deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4303
Published: 2006-08-23
Description: Race condition in (1) libnsl and (2) TLI/XTI API routines in Sun Solaris 10 allows remote attackers to cause a denial of service ("tight loop" and CPU consumption for listener applications) via unknown vectors related to TCP fusion (do_tcp_fusion).
CVSS Score: 2.6 (LOW)
References: http://securitytracker.com/id?1016706; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102576-1; https://exchange.xforce.ibmcloud.com/vulnerabilities/28420
CVE: CVE-2006-4262
Published: 2006-08-23
Description: Multiple buffer overflows in cscope 15.5 and earlier allow user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple vectors including (1) a long pathname that is not properly handled during file list parsing, (2) long pathnames that result from path variable expansion such as tilde expansion for the HOME environment variable, and (3) a long -f (aka reffile) command line argument.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/21601; http://secunia.com/advisories/22239; http://secunia.com/advisories/22515
CVE: CVE-2006-2932
Published: 2006-08-23
Description: A regression error in the restore_all code path of the 4/4GB split support for non-hugemem Linux kernels on Red Hat Linux Desktop and Enterprise Linux 4 allows local users to cause a denial of service (panic) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/21605; http://secunia.com/advisories/22174; http://support.avaya.com/elmodocs2/security/ASA-2006-203.htm
CVE: CVE-2006-3745
Published: 2006-08-23
Description: Unspecified vulnerability in the sctp_make_abort_user function in the SCTP implementation in Linux 2.6.x before 2.6.17.10 and 2.4.23 up to 2.4.33 allows local users to cause a denial of service (panic) and possibly gain root privileges via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0600.html; http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.33.2; http://secunia.com/advisories/21576
CVE: CVE-2006-4306
Published: 2006-08-23
Description: Unspecified vulnerability in Sun Solaris 8 and 9 before 20060821 allows local users to execute arbitrary commands via unspecified vectors, involving the default Role-Based Access Control (RBAC) settings in the "File System Management" profile.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/21581; http://secunia.com/advisories/22295; http://securitytracker.com/id?1016726
CVE: CVE-2006-4307
Published: 2006-08-23
Description: Unspecified vulnerability in the format command in Sun Solaris 8 and 9 before 20060821 allows local users to modify arbitrary files via unspecified vectors involving profiles that permit running format with elevated privileges, a different issue than CVE-2006-4306 and CVE-2006-4319.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/21581; http://secunia.com/advisories/22295; http://securitytracker.com/id?1016726
CVE: CVE-2006-4308
Published: 2006-08-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Learning System 6, Blackboard Learning and Community Portal Suite 6.2.3.23, and Blackboard Vista 4 allow remote attackers to inject arbitrary Javascript, VBScript, or HTML via (1) data, (2) vbscript, and (3) malformed javascript URIs in various HTML tags when posting to the Discussion Board.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/21577; http://securitytracker.com/id?1016735; http://www.securityfocus.com/archive/1/444062/100/0/threaded
CVE: CVE-2006-4309
Published: 2006-08-23
Description: VNC server on the AK-Systems Windows Terminal 1.2.5 ExVLP is not password protected, which allows remote attackers to login and view RDP or Citrix sessions.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/1438; http://www.securityfocus.com/archive/1/444060/100/0/threaded; http://www.securityfocus.com/bid/19659
CVE: CVE-2006-4310
Published: 2006-08-23
Description: Mozilla Firefox 1.5.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FTP response, when attempting to connect with a username and password via the FTP URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/23197; http://secunia.com/advisories/23202; http://secunia.com/advisories/23235
CVE: CVE-2006-4311
Published: 2006-08-23
Description: PHP remote file inclusion vulnerability in Sonium Enterprise Adressbook 0.2 allows remote attackers to execute arbitrary PHP code via the folder parameter in multiple files in the plugins directory, as demonstrated by plugins/1_Adressbuch/delete.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21553; http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_%28folder%29_RFI.htm; http://www.securityfocus.com/archive/1/443701/100/0/threaded
CVE: CVE-2006-4312
Published: 2006-08-23
Description: Cisco PIX 500 Series Security Appliances and ASA 5500 Series Adaptive Security Appliances, when running 7.0(x) up to 7.0(5) and 7.1(x) up to 7.1(2.4), and Firewall Services Module (FWSM) 3.1(x) up to 3.1(1.6), causes the EXEC password, local user passwords, and the enable password to be changed to a "non-random value" under certain circumstances, which causes administrators to be locked out and might allow attackers to gain access.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21616; http://securitytracker.com/id?1016738; http://securitytracker.com/id?1016739
CVE: CVE-2006-4313
Published: 2006-08-23
Description: Multiple unspecified vulnerabilities in Cisco VPN 3000 series concentrators before 4.1, 4.1.x up to 4.1(7)L, and 4.7.x up to 4.7(2)F allow attackers to execute the (1) CWD, (2) MKD, (3) CDUP, (4) RNFR, (5) SIZE, and (6) RMD FTP commands to modify files or create and delete directories via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21617; http://securitytracker.com/id?1016737; http://www.cisco.com/warp/public/707/cisco-sa-20060823-vpn3k.shtml
CVE: CVE-2006-4314
Published: 2006-08-23
Description: The manager server in Symantec Enterprise Security Manager (ESM) 6 and 6.5.x allows remote attackers to cause a denial of service (hang) via a malformed ESM agent request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21548; http://securityreason.com/securityalert/1437; http://securitytracker.com/id?1016728
CVE: CVE-2006-4315
Published: 2006-08-23
Description: Unquoted Windows search path vulnerability in multiple SSH Tectia products, including Client/Server/Connector 5.0.0 and 5.0.1 and Client/Server before 4.4.5, and Manager 2.12 and earlier, when running on Windows, might allow local users to gain privileges via a malicious program file under "Program Files" or its subdirectories.
CVSS Score: 7.2 (HIGH)
References: http://securitytracker.com/id?1016743; http://www.securityfocus.com/bid/19679; http://www.ssh.com/company/news/2006/english/security/article/775/
CVE: CVE-2006-4316
Published: 2006-08-23
Description: SSH Tectia Management Agent 2.1.2 allows local users to gain root privileges by running a program called sshd, which is obtained from a process listing when the "Restart" action is selected from the Management server GUI, which causes the agent to locate the pathname of the user's program and restart it with root privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/21559; http://securitytracker.com/id?1016744; http://www.osvdb.org/28159
CVE: CVE-2006-4304
Published: 2006-08-24
Description: Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1, NetBSD 2.0 through 4.0 beta before 20060823, and OpenBSD 3.8 and 3.9 before 20060902 allows remote attackers to cause a denial of service (panic), obtain sensitive information, and possibly execute arbitrary code via crafted Link Control Protocol (LCP) packets with an option length that exceeds the overall length, which triggers the overflow in (1) pppoe and (2) ippp.  NOTE: this issue was originally incorrectly reported for the ppp driver.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-019.txt.asc; http://secunia.com/advisories/21587; http://secunia.com/advisories/21731
CVE: CVE-2006-4317
Published: 2006-08-24
Description: Cross-site scripting (XSS) vulnerability in attachment.php in WoltLab Burning Board (WBB) 2.3.5 allows remote attackers to inject arbitrary web script or HTML via a GIF image that contains URL-encoded Javascript.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21580; http://securityreason.com/securityalert/1443; http://www.securityfocus.com/archive/1/443876/100/0/threaded
CVE: CVE-2006-4318
Published: 2006-08-24
Description: Buffer overflow in WFTPD Server 3.23 allows remote attackers to execute arbitrary code via long SIZE commands.
CVSS Score: 6.5 (MEDIUM)
References: http://packetstormsecurity.org/0608-exploits/wftpd_exp.c; http://secunia.com/advisories/21547; http://securitytracker.com/id?1016723
CVE: CVE-2006-4319
Published: 2006-08-24
Description: Buffer overflow in the format command in Solaris 8, 9, and 10 allows local users with access to format (such as the "File System Management" RBAC profile) to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2006-4307.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/21581; http://secunia.com/advisories/22295; http://securitytracker.com/id?1016727
CVE: CVE-2006-4320
Published: 2006-08-24
Description: PHP remote file inclusion vulnerability in sef.php in the OpenSEF 2.0.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1016722; http://www.securityfocus.com/archive/1/443745/100/0/threaded; http://www.securityfocus.com/bid/19600
CVE: CVE-2006-4321
Published: 2006-08-24
Description: PHP remote file inclusion vulnerability in cpg.php in the Coppermine Photo Gallery component (com_cpg) 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21539; http://www.osvdb.org/27970; http://www.securityfocus.com/bid/19589
CVE: CVE-2006-4322
Published: 2006-08-24
Description: PHP remote file inclusion vulnerability in estateagent.php in the EstateAgent component (com_estateagent) for Mambo, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.attrition.org/pipermail/vim/2006-August/000984.html; http://www.securityfocus.com/archive/1/443911/100/0/threaded; http://www.securityfocus.com/bid/19625
CVE: CVE-2006-4323
Published: 2006-08-24
Description: SQL injection vulnerability in list.php in CityForFree indexcity 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/135/description.html; http://secunia.com/advisories/21565; http://www.osvdb.org/28069
CVE: CVE-2006-4324
Published: 2006-08-24
Description: Cross-site scripting (XSS) vulnerability in add_url2.php in CityForFree indexcity 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://evuln.com/vulns/135/description.html; http://secunia.com/advisories/21565; http://www.osvdb.org/28070
CVE: CVE-2006-4325
Published: 2006-08-24
Description: Cross-site scripting (XSS) vulnerability in gbook.php in Doika guestbook 2.5, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://evuln.com/vulns/134/description.html; http://secunia.com/advisories/21549; http://www.osvdb.org/28068
CVE: CVE-2006-4326
Published: 2006-08-24
Description: Stack-based buffer overflow in Justsystem Ichitaro 9.x through 13.x, Ichitaro 2004, 2005, 2006, and Government 2006; Ichitaro for Linux; and FormLiner before 20060818 allows remote attackers to execute arbitrary code via long Unicode strings in a crafted document, as being actively exploited by malware such as Trojan.Tarodrop.  NOTE: some details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/21552; http://www.justsystem.co.jp/info/pd6002.html; http://www.securityfocus.com/bid/19550
CVE: CVE-2006-4327
Published: 2006-08-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in add_url.php in CloudNine Interactive Links Manager 2006-06-12 allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) description, or (3) keywords parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://evuln.com/vulns/136/description.html; http://secunia.com/advisories/21560; http://www.osvdb.org/28067
CVE: CVE-2006-4328
Published: 2006-08-24
Description: SQL injection vulnerability in admin.php in CloudNine Interactive Links Manager 2006-06-12, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the nick parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://evuln.com/vulns/136/description.html; http://secunia.com/advisories/21560; http://www.osvdb.org/28066
CVE: CVE-2006-4329
Published: 2006-08-24
Description: Multiple PHP remote file inclusion vulnerabilities in Shadows Rising RPG (Pre-Alpha) 0.0.5b and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONFIG[gameroot] parameter to (1) core/includes/security.inc.php, (2) core/includes/smarty.inc.php, (3) qcms/includes/smarty.inc.php or (4) qlib/smarty.inc.php.
CVSS Score: 7.5 (HIGH)
References: http://www.attrition.org/pipermail/vim/2006-August/000986.html; http://www.osvdb.org/28282; http://www.osvdb.org/28283
CVE: CVE-2006-4330
Published: 2006-08-24
Description: Unspecified vulnerability in the SCSI dissector in Wireshark (formerly Ethereal) 0.99.2 allows remote attackers to cause a denial of service (crash) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21597; http://secunia.com/advisories/21619; http://secunia.com/advisories/21649
CVE: CVE-2006-4331
Published: 2006-08-24
Description: Multiple off-by-one errors in the IPSec ESP preference parser in Wireshark (formerly Ethereal) 0.99.2 allow remote attackers to cause a denial of service (crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21597; http://secunia.com/advisories/21619; http://secunia.com/advisories/21649
CVE: CVE-2006-4332
Published: 2006-08-24
Description: Unspecified vulnerability in the DHCP dissector in Wireshark (formerly Ethereal) 0.10.13 through 0.99.2, when run on Windows, allows remote attackers to cause a denial of service (crash) via unspecified vectors that trigger a bug in Glib.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21597; http://secunia.com/advisories/21619; http://secunia.com/advisories/21649
CVE: CVE-2006-4333
Published: 2006-08-24
Description: The SSCOP dissector in Wireshark (formerly Ethereal) before 0.99.3 allows remote attackers to cause a denial of service (resource consumption) via malformed packets that cause the Q.2391 dissector to use excessive memory.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/21597; http://secunia.com/advisories/21619; http://secunia.com/advisories/21649
CVE: CVE-2006-4344
Published: 2006-08-24
Description: CRLF injection vulnerability in CGI-Rescue Mail F/W System (formd) before 8.3 allows remote attackers to spoof e-mails and inject e-mail headers via unspecified vectors in (1) mail.cgi and (2) query.cgi.
CVSS Score: 5.0 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/21543; http://www.osvdb.org/28131
CVE: CVE-2006-4345
Published: 2006-08-24
Description: Stack-based buffer overflow in channels/chan_mgcp.c in MGCP in Asterisk 1.0 through 1.2.10 allows remote attackers to execute arbitrary code via a crafted audit endpoint (AUEP) response.
CVSS Score: 7.5 (HIGH)
References: http://ftp.digium.com/pub/asterisk/ChangeLog-1.2.11; http://labs.musecurity.com/advisories/MU-200608-01.txt; http://secunia.com/advisories/21600
CVE: CVE-2006-4346
Published: 2006-08-24
Description: Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable.
CVSS Score: 7.5 (HIGH)
References: http://labs.musecurity.com/advisories/MU-200608-01.txt; http://secunia.com/advisories/22651; http://securitytracker.com/id?1016742
CVE: CVE-2006-4347
Published: 2006-08-24
Description: SQL injection vulnerability in user logon authentication request handling in Cool_CoolD.exe in Cool Manager 5.0 (5,60,90,28) and Cool Messenger Office/School Server 5.5 (5,65,12,13) allows remote attackers to execute arbitrary SQL commands via the username field.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0605.html; http://secunia.com/advisories/21569; http://vuln.sg/coolmessenger55-en.html
CVE: CVE-2006-4348
Published: 2006-08-24
Description: PHP remote file inclusion vulnerability in config.kochsuite.php in the Kochsuite (com_kochsuite) 0.9.4 component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1447; http://www.osvdb.org/28098; http://www.securityfocus.com/archive/1/443703/100/0/threaded
CVE: CVE-2006-4349
Published: 2006-08-24
Description: PHP remote file inclusion vulnerability in ToendaCMS 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tcms_administer_site parameter to an unspecified script, probably index.php.  NOTE: this issue has been disputed by a third party, who states that $tcms_administer_site is initialized to a constant value within index.php
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/29358; http://www.securityfocus.com/archive/1/443918/100/0/threaded; http://www.securityfocus.com/archive/1/444236/100/0/threaded
CVE: CVE-2006-4350
Published: 2006-08-24
Description: SQL injection vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1448; http://securityreason.com/securityalert/1460; http://www.securityfocus.com/archive/1/443631/100/0/threaded
CVE: CVE-2006-4351
Published: 2006-08-24
Description: Cross-site scripting (XSS) vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1448; http://www.securityfocus.com/archive/1/443631/100/0/threaded; http://securityreason.com/securityalert/1448
CVE: CVE-2006-2112
Published: 2006-08-25
Description: Fuji Xerox Printing Systems (FXPS) print engine, as used in products including (1) Dell 3000cn through 5110cn and (2) Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, allows remote attackers to use the FTP printing interface as a proxy ("FTP bounce") by using arbitrary PORT arguments to connect to systems for which access would be otherwise restricted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://itso.iu.edu/20060824_FXPS_Print_Engine_Vulnerabilities; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3454&w=2; http://secunia.com/advisories/21630
CVE: CVE-2006-2113
Published: 2006-08-25
Description: The embedded HTTP server in Fuji Xerox Printing Systems (FXPS) print engine, as used in products including (1) Dell 3000cn through 5110cn and (2) Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, does not properly perform authentication for HTTP requests, which allows remote attackers to modify system configuration via crafted requests, including changing the administrator password or causing a denial of service to the print server.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://itso.iu.edu/20060824_FXPS_Print_Engine_Vulnerabilities; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3454&w=2; http://secunia.com/advisories/21630
CVE: CVE-2006-3743
Published: 2006-08-25
Description: Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attackers to execute arbitrary code via crafted XCF images.
CVSS Score: 5.1 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://bugs.gentoo.org/show_bug.cgi?id=144854; http://secunia.com/advisories/21615
CVE: CVE-2006-3744
Published: 2006-08-25
Description: Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun Rasterfile (bitmap) images that trigger heap-based buffer overflows.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-189
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://bugs.gentoo.org/show_bug.cgi?id=144854; http://secunia.com/advisories/21615
CVE: CVE-2006-4352
Published: 2006-08-25
Description: The ArrowPoint cookie functionality for Cisco 11000 series Content Service Switches specifies an internal IP address if the administrator does not specify a string option, which allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/117/AP_cookies.html; http://www.osvdb.org/28121; http://www.cisco.com/warp/public/117/AP_cookies.html
CVE: CVE-2006-4353
Published: 2006-08-25
Description: Unspecified vulnerability in Sun Java System Content Delivery Server 4.0, 4.1, and 5.0 allows local and remote attackers to read data from arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21628; http://securitytracker.com/id?1016751; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102593-1
CVE: CVE-2006-3124
Published: 2006-08-26
Description: Buffer overflow in the HTTP header parsing in Streamripper before 1.61.26 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted HTTP headers.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/streamripper-aug292006.c; http://secunia.com/advisories/21579; http://secunia.com/advisories/21658
CVE: CVE-2006-4365
Published: 2006-08-26
Description: Multiple PHP remote file inclusion vulnerabilities in VistaBB 2.0.33 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) includes/functions_mod_user.php or (2) includes/functions_portal.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2219&w=2; http://secunia.com/advisories/21602; http://www.nukedx.com/?viewdoc=48
CVE: CVE-2006-4366
Published: 2006-08-26
Description: PHP remote file inclusion vulnerability in index.php in RedBLoG 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/30311; http://www.securityfocus.com/bid/19658; http://www.securityfocus.com/data/vulnerabilities/exploits/19658-rfi.html
CVE: CVE-2006-4367
Published: 2006-08-26
Description: SQL injection vulnerability in alltopics.php in the All Topics Hack 1.5.0 and earlier for phpBB 2.0.21 allows remote attackers to execute arbitrary SQL commands via the start parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19682; https://exchange.xforce.ibmcloud.com/vulnerabilities/28538; https://www.exploit-db.com/exploits/2248