deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0666
Published: 2006-02-15
Description: Unspecified vulnerability in the (1) unix_mp and (2) unix_64 kernels in IBM AIX 5.3 VRMF 5.3.0.30 through 5.3.0.33 allows local users to cause a denial of service (system crash) via unknown vectors related to EMULATE_VMX.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/18795; http://www-1.ibm.com/support/search.wss?rs=0&q=IY79595&apar=only; http://www.osvdb.org/23127
CVE: CVE-2006-0688
Published: 2006-02-15
Description: PHP remote file include vulnerability in application.php in nicecoder.com indexu 5.0.0 and 5.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://echo.or.id/adv/adv26-K-159-2006.txt; http://echo.or.id/adv/adv27-K-159-2006.txt; http://secunia.com/advisories/18752
CVE: CVE-2006-0689
Published: 2006-02-15
Description: Cross-site scripting (XSS) vulnerability in the Registration Form in TTS Time Tracking Software 3.0 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18854; http://www.evuln.com/vulns/69/summary.html; http://www.securityfocus.com/archive/1/425505/100/0/threaded
CVE: CVE-2006-0690
Published: 2006-02-15
Description: Multiple SQL injection vulnerabilities in TTS Time Tracking Software 3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18854; http://www.evuln.com/vulns/69/summary.html; http://www.securityfocus.com/archive/1/425505/100/0/threaded
CVE: CVE-2006-0691
Published: 2006-02-15
Description: edituser.php in TTS Time Tracking Software 3.0 does not verify that the name and password are correct, which allows remote attackers to overwrite arbitrary data belonging to any account.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18854; http://www.evuln.com/vulns/69/summary.html; http://www.securityfocus.com/archive/1/425505/100/0/threaded
CVE: CVE-2006-0692
Published: 2006-02-15
Description: Multiple SQL injection vulnerabilities in Carey Briggs PHP/MYSQL Timesheet 1 and 2 allow remote attackers to execute arbitrary SQL commands via the (1) yr, (2) month, (3) day, and (4) job parameters in (a) index.php and (b) changehrs.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/18822; http://securityreason.com/securityalert/451; http://www.evuln.com/vulns/67/summary.html
CVE: CVE-2006-0693
Published: 2006-02-15
Description: Multiple SQL injection vulnerabilities in rb_auth.php in Roberto Butti CALimba 0.99.2 beta and earlier allow remote attackers to execute arbitrary SQL commands and bypass login authentication via the (1) login and (2) password parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18856; http://securityreason.com/securityalert/453; http://www.evuln.com/vulns/68/summary.html
CVE: CVE-2006-0694
Published: 2006-02-15
Description: Unspecified vulnerability in the loaders (load_*.php) in Ansilove before 1.03 allows remote attackers to read arbitrary files via unspecified vectors involving "converting files accessible by the webserver".
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18810; http://sourceforge.net/project/shownotes.php?release_id=392826; http://www.securityfocus.com/bid/16603
CVE: CVE-2006-0695
Published: 2006-02-15
Description: Ansilove before 1.03 does not filter uploaded file extensions, which allows remote attackers to execute arbitrary code by uploading arbitrary files with dangerous extensions, then accessing them directly in the upload directory.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18810; http://sourceforge.net/project/shownotes.php?release_id=392826; http://www.securityfocus.com/bid/16603
CVE: CVE-2006-0696
Published: 2006-02-15
Description: SQL injection vulnerability in Zen Cart before 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18801; http://sourceforge.net/project/shownotes.php?release_id=392886; http://www.osvdb.org/23110
CVE: CVE-2006-0697
Published: 2006-02-15
Description: Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/18801; http://sourceforge.net/project/shownotes.php?release_id=392886; http://www.vupen.com/english/advisories/2006/0546
CVE: CVE-2006-0698
Published: 2006-02-15
Description: Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to "other attempted exploits" other than SQL injection.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18801; http://sourceforge.net/project/shownotes.php?release_id=392886; http://www.vupen.com/english/advisories/2006/0546
CVE: CVE-2006-0699
Published: 2006-02-15
Description: Cross-site scripting (XSS) vulnerability in search.php in QWikiWiki 1.5, and possibly 1.5.1 and other versions, allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://insecurity.altervista.org/index.php?m=02&y=06&entry=entry[PII_REDACTED]17; http://secunia.com/advisories/18814; http://www.securityfocus.com/bid/16638
CVE: CVE-2006-0700
Published: 2006-02-15
Description: imageVue 16.1 allows remote attackers to obtain folder permission settings via a direct request to dir.php, which returns an XML document that lists folders and their permissions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/18802; http://www.securityfocus.com/archive/1/424745/30/0/threaded; http://www.securityfocus.com/bid/16594
CVE: CVE-2006-0701
Published: 2006-02-15
Description: readfolder.php in imageVue 16.1 allows remote attackers to list directories via modified path and ext parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18802; http://www.securityfocus.com/archive/1/424745/30/0/threaded; http://www.securityfocus.com/bid/16594
CVE: CVE-2006-0702
Published: 2006-02-15
Description: admin/upload.php in imageVue 16.1 allows remote attackers to upload arbitrary files to certain allowed folders via .. (dot dot) sequences in the path parameter.  NOTE: due to the lack of details, the specific vulnerability type cannot be determined, although it might be due to directory traversal.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18802; http://www.securityfocus.com/archive/1/424745/30/0/threaded; http://www.securityfocus.com/bid/16594
CVE: CVE-2006-0703
Published: 2006-02-15
Description: Unspecified vulnerability in index.php in imageVue 16.1 has unknown impact, probably a cross-site scripting (XSS) vulnerability involving the query string that is not quoted when inserted into style and body tags, as demonstrated using a bgcol parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18802; http://securityreason.com/securityalert/429; http://www.securityfocus.com/archive/1/424745/30/0/threaded
CVE: CVE-2006-0704
Published: 2006-02-15
Description: iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, web server name, IP, and port, session cookie information, and the IIS system username.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/18813; http://www.irmplc.com/advisory016.htm; http://www.vupen.com/english/advisories/2006/0568
CVE: CVE-2006-0705
Published: 2006-02-15
Description: Format string vulnerability in a logging function as used by various SFTP servers, including (1) AttachmateWRQ Reflection for Secure IT UNIX Server before 6.0.0.9, (2) Reflection for Secure IT Windows Server before 6.0 build 38, (3) F-Secure SSH Server for Windows before 5.3 build 35, (4) F-Secure SSH Server for UNIX 3.0 through 5.0.8, (5) SSH Tectia Server 4.3.6 and earlier and 4.4.0, and (6) SSH Shell Server 3.2.9 and earlier, allows remote authenticated users to execute arbitrary commands via unspecified vectors, involving crafted filenames and the stat command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-134
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5315&w=2; http://secunia.com/advisories/18828; http://secunia.com/advisories/18843
CVE: CVE-2006-0706
Published: 2006-02-15
Description: Cross-site scripting vulnerability in eintrag.php in Gästebuch (Gastebuch) before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via the URL, which is used in the homepage parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1121&w=2; http://secunia.com/advisories/18849; http://www.php4scripte.de/index.php
CVE: CVE-2006-0707
Published: 2006-02-15
Description: PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH_INFO variable.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/18858; http://sourceforge.net/project/shownotes.php?release_id=391800; http://www.securityfocus.com/bid/16641
CVE: CVE-2006-0708
Published: 2006-02-15
Description: Multiple buffer overflows in NullSoft Winamp 5.13 and earlier allow remote attackers to execute arbitrary code via (1) an m3u file containing a long URL ending in .wma, (2) a pls file containing a File1 field with a long URL ending in .wma, or (3) an m3u file with a long filename, variants of CVE-2005-3188 and CVE-2006-0476.
CVSS Score: 9.3 (HIGH)
References: http://forums.winamp.com/showthread.php?s=&threadid=238648; http://securityreason.com/securityalert/444; http://securityreason.com/securityalert/492
CVE: CVE-2006-0709
Published: 2006-02-15
Description: Buffer overflow in Metamail 2.7-50 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via e-mail messages with a long boundary attribute, a different vulnerability than CVE-2004-0105.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=352482; http://secunia.com/advisories/18796; http://secunia.com/advisories/18987
CVE: CVE-2006-0710
Published: 2006-02-15
Description: Double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request, as demonstrated by ProtoVer Sample LDAP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.immunitysec.com/pipermail/dailydave/2006-February/002925.html; http://secunia.com/advisories/18818; http://www.securityfocus.com/bid/16635
CVE: CVE-2006-0711
Published: 2006-02-15
Description: The (1) addfolder and (2) deletefolder functions in neomail-prefs.pl in NeoMail 1.28 do not validate the Session ID, which allows remote attackers to add and delete arbitrary files, when configured with homedirfolders and homedirspools disabled.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18785; http://secunia.com/secunia_research/2006-3/advisory/; http://sourceforge.net/project/shownotes.php?release_id=392562&group_id=2874
CVE: CVE-2006-0712
Published: 2006-02-15
Description: mail_html template in Squishdot 1.5.0 and earlier does not properly validate the (1) email and (2) title variables, which allows remote attackers to bypass spam filters by injecting SMTP headers, probably due to a CRLF injection vulnerability.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18868; http://www.securityfocus.com/bid/16667; http://www.squishdot.org/[PII_REDACTED]
CVE: CVE-2006-0713
Published: 2006-02-15
Description: Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php.  NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/linpha_10_local.html; http://secunia.com/advisories/18808; http://securityreason.com/securityalert/426
CVE: CVE-2006-0714
Published: 2006-02-15
Description: Directory traversal vulnerability in the installation file (sql/install-0.9.7.php) in Flyspray 0.9.7 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the adodbpath parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/egs_10rc4_php5_incl_xpl.html; http://secunia.com/advisories/18847; http://securityreason.com/securityalert/432
CVE: CVE-2006-0715
Published: 2006-02-15
Description: Cross-site scripting (XSS) vulnerability in sNews 1.3 allows remote attackers to inject arbitrary web script or HTML via the comment field.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0297.html; http://www.securityfocus.com/archive/1/424958/100/0/threaded; http://www.securityfocus.com/bid/16647
CVE: CVE-2006-0716
Published: 2006-02-15
Description: SQL injection vulnerability in index.php in sNews 1.3 allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0297.html; http://securityreason.com/securityalert/431; http://www.securityfocus.com/archive/1/424958/100/0/threaded
CVE: CVE-2006-0717
Published: 2006-02-15
Description: IBM Tivoli Directory Server 6.0 allows remote attackers to cause a denial of service (crash) via a crafted LDAP request, as demonstrated by test 2532 in the ProtoVer Sample LDAP test suite.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.immunitysec.com/pipermail/dailydave/2006-February/002921.html; http://secunia.com/advisories/18779; http://securitytracker.com/id?1015653
CVE: CVE-2006-0718
Published: 2006-02-15
Description: The Internet Key Exchange version 1 (IKEv1) implementation in Avaya VSU 100, 2000, 7500, 10000, and CSU 5000, when running IPSec, allows remote attackers to cause a denial of service (crash) via certain IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18836; http://support.avaya.com/elmodocs2/security/ASA-2006-043.htm; http://www.kb.cert.org/vuls/id/226364
CVE: CVE-2006-0455
Published: 2006-02-15
Description: gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded.  Note: this also occurs when running the equivalent command "gpg --verify".
CVSS Score: 4.6 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U; http://fedoranews.org/updates/FEDORA-2006-116.shtml; http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html
CVE: CVE-2006-0719
Published: 2006-02-15
Description: SQL injection vulnerability in member_login.php in PHP Classifieds 6.18 through 6.20 allows remote attackers to execute arbitrary SQL commands via the (1) username parameter, which is used by the E-mail address field, and (2) password parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18881; http://securityreason.com/securityalert/424; http://www.deltascripts.com/board/viewtopic.php?id=7234
CVE: CVE-2006-0721
Published: 2006-02-16
Description: SQL injection vulnerability in pmlite.php in RunCMS 1.2 and 1.3a allows remote attackers to execute arbitrary SQL commands via the to_userid parameter.
CVSS Score: 7.5 (HIGH)
References: http://hamid.ir/security/runcms.txt; http://secunia.com/advisories/18831; http://securitytracker.com/id?1015626
CVE: CVE-2006-0722
Published: 2006-02-16
Description: settings.php in Reamday Enterprises Magic Downloads 1.1.3, when register_globals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified (1) action, (2) passwd, (3) admin_password, (4) new_passwd, and (5) confirm_passwd variables, which are not initialized.
CVSS Score: 2.6 (LOW)
References: http://evuln.com/vulns/73/summary.html; http://secunia.com/advisories/18877; http://securityreason.com/securityalert/468
CVE: CVE-2006-0723
Published: 2006-02-16
Description: PHP remote file inclusion vulnerability in preview.php in Reamday Enterprises Magic News Lite 1.2.3, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the php_script_path parameter.
CVSS Score: 2.6 (LOW)
CWE: CWE-94
References: http://evuln.com/vulns/72/summary.html; http://secunia.com/advisories/18878; http://www.securityfocus.com/bid/16660
CVE: CVE-2006-0724
Published: 2006-02-16
Description: profile.php in Reamday Enterprises Magic News Lite 1.2.3, when register_globals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified (1) action, (2) passwd, (3) admin_password, (4) new_passwd, and (5) confirm_passwd variables, which are not initialized.
CVSS Score: 2.6 (LOW)
References: http://evuln.com/vulns/72/summary.html; http://secunia.com/advisories/18878; http://www.securityfocus.com/bid/16665
CVE: CVE-2006-0725
Published: 2006-02-16
Description: PHP remote file inclusion vulnerability in prepend.php in Plume CMS 1.0.2, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the _PX_config[manager_path] parameter.  NOTE: this is a different executable and affected version than CVE-2006-2645.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://plume-cms.net/news/77-Security-Notice-Please-Update-Your-Prependphp-File; http://secunia.com/advisories/18883; http://securitytracker.com/id?1015624
CVE: CVE-2006-0726
Published: 2006-02-16
Description: Cross-site scripting (XSS) vulnerability in linking.php in CPG-Nuke Dragonfly CMS 9.0.6.1 allows remote attackers to inject arbitrary web script or HTML via a URI that is generated when creating a list of online users.
CVSS Score: 4.3 (MEDIUM)
References: http://dragonflycms.org/Forums/viewtopic/t=14751.html; http://dragonflycms.org/Forums/viewtopic/t=14877/postdays=0/postorder=asc/start=15.html; http://dragonflycms.org/cvs/html/includes/functions/linking.php?b=9.19.2
CVE: CVE-2006-0727
Published: 2006-02-16
Description: SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis (DFMSA), as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involving the profile name.
CVSS Score: 7.5 (HIGH)
References: http://dragonflycms.org/Forums/viewtopic/t=14751.html; http://dragonflycms.org/Forums/viewtopic/t=14877/postdays=0/postorder=asc/start=15.html; http://dragonflycms.org/cvs/html/includes/functions/linking.php?b=9.19.2
CVE: CVE-2006-0728
Published: 2006-02-16
Description: SQL injection vulnerability in search.php in webSPELL 4.01.00 and earlier allows remote attackers to inject arbitrary SQL commands via the title_op parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18885; http://www.securityfocus.com/bid/16673; http://www.vupen.com/english/advisories/2006/0606
CVE: CVE-2006-0729
Published: 2006-02-16
Description: SQL injection vulnerability in functions.php in Teca Diary PE 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) yy, (2) mm, and (3) dd parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18876; http://securityreason.com/securityalert/477; http://securitytracker.com/id?1015674
CVE: CVE-2006-0730
Published: 2006-02-16
Description: Multiple unspecified vulnerabilities in Dovecot before 1.0beta3 allow remote attackers to cause a denial of service (application crash or hang) via unspecified vectors involving (1) "potential hangs" in the APPEND command and "potential crashes" in (2) dovecot-auth and (3) imap/pop3-login.  NOTE: vector 2 might be related to a double free vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/18870; http://www.dovecot.org/list/dovecot/2006-February/011367.html; http://www.securityfocus.com/bid/16672
CVE: CVE-2006-0731
Published: 2006-02-16
Description: WmRoot/adapter-index.dsp in SAP Business Connector Core Fix 7 and earlier allows remote attackers to conduct spoofing (phishing) attacks via an absolute URL in the url parameter, which loads the URL inside a frame.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/18880; http://securitytracker.com/id?1015639; http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Phishing_Vector_in_SAP_BC.pdf
CVE: CVE-2006-0732
Published: 2006-02-16
Description: Directory traversal vulnerability in SAP Business Connector (BC) 4.6 and 4.7 allows remote attackers to read or delete arbitrary files via the fullName parameter to (1) sapbc/SAP/chopSAPLog.dsp or (2) invoke/sap.monitor.rfcTrace/deleteSingle.  Details will be updated after the grace period has ended.  NOTE: SAP Business Connector is an OEM version of webMethods Integration Server.  webMethods states that this issue can only occur when the product is installed as root/admin, and if the attacker has access to a general purpose port; however, both are discouraged in the documentation.  In addition, the attacker must already have acquired administrative privileges through other means.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/18880; http://securitytracker.com/id?1015639; http://securitytracker.com/id?1016090
CVE: CVE-2006-0733
Published: 2006-02-16
Description: Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field.  NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability
CVSS Score: 2.6 (LOW)
References: http://myimei.com/security/2006-02-15/wordpress200autors-websitexss-attack.html; http://www.securityfocus.com/archive/1/425043/100/0/threaded; http://www.securityfocus.com/bid/16656
CVE: CVE-2006-0734
Published: 2006-02-16
Description: The SV_CheckForDuplicateNames function in Valve Software Half-Life CSTRIKE Dedicated Server 1.6 and earlier allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) via a backslash character at the end of a connection string to UDP port 27015.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/csdos.txt; http://www.securityfocus.com/bid/16619; https://exchange.xforce.ibmcloud.com/vulnerabilities/33505
CVE: CVE-2006-0735
Published: 2006-02-16
Description: Cross-site scripting (XSS) vulnerability in BBcode.pm in M. Blom HTML::BBCode 1.04 and earlier, as used in products such as My Blog before 1.65, allows remote attackers to inject arbitrary Javascript via a javascript URI in an (1) img or (2) url BBcode tag.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/79/summary.html; http://evuln.com/vulns/80/summary.html; http://fuzzymonkey.net/forum/viewtopic.php?t=856