deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4256
Published: 2006-08-21
Description: index.php in Horde Application Framework before 3.1.2 allows remote attackers to include web pages from other sites, which could be useful for phishing attacks, via a URL in the url parameter, aka "cross-site referencing." NOTE: some sources have referred to this issue as XSS, but it is different than classic XSS.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.horde.org/archives/announce/2006/000292.html; http://secunia.com/advisories/21500; http://secunia.com/advisories/27565
CVE: CVE-2006-4257
Published: 2006-08-21
Description: IBM DB2 Universal Database (UDB) before 8.1 FixPak 13 allows remote authenticated users to cause a denial of service (crash) by (1) sending the first ACCSEC command without an RDBNAM parameter during the CONNECT process, or (2) sending crafted SQLJRA packet, which results in a null dereference.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT; http://secunia.com/advisories/21550; http://www-1.ibm.com/support/docview.wss?uid=swg24013114
CVE: CVE-2006-4258
Published: 2006-08-21
Description: Absolute path traversal vulnerability in the get functionality in Anti-Spam SMTP Proxy (ASSP) allows remote authenticated users to read arbitrary files via (1) C:\ (Windows drive letter), (2) UNC, and possibly other types of paths in the file parameter.
CVSS Score: 4.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048853.html; http://secunia.com/advisories/21523; http://www.securityfocus.com/bid/19545
CVE: CVE-2006-4259
Published: 2006-08-21
Description: Cross-site scripting (XSS) vulnerability in index.php in Fotopholder 1.8 allows remote attackers to inject arbitrary web script or HTML via the path parameter.  NOTE: this might be resultant from a directory traversal vulnerability.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0316.html; http://secunia.com/advisories/21648; http://securityreason.com/securityalert/1421
CVE: CVE-2006-4260
Published: 2006-08-21
Description: Directory traversal vulnerability in index.php in Fotopholder 1.8 allows remote attackers to read arbitrary directories or files via a .. (dot dot) in the path parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0316.html; http://securityreason.com/securityalert/1421; http://securitytracker.com/id?1016702
CVE: CVE-2006-4261
Published: 2006-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-4253.  Reason: This candidate is a duplicate of CVE-2006-4253.  Notes: All CVE users should reference CVE-2006-4253 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-4093
Published: 2006-08-21
Description: Linux kernel 2.x.6 before 2.6.17.9 and 2.4.x before 2.4.33.1 on PowerPC PPC970 systems allows local users to cause a denial of service (crash) related to the "HID0 attention enable on PPC970 at boot time."
CVSS Score: 4.9 (MEDIUM)
References: http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.33.1; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.17.9; http://secunia.com/advisories/21563
CVE: CVE-2006-4263
Published: 2006-08-21
Description: Multiple PHP remote file inclusion vulnerabilities in the Product Scroller Module and other modules in mambo-phpshop (com_phpshop) for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) mod_phpshop.php, (2) mod_phpshop_allinone.php, (3) mod_phpshop_cart.php, (4) mod_phpshop_featureprod.php, (5) mod_phpshop_latestprod.php, (6) mod_product_categories.php, (7) mod_productscroller.php, and (8) mosproductsnap.php.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/28151; http://www.osvdb.org/28152; http://www.osvdb.org/28153
CVE: CVE-2006-4264
Published: 2006-08-21
Description: Multiple PHP remote file inclusion vulnerabilities in the lmtg_myhomepage Component (com_lmtg_myhomepage) for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) install.lmtg_homepage.php and (2) mtg_homepage.php.  NOTE: this issue has been disputed by a third party, who states that the $mosConfig_absolute_path variable is only used within a function definition.  CVE source code analysis on 20060824 is not conclusive but tends to concur with the dispute.  In addition, it appears that the component name is actually "lmtg_myhomepage"
CVSS Score: 9.8 (CRITICAL)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0431.html; http://www.osvdb.org/28087; http://www.osvdb.org/28088
CVE: CVE-2006-4265
Published: 2006-08-21
Description: Kaspersky Anti-Hacker 1.8.180, when Stealth Mode is enabled, allows remote attackers to obtain responses to ICMP (1) timestamp and (2) netmask requests, which is inconsistent with the documented behavior of Stealth Mode.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1427; http://www.securityfocus.com/archive/1/443180/100/100/threaded; http://securityreason.com/securityalert/1427
CVE: CVE-2006-4266
Published: 2006-08-21
Description: Symantec Norton Personal Firewall 2006 9.1.0.33, and possibly earlier, does not properly protect Norton registry keys, which allows local users to provide Trojan horse libraries to Norton by using RegSaveKey and RegRestoreKey to modify HKLM\SOFTWARE\Symantec\CCPD\SuiteOwners, as demonstrated using NISProd.dll.  NOTE: in most cases, this attack would not cross privilege boundaries, because modifying the SuiteOwners key requires administrative privileges.  However, this issue is a vulnerability because the product's functionality is intended to protect against privileged actions such as this.
CVSS Score: 3.6 (LOW)
References: http://securityreason.com/securityalert/1428; http://www.matousec.com/info/advisories/Norton-DLL-faking-via-SuiteOwners-protection-bypass.php; http://www.securityfocus.com/archive/1/443632/100/0/threaded
CVE: CVE-2006-4267
Published: 2006-08-21
Description: Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num parameter in modules/gateway/Authorize/confirmed.php.
CVSS Score: 7.5 (HIGH)
References: http://bugs.cubecart.com/?do=details&id=523; http://retrogod.altervista.org/cubecart_3011_adv.html; http://retrogod.altervista.org/cubecart_3011_sql.html
CVE: CVE-2006-4268
Published: 2006-08-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) file, (2) x, and (3) y parameters in (a) admin/filemanager/preview.php; and the (4) email parameter in (b) admin/login.php.
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.cubecart.com/?do=details&id=523; http://retrogod.altervista.org/cubecart_3011_adv.html; http://secunia.com/advisories/21538
CVE: CVE-2006-4269
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in admin.x-shop.php in the x-shop component (com_x-shop) 1.7 and earlier for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: this issue has been disputed by third party researchers, stating that there is no mosConfig_absolute_path parameter and no admin.x-shop.php file in the reported package
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0427.html; http://www.osvdb.org/28095; http://www.securityfocus.com/archive/1/443625/100/0/threaded
CVE: CVE-2006-4270
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in mambelfish.class.php in the mambelfish component (com_mambelfish) 1.1 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21544; http://securityreason.com/securityalert/1430; http://www.securityfocus.com/archive/1/443672/100/0/threaded
CVE: CVE-2006-4271
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in install/upgrade_301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter.  NOTE: the vendor has disputed this vulnerability, saying "The default vBulletin requires authentication prior to the usage of the upgrade system.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0061.html; http://archives.neohapsis.com/archives/bugtraq/2006-07/0069.html; http://archives.neohapsis.com/archives/bugtraq/2006-07/0121.html
CVE: CVE-2006-4272
Published: 2006-08-21
Description: Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of requests to register.php.  NOTE: the vendor has disputed this vulnerability, stating "If you have the CAPTCHA enabled then the registrations wont even go through. ...  if you are talking about the flood being allowed in the first place then surely this is something that should be handled at the server level.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0381.html; http://securityreason.com/securityalert/1426; http://www.securityfocus.com/archive/1/443648/100/0/threaded
CVE: CVE-2006-4273
Published: 2006-08-21
Description: Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 3.5.4 and 3.6.0 allows remote attackers to inject arbitrary web script or HTML by uploading an attachment with a .pdf extension that contains JavaScript, which is processed as script by Microsoft Internet Explorer 6.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0074.html; http://archives.neohapsis.com/archives/bugtraq/2006-08/0082.html; http://www.osvdb.org/27778
CVE: CVE-2006-4274
Published: 2006-08-21
Description: Rejected reason: Unknown vulnerability in Microsoft PowerPoint allows user-assisted attackers to execute arbitrary code via a crafted PPT document, as exploited by malware such as TROJ_MDROPPER.BH.  NOTE: on 20060822, it was determined that TROJ_MDROPPER.BH was exploiting CVE-2006-0009, so this is not a new vulnerability
CVE: CVE-2006-4275
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in catalogshop.php in the CatalogShop component for Mambo (com_catalogshop) allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1433; http://www.securityfocus.com/archive/1/443758/100/0/threaded; http://www.securityfocus.com/bid/19604
CVE: CVE-2006-4276
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in Tutti Nova 1.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the TNLIB_DIR parameter to novalib/class.novaEdit.mysql.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21572; http://www.osvdb.org/28028; http://www.securityfocus.com/bid/19612
CVE: CVE-2006-4277
Published: 2006-08-21
Description: Multiple PHP remote file inclusion vulnerabilities in Tutti Nova 1.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the TNLIB_DIR parameter to (1) include/novalib/class.novaAdmin.mysql.php and (2) novalib/class.novaRead.mysql.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21572; http://www.osvdb.org/28029; http://www.osvdb.org/28030
CVE: CVE-2006-4278
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in includes/layout/plain.footer.php in SportsPHool 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the mainnav parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21594; http://www.osvdb.org/28038; http://www.securityfocus.com/bid/19610
CVE: CVE-2006-4279
Published: 2006-08-21
Description: SQL injection vulnerability in topic_post.php in XennoBB 2.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the icon_topic parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21575; http://securityreason.com/securityalert/1434; http://www.osvdb.org/28090
CVE: CVE-2006-4280
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in anjel.index.php in ANJEL (formerly MaMML) Component (com_anjel) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: this issue has been disputed by a third party, who says that $mosConfig_absolute_path is set in a configuration file
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0441.html; http://www.osvdb.org/28084; http://www.securityfocus.com/archive/1/443627/100/0/threaded
CVE: CVE-2006-4281
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in akocomments.php in AkoComment 1.1 module (com_akocomment) for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1435; http://www.securityfocus.com/archive/1/443748; http://www.securityfocus.com/bid/19602
CVE: CVE-2006-4282
Published: 2006-08-22
Description: PHP remote file inclusion vulnerability in MamboLogin.php in the MamboWiki component (com_mambowiki) 0.9.6 and earlier for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the IP parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1436; http://www.lyquidity.com/mambo/index.php?option=com_mambowiki&Itemid=134; http://www.securityfocus.com/archive/1/443706/100/0/threaded
CVE: CVE-2006-4283
Published: 2006-08-22
Description: Multiple PHP remote file inclusion vulnerabilities in SOLMETRA SPAW Editor 1.0.6 and 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the spaw_dir parameter in dialogs/ scripts including (1) a.php, (2) collorpicker.php, (3) img.php, (4) img_library.php, (5) table.php, or (6) td.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1432; http://www.securityfocus.com/archive/1/443752/100/0/threaded; http://www.securityfocus.com/bid/19603
CVE: CVE-2006-4284
Published: 2006-08-22
Description: SQL injection vulnerability in comments.asp in LBlog 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21596; http://securityreason.com/securityalert/1445; http://securitytracker.com/id?1016721
CVE: CVE-2006-4285
Published: 2006-08-22
Description: PHP remote file inclusion vulnerability in news.php in Fantastic News 2.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[script_path] parameter.  NOTE: it was later reported that 2.1.5 is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://fscripts.com/index.php; http://secunia.com/advisories/21571; http://www.securityfocus.com/archive/1/457680/100/0/threaded
CVE: CVE-2006-4286
Published: 2006-08-22
Description: PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: this issue has been disputed by third parties who state that contentpublisher.php protects against direct request in the most recent version.  The original researcher is known to be frequently inaccurate
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1431; http://www.osvdb.org/28093; http://www.securityfocus.com/archive/1/443626/100/0/threaded
CVE: CVE-2006-4287
Published: 2006-08-22
Description: Multiple PHP remote file inclusion vulnerabilities in NES Game and NES System c108122 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) phphtmllib parameter to (a) phphtmllib/includes.php; tag_utils/ scripts including (b) divtag_utils.php, (c) form_utils.php, (d) html_utils.php, and (e) localinc.php; and widgets/ scripts including (f) FooterNav.php, (g) HTMLPageClass.php, (h) InfoTable.php, (i) localinc.php, (j) NavTable.php, and (k) TextNav.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21593; http://www.osvdb.org/28044; http://www.osvdb.org/28045
CVE: CVE-2006-4288
Published: 2006-08-22
Description: PHP remote file inclusion vulnerability in admin.a6mambocredits.php in the a6mambocredits component (com_a6mambocredits) 2.0.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21540; http://securitytracker.com/id?1016716; http://www.osvdb.org/27991
CVE: CVE-2006-4289
Published: 2006-08-22
Description: Buffer overflow in Sony VAIO Media Server 2.x, 3.x, 4.x, and 5.x before 20060626 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://kb.sony-europe.com/kb/solutions/en/V00000_V00499/v00246.html; http://secunia.com/advisories/21512; http://www.css.ap.sony.com/VAIO/Website/General/ImportantNotices.aspx?Section=SN&file=/vaio/importantnotice/security_notice/SecurityNotice_VMIS.htm
CVE: CVE-2006-4290
Published: 2006-08-22
Description: Directory traversal vulnerability in Sony VAIO Media Server 2.x, 3.x, 4.x, and 5.x before 20060626 allows remote attackers to gain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://kb.sony-europe.com/kb/solutions/en/V00000_V00499/v00246.html; http://secunia.com/advisories/21512; http://www.pentest.co.uk/documents/ptl-2006-02.html
CVE: CVE-2006-4291
Published: 2006-08-22
Description: PHP remote file inclusion vulnerability in handlers/email/mod.listmail.php in PHlyMail Lite 3.4.4 and earlier (Build 3.04.04) allows remote attackers to execute arbitrary PHP code via a URL in the _PM_[path][handler] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21582; http://securitytracker.com/id?1016718; http://www.securityfocus.com/bid/19587
CVE: CVE-2006-4292
Published: 2006-08-22
Description: Unspecified vulnerability in Niels Provos Honeyd before 1.5b allows remote attackers to cause a denial of service (application crash) via certain Address Resolution Protocol (ARP) packets.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21591; http://www.honeyd.org/release.php?version=1.5b; http://www.securityfocus.com/bid/19614
CVE: CVE-2006-4293
Published: 2006-08-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21592; http://securityreason.com/securityalert/1442; http://www.osvdb.org/28041
CVE: CVE-2006-3869
Published: 2006-08-23
Description: Heap-based buffer overflow in URLMON.DLL in Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1, with versions the MS06-042 patch before 20060824, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long URL on a website that uses HTTP 1.1 compression.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21557; http://securityreason.com/securityalert/1441; http://securitytracker.com/id?1016731
CVE: CVE-2006-4295
Published: 2006-08-23
Description: Cross-site scripting (XSS) vulnerability in ascan_6.asp in Panda ActiveScan 5.53.00 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2006/08/panda-activescan-xss-vulnerability.html; http://securitytracker.com/id?1016696; http://www.osvdb.org/29147
CVE: CVE-2006-4296
Published: 2006-08-23
Description: PHP remote file inclusion vulnerability in classes/Tar.php in bigAPE-Backup component (com_babackup) for Mambo 1.1 allows remote attackers to include arbitrary files via the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21574; http://www.osvdb.org/28032; http://www.securityfocus.com/bid/19616
CVE: CVE-2006-4297
Published: 2006-08-23
Description: SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters.
CVSS Score: 7.5 (HIGH)
References: http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371; http://securitytracker.com/id?1016719; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6
CVE: CVE-2006-4298
Published: 2006-08-23
Description: Multiple directory traversal vulnerabilities in cache.php in osCommerce before 2.2 Milestone 2 060817 allow remote attackers to determine existence of arbitrary files and disclose the installation path via a .. (dot dot) in unspecified parameters in the (1) tep_cache_also_purchased, (2) tep_cache_manufacturers_box, and (3) tep_cache_categories_box functions.
CVSS Score: 5.0 (MEDIUM)
References: http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6; https://exchange.xforce.ibmcloud.com/vulnerabilities/28435
CVE: CVE-2006-4299
Published: 2006-08-23
Description: Cross-site scripting (XSS) vulnerability in tiki-searchindex.php in TikiWiki 1.9.4 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/21536; http://secunia.com/advisories/22100; http://security.gentoo.org/glsa/glsa-200609-16.xml
CVE: CVE-2006-4300
Published: 2006-08-23
Description: SQL injection vulnerability in comments.asp in SimpleBlog 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18488/; http://securityreason.com/securityalert/1440; http://www.securityfocus.com/archive/1/443923/100/0/threaded
CVE: CVE-2006-4301
Published: 2006-08-23
Description: Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) via a long Color attribute in multiple DirectX Media Image DirectX Transforms ActiveX COM Objects from (a) dxtmsft.dll and (b) dxtmsft3.dll, including (1) DXImageTransform.Microsoft.MaskFilter.1, (2) DXImageTransform.Microsoft.Chroma.1, and (3) DX3DTransform.Microsoft.Shapes.1.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/1439; http://www.osvdb.org/29524; http://www.osvdb.org/29525
CVE: CVE-2006-4302
Published: 2006-08-23
Description: The Java Plug-in J2SE 1.3.0_02 through 5.0 Update 5, and Java Web Start 1.0 through 1.2 and J2SE 1.4.2 through 5.0 Update 5, allows remote attackers to exploit vulnerabilities by specifying a JRE version that contain vulnerabilities.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/21570; http://securitytracker.com/id?1016732; http://securitytracker.com/id?1016733