
Published: 2006-07-13
Description: Cross-site scripting (XSS) vulnerability in the webform module in Drupal 4.6 before July 8, 2006 and 4.7 before July 8, 2006 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://drupal.org/node/72846; http://secunia.com/advisories/21021; http://www.securityfocus.com/bid/18947
CVE: CVE-2006-3571
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in interna/hilfe.php in Papoo 3 RC3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) titel or (2) ausgabe parameters.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/20978; http://securityreason.com/securityalert/1217; http://securitytracker.com/id?1016461
CVE: CVE-2006-3572
Published: 2006-07-13
Description: SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary SQL commands via the msgid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20978; http://securityreason.com/securityalert/1217; http://securitytracker.com/id?1016461
CVE: CVE-2006-3573
Published: 2006-07-13
Description: Format string vulnerability in the WriteText function in agl_text.cpp in Milan Mimica Sparklet 0.9.4 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a player nickname.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/sparkletfs-adv.txt; http://secunia.com/advisories/20974; http://securitytracker.com/id?1016443
CVE: CVE-2006-3574
Published: 2006-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Hitachi Groupmax Collaboration Portal and Web Client before 07-20-/D, and uCosminexus Collaboration Portal and Forum/File Sharing before 06-20-/C, allow remote attackers to "execute malicious scripts" via unknown vectors (aka HS06-014-01).
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20926; http://www.hitachi-support.com/security_e/vuls_e/HS06-014_e/01-e.html; http://www.hitachi-support.com/security_e/vuls_e/HS06-014_e/index-e.html
CVE: CVE-2006-3575
Published: 2006-07-13
Description: Unknown vulnerability in the Buffer Overflow Protection in McAfee VirusScan Enterprise 8.0.0 allows local users to cause a denial of service (unstable operation) via a long string in the (1) "Process name", (2) "Module name", or (3) "API name" fields.
CVSS Score: 2.1 (LOW)
References: http://securityreason.com/securityalert/1216; http://securitytracker.com/id?1016450; http://www.securityfocus.com/archive/1/439430/100/0/threaded
CVE: CVE-2006-3576
Published: 2006-07-13
Description: SQL injection vulnerability in search.php in SenseSites CommonSense CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the Date parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/18893; http://www.securityfocus.com/bid/18893
CVE: CVE-2006-3577
Published: 2006-07-13
Description: SQL injection vulnerability in index.php in LifeType 1.0.5 allows remote attackers to execute arbitrary SQL commands via the Date parameter in a Default op.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/LifeType105SQLInjJuly052006.pl; http://www.securityfocus.com/bid/18835; http://downloads.securityfocus.com/vulnerabilities/exploits/LifeType105SQLInjJuly052006.pl
CVE: CVE-2006-3578
Published: 2006-07-13
Description: Directory traversal vulnerability in Fujitsu ServerView 2.50 up to 3.60L98 and 4.10L11 up to 4.11L81 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/21011
CVE: CVE-2006-3579
Published: 2006-07-13
Description: Cross-site scripting (XSS) vulnerability in Fujitsu ServerView 2.50 up to 3.60L98 and 4.10L11 up to 4.11L81 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/21011
CVE: CVE-2006-3580
Published: 2006-07-13
Description: SQL injection vulnerability in pages.asp in ASP Stats Generator before 2.1.2 allows remote attackers to execute arbitrary SQL commands via the order parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20721; http://securitytracker.com/id?1016336; http://www.hamid.ir/security/aspstats.txt
CVE: CVE-2006-3453
Published: 2006-07-13
Description: Buffer overflow in Adobe Acrobat 6.0 to 6.0.4 allows remote attackers to execute arbitrary code via unknown vectors in a document that triggers the overflow when it is distilled to PDF.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21014; http://securitytracker.com/id?1016477; http://www.adobe.com/support/security/bulletins/apsb06-09.html
CVE: CVE-2006-3581
Published: 2006-07-13
Description: Multiple stack-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via large (1) DTM and (2) S3M files.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://adplug.cvs.sourceforge.net/adplug/adplug/src/dtm.cpp?view=log#rev1.17; http://aluigi.altervista.org/adv/adplugbof-adv.txt; http://secunia.com/advisories/20972
CVE: CVE-2006-3582
Published: 2006-07-13
Description: Multiple heap-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via the size specified in the package header of (1) CFF, (2) MTK, (3) DMO, and (4) U6M files.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://adplug.cvs.sourceforge.net/adplug/adplug/src/cff.cpp?r1=1.16&r2=1.17; http://aluigi.altervista.org/adv/adplugbof-adv.txt; http://secunia.com/advisories/20972
CVE: CVE-2006-1302
Published: 2006-07-13
Description: Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with certain crafted fields in a SELECTION record, which triggers memory corruption, aka "Malformed SELECTION record Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/1238; http://securitytracker.com/id?1016472; http://www.nsfocus.com/english/homepage/research/0605.htm
CVE: CVE-2006-1304
Published: 2006-07-13
Description: Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted COLINFO record, which triggers the overflow during a "data filling operation."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1016472; http://www.nsfocus.com/english/homepage/research/0606.htm; http://www.securityfocus.com/archive/1/439909/100/0/threaded
CVE: CVE-2006-1306
Published: 2006-07-13
Description: Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted BIFF record with an attacker-controlled array index that is used for a function pointer, aka "Malformed OBJECT record Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1016472; http://secway.org/advisory/AD20060711.txt; http://www.securityfocus.com/archive/1/439884/100/0/threaded
CVE: CVE-2006-2388
Published: 2006-07-13
Description: Microsoft Office Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via malformed cell comments, which lead to modification of "critical data offsets" during the rebuilding process.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1016472; http://www.securityfocus.com/archive/1/439786/100/0/threaded; http://www.securityfocus.com/bid/18938
CVE: CVE-2006-3135
Published: 2006-07-13
Description: Multiple SQL injection vulnerabilities in CMS Mundo 1.0 build 008, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter in the (a) news module, (2) searchstring parameter in (b) the search module, (3) id parameter in (c) the webshop module, (4) username parameter in (d) index.php, and (5) Name, (6) Address, (7) Zip, (8) City, (9) Country, and (10) Email fields during (e) a user profile update.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20589; http://secunia.com/secunia_research/2006-52/advisory/; http://securityreason.com/securityalert/1236
CVE: CVE-2006-3587
Published: 2006-07-13
Description: Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to execute arbitrary commands via a malformed .swf file that results in "multiple improper memory access" errors.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html; http://secunia.com/advisories/20971; http://secunia.com/advisories/21865
CVE: CVE-2006-3588
Published: 2006-07-13
Description: Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to cause a denial of service (browser crash) via a malformed, compressed .swf file, a different issue than CVE-2006-3587.
CVSS Score: 2.6 (LOW)
References: http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html; http://secunia.com/advisories/21865; http://secunia.com/advisories/21901