deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0600
Published: 2006-02-13
Description: elog before 2.5.7 r1558-4 allows remote attackers to cause a denial of service (infinite redirection) via a request with the fail parameter set to 1, which redirects to the same request.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528; http://savannah.psi.ch/viewcvs/trunk/src/elogd.c?root=elog&rev=1487&view=diff&r1=1487&r2=1486&p1=trunk/src/elogd.c&p2=/trunk/src/elogd.c; http://secunia.com/advisories/18783
CVE: CVE-2006-0647
Published: 2006-02-13
Description: LDAP service in Sun Java System Directory Server 5.2, running on Linux and possibly other platforms, allows remote attackers to cause a denial of service (memory allocation error) via an LDAP packet with a crafted subtree search request, as demonstrated using the ProtoVer LDAP test suite.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.immunitysec.com/pipermail/dailydave/2006-February/002914.html; http://lists.immunitysec.com/pipermail/dailydave/2006-February/002916.html; http://secunia.com/advisories/18769
CVE: CVE-2006-0648
Published: 2006-02-13
Description: Multiple directory traversal vulnerabilities in PHP iCalendar 2.0.1, 2.1, and 2.2 allow remote attackers to include arbitrary files via the (1) getdate and possibly other parameters used in the replace_files function in search.php and (2) $file variable as used in the parse function in functions/template.php.
CVSS Score: 5.0 (MEDIUM)
References: http://evuln.com/vulns/70/summary.html; http://phpicalendar.net/forums/viewtopic.php?t=396; http://secunia.com/advisories/18778
CVE: CVE-2006-0649
Published: 2006-02-13
Description: Cross-site scripting (XSS) vulnerability in DataparkSearch before 4.37 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18751; http://www.dataparksearch.org/ChangeLog; http://www.securityfocus.com/bid/16572
CVE: CVE-2006-0650
Published: 2006-02-13
Description: Cross-site scripting (XSS) vulnerability in cpaint2.inc.php in the CPAINT library before 2.0.3, as used in multiple scripts, allows remote attackers to inject arbitrary web script or HTML via the cpaint_response_type parameter, which is displayed in a resulting error message, as demonstrated using a hex-encoded IFRAME tag.
CVSS Score: 4.3 (MEDIUM)
References: http://cpaint.booleansystems.com/forums/viewtopic.php?t=98; http://secunia.com/advisories/18765; http://securitytracker.com/id?1015608
CVE: CVE-2006-0651
Published: 2006-02-13
Description: SQL injection vulnerability in index.php in vwdev allows remote attackers to execute arbitrary SQL commands via the UID parameter in the definition Page.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1015594; http://www.osvdb.org/22991; http://www.securityfocus.com/bid/16547
CVE: CVE-2006-0652
Published: 2006-02-13
Description: WHMCompleteSolution (WHMCS) before 2.3 assigns incorrect permissions to "resellers", which allows remote authenticated users to perform privileged actions or obtain sensitive information.  NOTE: this report is based on a vendor bug report that identified "incorrect permissions."  However, the vendor did not label it a security issue, and there was no statement regarding whether or not the permissions were actually more permissive than intended.  If in fact the permissions were more restrictive than intended, then this would be a functional problem but not a vulnerability.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/16560; http://www.vupen.com/english/advisories/2006/0484; http://www.whmcs.com/changelog.php
CVE: CVE-2006-0653
Published: 2006-02-13
Description: Multiple SQL injection vulnerabilities in Hinton Design phpht Topsites 1.3 allow remote attackers to execute arbitrary SQL commands via multiple vectors including the username parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/59/summary.html; http://secunia.com/advisories/18782; http://www.securityfocus.com/archive/1/424741/100/0/threaded
CVE: CVE-2006-0654
Published: 2006-02-13
Description: check.php in Hinton Design phpht Topsites 1.3 does not validate passwords when using cookies, which allows remote attackers to bypass authentication via unspecified cookies.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/59/summary.html; http://secunia.com/advisories/18782; http://www.securityfocus.com/archive/1/424741/100/0/threaded
CVE: CVE-2006-0655
Published: 2006-02-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) link_edited.php and (2) link_added.php in Hinton Design phpht Topsites 1.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/59/summary.html; http://secunia.com/advisories/18782; http://www.securityfocus.com/archive/1/424741/100/0/threaded
CVE: CVE-2006-0656
Published: 2006-02-13
Description: Directory traversal vulnerability in HP Systems Insight Manager 4.2 through 5.0 SP3 for Windows allows remote attackers to access arbitrary files via unspecified vectors, a different vulnerability than CVE-2005-2006.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18789; http://securitytracker.com/id?1015605; http://www.securityfocus.com/bid/16571
CVE: CVE-2006-0657
Published: 2006-02-13
Description: Cross-site scripting (XSS) vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the (1) username and (2) password parameters, which are not sanitized before being written to users.php.  NOTE: while this issue was originally reported as XSS, the primary issue might be direct static code injection with resultant XSS.
CVSS Score: 3.5 (LOW)
References: http://evuln.com/vulns/63/summary.html; http://secunia.com/advisories/18792; http://securityreason.com/securityalert/442
CVE: CVE-2006-0658
Published: 2006-02-13
Description: Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/fckeditor_22_xpl.html; http://secunia.com/advisories/18767; http://www.securityfocus.com/archive/1/424708
CVE: CVE-2006-0659
Published: 2006-02-13
Description: Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with register_globals and allow_url_fopen enabled, allow remote attackers to execute arbitrary code via the bbPath[path] parameter in (1) class.forumposts.php and (2) forumpollrenderer.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://retrogod.altervista.org/runcms_13a_xpl.html; http://secunia.com/advisories/18800; http://www.securityfocus.com/archive/1/424708
CVE: CVE-2006-0660
Published: 2006-02-13
Description: Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".."  or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php.
CVSS Score: 6.4 (MEDIUM)
References: http://forum.farsinewsteam.com/index.php?showtopic=71; http://forum.farsinewsteam.com/index.php?showtopic=76; http://secunia.com/advisories/18768
CVE: CVE-2006-0661
Published: 2006-02-13
Description: Cross-site scripting (XSS) vulnerability in Scriptme SmE GB Host 1.21 and SmE Blog Host allows remote attackers to inject arbitrary web script or HTML via the BBcode url tag.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/65/summary.html; http://secunia.com/advisories/18786; http://securityreason.com/securityalert/447
CVE: CVE-2006-0662
Published: 2006-02-13
Description: Cross-site scripting (XSS) vulnerability in Lotus Domino iNotes Client 6.5.4 allows remote attackers to inject arbitrary web script or HTML via email with attached html files, which are directly rendered in the browser.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/16340; http://secunia.com/secunia_research/2005-38/advisory/; http://securitytracker.com/id?1015610
CVE: CVE-2006-0663
Published: 2006-02-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Lotus Domino iNotes Client 6.5.4 and 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) an email subject; (2) an encoded javascript URI, as demonstrated using "java&#13;script:"; or (3) when the Domino Web Access ActiveX control is not installed, via an email attachment filename.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/16340; http://secunia.com/secunia_research/2005-38/advisory/; http://securitytracker.com/id?1015610
CVE: CVE-2006-0664
Published: 2006-02-13
Description: Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  An original vendor bug report is referenced, but not accessible to the general public.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21400; http://www.debian.org/security/2006/dsa-1133; http://www.securityfocus.com/bid/16561
CVE: CVE-2006-0665
Published: 2006-02-13
Description: Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unknown impact and attack vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  An original vendor bug report is referenced, but not accessible to the general public.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21400; http://www.debian.org/security/2006/dsa-1133; http://www.securityfocus.com/bid/16561
CVE: CVE-2006-0668
Published: 2006-02-13
Description: SQL injection vulnerability in index.php in PwsPHP 1.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in message.php in the espace_membre module.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19023; http://www.securityfocus.com/bid/16567; http://www.securityfocus.com/bid/16567/exploit
CVE: CVE-2006-0669
Published: 2006-02-13
Description: Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the (1) Forum and (2) pages parameter.  NOTE: SecurityTracker says that the vendor has disputed this issue, saying that GA Forum Light does not use an SQL database.  SecurityTracker's research indicates that the original problem could be due to a vbscript parsing error based on invalid arguments
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1015600; http://www.attrition.org/pipermail/vim/2006-February/000561.html; http://www.osvdb.org/23509
CVE: CVE-2006-0670
Published: 2006-02-13
Description: Buffer overflow in l2cap.c in hcidump 1.29 allows remote attackers to cause a denial of service (crash) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5488&w=2; http://secunia.com/advisories/18741; http://secunia.com/advisories/18971
CVE: CVE-2006-0671
Published: 2006-02-13
Description: Buffer overflow in Sony Ericsson K600i, V600i, W800i, and T68i cell phone allows remote attackers to cause a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length field is less than the actual length of the packet.
CVSS Score: 7.8 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7655&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4270&w=2; http://secunia.com/advisories/18747
CVE: CVE-2006-0672
Published: 2006-02-13
Description: Unspecified vulnerability in HP PSC 1210 All-in-One Drivers before 1.0.06 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?dlc=en&lc=en&os=228%20&product=90764&lang=en&cc=us&softwareitem=oj-37641-1; http://secunia.com/advisories/18770; http://www.securityfocus.com/bid/16583
CVE: CVE-2006-0673
Published: 2006-02-13
Description: Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) $total_login and (2) $total_password parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/71/summary.html; http://secunia.com/advisories/18855; http://securityreason.com/securityalert/459
CVE: CVE-2006-0674
Published: 2006-02-13
Description: Buffer overflow in the arp command of IBM AIX 5.3 L, 5.3, 5.2.2, 5.2 L, and 5.2 allows local users to cause a denial of service (crash) via a long iftype argument.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/18773; http://www-1.ibm.com/support/docview.wss?rs=0&q1=IY81424&uid=isg1IY81424&loc=en_US&cs=utf-8&cc=us&lang=en; http://www-1.ibm.com/support/docview.wss?uid=isg1IY81476
CVE: CVE-2006-0675
Published: 2006-02-13
Description: Cross-site scripting (XSS) vulnerability in search.php in Siteframe 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://kiki91.altervista.org/exploit/siteframe5.0.1a_xss.txt; http://secunia.com/advisories/18804; http://siteframe.org/p/xss_vulnerability_in_siteframe_501
CVE: CVE-2006-0676
Published: 2006-02-13
Description: Cross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18820; http://securityreason.com/securityalert/425; http://www.securityfocus.com/archive/1/424956/100/0/threaded
CVE: CVE-2006-0677
Published: 2006-02-14
Description: telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service (server crash) via unknown vectors that trigger a null dereference.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/18894; http://secunia.com/advisories/18961; http://secunia.com/advisories/19005
CVE: CVE-2006-0005
Published: 2006-02-14
Description: Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/18852; http://securitytracker.com/id?1015628; http://www.idefense.com/intelligence/vulnerabilities/display.php?id=393
CVE: CVE-2006-0008
Published: 2006-02-14
Description: The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program that displays the about box.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/18859; http://securitytracker.com/id?1015631; http://www.kb.cert.org/vuls/id/739844
CVE: CVE-2006-0013
Published: 2006-02-14
Description: Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/18857; http://securitytracker.com/id?1015630; http://www.kb.cert.org/vuls/id/388900
CVE: CVE-2006-0021
Published: 2006-02-14
Description: Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/18853; http://securitytracker.com/id?1015629; http://www.kb.cert.org/vuls/id/839284
CVE: CVE-2006-0553
Published: 2006-02-14
Description: PostgreSQL 8.1.0 through 8.1.2 allows authenticated database users to gain additional privileges via "knowledge of the backend protocol" using a crafted SET ROLE to other database users, a different vulnerability than CVE-2006-0678.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://archives.postgresql.org/pgsql-announce/2006-02/msg00008.php; http://secunia.com/advisories/18890; http://securitytracker.com/id?1015636
CVE: CVE-2006-0678
Published: 2006-02-14
Description: PostgreSQL 7.3.x before 7.3.14, 7.4.x before 7.4.12, 8.0.x before 8.0.7, and 8.1.x before 8.1.3, when compiled with Asserts enabled, allows local users to cause a denial of service (server crash) via a crafted SET SESSION AUTHORIZATION command, a different vulnerability than CVE-2006-0553.
CVSS Score: 1.5 (LOW)
References: http://secunia.com/advisories/18890; http://secunia.com/advisories/19015; http://secunia.com/advisories/19035
CVE: CVE-2006-0004
Published: 2006-02-14
Description: Microsoft PowerPoint 2000 in Office 2000 SP3 has an interaction with Internet Explorer that allows remote attackers to obtain sensitive information via a PowerPoint presentation that attempts to access objects in the Temporary Internet Files Folder (TIFF).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18865; http://securitytracker.com/id?1015632; http://www.kb.cert.org/vuls/id/963628
CVE: CVE-2006-0006
Published: 2006-02-14
Description: Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/18835; http://securityreason.com/securityalert/423; http://securitytracker.com/id?1015627
CVE: CVE-2006-0382
Published: 2006-02-14
Description: Apple Mac OS X 10.4.5 and allows local users to cause a denial of service (crash) via an undocumented system call.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2006/Feb/msg00000.html; http://secunia.com/advisories/18907; http://securitytracker.com/id?1015634
CVE: CVE-2006-0451
Published: 2006-02-14
Description: Multiple memory leaks in the LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (memory consumption) via invalid BER packets that trigger an error, which might prevent memory from being freed if it was allocated during the ber_scanf call, as demonstrated using the ProtoVer LDAP test suite.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135; http://secunia.com/advisories/18960; http://www.securityfocus.com/bid/16677
CVE: CVE-2006-0452
Published: 2006-02-14
Description: dn2ancestor in the LDAP component in Fedora Directory Server 1.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via a ModDN operation with a DN that contains a large number of "," (comma) characters, which results in a large amount of recursion, as demonstrated using the ProtoVer LDAP test suite.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179137; http://secunia.com/advisories/18960; http://www.securityfocus.com/bid/16677
CVE: CVE-2006-0453
Published: 2006-02-14
Description: The LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (crash) via a certain "bad BER sequence" that results in a free of uninitialized memory, as demonstrated using the ProtoVer LDAP test suite.
CVSS Score: 7.8 (HIGH)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135; http://secunia.com/advisories/18960; http://www.securityfocus.com/bid/16677
CVE: CVE-2006-0680
Published: 2006-02-15
Description: Unspecified vulnerability in WebGUI before 6.8.6-gamma allows remote attackers to create an account, when anonymous registration is disabled, via a certain URL.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18819; http://www.plainblack.com/getwebgui/advisories/webgui-6.8.6-gamma-released; http://www.securityfocus.com/bid/16612
CVE: CVE-2006-0681
Published: 2006-02-15
Description: Format string vulnerability in powerd.c in Power Daemon (powerd) 2.0.2 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the WHATIDO variable.
CVSS Score: 7.5 (HIGH)
References: http://gotfault.net/research/advisory/gadv-powerd.txt; http://secunia.com/advisories/18841; http://www.securityfocus.com/bid/16582
CVE: CVE-2006-0682
Published: 2006-02-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in bbcodes system in e107 before 0.7.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://e107.org/comment.php?comment.news.776; http://secunia.com/advisories/18816; http://www.securityfocus.com/bid/16614
CVE: CVE-2006-0683
Published: 2006-02-15
Description: Cross-site scripting (XSS) vulnerability in Virtual Hosting Control System (VHCS) 2.4.7.1 with v.1 patch and earlier allows remote attackers to inject arbitrary web script or HTML via the username, which is recorded in a log file but not properly handled when the administrator uses the admin log utility to read the log file.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18799; http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt; http://www.securityfocus.com/archive/1/424816/100/0/threaded
CVE: CVE-2006-0684
Published: 2006-02-15
Description: change_password.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not verify the old password when a user changes the password, which may allow remote attackers to gain unauthorized access.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18799; http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt; http://www.securityfocus.com/archive/1/424816/100/0/threaded
CVE: CVE-2006-0685
Published: 2006-02-15
Description: The check_login function in login.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not exit when authentication fails, which allows remote attackers to gain unauthorized access.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18799; http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt; http://www.securityfocus.com/archive/1/424816/100/0/threaded
CVE: CVE-2006-0686
Published: 2006-02-15
Description: add_user.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not check user privileges when adding a new administrative user, which allows remote attackers to gain unauthorized access.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18799; http://securityreason.com/securityalert/430; http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt
CVE: CVE-2006-0687
Published: 2006-02-15
Description: process.php in DocMGR 0.54.2 does not initialize the $siteModInfo variable when a direct request is made, which allows remote attackers to include arbitrary local files or possibly remote files via a modified includeModule and siteModInfo variable.
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/docmgr_0542_incl_xpl.html; http://secunia.com/advisories/18803; http://securityreason.com/securityalert/428