deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-5626
Published: 2006-10-31
Description: Cross-site scripting (XSS) vulnerability in cms_images/js/htmlarea/htmlarea.php in phpFaber Content Management System (CMS) before 1.3.36 on 20061026 allows remote attackers to inject arbitrary web script or HTML, probably via arbitrary parameters in the query string, as demonstrated with a vigilon parameter.  NOTE: earlier downloads of 1.3.36 have the vulnerability; the software was updated without changing the version number.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/22629; http://securityreason.com/securityalert/1802; http://www.securityfocus.com/archive/1/449894/100/0/threaded
CVE: CVE-2006-5627
Published: 2006-10-31
Description: Multiple PHP remote file inclusion vulnerabilities in QnECMS 2.5.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the adminfolderpath parameter to (1) headerscripts.php, (2) footerhome.php, and (3) footermain.php in admin/include/; (4) photogallery/headerscripts.php; and (5) footerhome.php, (6) footermain.php, (7) headermain.php, (8) sitemapfooter.php, and (9) sitemapheader.php in templates/.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv53-K-159-2006.txt; http://secunia.com/advisories/22623; http://www.osvdb.org/30117
CVE: CVE-2006-5628
Published: 2006-10-31
Description: SQL injection vulnerability in login.asp in UNISOR Content Management System (CMS) allows remote attackers to execute arbitrary SQL commands via the (1) user or (2) pass fields.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1800; http://www.securityfocus.com/archive/1/449905/100/0/threaded; http://www.securityfocus.com/bid/20770
CVE: CVE-2006-5629
Published: 2006-10-31
Description: Multiple SQL injection vulnerabilities in Hosting Controller 6.1 before Hotfix 3.3 allow remote attackers to execute arbitrary SQL commands via the ForumID parameter in (1) DisableForum.asp and (2) enableForum.asp.  NOTE: it was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and earlier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html; http://secunia.com/advisories/22607; http://secunia.com/advisories/28973
CVE: CVE-2006-5630
Published: 2006-10-31
Description: Hosting Controller 6.1 before Hotfix 3.3 allows remote attackers to (1) delete the virtual directory of an arbitrary site via a modified ForumID parameter in a disableforum action in DisableForum.asp and (2) create an arbitrary forum virtual directory via an empty ForumID parameter in an enableforum action in EnableForum.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22607; http://securityreason.com/securityalert/1804; http://securitytracker.com/id?1017103
CVE: CVE-2006-5631
Published: 2006-10-31
Description: Cross-site scripting (XSS) vulnerability in change_pass.php in iG Shop 1.4 allows remote attackers to inject arbitrary web script or HTML via arbitrary query strings when the action parameter is not "1", as demonstrated using script in the action parameter, a different vulnerability than CVE-2006-5632.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22701; http://securitytracker.com/id?1017130; http://www.attrition.org/pipermail/vim/2006-October/001099.html
CVE: CVE-2006-5632
Published: 2006-10-31
Description: Cross-site scripting (XSS) vulnerability in change_pass.php in iG Shop 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vulnerability than CVE-2006-5631.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/22701; http://securitytracker.com/id?1017130; http://www.attrition.org/pipermail/vim/2006-October/001099.html
CVE: CVE-2006-5633
Published: 2006-10-31
Description: Firefox 1.5.0.7 and 2.0, and Seamonkey 1.1b, allows remote attackers to cause a denial of service (crash) by creating a range object using createRange, calling selectNode on a DocType node (DOCUMENT_TYPE_NODE), then calling createContextualFragment on the range, which triggers a null dereference.  NOTE: the original Bugtraq post mentioned that code execution was possible, but followup analysis has shown that it is only a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050416.html; http://www.gotfault.net/research/advisory/gadv-firefox.txt; http://www.securityfocus.com/archive/1/450155/100/0/threaded
CVE: CVE-2006-5634
Published: 2006-11-01
Description: Multiple PHP remote file inclusion vulnerabilities in phpProfiles 2.1 Beta allow remote attackers to execute arbitrary PHP code via a URL in the (1) reqpath parameter to (a) body.inc.php and (b) body_blog.inc.php in users/include/; or the (2) usrinc parameter in users/include/upload_ht.inc.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/22644; http://www.osvdb.org/30137; http://www.osvdb.org/30138
CVE: CVE-2006-5635
Published: 2006-11-01
Description: SQL injection vulnerability in forum/search.asp in Web Wiz Forums allows remote attackers to execute arbitrary SQL commands via the KW parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1801; http://www.securityfocus.com/archive/1/450034/100/0/threaded; http://www.securityfocus.com/bid/20778
CVE: CVE-2006-5636
Published: 2006-11-01
Description: PHP remote file inclusion vulnerability in common.php in Simple Website Software (SWS) 0.99 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the SWSDIR parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22618; http://securityreason.com/securityalert/1799; http://www.osvdb.org/30131
CVE: CVE-2006-5637
Published: 2006-11-01
Description: PHP remote file inclusion vulnerability in faq_reply.php in Faq Administrator 2.1b allows remote attackers to execute arbitrary PHP code via a URL in the email parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22621; http://www.attrition.org/pipermail/vim/2006-October/001100.html; http://www.osvdb.org/30115
CVE: CVE-2006-5638
Published: 2006-11-01
Description: Multiple SQL injection vulnerabilities in cherche.php in PHPMyRing 4.2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) limite and (2) mots parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22620; http://www.securityfocus.com/bid/20792; http://www.vupen.com/english/advisories/2006/4261
CVE: CVE-2006-5639
Published: 2006-11-01
Description: Unspecified vulnerability in the random number generator in OpenWBEM (Web Based Enterprise Management) 3.2.0 allows attackers to gain privileges via vectors related to "local or HTTP Digest authentication."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22709; http://sourceforge.net/forum/forum.php?forum_id=625294; http://www.securityfocus.com/bid/20807
CVE: CVE-2006-5640
Published: 2006-11-01
Description: SQL injection vulnerability in guestbookview.asp in Techno Dreams Guest Book 1.0 earlier allows remote attackers to execute arbitrary SQL commands via the key parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22600; http://www.securityfocus.com/bid/20802; http://www.vupen.com/english/advisories/2006/4277
CVE: CVE-2006-5641
Published: 2006-11-01
Description: SQL injection vulnerability in MainAnnounce2.asp in Techno Dreams Announcement allows remote attackers to execute arbitrary SQL commands via the key parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22598; http://www.securityfocus.com/bid/20794; http://www.vupen.com/english/advisories/2006/4276
CVE: CVE-2006-5642
Published: 2006-11-01
Description: Unspecified vulnerability in NmnLogger 1.0.0 and earlier has unknown impact and attack vectors related to configuration of mesasge drivers.
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=456767&group_id=168715; http://www.securityfocus.com/bid/20820; http://www.vupen.com/english/advisories/2006/4237
CVE: CVE-2006-5643
Published: 2006-11-01
Description: Cross-site scripting (XSS) vulnerability in search_de.html in foresite CMS allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22648; http://securitytracker.com/id?1017134; http://www.majorsecurity.de/index_2.php?major_rls=major_rls29
CVE: CVE-2006-4517
Published: 2006-11-01
Description: Novell iManager 2.5 and 2.0.2 allows remote attackers to cause a denial of service (crash) in the Tomcat server via a long TREE parameter in an HTTP POST, which triggers a NULL pointer dereference.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189, CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=436; http://secunia.com/advisories/22657; http://securitytracker.com/id?1017139
CVE: CVE-2006-4704
Published: 2006-11-01
Description: Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual Studio 2005 allows remote attackers to bypass Internet zone restrictions and execute arbitrary code by instantiating dangerous objects, aka "WMI Object Broker Vulnerability."
CVSS Score: 6.8 (MEDIUM)
References: http://blogs.technet.com/msrc/archive/2006/11/01/microsoft-security-advisory-927709-posted.aspx; http://research.eeye.com/html/alerts/zeroday/20061031.html; http://secunia.com/advisories/22603
CVE: CVE-2006-4839
Published: 2006-11-01
Description: Sophos Anti-Virus 5.1 allows remote attackers to cause a denial of service (memory consumption) via a file that is compressed with Petite and contains a large number of sections.
CVSS Score: 5.0 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=438; http://secunia.com/advisories/22635; http://securitytracker.com/id?1017132
CVE: CVE-2006-5645
Published: 2006-11-01
Description: Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11, when "Enabled scanning of archives" is set, allows remote attackers to cause a denial of service (infinite loop) via a malformed RAR archive with an Archive Header section with the head_size and pack_size fields set to zero.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=439; http://secunia.com/advisories/22591; http://securitytracker.com/id?1017132
CVE: CVE-2006-5646
Published: 2006-11-01
Description: Heap-based buffer overflow in Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11, when archive scanning is enabled, allows remote attackers to trigger a denial of service (memory corruption) via a CHM file with an LZX decompression header that specifies a Window_size of 0.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=452; http://secunia.com/advisories/22591; http://securitytracker.com/id?1017132
CVE: CVE-2006-5647
Published: 2006-11-01
Description: Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a malformed CHM file with a large name length in the CHM chunk header, aka "CHM name length memory consumption vulnerability."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=451; http://secunia.com/advisories/22591; http://securitytracker.com/id?1017132
CVE: CVE-2006-5397
Published: 2006-11-03
Description: The Xinput module (modules/im/ximcp/imLcIm.c) in X.Org libX11 1.0.2 and 1.0.3 opens a file for reading twice using the same file descriptor, which causes a file descriptor leak that allows local users to read files specified by the XCOMPOSEFILE environment variable via the duplicate file descriptor.
CVSS Score: 2.1 (LOW)
References: http://gitweb.freedesktop.org/?p=xorg/lib/libX11.git%3Ba=commit%3Bh=686bb8b35acf6cecae80fe89b2b5853f5816ce19; http://secunia.com/advisories/22642; http://secunia.com/advisories/22749
CVE: CVE-2006-5652
Published: 2006-11-03
Description: Cross-site scripting (XSS) vulnerability in Sun iPlanet Messaging Server Messenger Express allows remote attackers to inject arbitrary web script via the expression Cascading Style Sheets (CSS) function, as demonstrated by setting the width style for an IMG element.  NOTE: this issue might be related to CVE-2006-5486, however due to the vagueness of the initial advisory and different researchers, it has been assigned a new CVE.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050460.html; http://securityreason.com/securityalert/1806; http://www.securityfocus.com/archive/1/450184/100/0/threaded
CVE: CVE-2006-5653
Published: 2006-11-03
Description: Cross-site scripting (XSS) vulnerability in the errorHTML function in the index script in Sun Java System Messenger Express 6 allows remote attackers to inject arbitrary web script or HTML via the error parameter.  NOTE: this issue might be related to CVE-2006-5486, however due to the vagueness of the initial advisory and different researchers a new CVE was assigned.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/22663; http://securityreason.com/securityalert/1805; http://www.securityfocus.com/archive/1/450153/100/0/threaded
CVE: CVE-2006-5654
Published: 2006-11-03
Description: Unspecified vulnerability in the Network Security Services (NSS) in Sun Java System Web Server 6.0 before SP 10 and ONE Application Server 7 before Update 3, when SSLv2 is enabled, allows remote authenticated users to cause a denial of service (application crash) via unspecified vectors.  NOTE: due to lack of details from the vendor, it is unclear whether this is related to vector 1 in CVE-2006-5201 or CVE-2006-3127.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/22646; http://securitytracker.com/id?1017143; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102670-1
CVE: CVE-2006-5655
Published: 2006-11-03
Description: SQL injection vulnerability in index.php in OpenDocMan 1.2p3 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1809; http://www.securityfocus.com/archive/1/450058/100/0/threaded; http://www.securityfocus.com/bid/20809
CVE: CVE-2006-5656
Published: 2006-11-03
Description: Memory leak in the push_align function in src/util.c in Vilistextum before 2.6.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the tmp_align variable.  NOTE: it is not clear whether this is a vulnerability, due to the functionality of the product.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://sourceforge.net/forum/forum.php?forum_id=626024; http://www.securityfocus.com/bid/20813; http://www.vupen.com/english/advisories/2006/4253
CVE: CVE-2006-5657
Published: 2006-11-03
Description: Multiple off-by-one errors in src/text.c in Vilistextum before 2.6.9 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/forum/forum.php?forum_id=626024; http://www.securityfocus.com/bid/20813; http://www.vupen.com/english/advisories/2006/4253
CVE: CVE-2006-5658
Published: 2006-11-03
Description: BlooMooWeb ActiveX control (AidemATL.dll) allows remote attackers to (1) download arbitrary files via a URL in the bstrUrl parameter to the BW_DownloadFile method, (2) execute arbitrary local files via a file path in the bstrParams parameter to the BW_LaunchGame method, and (3) delete arbitrary files via a file path in the filePath parameter to the BW_DeleteTempFile method.
CVSS Score: 7.6 (HIGH)
References: http://secunia.com/advisories/22666; http://securityreason.com/securityalert/1808; http://www.securityfocus.com/archive/1/450144/100/0/threaded
CVE: CVE-2006-5659
Published: 2006-11-03
Description: PAM_extern before 0.2 sends a password as a command line argument, which allows local users to obtain the password by listing the command line arguments, such as ps.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.1 (LOW)
References: http://www.vupen.com/english/advisories/2006/4235; https://exchange.xforce.ibmcloud.com/vulnerabilities/29912; http://www.vupen.com/english/advisories/2006/4235
CVE: CVE-2006-5660
Published: 2006-11-03
Description: Cisco Security Agent Management Center (CSAMC) 5.1 before 5.1.0.79 does not properly handle certain LDAP error messages, which allows remote attackers to bypass authentication requirements via an empty password when using an external LDAP server.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22684; http://securitytracker.com/id?1017148; http://www.cisco.com/en/US/products/products_security_advisory09186a00807726f7.shtml
CVE: CVE-2006-5661
Published: 2006-11-03
Description: Cross-site scripting (XSS) vulnerability in nquser.php in VIRtech Netquery allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050462.html; http://secunia.com/advisories/22864; http://securityreason.com/securityalert/1807
CVE: CVE-2006-5662
Published: 2006-11-03
Description: SQL injection vulnerability in easy notesManager (eNM) 0.0.1 allows remote attackers to execute arbitrary SQL commands via (1) the username parameter in login.php and (2) a search on the "search page."
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1819; http://www.securityfocus.com/archive/1/450045/100/0/threaded; http://www.securityfocus.com/bid/20803
CVE: CVE-2006-5663
Published: 2006-11-03
Description: IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 use insecure permissions for installation scripts, which allows local users to gain privileges by modifying the scripts.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/22609; http://securitytracker.com/id?1017156; http://www-1.ibm.com/support/docview.wss?uid=swg21247438
CVE: CVE-2006-5664
Published: 2006-11-03
Description: The installation script in IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 allows local users to "compromise security" via a symlink attack on temporary files.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/22609; http://securitytracker.com/id?1017156; http://www-1.ibm.com/support/docview.wss?uid=swg21247438
CVE: CVE-2006-5665
Published: 2006-11-03
Description: PHP remote file inclusion vulnerability in admin/modules_data.php in the phpBB module Spider Friendly 1.3.10 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22630; http://www.osvdb.org/30160; http://www.securityfocus.com/bid/20844
CVE: CVE-2006-5666
Published: 2006-11-03
Description: SQL injection vulnerability in includes/menu.inc.php in E-Annu 1.0 allows remote attackers to execute arbitrary SQL commands via the login parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22631; http://www.securityfocus.com/bid/20815; http://www.vupen.com/english/advisories/2006/4279
CVE: CVE-2006-5667
Published: 2006-11-03
Description: Multiple PHP remote file inclusion vulnerabilities in P-Book 1.17 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pb_lang parameter to (1) admin.php and (2) pbook.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22608; http://securityreason.com/securityalert/1811; http://www.securityfocus.com/archive/1/449106/100/200/threaded
CVE: CVE-2006-5668
Published: 2006-11-03
Description: Unspecified vulnerability in Ampache 3.3.2 and earlier, when register_globals is enabled, allows remote attackers to bypass security restrictions and gain guest access.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22842; http://www.securityfocus.com/bid/20798; http://www.vupen.com/english/advisories/2006/4236
CVE: CVE-2006-5669
Published: 2006-11-03
Description: PHP remote file inclusion vulnerability in gestion/savebackup.php in Gepi 1.4.0 and earlier, and possibly other versions before 1.4.4, allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.attrition.org/pipermail/vim/2006-November/001104.html; http://www.securityfocus.com/bid/20830; https://exchange.xforce.ibmcloud.com/vulnerabilities/29921
CVE: CVE-2006-5670
Published: 2006-11-03
Description: PHP remote file inclusion vulnerability in forgot_pass.php in Free Image Hosting 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22597; http://www.osvdb.org/30127; http://www.securityfocus.com/bid/20782
CVE: CVE-2006-5671
Published: 2006-11-03
Description: PHP remote file inclusion vulnerability in contact.php in Free Image Hosting 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/4229; http://www.vupen.com/english/advisories/2006/4229
CVE: CVE-2006-5672
Published: 2006-11-03
Description: PHP remote file inclusion vulnerability in web/init_mysource.php in MySource CMS 2.16.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the INCLUDE_PATH parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20817; http://www.vupen.com/english/advisories/2006/4273; https://exchange.xforce.ibmcloud.com/vulnerabilities/29865
CVE: CVE-2006-5673
Published: 2006-11-03
Description: PHP remote file inclusion vulnerability in bb_func_txt.php in miniBB 2.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22596; http://www.minibb.net/forums/9_4274_0.html; http://www.osvdb.org/29971
CVE: CVE-2006-5674
Published: 2006-11-03
Description: Multiple PHP remote file inclusion vulnerabilities in miniBB 2.0.2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter to (1) bb_func_forums.php, (2) bb_functions.php, or (3) the RSS plugin.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33963; http://osvdb.org/33964; http://osvdb.org/33965
CVE: CVE-2006-5675
Published: 2006-11-03
Description: Multiple unspecified vulnerabilities in Pentaho Business Intelligence (BI) Suite before 1.2 RC3 (1.2.0.470-RC3) have unknown impact and attack vectors, related to "MySQL Scripts need changes for security," possibly SQL injection vulnerabilities associated with these scripts.
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/project/shownotes.php?group_id=140317&release_id=456313; http://www.securityfocus.com/bid/20806; http://www.vupen.com/english/advisories/2006/4252