deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3411
Published: 2006-07-07
Description: TLS handshakes in Tor before 0.1.1.20 generate public-private keys based on TLS context rather than the connection, which makes it easier for remote attackers to conduct brute force attacks on the encryption keys.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20514; http://security.gentoo.org/glsa/glsa-200606-04.xml; http://tor.eff.org/cvs/tor/ChangeLog
CVE: CVE-2006-3412
Published: 2006-07-07
Description: Tor before 0.1.1.20 does not sufficiently obey certain firewall options, which allows remote attackers to bypass intended access restrictions for dirservers, direct connections, or proxy servers.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20514; http://security.gentoo.org/glsa/glsa-200606-04.xml; http://tor.eff.org/cvs/tor/ChangeLog
CVE: CVE-2006-3413
Published: 2006-07-07
Description: The privoxy configuration file in Tor before 0.1.1.20, when run on Apple OS X, logs all data via the "logfile", which allows attackers to obtain potentially sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20514; http://security.gentoo.org/glsa/glsa-200606-04.xml; http://tor.eff.org/cvs/tor/ChangeLog
CVE: CVE-2006-3414
Published: 2006-07-07
Description: Tor before 0.1.1.20 supports server descriptors that contain hostnames instead of IP addresses, which allows remote attackers to arbitrarily group users by providing preferential address resolution.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20514; http://security.gentoo.org/glsa/glsa-200606-04.xml; http://tor.eff.org/cvs/tor/ChangeLog
CVE: CVE-2006-3415
Published: 2006-07-07
Description: Tor before 0.1.1.20 uses improper logic to validate the "OR" destination, which allows remote attackers to perform a man-in-the-middle (MITM) attack via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20514; http://security.gentoo.org/glsa/glsa-200606-04.xml; http://tor.eff.org/cvs/tor/ChangeLog
CVE: CVE-2006-3416
Published: 2006-07-07
Description: Tor before 0.1.1.20 kills the circuit when it receives an unrecognized relay command, which causes network circuits to be disbanded.  NOTE: while this item is listed under the "Security fixes" section of the developer changelog, the developer clarified on 20060707 that this is only a self-DoS.  Therefore this issue should not be included in CVE
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20514; http://security.gentoo.org/glsa/glsa-200606-04.xml; http://tor.eff.org/cvs/tor/ChangeLog
CVE: CVE-2006-3417
Published: 2006-07-07
Description: Tor client before 0.1.1.20 prefers entry points based on is_fast or is_stable flags, which could allow remote attackers to be preferred over nodes that are identified as more trustworthy "entry guard" (is_guard) systems by directory authorities.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20514; http://security.gentoo.org/glsa/glsa-200606-04.xml; http://tor.eff.org/cvs/tor/ChangeLog
CVE: CVE-2006-3418
Published: 2006-07-07
Description: Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by users or other applications.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20514; http://security.gentoo.org/glsa/glsa-200606-04.xml; http://tor.eff.org/cvs/tor/ChangeLog
CVE: CVE-2006-3419
Published: 2006-07-07
Description: Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RAND_pseudo_bytes) instead of cryptographically strong RAND_bytes, and seeds the entropy value at start-up with 160-bit chunks without reseeding, which makes it easier for attackers to conduct brute force guessing attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20514; http://security.gentoo.org/glsa/glsa-200606-04.xml; http://tor.eff.org/cvs/tor/ChangeLog
CVE: CVE-2006-3420
Published: 2006-07-07
Description: Cross-site request forgery (CSRF) vulnerability in editpost.php in MyBulletinBoard (MyBB) before 1.1.5 allows remote attackers to perform unauthorized actions as a logged in user and delete arbitrary forum posts via a bbcode IMG tag with a modified delete parameter in a deletepost action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20659; http://www.osvdb.org/26807; https://exchange.xforce.ibmcloud.com/vulnerabilities/27682
CVE: CVE-2006-3421
Published: 2006-07-07
Description: PHP remote file inclusion vulnerability in SmartSiteCMS 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the root parameter in (1) comment.php, (2) admin/comedit.php, (3) admin/test.php, (4) admin/index.php, and (5) admin/include/inc_adminfoot.php, a different set of vectors than CVE-2006-3162.
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/1198; http://securitytracker.com/id?1016411; http://www.osvdb.org/26748
CVE: CVE-2006-3422
Published: 2006-07-07
Description: PHP remote file inclusion vulnerability in WonderEdit Pro CMS allows remote attackers to execute arbitrary PHP code via the config[template_path] parameter in user_bottom.php, as used by multiple templates including (1) rwb (template/rwb/user_bottom.php), (2) gwb (template/rwb/user_bottom.php, (3) blues, (4) bluwhi, and (5) grns.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/18821; https://exchange.xforce.ibmcloud.com/vulnerabilities/27536; https://www.exploit-db.com/exploits/1982
CVE: CVE-2006-3423
Published: 2006-07-07
Description: WebEx Downloader ActiveX Control and WebEx Downloader Java before 2.1.0.0 do not validate downloaded components, which allows remote attackers to execute arbitrary code via a website that activates the GpcUrlRoot and GpcIniFileName ActiveX controls to cause the client to download a DLL file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/20956; http://securitytracker.com/id?1016446; http://www.osvdb.org/27039
CVE: CVE-2006-3424
Published: 2006-07-07
Description: Multiple buffer overflows in WebEx Downloader ActiveX Control, possibly in versions before November 2005, allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20956; http://www.vupen.com/english/advisories/2006/2688; http://xforce.iss.net/xforce/alerts/id/226
CVE: CVE-2006-3425
Published: 2006-07-07
Description: FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, does not require authentication for dagent/proxyreg.asp, which allows remote attackers to list, add, or delete PatchLink Distribution Point (PDP) proxy servers via modified (1) List, (2) Proxy, or (3) Delete parameters.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html; http://secunia.com/advisories/20876; http://secunia.com/advisories/20878
CVE: CVE-2006-3426
Published: 2006-07-07
Description: Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (b) Novell ZENworks 6.2 SR1 and earlier allows remote attackers to overwrite arbitrary files and directories via a .. (dot dot) sequence in the (1) action, (2) agentid, or (3) index parameters to dagent/nwupload.asp, which are used as pathname components.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html; http://secunia.com/advisories/20876; http://secunia.com/advisories/20878
CVE: CVE-2006-3427
Published: 2006-07-07
Description: Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by declaring the sourceURL attribute on an uninitialized DirectAnimation.StructuredGraphicsControl ActiveX Object, which triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-6-structuredgraphicscontrol.html; http://www.osvdb.org/26839; http://www.securityfocus.com/bid/18855
CVE: CVE-2006-3428
Published: 2006-07-07
Description: Cross-site scripting (XSS) vulnerability in TigerTom TTCalc 1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in (1) loan.php and (2) mortgage.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20952; http://www.osvdb.org/27035; http://www.osvdb.org/27036
CVE: CVE-2006-3429
Published: 2006-07-07
Description: Cross-site scripting (XSS) vulnerability in TigerTom TTCalc 1.0 allows remote attackers to inject arbitrary web script or HTML via the currency parameter in (1) loan.php and (2) mortgage.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20952; http://www.securityfocus.com/archive/1/439208/100/0/threaded; http://www.securityfocus.com/bid/18844
CVE: CVE-2006-3430
Published: 2006-07-07
Description: SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (2) Novell ZENworks 6.2 SR1 and earlier, allows remote attackers to execute arbitrary SQL commands via the agentid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html; http://secunia.com/advisories/20876; http://secunia.com/advisories/20878
CVE: CVE-2006-2451
Published: 2006-07-07
Description: The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a local user to cause a denial of service (disk consumption) and possibly gain privileges via the PR_SET_DUMPABLE argument of the prctl function and a program that causes a core dump file to be created in a directory for which the user does not have permissions.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-399
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=195902; http://secunia.com/advisories/20953; http://secunia.com/advisories/20960
CVE: CVE-2006-3431
Published: 2006-07-07
Description: Buffer overflow in certain Asian language versions of Microsoft Excel might allow user-assisted attackers to execute arbitrary code via a crafted STYLE record in a spreadsheet that triggers the overflow when the user attempts to repair the document or selects the "Style" option, as demonstrated by nanika.xls.  NOTE: Microsoft has confirmed to CVE via e-mail that this is different than the other Excel vulnerabilities announced before 20060707, including CVE-2006-3059 and CVE-2006-3086.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4243&w=2; http://secunia.com/advisories/20268; http://securitytracker.com/id?1016430
CVE: CVE-2006-3458
Published: 2006-07-07
Description: Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.
CVSS Score: 2.1 (LOW)
References: http://mail.zope.org/pipermail/zope-announce/2006-July/001984.html; http://secunia.com/advisories/20988; http://secunia.com/advisories/21025
CVE: CVE-2006-1176
Published: 2006-07-08
Description: Buffer overflow in eBay Enhanced Picture Services (aka EPUImageControl Class) in EUPWALcontrol.dll before 1.0.3.48, as used in Sell Your Item (SYI), Setup & Test eBay Enhanced Picture Services, Picture Manager Enhanced Uploader, and CARad.com Add Vehicle, allows remote attackers to execute arbitrary code via a crafted HTML document.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20969; http://securitytracker.com/id?1016445; http://www.kb.cert.org/vuls/id/597721
CVE: CVE-2006-2917
Published: 2006-07-10
Description: Directory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and 6.1.3.1096, and possibly other versions before 6.1.4 Build 1099, allows remote authenticated users to read email of other users, or perform unauthorized operations on directories, via the (1) CREATE, (2) SELECT, (3) DELETE, (4) RENAME, (5) COPY, (6) APPEND, and (7) LIST commands.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/20707; http://secunia.com/secunia_research/2006-48/advisory/; http://www.securityfocus.com/bid/18908
CVE: CVE-2006-2936
Published: 2006-07-10
Description: The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the hardware can handle, which causes the data to be queued.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/20703; http://secunia.com/advisories/21057; http://secunia.com/advisories/21298
CVE: CVE-2006-3470
Published: 2006-07-10
Description: The Dell Openmanage CD launches X11 and SSH daemons that do not require authentication, which allows remote attackers to gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://msgs.securepoint.com/cgi-bin/get/bugtraq0606/187.html; http://www.kb.cert.org/vuls/id/577729; https://exchange.xforce.ibmcloud.com/vulnerabilities/27137
CVE: CVE-2006-3471
Published: 2006-07-10
Description: Microsoft Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) via a table with a frameset as a child, which triggers a null dereference, as demonstrated using the appendChild method.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-7-tableframeset.html; http://www.osvdb.org/26837; http://www.securityfocus.com/bid/18873
CVE: CVE-2006-3472
Published: 2006-07-10
Description: Microsoft Internet Explorer 6.0 and 6.0 SP1 allows remote attackers to cause a denial of service via an HTML page with an A tag containing a long title attribute.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/30822; http://www.securityfocus.com/bid/18820; http://www.osvdb.org/30822
CVE: CVE-2006-3473
Published: 2006-07-10
Description: CRLF injection vulnerability in form_mail Drupal Module before 1.8.2.2 allows remote attackers to inject e-mail headers, which facilitates sending spam messages, a different issue than CVE-2006-1225.
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/72177; http://secunia.com/advisories/20920; http://www.securityfocus.com/bid/18833
CVE: CVE-2006-3474
Published: 2006-07-10
Description: Multiple SQL injection vulnerabilities in Belchior Foundry vCard PRO allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to (a) gbrowse.php, (2) card_id parameter to (b) rating.php and (c) create.php, and the (3) event_id parameter to (d) search.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1230; http://www.securityfocus.com/archive/1/438589/100/100/threaded; http://www.securityfocus.com/bid/18699
CVE: CVE-2006-3475
Published: 2006-07-10
Description: Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the qb_path parameter to (1) index.php, (2) about.php, (3) contact.php, (4) delete.php, (5) faq.php, (6) features.php or (7) history.php, a different set of vectors than CVE-2006-2998.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1233; http://securitytracker.com/id?1016433; http://www.osvdb.org/28059
CVE: CVE-2006-3476
Published: 2006-07-10
Description: Cross-site scripting (XSS) vulnerability in comments.php in PhpWebGallery 1.5.2 and earlier, and possibly 1.6.0, allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20935; http://securityreason.com/securityalert/1228; http://securitytracker.com/id?1016435
CVE: CVE-2006-3477
Published: 2006-07-10
Description: Unspecified vulnerability in the POP service in Stalker CommuniGate Pro 5.1c1 and earlier allows remote attackers to cause a denial of service (server crash) via unspecified vectors involving opening an empty inbox.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20905; http://www.communigate.com/CommuniGatePro/History.html; http://www.securityfocus.com/bid/18770
CVE: CVE-2006-3478
Published: 2006-07-10
Description: PHP remote file inclusion vulnerability in styles/default/global_header.php in MyPHP CMS 0.3 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the domain parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/18834; http://www.vupen.com/english/advisories/2006/2679; https://exchange.xforce.ibmcloud.com/vulnerabilities/27538
CVE: CVE-2006-3479
Published: 2006-07-10
Description: Cross-site request forgery (CSRF) vulnerability in the del_block function in modules/Admin/block.php in Nuked-Klan 1.7.5 and earlier and 1.7 SP4.2 allows remote attackers to delete arbitrary "blocks" via a link with a modified bid parameter in a del_block op on the block page in index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20898; http://securityreason.com/securityalert/1205; http://www.securityfocus.com/archive/1/438703
CVE: CVE-2006-3480
Published: 2006-07-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.10 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters involving the (1) getUserStateFromRequest function, and the (2) SEF and (3) com_messages modules.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20874; http://www.joomla.org/content/view/1510/74/; http://www.joomla.org/content/view/1511/78/
CVE: CVE-2006-3481
Published: 2006-07-10
Description: Multiple SQL injection vulnerabilities in Joomla! before 1.0.10 allow remote attackers to execute arbitrary SQL commands via unspecified parameters involving the (1) "Remember Me" function, (2) "Related Items" module, and the (3) "Weblinks submission".
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20874; http://www.joomla.org/content/view/1510/74/; http://www.joomla.org/content/view/1511/78/
CVE: CVE-2006-3482
Published: 2006-07-10
Description: Cross-site scripting (XSS) vulnerability in maillist.php in PHPMailList 1.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVSS Score: 2.6 (LOW)
References: http://lostmon.blogspot.com/2006/07/multiple-vulnerabilities-in.html; http://secunia.com/advisories/20959; http://securitytracker.com/id?1016439
CVE: CVE-2006-3483
Published: 2006-07-10
Description: PHPMailList 1.8.0 stores sensitive information under the web document root iwth insufficient access control, which allows remote attackers to obtain email addresses of subscribers, configuration information, and the admin username and password via direct requests to (1) list.dat or (2) ml_config.dat.
CVSS Score: 5.0 (MEDIUM)
References: http://lostmon.blogspot.com/2006/07/multiple-vulnerabilities-in.html; http://securitytracker.com/id?1016439; http://www.osvdb.org/27017
CVE: CVE-2006-3484
Published: 2006-07-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) show_courses or (2) current_cat parameters to (a) admin/create_course.php, show_courses parameter to (b) users/create_course.php, (3) p parameter to (c) documentation/admin/, (4) forgot parameter to (d) password_reminder.php, (5) cat parameter to (e) users/browse.php, or the (6) submit parameter to admin/fix_content.php.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20941; http://www.atutor.ca/view/3/8341/1.html; http://www.osvdb.org/27019
CVE: CVE-2006-3485
Published: 2006-07-10
Description: Multiple SQL injection vulnerabilities in AstroDog Press Some Chess 1.5-RC2 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly including the gameID parameter in board.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20885; http://sourceforge.net/forum/forum.php?forum_id=586734; http://www.osvdb.org/26784
CVE: CVE-2006-3486
Published: 2006-07-10
Description: Off-by-one buffer overflow in the Instance_options::complete_initialization function in instance_options.cc in the Instance Manager in MySQL before 5.0.23 and 5.1 before 5.1.12 might allow local users to cause a denial of service (application crash) via unspecified vectors, which triggers the overflow when the convert_dirname function is called.  NOTE: the vendor has disputed this issue via e-mail to CVE, saying that it is only exploitable when the user has access to the configuration file or the Instance Manager daemon.  Due to intended functionality, this level of access would already allow the user to disrupt program operation, so this does not cross security boundaries and is not a vulnerability
CVSS Score: 2.1 (LOW)
CWE: CWE-189
References: http://bugs.mysql.com/bug.php?id=20622; http://dev.mysql.com/doc/refman/5.0/en/news-5-0-23.html; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-12.html
CVE: CVE-2006-3487
Published: 2006-07-10
Description: VirtuaStore 2.0 stores sensitive files under the web root with insufficient access control, which allows remote attackers to obtain local database information by directly accessing database/virtuastore.mdb.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1016421; http://securitytracker.com/id?1016421
CVE: CVE-2006-3488
Published: 2006-07-10
Description: Absolute path traversal vulnerability in administrador.asp in VirtuaStore 2.0 allows remote attackers to possibly read arbitrary directories or files via an absolute path with Windows drive letter in the Pasta parameter when link=util, acao=ftp, and acaba=sim.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1016421; http://securitytracker.com/id?1016421
CVE: CVE-2006-3489
Published: 2006-07-10
Description: F-Secure Anti-Virus 2003 through 2006 and other versions, Internet Security 2003 through 2006, and Service Platform for Service Providers 6.x and earlier allows remote attackers to bypass anti-virus scanning via a crafted filename.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20858; http://securitytracker.com/id?1016400; http://securitytracker.com/id?1016401
CVE: CVE-2006-3490
Published: 2006-07-10
Description: F-Secure Anti-Virus 2003 through 2006 and other versions, Internet Security 2003 through 2006, and Service Platform for Service Providers 6.x and earlier does not scan files contained on removable media when "Scan network drives" is disabled, which allows remote attackers to bypass anti-virus controls.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20858; http://securitytracker.com/id?1016400; http://securitytracker.com/id?1016401
CVE: CVE-2006-3491
Published: 2006-07-10
Description: Stack-based buffer overflow in Kaillera Server 0.86 and earlier allows remote attackers to execute arbitrary code via a long nickname.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/kailleraex-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]7900&w=2; http://secunia.com/advisories/20973
CVE: CVE-2006-3492
Published: 2006-07-10
Description: The CORBA::ORBInvokeRec::set_answer_invoke function in orb.cc in MICO (Mico Is CORBA) 2.3.12 and earlier allows remote attackers to cause a denial of service (application crash) via a message with an incorrect "object key", which triggers an assert error.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047708.html; http://mico.org/down.html; http://secunia.com/advisories/20970