deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6286
Published: 2006-12-04
Description: Palm Desktop 4.1.4 and earlier stores user data with weak permissions under the application directory, which allows local users to obtain sensitive information (address books, calendar files, and todo lists of other users) via unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 1.7 (LOW)
References: http://secunia.com/advisories/23072; http://www.securityfocus.com/bid/21382/info; http://www.vupen.com/english/advisories/2006/4803
CVE: CVE-2006-6287
Published: 2006-12-04
Description: Stack-based buffer overflow in AtomixMP3 2.3 and earlier allows remote attackers to execute arbitrary code via a long pathname in an M3U file.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23151; http://www.securityfocus.com/bid/21380; http://www.vupen.com/english/advisories/2006/4804
CVE: CVE-2006-6288
Published: 2006-12-04
Description: Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via (1) a playlist file with long song names, because of an overflow in the CPL_AddPrefixedFile function in CPI_Playlist.c; (2) a skin file with long button names, because of an overflow in the main_skin_check_ini_value function in skin.c; and (3) a skin file with long bitmap filenames, because of an overflow in the main_skin_open function in skin.c.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://coolplayer.cvs.sourceforge.net/coolplayer/Main/stdafx.h?view=log; http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051269.html; http://secunia.com/advisories/23360
CVE: CVE-2006-6142
Published: 2006-12-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."
CVSS Score: 6.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://docs.info.apple.com/article.html?artnum=306172; http://fedoranews.org/cms/node/2438
CVE: CVE-2006-6289
Published: 2006-12-05
Description: Woltlab Burning Board (wBB) Lite 1.0.2 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the wbb_userid parameter to the top-level URI.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in wBB Lite.
CVSS Score: 6.8 (MEDIUM)
References: http://retrogod.altervista.org/wbblite_102_sql.html; http://www.securityfocus.com/archive/1/452561/100/0/threaded; http://www.securityfocus.com/bid/21265
CVE: CVE-2006-6290
Published: 2006-12-05
Description: Multiple stack-based buffer overflows in the IMAP module (MEIMAPS.EXE) in MailEnable Professional 1.6 through 1.82 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.30 and 2.0 through 2.33 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a long argument to the (1) EXAMINE or (2) SELECT command.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/23047; http://secunia.com/advisories/23080; http://secunia.com/secunia_research/2006-71/advisory/
CVE: CVE-2006-6291
Published: 2006-12-05
Description: Stack overflow in the IMAP module (MEIMAPS.EXE) in MailEnable Professional 1.6 through 1.83 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.40 and 2.0 through 2.33, allows remote authenticated users to cause a denial of service (crash) via a long argument containing * (asterisk) and ? (question mark) characters to the DELETE command, as addressed by the ME-10020 hotfix.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/23080; http://secunia.com/secunia_research/2006-71/advisory/; http://securitytracker.com/id?1017276
CVE: CVE-2006-6292
Published: 2006-12-05
Description: Apple Airport Extreme firmware 0.1.27 in Mac OS X 10.4.8 on Mac mini, MacBook, and MacBook Pro with Core Duo hardware allows remote attackers to cause a denial of service (out-of-bounds memory access and kernel panic) and have possibly other security-related impact via certain beacon frames.
CVSS Score: 5.7 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305031; http://lists.apple.com/archives/Security-announce/2007/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2007/Jan/msg00001.html
CVE: CVE-2006-6293
Published: 2006-12-05
Description: Heap-based buffer overflow in FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to execute arbitrary code via a crafted CHM file. NOTE: this issue has at least a partial overlap with CVE-2006-6294.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://gleg.net/fprot.txt; http://gleg.net/vulndisco_meta.shtml; http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051096.html
CVE: CVE-2006-6294
Published: 2006-12-05
Description: Multiple unspecified vulnerabilities in FRISK Software F-Prot Antivirus before 4.6.7 have unspecified impact and attack vectors. NOTE: this might be related to CVE-2006-6293, but it is not clear due to the vagueness of the report.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23328; http://security.gentoo.org/glsa/glsa-200612-12.xml; http://www.f-prot.com/news/gen_news/061201_release_unix467.html
CVE: CVE-2006-6295
Published: 2006-12-05
Description: PHP remote file inclusion vulnerability in includes/mx_common.php in the mx_tinies 1.3.0 Module for MxBB Portal 1.06 allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23206; http://www.securityfocus.com/bid/21415; http://www.vupen.com/english/advisories/2006/4838
CVE: CVE-2006-6296
Published: 2006-12-05
Description: The RpcGetPrinterData function in the Print Spooler (spoolsv.exe) service in Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows remote attackers to cause a denial of service (memory consumption) via an RPC request that specifies a large 'offered' value (output buffer size), a variant of CVE-2005-3644.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://research.eeye.com/html/alerts/zeroday/20051116.html; http://secunia.com/advisories/23196; http://securitytracker.com/id?1017330
CVE: CVE-2006-6297
Published: 2006-12-05
Description: Stack consumption vulnerability in the KFILE JPEG (kfile_jpeg) plugin in kdegraphics 3, as used by konqueror, digikam, and other KDE image browsers, allows remote attackers to cause a denial of service (stack consumption) via a crafted EXIF section in a JPEG file, which results in an infinite recursion.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/23203; http://secunia.com/advisories/23213; http://secunia.com/advisories/23300
CVE: CVE-2006-6298
Published: 2006-12-05
Description: SQL injection vulnerability in uye_giris_islem.asp in Metyus Okul Yonetim Sistemi 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) kullanici_ismi and (2) sifre parameters.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1971; http://www.securityfocus.com/archive/1/453419/100/0/threaded; http://www.securityfocus.com/bid/21418
CVE: CVE-2006-6299
Published: 2006-12-05
Description: Integer overflow in Msg.dll in Novell ZENworks 7 Asset Management (ZAM) before SP1 IR11 and the Collection client allows remote attackers to execute arbitrary code via crafted packets, which trigger a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=447; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=448; http://secunia.com/advisories/23157
CVE: CVE-2006-6300
Published: 2006-12-05
Description: Cross-site scripting (XSS) vulnerability in CuteNews 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the result parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1969; http://www.securityfocus.com/archive/1/453314/100/0/threaded; http://www.securityfocus.com/bid/21403
CVE: CVE-2006-6306
Published: 2006-12-05
Description: Format string vulnerability in Novell Modular Authentication Services (NMAS) in the Novell Client 4.91 SP2 and SP3 allows users with physical access to read stack and memory contents via format string specifiers in the Username field of the logon window.
CVSS Score: 1.2 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051038.html; http://secunia.com/advisories/23363; http://securityreason.com/securityalert/1970
CVE: CVE-2006-6307
Published: 2006-12-05
Description: srvloc.sys in Novell Client for Windows before 4.91 SP3 allows remote attackers to cause an unspecified denial of service via a crafted packet to port 427 that triggers an access of pageable or invalid addresses using a higher interrupt request level (IRQL) than necessary.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23244; http://www.securityfocus.com/bid/21430; http://www.vupen.com/english/advisories/2006/4840
CVE: CVE-2006-5855
Published: 2006-12-06
Description: Multiple buffer overflows in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in (1) the language field at logon that begins with a 0x18 byte, (2) two unspecified parameters to the SmExecuteWdsfSession function, and (3) the contact field in an open registration message.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23177; http://securityreason.com/securityalert/1979; http://securitytracker.com/id?1017333
CVE: CVE-2006-5856
Published: 2006-12-06
Description: Stack-based buffer overflow in the Adobe Download Manager before 2.2 allows remote attackers to execute arbitrary code via a long section name in the dm.ini file, which is populated via an AOM file.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051114.html; http://research.eeye.com/html/advisories/published/AD20061205.html; http://secunia.com/advisories/23233
CVE: CVE-2006-6301
Published: 2006-12-06
Description: DenyHosts 2.5 does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a login name containing certain strings with an IP address, which is not properly handled by a regular expression.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=157163; http://secunia.com/advisories/23236; http://secunia.com/advisories/23603
CVE: CVE-2006-6302
Published: 2006-12-06
Description: fail2ban 0.7.4 and earlier does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a login name containing certain strings with an IP address.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=157166; http://secunia.com/advisories/23237; http://secunia.com/advisories/24184
CVE: CVE-2006-6303
Published: 2006-12-06
Description: The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP requests, a different issue than CVE-2006-5467.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.gentoo.org/show_bug.cgi?id=157048; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218287; http://docs.info.apple.com/article.html?artnum=305530
CVE: CVE-2006-5994
Published: 2006-12-06
Description: Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456.
CVSS Score: 9.3 (HIGH)
References: http://blogs.securiteam.com/?p=759; http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx; http://secunia.com/advisories/23232
CVE: CVE-2006-6308
Published: 2006-12-06
Description: Symantec LiveState 7.1 Agent for Windows allows local users to gain privileges by stopping the shstart.exe process and open "Web Self-Service" from the system tray icon, which will open a browser window running with elevated privileges.  NOTE: several third-party researchers have noted that administrator privileges may be necessary to terminate shstart.exe. If this is the case, then no privilege escalation occurs, and this is not a vulnerability
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1017332; http://www.securityfocus.com/archive/1/453481/100/0/threaded; http://www.securityfocus.com/archive/1/453551/100/0/threaded
CVE: CVE-2006-6309
Published: 2006-12-06
Description: Multiple array index errors in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 allow remote attackers to read arbitrary memory locations and cause a denial of service (crash) via a large index value in unspecified messages, a different issue than CVE-2006-5855.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1979; http://www-1.ibm.com/support/docview.wss?uid=swg21250261; http://www.securityfocus.com/archive/1/453544/100/0/threaded
CVE: CVE-2006-6310
Published: 2006-12-06
Description: Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (crash) via an invalid src attribute value ("?") in an HTML frame tag that is in a frameset tag with a large rows attribute.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/21447.html; http://www.osvdb.org/31325; http://www.securityfocus.com/bid/21447
CVE: CVE-2006-6311
Published: 2006-12-06
Description: Microsoft Internet Explorer 6.0.2900.2180 allows remote attackers to cause a denial of service via a style attribute in an HTML table tag with a width value that is dynamically calculated using JavaScript.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1968; http://www.osvdb.org/31326; http://www.securityfocus.com/archive/1/453642/100/0/threaded
CVE: CVE-2006-6328
Published: 2006-12-06
Description: Directory traversal vulnerability in index.php for TorrentFlux 2.2 allows remote attackers to create or overwrite arbitrary files via sequences in the alias_file parameter.
CVSS Score: 4.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23400582; http://secunia.com/advisories/22880; https://www.exploit-db.com/exploits/2786
CVE: CVE-2006-6329
Published: 2006-12-06
Description: index.php for TorrentFlux 2.2 allows remote attackers to delete files by specifying the target filename in the delfile parameter.
CVSS Score: 4.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23400582; http://secunia.com/advisories/22880; https://www.exploit-db.com/exploits/2786
CVE: CVE-2006-6330
Published: 2006-12-06
Description: index.php for TorrentFlux 2.2 allows remote registered users to execute arbitrary commands via shell metacharacters in the kill parameter.
CVSS Score: 6.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23400582; http://secunia.com/advisories/22880; https://www.exploit-db.com/exploits/2786
CVE: CVE-2006-6331
Published: 2006-12-06
Description: metaInfo.php in TorrentFlux 2.2, when $cfg["enable_file_priority"] is false, allows remote attackers to execute arbitrary commands via shell metacharacters (backticks) in the torrent parameter to (1) details.php and (2) startpop.php.
CVSS Score: 6.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi/11_missed_security_fixes.dpatch?bug=400582%3Bmsg=71%3Batt=1; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23400582; http://secunia.com/advisories/23270
CVE: CVE-2006-6112
Published: 2006-12-06
Description: LifeType 1.0.x and 1.1.x have insufficient access control for all of the PHP scripts under (1) class/ and (2) plugins/, which allows remote attackers to obtain the installation path via a direct request to any of the scripts, as demonstrated by (a) bayesianfilter.class.php and (b) bootstrap.php, which leaks the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1980; http://www.lifetype.net/blog.php/lifetype-development-journal/2006/11/30/full_path_disclosure_vulnerability_in_lifetype_1.0.x_and_1.1.x; http://www.netvigilance.com/advisory0008
CVE: CVE-2006-6305
Published: 2006-12-06
Description: Unspecified vulnerability in Net-SNMP 5.3 before 5.3.0.1, when configured using the rocommunity or rouser snmpd.conf tokens, causes Net-SNMP to grant write access to users or communities that only have read-only access.
CVSS Score: 7.5 (HIGH)
References: http://net-snmp.sourceforge.net/about/ChangeLog.html; http://net-snmp.sourceforge.net/about/news.html; http://secunia.com/advisories/23285
CVE: CVE-2006-6333
Published: 2006-12-06
Description: The tr_rx function in ibmtr.c for Linux kernel 2.6.19 assigns the wrong flag to the ip_summed field, which allows remote attackers to cause a denial of service (memory corruption) via crafted packets that cause the kernel to interpret another field as an offset.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/23254; http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=blobdiff%3Bh=0d97e10ccac580e16d3dffbe4a9a88144360e64a%3Bhp=bfe59865b1dd50e5c4dbd4cefe506a31e1495a1a%3Bhb=ee28b0da1069ced1688aa9d0b7b378353b988321%3Bf=drivers/net/tokenring/ibmtr.c; http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ee28b0da1069ced1688aa9d0b7b378353b988321
CVE: CVE-2006-6337
Published: 2006-12-07
Description: Multiple SQL injection vulnerabilities in giris.asp in Aspee and Dogantepe Ziyaretci Defteri allow remote attackers to execute arbitrary SQL commands via the (1) kullanici or (2) parola parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/23291; http://www.securityfocus.com/archive/1/453234/100/0/threaded; http://www.securityfocus.com/archive/1/454589/100/0/threaded
CVE: CVE-2006-6338
Published: 2006-12-07
Description: Unrestricted file upload vulnerability in upload/index.php in deV!L`z Clanportal (DZCP) before 1.3.6.1 allows remote attackers to upload and execute arbitrary .php files by embedding PHP code in a JPEG or GIF file that is uploaded to inc/images/uploads/userpics/.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051022.html; http://secunia.com/advisories/23194; http://www.securityfocus.com/archive/1/453178/100/0/threaded
CVE: CVE-2006-6339
Published: 2006-12-07
Description: SQL injection vulnerability in sites/index.php in deV!L`z Clanportal (DZCP) before 1.3.6.1 allows remote attackers to execute arbitrary SQL commands via the show element in a GET request.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23194; http://securityreason.com/securityalert/1984; http://www.securityfocus.com/archive/1/453179/100/0/threaded
CVE: CVE-2006-6340
Published: 2006-12-07
Description: keystone.exe in nVIDIA nView allows attackers to cause a denial of service via a long command line argument.  NOTE: it is not clear whether this issue crosses security boundaries. If not, then this is not a vulnerability.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1973; http://www.securityfocus.com/archive/1/452439/100/100/threaded; http://www.securityfocus.com/bid/21260
CVE: CVE-2006-6341
Published: 2006-12-07
Description: Multiple PHP remote file inclusion vulnerabilities in mg.applanix 1.3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the apx_root_path parameter to (1) act/act_check_access.php, (2) dsp/dsp_form_booking_ctl.php, and (3) dsp/dsp_bookings.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1972; http://www.attrition.org/pipermail/vim/2006-December/001163.html; http://www.attrition.org/pipermail/vim/2006-December/001164.html
CVE: CVE-2006-6342
Published: 2006-12-07
Description: Multiple SQL injection vulnerabilities in KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) agent parameters in (a) search_listing.asp, and the (3) property_id parameter in (b) detail.asp.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1976; http://www.securityfocus.com/archive/1/452115/100/200/threaded; http://www.securityfocus.com/bid/21199
CVE: CVE-2006-6343
Published: 2006-12-07
Description: SQL injection vulnerability in polls.php in Neocrome Seditio 1.10 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23180; http://securityreason.com/securityalert/1974; http://www.securityfocus.com/archive/1/453125/100/0/threaded
CVE: CVE-2006-6344
Published: 2006-12-07
Description: Multiple unspecified vulnerabilities in Neocrome Seditio 1.10 and earlier have unknown impact and attack vectors related to (1) plugins/ipsearch/ipsearch.admin.php, and (2) pfs/pfs.edit.inc.php, (3) users/users.register.inc.php in system/core.  NOTE: the users.profile.inc.php vector is identified by CVE-2006-6177.  NOTE: these issues might be related to SQL injection.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23180; http://www.neocrome.net/page.php?id=2233; http://www.vupen.com/english/advisories/2006/4805
CVE: CVE-2006-6345
Published: 2006-12-07
Description: Directory traversal vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 16 and earlier, and 7.00 Patchlevel 6 and earlier, allows remote attackers to delete arbitrary files via directory traversal sequences in an HTTP request.  NOTE: This information is based upon an initial disclosure. Details will be updated after the grace period has ended. This issue is different from CVE-2006-4133 and CVE-2006-4134.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23262; http://securityreason.com/securityalert/1986; http://securitytracker.com/id?1017342
CVE: CVE-2006-6346
Published: 2006-12-07
Description: Unspecified vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 15 and earlier, and 7.00 Patchlevel 3 and earlier, allows remote attackers to cause a denial of service (service shutdown), obtain sensitive information (configuration files), and conduct certain other unauthorized activities, related to "Undocumented Features." NOTE: it is possible that there are multiple issues. This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended. This is likely a different issue than CVE-2006-4134.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23262; http://securityreason.com/securityalert/1985; http://securitytracker.com/id?1017341