deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-2028
Published: 2006-04-26
Description: Cross-site scripting (XSS) vulnerability in imagelist.php in Jeremy Ashcraft Simplog 0.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the imagedir parameter.  NOTE: this issue might be resultant from directory traversal.
CVSS Score: 5.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0649.html; http://secunia.com/advisories/19764; http://securityreason.com/securityalert/799
CVE: CVE-2006-2029
Published: 2006-04-26
Description: Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) tid parameter in (a) preview.php; the (2) cid, (3) pid, and (4) eid parameters in (b) archive.php; and the (5) pid parameter in (c) comments.php.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0649.html; http://secunia.com/advisories/19764; http://securityreason.com/securityalert/799
CVE: CVE-2006-2030
Published: 2006-04-26
Description: The Allied Telesyn AT-9724TS switch allows remote attackers to cause a denial of service via a large amount of UDP data to the switch, which leads to unstable operation and possibly failure of the management interface or routing.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/431586/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/25938; http://www.securityfocus.com/archive/1/431586/100/0/threaded
CVE: CVE-2006-2031
Published: 2006-04-26
Description: Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/phpmyadmin-xss-vuln.html; http://secunia.com/advisories/19659; http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2
CVE: CVE-2006-2032
Published: 2006-04-26
Description: Multiple SQL injection vulnerabilities in Core CoreNews 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) icon_id and (2) userid parameters in preview.php.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045372.html; http://securityreason.com/securityalert/797; http://www.nukedx.com/?getxpl=24
CVE: CVE-2006-2033
Published: 2006-04-26
Description: PHP remote file inclusion vulnerability in Core CoreNews 2.0.1 and earlier allows remote authenticated users to execute arbitrary commands via the show parameter.  NOTE: this is a different vector than CVE-2006-1212, although it might be the same primary issue.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045372.html; http://securityreason.com/securityalert/797; http://www.nukedx.com/?getxpl=24
CVE: CVE-2006-2034
Published: 2006-04-26
Description: SQL injection vulnerability in function/showprofile.php in FlexBB 0.5.5 allows remote attackers to execute arbitrary SQL commands, and view all usernames and passwords, via the id parameter to the showprofile page in index.php.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/24867; http://www.securityfocus.com/archive/1/431793/100/0/threaded; http://www.securityfocus.com/bid/17574
CVE: CVE-2006-2035
Published: 2006-04-26
Description: Websense, when configured to permit access to the dynamic content category, allows local users to bypass intended blocking of the Uncategorized category by appending a "/?" sequence to a URL.
CVSS Score: 3.7 (LOW)
References: http://www.osvdb.org/25211; http://www.securityfocus.com/archive/1/431600/100/0/threaded; http://www.securityfocus.com/archive/1/431685/100/0/threaded
CVE: CVE-2006-2036
Published: 2006-04-26
Description: iOpus Secure Email Attachments (SEA), probably 1.0, does not properly handle passwords that consist of repetitions of a substring, which allows attackers to decrypt files by entering only the substring.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19771; http://securitytracker.com/id?1015980; http://www.securityfocus.com/archive/1/431904/100/0/threaded
CVE: CVE-2006-1864
Published: 2006-04-26
Description: Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences, a similar vulnerability to CVE-2006-1863.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/19869; http://secunia.com/advisories/20237; http://secunia.com/advisories/20398
CVE: CVE-2006-2037
Published: 2006-04-26
Description: Cross-site scripting (XSS) vulnerability in index.php in Thwboard 3.0 Beta 2.84 allows remote attackers to inject arbitrary web script or HTML via the navpath parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/431509/100/0/threaded; http://www.securityfocus.com/bid/17627; https://exchange.xforce.ibmcloud.com/vulnerabilities/25953
CVE: CVE-2006-2038
Published: 2006-04-26
Description: Multiple SQL injection vulnerabilities in ampleShop 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) RecordID parameter in (a) Customeraddresses_RecordAction.cfm and (b) youraccount.cfm; (2) solus parameter in (c) detail.cfm; and (3) cat parameter in (d) category.cfm.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/04/ampleshop-ecommerce-software-vuln.html; http://secunia.com/advisories/19806; http://www.osvdb.org/24934
CVE: CVE-2006-2039
Published: 2006-04-26
Description: Multiple SQL injection vulnerabilities in the osTicket module in Help Center Live before 2.1.0 allow remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19776; http://sourceforge.net/project/shownotes.php?release_id=411859; http://www.securityfocus.com/bid/17676
CVE: CVE-2006-2040
Published: 2006-04-26
Description: Multiple SQL injection vulnerabilities in photokorn 1.53 and 1.542 allow remote attackers to execute arbitrary SQL commands via the (1) cat, (2) pic and (3) page parameter in index.php; (4) id parameter in postcard.php; and (5) cat parameter in print.php.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19836; http://securityreason.com/securityalert/789; http://www.osvdb.org/24981
CVE: CVE-2006-2041
Published: 2006-04-26
Description: PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19801; http://www.vupen.com/english/advisories/2006/1515; https://exchange.xforce.ibmcloud.com/vulnerabilities/26079
CVE: CVE-2006-2043
Published: 2006-04-26
Description: na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 allows local users to gain Unix shell access via "`" (backtick) characters in the appliance's command line interface (CLI).
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/19818; http://securityreason.com/securityalert/793; http://www.securityfocus.com/archive/1/432007/100/0/threaded
CVE: CVE-2006-2044
Published: 2006-04-26
Description: na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 has a default username of admin and a default password of admin.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19818; http://securityreason.com/securityalert/793; http://www.securityfocus.com/archive/1/432007/100/0/threaded
CVE: CVE-2006-2045
Published: 2006-04-26
Description: The (1) shadow password file in na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 has world readable permissions, which allows local users to view encrypted passwords; and the (2) NetAccess database file has world readable and writable permissions, which allows local users to view sensitive information and modify data.
CVSS Score: 3.6 (LOW)
References: http://secunia.com/advisories/19818; http://www.securityfocus.com/archive/1/432007/100/0/threaded; http://www.securityfocus.com/bid/17698
CVE: CVE-2006-2046
Published: 2006-04-26
Description: Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) keywords parameters in (a) Results.cfm, and the (3) ProdID parameter in (b) Details.cfm.
CVSS Score: 6.4 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/cartweaver-coldfusion-vuln.html; http://secunia.com/advisories/19812; http://www.osvdb.org/24961
CVE: CVE-2006-2047
Published: 2006-04-26
Description: Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid (1) secondary, (2) PageNum_Results, (3) category, or (4) keywords parameter in (a) Results.cfm; or an invalid (5) ProdID parameter in (b) Details.cfm; which reveal the path in various error messages. NOTE: the behavior for the category, keywords, and ProdID parameters might be resultant from SQL injection.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/cartweaver-coldfusion-vuln.html; http://secunia.com/advisories/19812; http://www.osvdb.org/24963
CVE: CVE-2006-2048
Published: 2006-04-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) port, (2) server, and (3) user parameters.  NOTE: it is possible that the affected version is actually 3.2.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19827; http://securityreason.com/securityalert/786; http://www.osvdb.org/24975
CVE: CVE-2006-2049
Published: 2006-04-26
Description: Cross-site scripting (XSS) vulnerability in dcboard.cgi in DCScripts DCForumLite 3.0 allows remote attackers to inject arbitrary web script or HTML via the az parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19815; http://securityreason.com/securityalert/792; http://www.osvdb.org/24988
CVE: CVE-2006-2050
Published: 2006-04-26
Description: SQL injection vulnerability in dcboard.cgi in DCScripts DCForumLite 3.0 allows remote attackers to execute arbitrary SQL commands via the az parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/792; http://www.osvdb.org/24989; http://www.securityfocus.com/archive/1/432010/100/0/threaded
CVE: CVE-2006-2051
Published: 2006-04-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in myadmin/index.php in NextAge Shopping Cart allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) password parameters.
CVSS Score: 5.8 (MEDIUM)
References: http://securityreason.com/securityalert/791; http://www.aria-security.net/advisory/nextage/nextageshoppingcart.txt; http://www.securityfocus.com/archive/1/431983/100/0/threaded
CVE: CVE-2006-2052
Published: 2006-04-26
Description: Cross-site scripting (XSS) vulnerability in Verosky Media Instant Photo Gallery allows remote attackers to inject arbitrary web script or HTML via the member parameter in a viewpro action in member.php. NOTE: the original report may be inaccurate, since the "viewpro" string does not appear in the source code for version 1.0.2 of the product.
CVSS Score: 5.8 (MEDIUM)
References: http://securityreason.com/securityalert/790; http://www.osvdb.org/24984; http://www.securityfocus.com/archive/1/432022/100/0/threaded
CVE: CVE-2006-2053
Published: 2006-04-26
Description: Multiple SQL injection vulnerabilities in QuickEStore 7.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the OrderID parameter in (a) shipping.cfm and (b) checkout.cfm, (2) ItemID parameter in (c) proddetail.cfm, (3) SubCatID parameter in (d) index.cfm, the (4) CategoryID parameter in (e) prodpage.cfm, and (5) ProdID parameter in (f) Details.cfm.  NOTE: these issues can also be exploited for path disclosure.
CVSS Score: 6.4 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/quickestore-79-vuln.html; http://secunia.com/advisories/19817; http://www.osvdb.org/24976
CVE: CVE-2006-2054
Published: 2006-04-26
Description: 3Com Baseline Switch 2848-SFP Plus Model #3C16486 with firmware before 1.0.2.0 allows remote attackers to cause a denial of service (unstable operation) via long DHCP packets.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19756; http://securitytracker.com/id?1015997; http://support.3com.com/infodeli/tools/switches/baseline/3C16486_V1_0_2_0_readme.pdf
CVE: CVE-2006-2055
Published: 2006-04-26
Description: Argument injection vulnerability in Microsoft Outlook 2003 SP1 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment.  NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-88
References: http://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.html; http://secunia.com/advisories/19819; http://www.osvdb.org/25003
CVE: CVE-2006-2056
Published: 2006-04-26
Description: Argument injection vulnerability in Internet Explorer 6 for Windows XP SP2 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment.  NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-88
References: http://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.html; http://www.securityfocus.com/archive/1/432009/100/0/threaded; http://www.vupen.com/english/advisories/2006/1538
CVE: CVE-2006-2057
Published: 2006-04-26
Description: Argument injection vulnerability in Mozilla Firefox 1.0.6 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment.  NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-88
References: http://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.html; http://www.securityfocus.com/archive/1/432009/100/0/threaded; http://www.vupen.com/english/advisories/2006/1538
CVE: CVE-2006-2058
Published: 2006-04-26
Description: Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an arbitrary filename as an attachment.  NOTE: it is not clear whether this issue is implementation-specific or a problem in the Microsoft API.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-88
References: http://ingehenriksen.blogspot.com/2006/04/office-2003-file-attachment-exploit.html; http://securityreason.com/securityalert/785; http://www.securityfocus.com/archive/1/432009/100/0/threaded
CVE: CVE-2006-2059
Published: 2006-04-26
Description: action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a "#e" (execute) modifier.
CVSS Score: 5.0 (MEDIUM)
References: http://forums.invisionpower.com/index.php?showtopic=213374; http://secunia.com/advisories/19830; http://securityreason.com/securityalert/796
CVE: CVE-2006-2060
Published: 2006-04-26
Description: Directory traversal vulnerability in action_admin/paysubscriptions.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. (dot dot) in the name parameter, preceded by enough backspace (%08) characters to erase the initial static portion of a filename.
CVSS Score: 6.4 (MEDIUM)
References: http://forums.invisionpower.com/index.php?showtopic=213374; http://secunia.com/advisories/19830; http://securityreason.com/securityalert/796
CVE: CVE-2006-2061
Published: 2006-04-26
Description: SQL injection vulnerability in lib/func_taskmanager.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary SQL commands via the ck parameter, which can inject at most 32 characters.
CVSS Score: 5.0 (MEDIUM)
References: http://forums.invisionpower.com/index.php?showtopic=213374; http://secunia.com/advisories/19830; http://securityreason.com/securityalert/796
CVE: CVE-2006-2062
Published: 2006-04-26
Description: Multiple SQL injection vulnerabilities in Leadhound Full and LITE 2.1, and probably the Network Version "Full Version", allow remote attackers to execute arbitrary SQL commands via the (1) banner parameter in agent_links.pl; the offset parameter in (2) agent_links.pl, (3) agent_transactions.pl, (4) agent_subaffiliates.pl, and (5) agent_summary.pl; the camp_id parameter in (6) agent_transactions_csv.pl, (7) agent_subaffiliates.pl, and (8) agent_camp_det.pl; the (9) login parameter in agent_commission_statement.pl; the logged parameter in (10) agent_commission_statement.pl and (11) agent_camp_det.pl; the (12) agent_id parameter in agent_commission_statement.pl; and the (13) sub parameter in unspecified files.
CVSS Score: 6.4 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/leadhound-multiple-vuln.html; http://secunia.com/advisories/19867; http://www.osvdb.org/25023
CVE: CVE-2006-2063
Published: 2006-04-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Leadhound Full and LITE 2.1, and probably the Network Version "Full Version", allow remote attackers to inject arbitrary web script or HTML via the login parameter in (1) agent_affil.pl, (2) agent_help.pl, (3) agent_faq.pl, (4) agent_help_insert.pl, (5) sign_out.pl, (6) members.pl, (7) modify_agent_1.pl, (8) modify_agent_2.pl, (9) modify_agent.pl, (10) agent_links.pl, (11) agent_stats_pending_leads.pl, (12) agent_logoff.pl, (13) agent_rev_det.pl, (14) agent_subaffiliates.pl, (15) agent_stats_pending_leads.pl, (16) agent_transactions.pl, (17) agent_payment_history.pl, (18) agent_summary.pl, (19) agent_camp_all.pl, (20) agent_camp_new.pl, (21) agent_camp_notsub.pl, (22) agent_campaign.pl, (23) agent_camp_expired.pl, (24) agent_stats_det.pl, (25) agent_stats.pl, (26) agent_camp_det.pl, (27) agent_camp_sub.pl, (28) agent_affil_list.pl, and (29) agent_affil_code.pl; the logged parameter in (30) agent_faq.pl, (31) agent_help_insert.pl, (32) members.pl, (33) modify_agent_1.pl, (34) modify_agent_2.pl, (35) modify_agent.pl, (36) agent_links.pl, (37) agent_subaffiliates.pl, (38) agent_stats_pending_leads.pl, (39) agent_transactions.pl, (40) agent_summary.pl, (41) agent_camp_all.pl, (42) agent_camp_new.pl, (43) agent_camp_notsub.pl, (44) agent_campaign.pl, (45) agent_camp_expired.pl, (46) agent_stats.pl, (47) agent_camp_det.pl, (48) agent_camp_sub.pl, (49) agent_affil_list.pl, and (50) agent_affil_code.pl; the camp_id parameter in (51) agent_links.pl, (52) agent_subaffiliates.pl, and (53) agent_camp_det.pl; the (54) banner parameter in agent_links.pl; the offset parameter in (55) agent_links.pl, (56) agent_subaffiliates.pl, (57) agent_transactions.pl, and (58) agent_summary.pl; the date parameter in (59) agent_subaffiliates.pl, (60) agent_transactions.pl, and (61) agent_summary.pl; the dates parameter in (62) agent_rev_det.pl and (63) agent_stats_det.pl; the (64) page parameter in agent_camp_det.pl; the (65) agent_id parameter in agent_commission_statement.pl; and the (66) lost password field in lost_pwd.pl.
CVSS Score: 6.8 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/leadhound-multiple-vuln.html; http://secunia.com/advisories/19867; http://www.osvdb.org/25030
CVE: CVE-2006-1514
Published: 2006-04-27
Description: Multiple buffer overflows in the abcmidi-yaps translator in abcmidi 20050101, and other versions, allow remote attackers to execute arbitrary code via crafted ABC music files that trigger the overflows during translation into PostScript.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19826; http://secunia.com/advisories/19829; http://www.debian.org/security/2006/dsa-1043
CVE: CVE-2006-2064
Published: 2006-04-27
Description: Unspecified vulnerability in the libpkcs11 library in Sun Solaris 10 might allow local users to gain privileges or cause a denial of service (application failure) via unknown attack vectors that involve the getpwnam family of non-reentrant functions.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/19789; http://securitytracker.com/id?1015987; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102316-1
CVE: CVE-2006-2065
Published: 2006-04-27
Description: SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie.  NOTE: this issue could be leveraged to execute arbitrary PHP code, as demonstrated by inserting directory traversal sequences into the database, which are then processed by the thissurvey['language'] variable.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/phpsurveyor_0995_xpl.html; http://secunia.com/advisories/19761; http://securitytracker.com/id?1015970
CVE: CVE-2006-2066
Published: 2006-04-27
Description: Multiple cross-site scripting (XSS) vulnerabilities pm_popup.php in MKPortal 1.1 Rc1 and earlier, as used with vBulletin 3.5.4 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) u1, (2) m1, (3) m2, (4) m3, (5) m4 parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/19786; http://securityreason.com/securityalert/801; http://securitytracker.com/id?1015977
CVE: CVE-2006-2067
Published: 2006-04-27
Description: SQL injection vulnerability in vb_board_functions.php in MKPortal 1.1, as used with vBulletin 3.5.4 and earlier, allows remote attackers to execute arbitrary SQL commands via the userid parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/801; http://securitytracker.com/id?1015977; http://www.nukedx.com/?viewdoc=26
CVE: CVE-2006-2068
Published: 2006-04-27
Description: Unspecified vulnerability in Hitachi JP1 products allow remote attackers to cause a denial of service (application stop or fail) via unexpected requests or data.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19841; http://www.hitachi-support.com/security_e/vuls_e/HS06-007_e/index-e.html; http://www.securityfocus.com/bid/17706
CVE: CVE-2006-2069
Published: 2006-04-27
Description: The recursor in PowerDNS before 3.0.1 allows remote attackers to cause a denial of service (application crash) via malformed EDNS0 packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://doc.powerdns.com/changelog.html#CHANGELOG-RECURSOR-3-0-1; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html; http://secunia.com/advisories/19831
CVE: CVE-2006-2070
Published: 2006-04-27
Description: Cross-site scripting (XSS) vulnerability in member.php in DevBB 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the member parameter in a viewpro action.
CVSS Score: 4.3 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/DevBB-1.0.0-xss.txt; http://secunia.com/advisories/19855; http://securityreason.com/securityalert/800