deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0679
Published: 2006-02-16
Description: SQL injection vulnerability in index.php in the Your_Account module in PHP-Nuke 7.8 and earlier allows remote attackers to execute arbitrary SQL commands via the username variable (Nickname field).
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0358.html; http://secunia.com/advisories/18931; http://securityreason.com/achievement_securityalert/32
CVE: CVE-2006-0460
Published: 2006-02-17
Description: Multiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18914; http://secunia.com/advisories/18915; http://secunia.com/advisories/19210
CVE: CVE-2006-0737
Published: 2006-02-17
Description: eStara SIP softphone allows remote attackers to cause a denial of service (crash) via a SIP OPTIONS request with a negative Expires field.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18872; http://www.securityfocus.com/archive/1/424943/100/0/threaded; http://www.securityfocus.com/bid/16629
CVE: CVE-2006-0738
Published: 2006-02-17
Description: Multiple format string vulnerabilities in eStara SIP softphone allow remote attackers to cause a denial of service (hang) via SIP INVITE requests with format string specifiers in the SDP session description, as demonstrated using (1) the field name, (2) the o field (owner/creator and session identifier), or (3) the m field (media name and transport address).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18872; http://www.securityfocus.com/archive/1/424943/100/0/threaded; http://www.securityfocus.com/bid/16629
CVE: CVE-2006-0739
Published: 2006-02-17
Description: eStara SIP softphone allows remote attackers to cause a denial of service (crash) via an INVITE request with a Content-Length field that has more than 9 digits.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18872; http://www.securityfocus.com/archive/1/424943/100/0/threaded; http://www.securityfocus.com/bid/16629
CVE: CVE-2006-0750
Published: 2006-02-18
Description: SQL injection vulnerability in army.php in supersmashbrothers (SSB) Army System 2.1.0 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the userstat parameter in an army action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secubox.shadock.net/Invision_Power_Board_Army_System_Mod_2.1_and_prior_SQL_Injection_Exploit.html; http://secunia.com/advisories/18840; http://www.securityfocus.com/archive/1/424846/100/0/threaded
CVE: CVE-2006-0751
Published: 2006-02-18
Description: Multiple unspecified vulnerabilities in the (1) Filesystem in USErspace (FUSE) client and (2) NOOFS daemon in in Network Object Oriented File System (NOOFS) before 0.9.0 have unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/apps/freshmeat/2006-02/0003.html; http://freshmeat.net/projects/noofs/?branch_id=60557&release_id=218852; http://www.osvdb.org/23052
CVE: CVE-2006-0752
Published: 2006-02-18
Description: Niels Provos Honeyd before 1.5 replies to certain illegal IP packet fragments that other IP stack implementations would drop, which allows remote attackers to identify IP addresses that are being simulated using honeyd.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18867; http://www.honeyd.org/adv.2006-01; http://www.honeyd.org/phpBB2/viewtopic.php?t=106
CVE: CVE-2006-0753
Published: 2006-02-18
Description: Memory leak in Microsoft Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to cause a denial of service (memory consumption) via JavaScript that uses setInterval to repeatedly call a function to set the value of window.status.
CVSS Score: 2.6 (LOW)
References: http://www.osvdb.org/23307; http://www.securityfocus.com/archive/1/424959/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24846
CVE: CVE-2006-0754
Published: 2006-02-18
Description: dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message.  NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18879; http://www.osvdb.org/23206; http://www.securityfocus.com/archive/1/424957/100/0/threaded
CVE: CVE-2006-0755
Published: 2006-02-18
Description: Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary commands via the baseDir parameter in (1) db_adodb.php, (2) db_connect.php, (3) session.php, (4) vw_usr_roles.php, (5) calendar.php, (6) date_format.php, and (7) tasks/gantt.php; and the dPconfig[root_dir] parameter in (8) projects/gantt.php, (9) gantt2.php, and (10) vw_files.php.  NOTE: the vendor disputes this issue, stating that the product documentation clearly recommends that the system administrator disable register_globals, and that the check.php script warns against this setting.  Also, the vendor says that the protection.php/siteurl vector is incorrect because protection.php does not exist in the product
CVSS Score: 5.6 (MEDIUM)
References: http://secunia.com/advisories/18879; http://www.osvdb.org/23209; http://www.osvdb.org/23210
CVE: CVE-2006-0756
Published: 2006-02-18
Description: dotProject 2.0.1 and earlier leaves (1) phpinfo.php and (2) check.php accessible under the /docs/ directory after installation, which allows remote attackers to obtain sensitive configuration information.  NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18879; http://securityreason.com/securityalert/434; http://www.osvdb.org/23207
CVE: CVE-2006-0757
Published: 2006-02-18
Description: Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts, as demonstrated by an addressbook.update.php request with a contactgroupid value of phpinfo() preceded by facilitators.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0162.html; http://forum.hivemail.com/showthread.php?p=26745; http://secunia.com/advisories/18807
CVE: CVE-2006-0758
Published: 2006-02-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via a URL encoded expression in the query string in (1) index.php and (2) possibly certain other scripts, which is not properly cleansed when accessed from the $_SERVER['PHP_SELF'] variable.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0162.html; http://forum.hivemail.com/showthread.php?p=26745; http://secunia.com/advisories/18807
CVE: CVE-2006-0759
Published: 2006-02-18
Description: Multiple SQL injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts; and allow remote authenticated users to execute arbitrary SQL commands via (11) the folderid parameter in index.php and (12) possibly other parameters in certain other scripts, because $_SERVER['PHP_SELF'] is improperly handled.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0162.html; http://forum.hivemail.com/showthread.php?p=26745; http://secunia.com/advisories/18807
CVE: CVE-2006-0760
Published: 2006-02-18
Description: LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.
CVSS Score: 2.6 (LOW)
References: http://lighttpd.net/news/; http://secunia.com/advisories/18869; http://www.lighttpd.net/news/
CVE: CVE-2006-0761
Published: 2006-02-18
Description: Buffer overflow in BlackBerry Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server 2.2 and 4.0 before SP3 Hotfix 4 for IBM Lotus Domino, 3.6 before SP7 and 5.0 before SP3 Hotfix 3 for Microsoft Exchangem, and 4.0 for Novell GroupWise before SP3 Hotfix 1 might allow user-assisted remote attackers to execute arbitrary code on the server via a crafted Microsoft Word document that is opened on a wireless device.
CVSS Score: 5.1 (MEDIUM)
References: http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/8149/8052/Support_-_Corrupt_Word_file_may_cause_buffer_overflow_in_the_BlackBerry_Attachment_Service.html?nodeid=1181753&vernum=2; http://www.securityfocus.com/archive/1/424728/100/0/threaded; http://www.securityfocus.com/bid/16590
CVE: CVE-2006-0762
Published: 2006-02-18
Description: WinAbility Folder Guard 4.11 allows local users to gain unauthorized access to certain capabilities of the application by renaming or moving the password file (FGuard.FGP), which disables the password requirement.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/archive/1/424855/100/0/threaded; http://www.securityfocus.com/archive/1/424905/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24725
CVE: CVE-2006-0763
Published: 2006-02-18
Description: Cross-site scripting (XSS) vulnerability in dowebmailforward.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via a URL encoded value in the fwd parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0129.html; http://www.osvdb.org/22971; https://exchange.xforce.ibmcloud.com/vulnerabilities/24839
CVE: CVE-2006-0764
Published: 2006-02-18
Description: The Authentication, Authorization, and Accounting (AAA) capability in versions 5.0(1) and 5.0(3) of the software used by multiple Cisco Anomaly Detection and Mitigation products, when running with an incomplete TACACS+ configuration without a "tacacs-server host" command, allows remote attackers to bypass authentication and gain privileges, aka Bug ID CSCsd21455.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/18904; http://securityreason.com/securityalert/435; http://securitytracker.com/id?1015637
CVE: CVE-2006-0765
Published: 2006-02-18
Description: GUI display truncation vulnerability in ICQ Inc. (formerly Mirabilis) ICQ 2003a, 2003b, Lite 4.0, Lite 4.1, and possibly other Windows versions allows user-assisted remote attackers to hide malicious file extensions, bypass Windows security warnings via a filename that is all uppercase and of a specific length, which truncates the malicious extension from the display and could trick a user into executing arbitrary programs.
CVSS Score: 5.1 (MEDIUM)
References: http://www.securityfocus.com/archive/1/425078/100/0/threaded; http://www.securityfocus.com/bid/16655; http://www.securityfocus.com/archive/1/425078/100/0/threaded
CVE: CVE-2006-0766
Published: 2006-02-18
Description: ICQ Inc. (formerly Mirabilis) ICQ 2003a, 2003b, Lite 4.0, Lite 4.1, and possibly other Windows versions allows user-assisted remote attackers to hide malicious file extensions and bypass Windows security warnings via a filename that ends in an assumed-safe extension such as JPG, and possibly containing other modified properties such as company name, icon, and description, which could trick a user into executing arbitrary programs.
CVSS Score: 5.1 (MEDIUM)
References: http://www.securityfocus.com/archive/1/425078/100/0/threaded; http://www.securityfocus.com/bid/16655; http://www.securityfocus.com/archive/1/425078/100/0/threaded
CVE: CVE-2006-0042
Published: 2006-02-18
Description: Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers to cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18846; http://secunia.com/advisories/19139; http://secunia.com/advisories/19658
CVE: CVE-2006-0767
Published: 2006-02-18
Description: CGIWrap before 3.10 allows remote attackers to obtain sensitive information via unknown attack vectors that cause errors in scripts that reveal system information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18797; http://sourceforge.net/project/showfiles.php?group_id=8209; http://sourceforge.net/project/shownotes.php?release_id=393274&group_id=8209
CVE: CVE-2006-0768
Published: 2006-02-18
Description: Kadu 0.4.3 allows remote attackers to cause a denial of service (application crash) via a large number of image send requests.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1441&w=2; http://secunia.com/advisories/18824; http://www.piotrbania.com/all/adv/kadu-fun.txt
CVE: CVE-2006-0769
Published: 2006-02-18
Description: Unspecified vulnerability in in.rexecd in Solaris 10 allows local users to gain privileges on Kerberos systems via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/18891; http://securitytracker.com/id?1015635; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102186-1
CVE: CVE-2006-0770
Published: 2006-02-18
Description: Cross-site scripting (XSS) vulnerability in calendar.php in MyBulletinBoard (MyBB) 1.0.4 allows remote attackers to inject arbitrary web script or HTML via a URL that is not sanitized before being returned as a link in "advanced details".  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/18866; http://www.osvdb.org/23264; http://www.vupen.com/english/advisories/2006/0635
CVE: CVE-2006-0771
Published: 2006-02-18
Description: Format string vulnerability in PunkBuster 1.180 and earlier, as used by Soldier of Fortune II and possibly other games, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in invalid cvar values, which are not properly handled when the server kicks the player and records the reason.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/sof2pbfs-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0372.html; http://secunia.com/advisories/18917
CVE: CVE-2006-0772
Published: 2006-02-19
Description: SQL injection vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to execute arbitrary SQL commands via unspecified vectors in the extended receiving box function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/18817; http://www.hitachi-support.com/security_e/vuls_e/HS06-002_e/index-e.html; http://www.osvdb.org/23099
CVE: CVE-2006-0773
Published: 2006-02-19
Description: Cross-site scripting (XSS) vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the extended receiving box function.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18817; http://www.hitachi-support.com/security_e/vuls_e/HS06-002_e/index-e.html; http://www.securityfocus.com/bid/16602
CVE: CVE-2006-0774
Published: 2006-02-19
Description: SQL injection vulnerability in deleteSession() in DB_eSession library 1.0.2 and earlier, as used in multiple products, allows remote attackers to execute arbitrary SQL commands via the $_sess_id_set variable, which is usually derived from PHPSESSID.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18805; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6; http://www.osvdb.org/23104
CVE: CVE-2006-0775
Published: 2006-02-19
Description: Multiple SQL injection vulnerabilities in show.php in BirthSys 3.1 allow remote attackers to execute arbitrary SQL commands via the $month variable.  NOTE: a vector regarding the $date parameter and data.php (date.php) was originally reported, but this appears to be in error.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2006-February/000549.html; http://secunia.com/advisories/18893; http://securityreason.com/securityalert/467
CVE: CVE-2006-0776
Published: 2006-02-19
Description: Cross-site scripting (XSS) vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18927; http://securityreason.com/securityalert/490; http://securitytracker.com/id?1015678
CVE: CVE-2006-0777
Published: 2006-02-19
Description: Unspecified vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to execute arbitrary shell commands via the email parameter, possibly involving shell metacharacters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18927; http://securityreason.com/securityalert/489; http://www.evuln.com/vulns/76/summary.html
CVE: CVE-2006-0778
Published: 2006-02-19
Description: Multiple SQL injection vulnerabilities in XMB Forums 1.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) $u2u_select array parameter to u2u.inc.php and (2) $val variable (fidpw0 cookie value) in today.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18821; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6; http://www.osvdb.org/23117
CVE: CVE-2006-0779
Published: 2006-02-19
Description: Cross-site scripting (XSS) vulnerability in u2u.php in XMB Forums 1.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter, as demonstrated using a URL-encoded iframe tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6; http://www.osvdb.org/23119; http://www.securityfocus.com/archive/1/425084/100/0/threaded
CVE: CVE-2006-0780
Published: 2006-02-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in weblog.pl in PerlBlog 1.09b and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) email parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/81/summary.html; http://secunia.com/advisories/18924; http://securityreason.com/securityalert/508
CVE: CVE-2006-0781
Published: 2006-02-19
Description: Directory traversal vulnerability in weblog.pl in PerlBlog 1.09b and earlier allows remote attackers to read certain files via the month parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://evuln.com/vulns/81/summary.html; http://secunia.com/advisories/18924; http://securityreason.com/securityalert/508
CVE: CVE-2006-0782
Published: 2006-02-19
Description: Unspecified vulnerability in weblog.pl in PerlBlog 1.09b and earlier allows remote attackers to create arbitrary files and possibly execute arbitrary code via unspecified attack vectors related to improper handling of (1) the reply parameter, possibly involving injection of (2) the name parameter and (3) the body parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/81/summary.html; http://secunia.com/advisories/18924; http://securityreason.com/securityalert/508
CVE: CVE-2006-0783
Published: 2006-02-19
Description: Cross-site scripting (XSS) vulnerability in page.php in in Siteframe Beaumont, possibly 5.0.2 or 5.0.1a, allows remote attackers to inject arbitrary web script or HTML via the comment_text parameter to the user comment page (/edit/Comment).
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18892; http://securityreason.com/securityalert/443; http://www.osvdb.org/23267
CVE: CVE-2006-0784
Published: 2006-02-19
Description: D-Link DWL-G700AP with firmware 2.00 and 2.01 allows remote attackers to cause a denial of service (CAMEO HTTP service crash) via a request composed of "GET" followed by a space and two newlines, possibly triggering the crash due to missing arguments.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18932; http://securityreason.com/securityalert/441; http://www.securityfocus.com/archive/1/425169/100/0/threaded
CVE: CVE-2006-0785
Published: 2006-02-19
Description: Absolute path traversal vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to include and execute arbitrary local files via a direct request with a path parameter with a null character and beginning with (1) '/' (slash) for an absolute pathname or (2) a drive letter (such as "C:"), which bypasses checks for ".." sequences and trailing ".php" extensions.
CVSS Score: 6.4 (MEDIUM)
References: http://retrogod.altervista.org/phpkit_161r2_incl_xpl.html; http://securitytracker.com/id?1015640; http://www.securityfocus.com/archive/1/425196/100/0/threaded
CVE: CVE-2006-0786
Published: 2006-02-19
Description: Incomplete blacklist vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier, with allow_url_fopen enabled, allows remote attackers to conduct PHP remote file include attacks via a path parameter that specifies a (1) UNC share or (2) ftps URL, which bypasses the check for "http://", "ftp://", and "https://" URLs.
CVSS Score: 5.1 (MEDIUM)
References: http://retrogod.altervista.org/phpkit_161r2_incl_xpl.html; http://securityreason.com/securityalert/445; http://securitytracker.com/id?1015640
CVE: CVE-2006-0787
Published: 2006-02-19
Description: wimpy_trackplays.php in Plaino Wimpy MP3 Player, possibly 5.2 and earlier, allows remote attackers to insert arbitrary strings into trackme.txt via the (1) trackFile, (2) trackArtist, and (3) trackTitle parameters, which can result in providing false information about songs, occupying excessive disk space with very long parameter values, and storing executable code that might be invoked through a different vulnerability.  NOTE: since this issue, as described by the original researcher, is entirely dependent on the presence of another vulnerability, it could be argued that Wimpy cannot be responsible for how its data file is processed by applications outside of its control. Since this issue might only be useful as a facilitator manipulation in another vulnerability, perhaps it should not be included in CVE.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/18900; http://www.securityfocus.com/bid/16696; http://www.xorcrew.net/xpa/XPA-WimpyMP3Player.txt
CVE: CVE-2006-0788
Published: 2006-02-19
Description: Kyocera 3830 (aka FS-3830N) printers have a back door that allows remote attackers to read and alter configuration settings via strings that begin with "!R!SIOP0", as demonstrated using (1) a connection to to TCP port 9100 or (2) the UNIX lp command.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0344.html; http://evader.wordpress.com/2006/02/16/kyocera-printers/; http://secunia.com/advisories/18896