deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1769
Published: 2006-04-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in UserLand Manila 9.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the mode parameter in msgReader$1 and (2) the end of the URI in viewDepartment$.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/19636; http://securityreason.com/securityalert/692; http://www.osvdb.org/24554
CVE: CVE-2006-1770
Published: 2006-04-13
Description: Multiple PHP remote file inclusion vulnerabilities in Azerbaijan Design & Development Group (AZDG) AzDGVote allow remote attackers to execute arbitrary PHP code via a URL in the int_path parameter in (1) vote.php, (2) view.php, (3) admin.php, and (4) admin/index.php.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/19630; http://securityreason.com/securityalert/695; http://www.securityfocus.com/archive/1/430691/100/0/threaded
CVE: CVE-2006-1771
Published: 2006-04-13
Description: Directory traversal vulnerability in misc in pbcs.dll in SAXoTECH SAXoPRESS, aka Saxotech Online (formerly Publicus) allows remote attackers to read arbitrary files and possibly execute arbitrary programs via a .. (dot dot) in the url parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19566; http://www.securityfocus.com/archive/1/430707/100/0/threaded; http://www.securityfocus.com/archive/1/431037/30/5580/threaded
CVE: CVE-2006-1772
Published: 2006-04-13
Description: debconf in Debian GNU/Linux, when configuring mnogosearch in the mnogosearch-common 3.2.31-1 package, uses the world-readable config.dat file instead of the restricted passwords.dat for storing the cleartext database administrator password in the mnogosearch-common/database_admin_pass record, which allows local users to view the password.
CVSS Score: 7.2 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=361775; http://secunia.com/advisories/19589; http://www.securityfocus.com/bid/17477
CVE: CVE-2006-1773
Published: 2006-04-13
Description: SQL injection vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to execute arbitrary SQL commands via the contentid parameter, possibly involving content/news.php.
CVSS Score: 6.4 (MEDIUM)
References: http://securitytracker.com/id?1015888; http://www.hamid.ir/security/phpkit.txt; http://www.securityfocus.com/bid/17467
CVE: CVE-2006-1774
Published: 2006-04-13
Description: HP System Management Homepage (SMH) 2.1.3.132, when running on CompaqHTTPServer/9.9 on Windows, Linux, or Tru64 UNIX, and when "Trust by Certificates" is not enabled, allows remote attackers to bypass authentication via a crafted URL.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1015901; http://src.telindus.com/articles/hpsm_vulnerability.html; http://www.securityfocus.com/archive/1/430688/100/0/threaded
CVE: CVE-2006-1775
Published: 2006-04-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.19 allow remote attackers to inject arbitrary web script or HTML via the (1) Site Description field in (a) admin_board.php, the (2) Group name and (3) Group description fields in (b) admin_groups.php and (c) groupcp.php, the (4) Theme Name field in (d) admin_styles.php, and the (5) Rank Title field in (e) admin_ranks.php.  NOTE: the profile.php/Current password vector is already covered by CVE-2006-1603.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/24/24353-phpbb.txt; http://www.osvdb.org/24354; http://www.osvdb.org/24355
CVE: CVE-2006-1776
Published: 2006-04-13
Description: PHP remote file inclusion vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the s parameter.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/simplog_092_incl_xpl.html; http://secunia.com/advisories/19628; http://securitytracker.com/id?1015904
CVE: CVE-2006-1777
Published: 2006-04-13
Description: Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache error_log file, which is then included by doc/index.php.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/simplog_092_incl_xpl.html; http://secunia.com/advisories/19628; http://securitytracker.com/id?1015904
CVE: CVE-2006-1778
Published: 2006-04-13
Description: Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) blogid parameter in (a) index.php and (b) archive.php, the (2) m and (3) y parameters in archive.php, and the (4) sql parameter in (c) server.php.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/simplog_092_incl_xpl.html; http://secunia.com/advisories/19628; http://securityreason.com/securityalert/702
CVE: CVE-2006-1779
Published: 2006-04-13
Description: Cross-site scripting (XSS) vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the btag parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://retrogod.altervista.org/simplog_092_incl_xpl.html; http://secunia.com/advisories/19628; http://securitytracker.com/id?1015904
CVE: CVE-2006-1780
Published: 2006-04-13
Description: The Bourne shell (sh) in Solaris 8, 9, and 10 allows local users to cause a denial of service (sh crash) via an unspecified attack vector that causes sh processes to crash during creation of temporary files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19627; http://secunia.com/advisories/21493; http://securitytracker.com/id?1015902
CVE: CVE-2006-1781
Published: 2006-04-13
Description: PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.  NOTE: It was later reported that 1.4.2 and earlier are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://pridels0.blogspot.com/2006/04/monstertoplist.html; http://secunia.com/advisories/19688; http://www.osvdb.org/24650
CVE: CVE-2006-1782
Published: 2006-04-13
Description: Unspecified vulnerability in Solaris 8 and 9 allows local users to obtain the LDAP Directory Server root Distinguished Name (rootDN) password when a privileged user (1) runs idsconfig; or "insecurely" runs LDAP2 commands with the -w option, including (2) ldapadd, (3) ldapdelete, (4) ldapmodify, (5) ldapmodrdn, and (6) ldapsearch.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19638; http://secunia.com/advisories/21493; http://securitytracker.com/id?1015903
CVE: CVE-2006-1783
Published: 2006-04-13
Description: Cross-site scripting (XSS) vulnerability in PatroNet CMS allows remote attackers to inject arbitrary web script or HTML via the URI.
CVSS Score: 2.6 (LOW)
References: http://www.securityfocus.com/archive/1/430868/100/0/threaded; http://www.securityfocus.com/bid/17495; http://www.securityfocus.com/archive/1/430868/100/0/threaded
CVE: CVE-2006-1627
Published: 2006-04-13
Description: Adobe Document Server for Reader Extensions 6.0 does not provide proper access control, which allows remote authenticated users to perform privileged actions by modifying the (1) actionID and (2) pageID parameters.  NOTE: due to an error during reservation, this identifier was inadvertently associated with multiple issues.  Other CVE identifiers have been assigned to handle other problems that are covered by the same disclosure.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15924; http://secunia.com/secunia_research/2005-68/advisory/; http://securitytracker.com/id?1015905
CVE: CVE-2006-1628
Published: 2006-04-13
Description: Adobe LiveCycle Workflow 7.01 and LiveCycle Forum Manager 7.01 allows users to authenticate and perform privileged actions when their account is marked "OBSOLETE" but the account is also active, within the authentication system.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/19620; http://securitytracker.com/id?1015906; http://www.adobe.com/support/techdocs/333036.html
CVE: CVE-2006-1551
Published: 2006-04-13
Description: Eval injection vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the (1) $method and (2) $args parameters.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0270.html; http://secunia.com/advisories/19653; http://www.osvdb.org/24618
CVE: CVE-2006-1784
Published: 2006-04-13
Description: PHP remote file inclusion vulnerability in admin/configset.php in Sphider 1.3 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the settings_dir parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/19642; http://www.securityfocus.com/bid/17514; http://www.vupen.com/english/advisories/2006/1341
CVE: CVE-2006-1785
Published: 2006-04-13
Description: Adobe Document Server for Reader Extensions 6.0 allows remote authenticated users to inject arbitrary web script via a leading (1) ftp or (2) http URI in the ReaderURL variable in the "Update Download Site" section of ads-readerext.  NOTE: it is not clear whether the vendor advisory addresses this issue.  In addition, since the issue requires administrative privileges to exploit, it is not clear whether this crosses security boundaries.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/15924; http://secunia.com/secunia_research/2005-68/advisory/; http://www.adobe.com/support/techdocs/322699.html
CVE: CVE-2006-1786
Published: 2006-04-13
Description: Cross-site scripting (XSS) vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web script or HTML via (1) the actionID parameter in ads-readerext and (2) the op parameter in AlterCast. NOTE: it is not clear whether the vendor advisory addresses this issue.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/15924; http://secunia.com/secunia_research/2005-68/advisory/; http://www.adobe.com/support/techdocs/322699.html
CVE: CVE-2006-1787
Published: 2006-04-13
Description: Adobe Document Server for Reader Extensions 6.0 includes a user's session (jsession) ID in the HTTP Referer header, which allows remote attackers to gain access to PDF files that are being processed within that session.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/15924; http://secunia.com/secunia_research/2005-68/advisory/; http://www.adobe.com/support/techdocs/322699.html
CVE: CVE-2006-1788
Published: 2006-04-13
Description: Adobe Document Server for Reader Extensions 6.0, during log on, provides different error messages depending on whether the user ID is valid or invalid, which allows remote attackers to more easily identify valid user IDs via brute force attacks.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/15924; http://secunia.com/secunia_research/2005-68/advisory/; http://www.adobe.com/support/techdocs/331917.html
CVE: CVE-2006-1789
Published: 2006-04-13
Description: Directory traversal vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to read arbitrary files via the $className variable.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0270.html; http://secunia.com/advisories/19653; http://www.osvdb.org/24862
CVE: CVE-2006-0748
Published: 2006-04-14
Description: Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via "an invalid and non-sensical ordering of table-related tags" that results in a negative array index.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://secunia.com/advisories/19759
CVE: CVE-2006-0749
Published: 2006-04-14
Description: nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors involving a "particular sequence of HTML tags" that leads to memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-0992
Published: 2006-04-14
Description: Stack-based buffer overflow in Novell GroupWise Messenger before 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept-Language value without a comma or semicolon.  NOTE: due to a typo, the original ZDI advisory accidentally referenced CVE-2006-0092.  This is the correct identifier.
CVSS Score: 10.0 (HIGH)
References: http://cirt.dk/advisories/cirt-42-advisory.txt; http://metasploit.blogspot.com/2006/04/exploit-development-groupwise_14.html; http://secunia.com/advisories/19663
CVE: CVE-2006-1529
Published: 2006-04-14
Description: Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.  NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; http://secunia.com/advisories/19631; http://secunia.com/advisories/19649
CVE: CVE-2006-1530
Published: 2006-04-14
Description: Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.  NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; http://secunia.com/advisories/19631; http://secunia.com/advisories/19649
CVE: CVE-2006-1531
Published: 2006-04-14
Description: Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.  NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; http://secunia.com/advisories/19631; http://secunia.com/advisories/19649
CVE: CVE-2006-1723
Published: 2006-04-14
Description: Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.  NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; http://secunia.com/advisories/19631; http://secunia.com/advisories/19649
CVE: CVE-2006-1724
Published: 2006-04-14
Description: Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to DHTML.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; http://secunia.com/advisories/19631; http://secunia.com/advisories/19649
CVE: CVE-2006-1725
Published: 2006-04-14
Description: Mozilla Firefox 1.5 before 1.5.0.2 and SeaMonkey before 1.0.1 causes certain windows to become translucent due to an interaction between XUL content windows and the history mechanism, which might allow user-assisted remote attackers to trick users into executing arbitrary code.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/19631; http://secunia.com/advisories/19649; http://secunia.com/advisories/22066
CVE: CVE-2006-1726
Published: 2006-04-14
Description: Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox' ForEach method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/19631; http://secunia.com/advisories/19649; http://secunia.com/advisories/22065
CVE: CVE-2006-1727
Published: 2006-04-14
Description: Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to gain chrome privileges via multiple attack vectors related to the use of XBL scripts with "Print Preview".
CVSS Score: 7.6 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1728
Published: 2006-04-14
Description: Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to the crypto.generateCRMFRequest method.
CVSS Score: 9.3 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1729
Published: 2006-04-14
Description: Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename into a text box, then turning that box into a file upload control, or (2) changing the type of the input control that is associated with an event handler.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1730
Published: 2006-04-14
Description: Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1731
Published: 2006-04-14
Description: Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1732
Published: 2006-04-14
Description: Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to bypass same-origin protections and conduct cross-site scripting (XSS) attacks via unspecified vectors involving the window.controllers array.
CVSS Score: 4.3 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1733
Published: 2006-04-14
Description: Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allows remote attackers to execute arbitrary code via the (1) valueOf.call or (2) valueOf.apply methods of an XBL binding, or (3) "by inserting an XBL method into the DOM's document.body prototype chain."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1734
Published: 2006-04-14
Description: Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using the Object.watch method to access the "clone parent" internal function.
CVSS Score: 6.8 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1735
Published: 2006-04-14
Description: Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XBL.method.eval) to create Javascript functions that are compiled with extra privileges.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
CVE: CVE-2006-1736
Published: 2006-04-14
Description: Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to trick users into downloading and saving an executable file via an image that is overlaid by a transparent image link that points to the executable, which causes the executable to be saved when the user clicks the "Save image as..." option.  NOTE: this attack is made easier due to a GUI truncation issue that prevents the user from seeing the malicious extension when there is extra whitespace in the filename.
CVSS Score: 2.6 (LOW)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html; http://secunia.com/advisories/19631