deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-2785
Published: 2006-06-02
Description: Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 1.5.0.4 allows user-assisted remote attackers to inject arbitrary web script or HTML by tricking a user into (1) performing a "View Image" on a broken image in which the SRC attribute contains a Javascript URL, or (2) selecting "Show only this frame" on a frame whose SRC attribute contains a Javascript URL.
CVSS Score: 4.3 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/20376; http://secunia.com/advisories/20561
CVE: CVE-2006-2786
Published: 2006-06-02
Description: HTTP response smuggling vulnerability in Mozilla Firefox and Thunderbird before 1.5.0.4, when used with certain proxy servers, allows remote attackers to cause Firefox to interpret certain responses as if they were responses from two different sites via (1) invalid HTTP response headers with spaces between the header name and the colon, which might not be ignored in some cases, or (2) HTTP 1.1 headers through an HTTP 1.0 proxy, which are ignored by the proxy but processed by the client.
CVSS Score: 2.6 (LOW)
References: http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/20376; http://secunia.com/advisories/20382
CVE: CVE-2006-2787
Published: 2006-06-02
Description: EvalInSandbox in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to gain privileges via javascript that calls the valueOf method on objects that were created outside of the sandbox.
CVSS Score: 9.3 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/20376; http://secunia.com/advisories/20382
CVE: CVE-2006-2788
Published: 2006-06-02
Description: Double free vulnerability in the getRawDER function for nsIX509Cert in Firefox allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via certain Javascript code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/21269; http://secunia.com/advisories/21270
CVE: CVE-2006-2789
Published: 2006-06-02
Description: Evolution 2.2.x and 2.3.x in GNOME 2.7 and 2.8, when "load images if sender in addressbook" is enabled, allows remote attackers to cause a denial of service (persistent crash) via a crafted "From" header that triggers an assert error in camel-internet-address.c when a null pointer is used.
CVSS Score: 2.6 (LOW)
References: http://bugzilla.gnome.org/show_bug.cgi?id=309453; http://bugzilla.gnome.org/show_bug.cgi?id=311440; http://www.mandriva.com/security/advisories?name=MDKSA-2006:094
CVE: CVE-2006-2790
Published: 2006-06-02
Description: A package component in Sun Storage Automated Diagnostic Environment (StorADE) 2.4 uses world-writable permissions for certain critical files and directories, which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/20445; http://securitytracker.com/id?1016215; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102305-1
CVE: CVE-2006-2791
Published: 2006-06-03
Description: Directory traversal vulnerability in index.php in iBoutique.MALL and possibly iBoutique allows remote attackers to read arbitrary files via ".." sequences in the function parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1023; http://www.securityfocus.com/archive/1/435164/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26739
CVE: CVE-2006-2792
Published: 2006-06-03
Description: SQL injection vulnerability in misc.php in Woltlab Burning Board (WBB) 2.3.4 allows remote attackers to execute arbitrary SQL commands via the sid parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0760.html; http://securityreason.com/securityalert/1022; http://www.securityfocus.com/archive/1/435368/100/0/threaded
CVE: CVE-2006-2793
Published: 2006-06-03
Description: SQL injection vulnerability in Anket.asp in ASPSitem 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20355; http://securityreason.com/securityalert/1021; http://securityreason.com/securityalert/745
CVE: CVE-2006-2794
Published: 2006-06-03
Description: Hesabim.asp in ASPSitem 2.0 and earlier allows remote attackers to read private messages of other users via a modified id parameter.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/20355; http://securityreason.com/securityalert/1021; http://www.nukedx.com/?viewdoc=39
CVE: CVE-2006-2795
Published: 2006-06-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via (1) the xtref parameter in xiti.js and (2) an HTTP Referer header field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20363; http://www.osvdb.org/25844; http://www.securityfocus.com/bid/18710
CVE: CVE-2006-2796
Published: 2006-06-03
Description: Cross-site scripting (XSS) vulnerability in gallery.php in Captivate 1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter, which is reflected in an error message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0413.html; http://securityreason.com/securityalert/1020; http://www.securityfocus.com/bid/18072
CVE: CVE-2006-2797
Published: 2006-06-03
Description: Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to execute arbitrary SQL commands via the (1) CalendarDetailsID parameter in (a) month.php, (b) day.php, and (c) delCalendar.php; (2) ID parameter in (d) event.php; (3) AdminUserID parameter in (e) delAdmin.php; (4) EventLocationID parameter in (f) delAddress.php; and (5) LocationID parameter in (g) delCategory.php.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/26648; https://www.exploit-db.com/exploits/1818; https://exchange.xforce.ibmcloud.com/vulnerabilities/26648
CVE: CVE-2006-2798
Published: 2006-06-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) LoName parameter in (a) week.php and (b) month.php and (2) AddressLink parameter in (c) event.php.
CVSS Score: 6.8 (MEDIUM)
References: http://www.osvdb.org/31691; http://www.osvdb.org/31692; http://www.osvdb.org/31693
CVE: CVE-2006-2799
Published: 2006-06-03
Description: Cross-site scripting (XSS) vulnerability in content_footer.php in toendaCMS 0.7.0 allows remote attackers to inject arbitrary web scripts or HTML via the print_url variable.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party sources.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20391; http://www.securityfocus.com/bid/18207; http://www.vupen.com/english/advisories/2006/2081
CVE: CVE-2006-2800
Published: 2006-06-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Unak CMS 1.5 RC2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) u_a or (2) u_s parameters.  NOTE: this might be resultant from SQL injection.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://pridels0.blogspot.com/2006/06/unak-cms-vuln.html; http://secunia.com/advisories/20410; http://www.securityfocus.com/bid/18253
CVE: CVE-2006-2801
Published: 2006-06-03
Description: Multiple SQL injection vulnerabilities in Unak CMS 1.5 RC2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) u_a or (2) u_s parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/06/unak-cms-vuln.html; http://secunia.com/advisories/20410; http://www.securityfocus.com/bid/18253
CVE: CVE-2006-2802
Published: 2006-06-03
Description: Buffer overflow in the HTTP Plugin (xineplug_inp_http.so) for xine-lib 1.1.1 allows remote attackers to cause a denial of service (application crash) via a long reply from an HTTP server, as demonstrated using gxine 0.5.6.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.suse.com/archive/suse-security-announce/2006-Jun/0008.html; http://secunia.com/advisories/20369; http://secunia.com/advisories/20549
CVE: CVE-2006-2803
Published: 2006-06-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHP ManualMaker 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) id parameter to index.php, (2) search field (possibly the s parameter), or (3) comment field.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/20453; http://securityreason.com/securityalert/1024; http://www.securityfocus.com/archive/1/435717/100/0/threaded
CVE: CVE-2006-2804
Published: 2006-06-03
Description: Cross-site scripting (XSS) vulnerability in index.cfm in Goss Intelligent Content Management (iCM) 7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party sources.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20372; http://www.securityfocus.com/bid/18221; http://www.vupen.com/english/advisories/2006/2089
CVE: CVE-2006-2805
Published: 2006-06-03
Description: SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featureid parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/vbulletin-3.0.10-sql-inj.txt; http://www.securityfocus.com/bid/18197; http://downloads.securityfocus.com/vulnerabilities/exploits/vbulletin-3.0.10-sql-inj.txt
CVE: CVE-2006-2806
Published: 2006-06-05
Description: The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.
CVSS Score: 7.8 (HIGH)
References: http://advisories.echo.or.id/adv/adv31-y3dips-2006.txt; http://securityreason.com/securityalert/1038; http://www.securityfocus.com/archive/1/435278/100/0/threaded
CVE: CVE-2006-2807
Published: 2006-06-05
Description: ASPwebSoft Speedy Asp Discussion Forum allows remote attackers to change the password of any account via a modified account id and possibly arbitrary values of the name, email, country, password, and passwordre parameters to profileupdate.asp.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/1037; http://www.securityfocus.com/archive/1/435209/100/0/threaded; http://www.securityfocus.com/bid/18170
CVE: CVE-2006-2808
Published: 2006-06-05
Description: Cross-site scripting (XSS) vulnerability in Lycos Tripod htmlGEAR guestGEAR (aka Guest Gear) allows remote attackers to inject arbitrary web script or HTML via a guestbook post containing a javascript URI in the SRC attribute of the BR element after an extra "iframe" tagname within that element, followed by a double ">", which might bypass cleansing operations.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1036; http://www.securityfocus.com/archive/1/435220/100/0/threaded; http://securityreason.com/securityalert/1036
CVE: CVE-2006-2809
Published: 2006-06-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in ar-blog 5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) count parameter, and possibly the (2) next, (3) Year_the_news, and (4) mo parameters.  NOTE: the year and month vectors are already covered by CVE-2006-0333.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1035; http://www.securityfocus.com/archive/1/435205/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/26787
CVE: CVE-2006-2810
Published: 2006-06-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Belchior Foundry vCard 2.9 allow remote attackers to inject arbitrary web script or HTML via the page parameter in (1) toprated.php and (2) newcards.php.  NOTE: the card_id vector is already covered by CVE-2006-1230.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/19216; http://securityreason.com/securityalert/1034; http://securityreason.com/securityalert/571
CVE: CVE-2006-2811
Published: 2006-06-05
Description: Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the babInstallPath parameter in (1) index.php, (2) topman.php, (3) approb.php, (4) vacadmb.php, (5) vacadma.php, (6) vacadm.php, (7) statart.php, (8) search.php, (9) posts.php, (10) options.php, (11) login.php, (12) frchart.php, (13) flbchart.php, (14) fileman.php, (15) faq.php, (16) event.php, (17) directory.php, (18) articles.php, (19) artedit.php, (20) calday.php, and additional unspecified PHP scripts.  NOTE: the utilit.php vector is already covered by CVE-2005-1964.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1033; http://www.osvdb.org/27209; http://www.osvdb.org/27211
CVE: CVE-2006-2812
Published: 2006-06-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the (1) name (aka nick), (2) email, and (3) comment boxes; and via the (4) id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1032; http://www.securityfocus.com/archive/1/435599/100/0/threaded; http://securityreason.com/securityalert/1032
CVE: CVE-2006-2813
Published: 2006-06-05
Description: Directory traversal vulnerability in easy-scart.cgi in iShopCart allows remote attackers to read arbitrary files via a .. (dot dot) in the query string.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/20415; http://securityreason.com/securityalert/1031; http://www.securityfocus.com/archive/1/435597/100/0/threaded
CVE: CVE-2006-2814
Published: 2006-06-05
Description: Multiple buffer overflows in the (1) vGetPost and (2) main functions in easy-scart.c through easy-scart6.c in iShopCart allow remote attackers to execute arbitrary code by sending a large amount of data containing "Submit" in an sslinvoice action, and allow remote attackers to have an unknown impact via a large amount of posted data.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20415; http://securityreason.com/securityalert/1031; http://www.securityfocus.com/archive/1/435597/100/0/threaded
CVE: CVE-2006-2815
Published: 2006-06-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Two Shoes M-Factory (TSMF) SimpleBoard 1.1.0 Stable (aka com_simpleboard), as used in Mambo and Joomla!, allow remote attackers to inject arbitrary web script or HTML via (1) the Name field in "post ne topic" in the Frontend, (2) the Title (aka Community-Title) field in Simpleboard Configuration in the Backend Admin Panel, and the (3) Name (aka Forum-Title) and (4) Name (aka Category-Title) fields in Simpleboard Administration in the Backend Admin Panel.  NOTE: some sources have stated that the sb_authorname parameter is affected, but it is unclear which field is related to it.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046484.html; http://secunia.com/advisories/20409; http://securityreason.com/securityalert/1030
CVE: CVE-2006-2816
Published: 2006-06-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in coolphp magazine allow remote attackers to inject arbitrary web script or HTML via the (1) op and (2) nick parameters, and possibly the (3) 0000, (4) userinfo, (5) comp_der, (6) encuestas, and (7) pagina parameters.  NOTE: it is not clear whether this is a distributable product or a site-specific vulnerability. If it is site-specific, then it should not be included in CVE.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/1029; http://www.securityfocus.com/archive/1/435309/100/0/threaded; http://www.securityfocus.com/bid/18124
CVE: CVE-2006-2817
Published: 2006-06-05
Description: SQL injection vulnerability in bolum.php in tekno.Portal allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20464; http://www.securityfocus.com/bid/18216; http://www.securityfocus.com/data/vulnerabilities/exploits/Tekno.Portal-0601-sql.txt
CVE: CVE-2006-2818
Published: 2006-06-05
Description: PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONF[local_path] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20448; http://www.securityfocus.com/bid/18249; http://www.vupen.com/english/advisories/2006/2131
CVE: CVE-2006-2819
Published: 2006-06-05
Description: PHP remote file inclusion vulnerability in Wiki.php in Barnraiser Igloo 0.1.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the c_node[class_path] parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/18250; https://exchange.xforce.ibmcloud.com/vulnerabilities/27683; https://www.exploit-db.com/exploits/1863
CVE: CVE-2006-2820
Published: 2006-06-05
Description: Cross-site scripting (XSS) vulnerability in HotWebScripts.com Weblog Oggi 1.0 allows remote attackers to inject arbitrary web script or HTML via a comment, possibly involving a javascript URI in the SRC attribute of an IMG element.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20447; http://securityreason.com/securityalert/1028; http://www.securityfocus.com/archive/1/435713/100/0/threaded
CVE: CVE-2006-2821
Published: 2006-06-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in DeltaScripts Pro Publish allow remote attackers to inject arbitrary web script or HTML via the (1) artid parameter in art.php and the (2) catname parameter in cat.php.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1027; http://soot.shabgard.org/bugs/propublish.txt; http://www.securityfocus.com/archive/1/435787/100/0/threaded
CVE: CVE-2006-2822
Published: 2006-06-05
Description: SQL injection vulnerability in admin/default.asp in Dusan Drobac CodeAvalanche FreeForum (aka CAForum) 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.
CVSS Score: 7.5 (HIGH)
References: http://colander.altervista.org/advisory/CAForum.txt; http://secunia.com/advisories/20411; http://securityreason.com/securityalert/1026
CVE: CVE-2006-2823
Published: 2006-06-05
Description: Katrien De Graeve a.shopKart 2.0 (aka ashopKart20) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) admin/scart.mdb and possibly (2) admin/scart97.mdb.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20485; http://securityreason.com/securityalert/1025; http://securitytracker.com/id?1009549
CVE: CVE-2006-2824
Published: 2006-06-05
Description: Logicalware MailManager before 2.0.10 does not remove 0xc8 0x27 (0xc8 followed by a single-quote character) from the data stream to the server, which allows remote attackers to modify data and gain administrative access when PostgreSQL is used, aka "bug #1494281 - Postgres encoding security hole."  NOTE: while this issue involves PostgreSQL, it is specific to MailManager's interface to PostgreSQL and is therefore a different vulnerability than CVE-2006-2313 and CVE-2006-2314.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20303; http://sourceforge.net/project/shownotes.php?group_id=85788&release_id=419822; http://svn.sourceforge.net/viewcvs.cgi/mailmanager/MailManager/branches/RELENG_2_1/sql/__init__.py?r1=3019&r2=3063
CVE: CVE-2006-2825
Published: 2006-06-05
Description: cPanel does not automatically synchronize the PHP open_basedir configuration directive between the main server and virtual hosts that share physical directories, which might allow a local user to bypass open_basedir restrictions and access other virtual hosts via a PHP script that uses a main server URL (such as ~username) that is blocked by the user's own open_basedir directive, but not the main server's open_basedir directive.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0402.html; http://osvdb.org/31835; http://securityreason.com/securityalert/1039
CVE: CVE-2006-2826
Published: 2006-06-05
Description: SQL injection vulnerability in sessions.inc in PHP Base Library (PHPLib) before 7.4a allows remote attackers to execute arbitrary SQL commands via the id variable, which is set by a client through a query string or a cookie.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16902; http://securitytracker.com/id?1016123; http://sourceforge.net/project/shownotes.php?group_id=31885&release_id=396091
CVE: CVE-2006-2827
Published: 2006-06-05
Description: SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1, allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when the settings specify only "Search in Detailed description" and "Search also in ISBN."  NOTE: the vendor disputed this issue in a comment on the original researcher's blog, saying "the bug does not impose any security threat and remote attackers can't add, modify, or delete information in the back-end database by sending specially-crafted SQL statements to the search.php script using various search parameters." As of 20060605, the original blog entry is unavailable, although ISS also reports the same dispute.  CVE has not been able to investigate this issue further, although the researcher sometimes makes inaccurate claims
CVSS Score: 9.8 (CRITICAL)
References: http://pridels0.blogspot.com/2006/04/x-cart-sql-inj-vuln.html; http://www.osvdb.org/25204; https://exchange.xforce.ibmcloud.com/vulnerabilities/25944
CVE: CVE-2006-2828
Published: 2006-06-05
Description: Global variable overwrite vulnerability in PHP-Nuke allows remote attackers to conduct remote PHP file inclusion attacks via a modified phpbb_root_path parameter to the admin scripts (1) index.php, (2) admin_ug_auth.php, (3) admin_board.php, (4) admin_disallow.php, (5) admin_forumauth.php, (6) admin_groups.php, (7) admin_ranks.php, (8) admin_styles.php, (9) admin_user_ban.php, (10) admin_words.php, (11) admin_avatar.php, (12) admin_db_utilities.php, (13) admin_forum_prune.php, (14) admin_forums.php, (15) admin_mass_email.php, (16) admin_smilies.php, (17) admin_ug_auth.php, and (18) admin_users.php, which overwrites $phpbb_root_path when the import_request_variables function is executed after $phpbb_root_path has been initialized to a static value.
CVSS Score: 6.4 (MEDIUM)
References: http://securityreason.com/securityalert/1040; http://www.securityfocus.com/archive/1/435407/100/0/threaded; http://www.securityfocus.com/archive/1/435611/100/0/threaded
CVE: CVE-2006-2829
Published: 2006-06-05
Description: Buffer overflow in Hawk Monitoring Agent (HMA) for TIBCO Hawk before 4.6.1 and TIBCO Runtime Agent (TRA) before 5.4 allows authenticated users to execute arbitrary code via the configuration for tibhawkhma.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20431; http://securitytracker.com/id?1016223; http://www.kb.cert.org/vuls/id/620516