deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-2336
Published: 2006-05-12
Description: SQL injection vulnerability in showthread.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands via the comma parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://securityreason.com/securityalert/884; http://www.osvdb.org/25674; http://www.securityfocus.com/archive/1/433564/100/0/threaded
CVE: CVE-2006-2337
Published: 2006-05-12
Description: Directory traversal vulnerability in webcm in the D-Link DSL-G604T Wireless ADSL Router Modem allows remote attackers to read arbitrary files via an absolute path in the getpage parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securitytracker.com/id?1016038; http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.securiteam.com/securitynews/5JP0220IKK.html
CVE: CVE-2006-2338
Published: 2006-05-12
Description: PlaNet Concept plaNetStat 20050127 allows remote attackers to gain administrative privileges, and view and configure log files, via a direct request to the (1) admin.php or (2) settings.php page.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/874; http://www.securityfocus.com/archive/1/433372/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26436
CVE: CVE-2006-1859
Published: 2006-05-12
Description: Memory leak in __setlease in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (memory consumption) via unspecified actions related to an "uninitialised return value," aka "slab leak."
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/20083; http://secunia.com/advisories/20716; http://secunia.com/advisories/21045
CVE: CVE-2006-1860
Published: 2006-05-12
Description: lease_init in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (fcntl_setlease lockup) via actions that cause lease_init to free a lock that might not have been allocated on the stack.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/20083; http://secunia.com/advisories/20716; http://secunia.com/advisories/21045
CVE: CVE-2006-2339
Published: 2006-05-12
Description: SQL injection vulnerability in index.php in evoTopsites 2.x and evoTopsites Pro 2.x allows remote attackers to execute arbitrary SQL commands via the (1) cat_id and (2) id parameters.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19989; http://securitytracker.com/id?1016062; http://www.hamid.ir/security/evotopsites.txt
CVE: CVE-2006-2340
Published: 2006-05-12
Description: Cross-site scripting (XSS) vulnerability in PassMasterFlex and PassMasterFlexPlus (PassMasterFlex+) 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) password, or (3) User-Agent HTTP header in the Hack Log.
CVSS Score: 5.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0108.html; http://secunia.com/advisories/20020; http://securityreason.com/securityalert/879
CVE: CVE-2006-2341
Published: 2006-05-12
Description: The HTTP proxy in Symantec Gateway Security 5000 Series 2.0.1 and 3.0, and Enterprise Firewall 8.0, when NAT is being used, allows remote attackers to determine internal IP addresses by using malformed HTTP requests, as demonstrated using a get request without a space separating the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/20082; http://securityresponse.symantec.com/avcenter/security/Content/2006.05.10.html; http://securitytracker.com/id?1016057
CVE: CVE-2006-2342
Published: 2006-05-12
Description: IBM WebSphere Application Server 6.0.2 before FixPack 3 allows remote attackers to bypass authentication for the Welcome Page via a request to the default context root.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20025; http://www-1.ibm.com/support/docview.wss?uid=swg24010245; http://www.osvdb.org/25368
CVE: CVE-2006-2343
Published: 2006-05-12
Description: Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine OpManager 6.0 allows remote attackers to inject arbitrary web script or HTML via the searchTerm parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/20067; http://www.securityfocus.com/bid/17944; http://www.vupen.com/english/advisories/2006/1774
CVE: CVE-2006-2344
Published: 2006-05-12
Description: SQL injection vulnerability in inc/elementz.php in AliPAGER 1.5, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the ubild parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20084; http://www.hamid.ir/security/alipager.txt; http://www.securityfocus.com/bid/17945
CVE: CVE-2006-2345
Published: 2006-05-12
Description: Cross-site scripting (XSS) vulnerability in inc/elementz.php in AliPAGER 1.5 allows remote attackers to inject arbitrary web script or HTML via the ubild parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.  NOTE: this issue might be resultant from SQL injection.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20084; http://www.osvdb.org/25493; https://exchange.xforce.ibmcloud.com/vulnerabilities/26379
CVE: CVE-2006-2346
Published: 2006-05-12
Description: vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, allows remote attackers to authenticate to an account that does not have a cleartext password set by using a blank password to (1) SMTP AUTH or (2) APOP.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19987; http://sourceforge.net/project/shownotes.php?release_id=415350; http://www.osvdb.org/25445
CVE: CVE-2006-2347
Published: 2006-05-12
Description: E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via "'" characters, and possibly other invalid values, in (1) the id parameter to form_grupo.html, or requests to the (2) archivos/ and (3) files/ directories.  NOTE: this issue might be resultant from SQL injection.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html; http://secunia.com/advisories/20071; http://securityreason.com/securityalert/891
CVE: CVE-2006-2348
Published: 2006-05-12
Description: Cross-site scripting (XSS) vulnerability in form_grupo.html in E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this issue might be resultant from SQL injection.
CVSS Score: 2.6 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html; http://secunia.com/advisories/20071; http://securityreason.com/securityalert/891
CVE: CVE-2006-2349
Published: 2006-05-12
Description: E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to upload or modify arbitrary files, and execute arbitrary code, via a direct request to (1) common/html_editor/image_browser.upload.html, (2) common/html_editor/image_browser.html, or (3) common/html_editor/html_editor.html.  NOTE: this can also be used for cross-site scripting (XSS) attacks by uploading cascading style sheet (.CSS) files.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html; http://lists.oasyssoft.com/ebd-devel/200605/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0633&w=2
CVE: CVE-2006-1453
Published: 2006-05-12
Description: Stack-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT image format file containing malformed font information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20069
CVE: CVE-2006-1454
Published: 2006-05-12
Description: Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT image format file with malformed image data.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20069
CVE: CVE-2006-1458
Published: 2006-05-12
Description: Integer overflow in Apple QuickTime Player before 7.1 allows remote attackers to execute arbitrary code via a crafted JPEG image.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://secunia.com/advisories/20069; http://securitytracker.com/id?1016067
CVE: CVE-2006-1459
Published: 2006-05-12
Description: Multiple integer overflows in Apple QuickTime before 7.1 allow remote attackers to cause a denial of service or execute arbitrary code via a crafted QuickTime movie (.MOV).
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://secunia.com/advisories/20069; http://securityreason.com/securityalert/887
CVE: CVE-2006-1460
Published: 2006-05-12
Description: Multiple buffer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime movie (.MOV), as demonstrated via a large size for a udta Atom.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045987.html; http://secunia.com/advisories/20069
CVE: CVE-2006-1461
Published: 2006-05-12
Description: Multiple buffer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime Flash (SWF) file.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://secunia.com/advisories/20069; http://securityreason.com/securityalert/887
CVE: CVE-2006-1462
Published: 2006-05-12
Description: Multiple integer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime H.264 (M4V) video format file.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://secunia.com/advisories/20069; http://securityreason.com/securityalert/887
CVE: CVE-2006-1463
Published: 2006-05-12
Description: Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a H.264 (M4V) video format file with a certain modified size value.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://secunia.com/advisories/20069; http://securityreason.com/securityalert/888
CVE: CVE-2006-1464
Published: 2006-05-12
Description: Buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickTime MPEG4 (M4P) video format file.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://secunia.com/advisories/20069; http://securityreason.com/securityalert/887
CVE: CVE-2006-1465
Published: 2006-05-12
Description: Buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickTime AVI video format file.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://secunia.com/advisories/20069; http://securityreason.com/securityalert/887
CVE: CVE-2006-1439
Published: 2006-05-12
Description: NSSecureTextField in AppKit in Apple Mac OS X 10.4.6 does not re-enable secure event input under certain circumstances, which could allow other applications in the window session to monitor input characters and keyboard events.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://www.osvdb.org/25583
CVE: CVE-2006-1440
Published: 2006-05-12
Description: BOM in Apple Mac OS X 10.3.9 and 10.4.6 allows attackers to overwrite arbitrary files via an archive that contains symbolic links.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016082
CVE: CVE-2006-1441
Published: 2006-05-12
Description: Integer overflow in CFNetwork in Apple Mac OS X 10.4.6 allows remote attackers to execute arbitrary code via crafted chunked transfer encoding.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016082
CVE: CVE-2006-1442
Published: 2006-05-12
Description: The bundle API in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 loads dynamic libraries even if the client application has not directly requested it, which allows attackers to execute arbitrary code from an untrusted bundle.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016080
CVE: CVE-2006-1443
Published: 2006-05-12
Description: Integer underflow in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving conversions from string to file system representation within (1) CFStringGetFileSystemRepresentation or (2) getFileSystemRepresentation:maxLength:withPath in NSFileManager, and possibly other similar API functions.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016080
CVE: CVE-2006-1444
Published: 2006-05-12
Description: CoreGraphics in Apple Mac OS X 10.4.6, when "Enable access for assistive devices" is on, allows an application to bypass restrictions for secure event input and read certain events from other applications in the same window session by using Quartz Event Services.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016079
CVE: CVE-2006-1445
Published: 2006-05-12
Description: Buffer overflow in the FTP server (FTPServer) in Apple Mac OS X 10.3.9 and 10.4.6 allows remote authenticated users to execute arbitrary code via vectors related to "FTP server path name handling."
CVSS Score: 6.5 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016084
CVE: CVE-2006-1446
Published: 2006-05-12
Description: Keychain in Apple Mac OS X 10.3.9 and 10.4.6 might allow an application to bypass a locked Keychain by first obtaining a reference to the Keychain when it is unlocked, then reusing that reference after the Keychain has been locked.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016072
CVE: CVE-2006-1447
Published: 2006-05-12
Description: LaunchServices in Apple Mac OS X 10.4.6 allows remote attackers to cause Safari to launch unsafe content via long file name extensions, which prevents Download Validation from determining which application will be used to open the file.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016081
CVE: CVE-2006-1448
Published: 2006-05-12
Description: Finder in Apple Mac OS X 10.3.9 and 10.4.6 allows user-assisted attackers to execute arbitrary code by tricking a user into launching an Internet Location item that appears to use a safe URL scheme, but which actually has a different and more risky scheme.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016082
CVE: CVE-2006-1449
Published: 2006-05-12
Description: Integer overflow in Mail in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via a crafted MacMIME encapsulated attachment.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016078
CVE: CVE-2006-1450
Published: 2006-05-12
Description: Mail in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via an enriched text e-mail message with "invalid color information" that causes Mail to allocate and initialize arbitrary classes.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016078
CVE: CVE-2006-1451
Published: 2006-05-12
Description: MySQL Manager in Apple Mac OS X 10.3.9 and 10.4.6, when setting up a new MySQL database server, does not use the "New MySQL root password" that is provided, which causes the MySQL root password to be blank and allows local users to gain full privileges to that database.
CVSS Score: 7.2 (HIGH)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016077
CVE: CVE-2006-1452
Published: 2006-05-12
Description: Stack-based buffer overflow in Preview in Apple Mac OS 10.4 up to 10.4.6 allows local users to execute arbitrary code via a deep directory hierarchy.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016076
CVE: CVE-2006-1455
Published: 2006-05-12
Description: QuickTime Streaming Server in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to cause a denial of service (crash and connection interruption) via a QuickTime movie with a missing track, which triggers a null dereference.
CVSS Score: 7.8 (HIGH)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016070
CVE: CVE-2006-1456
Published: 2006-05-12
Description: Buffer overflow in QuickTime Streaming Server in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via a crafted RTSP request, which is not properly handled during message logging.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016070
CVE: CVE-2006-1457
Published: 2006-05-12
Description: Safari on Apple Mac OS X 10.4.6, when "Open `safe' files after downloading" is enabled, will automatically expand archives, which could allow remote attackers to overwrite arbitrary files via an archive that contains a symlink.
CVSS Score: 2.6 (LOW)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/20077; http://securitytracker.com/id?1016069
CVE: CVE-2006-2238
Published: 2006-05-12
Description: Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted BMP file that triggers the overflow in the ReadBMP function.  NOTE: this issue was originally included as item 3 in CVE-2006-1983, but it has been given a separate identifier because it is a distinct issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html; http://secunia.com/advisories/20069; http://securitytracker.com/id?1016067
CVE: CVE-2006-1519
Published: 2006-05-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-2224.  Reason: This candidate is a duplicate of CVE-2006-2224.  Notes: All CVE users should reference CVE-2006-2224 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-2350
Published: 2006-05-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-2344.  Reason: This candidate is a duplicate of CVE-2006-2344.  Notes: All CVE users should reference CVE-2006-2344 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-2351
Published: 2006-05-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via the (1) sDeviceView or (2) nDeviceID parameter to (a) NmConsole/Navigation.asp or (3) sHostname parameter to (b) NmConsole/ToolResults.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20075; http://securityreason.com/securityalert/897; http://www.osvdb.org/25469
CVE: CVE-2006-2352
Published: 2006-05-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via unknown vectors in (1) NmConsole/Tools.asp and (2) NmConsole/DeviceSelection.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20075; http://www.osvdb.org/25471; http://www.osvdb.org/25472
CVE: CVE-2006-2353
Published: 2006-05-15
Description: NmConsole/DeviceSelection.asp in Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to redirect users to other websites via the (1) sCancelURL and possibly (2) sRedirectUrl parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/20075; http://securityreason.com/securityalert/897; http://www.osvdb.org/25473
CVE: CVE-2006-2354
Published: 2006-05-15
Description: NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium generates different error messages in a way that allows remote attackers to enumerate valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20075; http://www.osvdb.org/25476; https://exchange.xforce.ibmcloud.com/vulnerabilities/26503
CVE: CVE-2006-2355
Published: 2006-05-15
Description: Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium allows remote attackers to obtain full path information via 404 error messages.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20075; http://www.osvdb.org/25477; https://exchange.xforce.ibmcloud.com/vulnerabilities/26504
CVE: CVE-2006-2356
Published: 2006-05-15
Description: NmConsole/utility/RenderMap.asp in Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain sensitive information about network nodes via a modified nDeviceGroupID parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/20075; http://securityreason.com/securityalert/897; http://www.osvdb.org/25475
CVE: CVE-2006-2357
Published: 2006-05-15
Description: Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain source code for scripts via a trailing dot in a request to NmConsole/Login.asp.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20075; http://securityreason.com/securityalert/897; http://www.securityfocus.com/archive/1/433808