deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0232
Published: 2006-04-25
Description: Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0012.html; http://secunia.com/advisories/19734; http://securityreason.com/securityalert/758
CVE: CVE-2006-1057
Published: 2006-04-25
Description: Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.
CVSS Score: 3.7 (LOW)
CWE: CWE-362
References: http://cvs.gnome.org/viewcvs/gdm2/daemon/slave.c?r1=1.260&r2=1.261; http://www.debian.org/security/2006/dsa-1040; http://www.mandriva.com/security/advisories?name=MDKSA-2006:083
CVE: CVE-2006-1992
Published: 2006-04-25
Description: mshtml.dll 6.00.2900.2873, as used in Microsoft Internet Explorer, allows remote attackers to cause a denial of service (crash) via nested OBJECT tags, which trigger invalid pointer dereferences including NULL dereferences.  NOTE: the possibility of code execution was originally theorized, but Microsoft has stated that this issue is non-exploitable.
CVSS Score: 2.6 (LOW)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0616.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045422.html; http://secunia.com/advisories/19762
CVE: CVE-2006-1513
Published: 2006-04-25
Description: Multiple buffer overflows in abc2ps before 1.3.3 allow user-assisted attackers to execute arbitrary code via crafted ABC music files.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/19787; http://secunia.com/advisories/19807; http://www.debian.org/security/2006/dsa-1041
CVE: CVE-2006-1932
Published: 2006-04-25
Description: Off-by-one error in the OID printing routine in Ethereal 0.10.x up to 0.10.14 has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html; http://secunia.com/advisories/19769
CVE: CVE-2006-1933
Published: 2006-04-25
Description: Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (large or infinite loops) viarafted packets to the (1) UMA and (2) BER dissectors.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html; http://secunia.com/advisories/19769
CVE: CVE-2006-1934
Published: 2006-04-25
Description: Multiple buffer overflows in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) ALCAP dissector, (2) Network Instruments file code, or (3) NetXray/Windows Sniffer file code.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html; http://secunia.com/advisories/19769
CVE: CVE-2006-1935
Published: 2006-04-25
Description: Buffer overflow in Ethereal 0.9.15 up to 0.10.14 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the COPS dissector.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html; http://secunia.com/advisories/19769
CVE: CVE-2006-1936
Published: 2006-04-25
Description: Buffer overflow in Ethereal 0.8.5 up to 0.10.14 allows remote attackers to execute arbitrary code via the telnet dissector.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html; http://secunia.com/advisories/19769
CVE: CVE-2006-1937
Published: 2006-04-25
Description: Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via (1) multiple vectors in H.248, and the (2) X.509if, (3) SRVLOC, (4) H.245, (5) AIM, and (6) general packet dissectors; and (7) the statistics counter.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html; http://secunia.com/advisories/19769
CVE: CVE-2006-1938
Published: 2006-04-25
Description: Multiple unspecified vulnerabilities in Ethereal 0.8.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via the (1) Sniffer capture or (2) SMB PIPE dissector.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html; http://secunia.com/advisories/19769
CVE: CVE-2006-1939
Published: 2006-04-25
Description: Multiple unspecified vulnerabilities in Ethereal 0.9.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via (1) an invalid display filter, or the (2) GSM SMS, (3) ASN.1-based, (4) DCERPC NT, (5) PER, (6) RPC, (7) DCERPC, and (8) ASN.1 dissectors.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html; http://secunia.com/advisories/19769
CVE: CVE-2006-1940
Published: 2006-04-25
Description: Unspecified vulnerability in Ethereal 0.10.4 up to 0.10.14 allows remote attackers to cause a denial of service (abort) via the SNDCP dissector.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html; http://secunia.com/advisories/19769
CVE: CVE-2006-1993
Published: 2006-04-25
Description: Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object.  NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll, but the vendor disputes this claim.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/19802; http://secunia.com/advisories/20015; http://secunia.com/advisories/20019
CVE: CVE-2006-1994
Published: 2006-04-25
Description: PHP remote file inclusion vulnerability in dForum 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DFORUM_PATH parameter to (1) about.php, (2) admin.php, (3) anmelden.php, (4) losethread.php, (5) config.php, (6) delpost.php, (7) delthread.php, (8) dfcode.php, (9) download.php, (10) editanoc.php, (11) forum.php, (12) login.php, (13) makethread.php, (14) menu.php, (15) newthread.php, (16) openthread.php, (17) overview.php, (18) post.php, (19) suchen.php, (20) user.php, (21) userconfig.php, (22) userinfo.php, and (23) verwalten.php.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045369.html; http://secunia.com/advisories/19788; http://www.nukedx.com/?viewdoc=27
CVE: CVE-2006-1995
Published: 2006-04-25
Description: Directory traversal vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to read arbitrary files via ".." sequences in the p parameter, which is not properly sanitized due to an rtrim function call with the arguments in the wrong order.
CVSS Score: 5.0 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-April/000716.html; http://downloads.securityfocus.com/vulnerabilities/exploits/17649-directory-traversal.exploit; http://secunia.com/advisories/19777
CVE: CVE-2006-1996
Published: 2006-04-25
Description: Scry Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid p parameter, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-April/000716.html; http://secunia.com/advisories/19777; http://securityreason.com/securityalert/784
CVE: CVE-2006-1997
Published: 2006-04-25
Description: Unspecified vulnerability in Sybase Pylon Anywhere groupware synchronization server before 7.0 allows local users to obtain sensitive information such as email and PIM data of another user via unknown attack vectors.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19784; http://www.securityfocus.com/bid/17677; http://www.sybase.com/detail?id=1040213
CVE: CVE-2006-1998
Published: 2006-04-25
Description: OpenTTD 0.4.7 and earlier allows local users to cause a denial of service (application exit) via a large invalid error number, which triggers an error.
CVSS Score: 2.1 (LOW)
References: http://aluigi.altervista.org/adv/openttdx-adv.txt; http://secunia.com/advisories/19768; http://secunia.com/advisories/21799
CVE: CVE-2006-1999
Published: 2006-04-25
Description: The multiplayer menu in OpenTTD 0.4.7 allows remote attackers to cause a denial of service via a UDP packet with an incorrect size, which causes the client to return to the main menu.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/openttdx-adv.txt; http://secunia.com/advisories/19768; http://secunia.com/advisories/21799
CVE: CVE-2006-2000
Published: 2006-04-25
Description: Cross-site scripting (XSS) vulnerability in /lms/a2z.jsp in logMethods 0.9 allows remote attackers to inject arbitrary web script or HTML via the kwd parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/logmethods-xss-vuln.html; http://secunia.com/advisories/19793; http://www.osvdb.org/24876
CVE: CVE-2006-2001
Published: 2006-04-25
Description: Cross-site scripting (XSS) vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the p parameter.  NOTE: this is a different vulnerability than the directory traversal vector.
CVSS Score: 4.3 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-April/000716.html; http://secunia.com/advisories/19777; http://securityreason.com/securityalert/783
CVE: CVE-2006-2002
Published: 2006-04-25
Description: PHP remote file inclusion vulnerability in stats.php in MyGamingLadder 7.0 allows remote attackers to execute arbitrary PHP code via a URL in the dir[base] parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19773; http://www.nukedx.com/?viewdoc=28; http://www.osvdb.org/24892
CVE: CVE-2006-2003
Published: 2006-04-25
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/guest in Community Architect Guestbook allows remote attackers to inject arbitrary web script or HTML by signing the guestbook, which is displayed by fsguestbook.html.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19742; http://www.osvdb.org/24784; http://www.vupen.com/english/advisories/2006/1446
CVE: CVE-2006-2004
Published: 2006-04-25
Description: Multiple SQL injection vulnerabilities in RI Blog 1.1 allow remote attackers to execute arbitrary SQL command via the (1) username or (2) password fields.
CVSS Score: 7.5 (HIGH)
References: http://colander.altervista.org/advisory/riblog.txt; http://secunia.com/advisories/19783; http://www.securityfocus.com/archive/1/431868/100/0/threaded
CVE: CVE-2006-2005
Published: 2006-04-25
Description: Eval injection vulnerability in index.php in ClanSys 1.1 allows remote attackers to execute arbitrary PHP code via PHP code in the page parameter, as demonstrated by using an "include" statement that is injected into the eval statement.  NOTE: this issue has been described as file inclusion by some sources, but that is just one attack; the primary vulnerability is eval injection.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/782; http://securitytracker.com/id?1015988; http://www.nukedx.com/?getxpl=29
CVE: CVE-2006-2006
Published: 2006-04-25
Description: Multiple directory traversal vulnerabilities in IZArc Archiver 3.5 beta 3 allow remote attackers to write arbitrary files via a ..\ (dot dot backslash) in a (1) .rar, (2) .tar, (3) .zip, (4) .jar, or (5) .gz archive.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19791; http://www.osvdb.org/24895; http://www.securityfocus.com/bid/17664
CVE: CVE-2006-2007
Published: 2006-04-25
Description: Heap-based buffer overflow in Winny 2.0 b7.1 and earlier allows remote attackers to execute arbitrary code via long strings to certain commands sent to the file transfer port.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/19795; http://www.eeye.com/html/research/advisories/AD20060421.html
CVE: CVE-2006-2008
Published: 2006-04-25
Description: PHP remote file inclusion vulnerability in movie_cls.php in Built2Go PHP Movie Review 2B and earlier allows remote attackers to execute arbitrary PHP code via a URL in the full_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19749; http://www.osvdb.org/24887; http://www.securityfocus.com/bid/17679
CVE: CVE-2006-2009
Published: 2006-04-25
Description: PHP remote file inclusion vulnerability in agenda.php3 in phpMyAgenda 3.0 Final and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootagenda parameter.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/phpMyAgenda_fi.txt; http://osvdb.org/ref/29/2914x-phpmyagenda.txt; http://secunia.com/advisories/19748
CVE: CVE-2006-2010
Published: 2006-04-25
Description: Multiple SQL injection vulnerabilities in check_login.asp in Bloggage allow remote attackers to execute arbitrary SQL commands via the (1) acc_name and (2) password parameter.
CVSS Score: 7.5 (HIGH)
References: http://colander.altervista.org/advisory/bloggage.txt; http://secunia.com/advisories/19751; http://securityreason.com/securityalert/751
CVE: CVE-2006-2011
Published: 2006-04-25
Description: Cross-site scripting (XSS) vulnerability in member.php in 4images 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the nickname, probably involving the user_name parameter in register.php.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19745; http://www.osvdb.org/24796; http://www.securityfocus.com/archive/1/431599/100/0/threaded
CVE: CVE-2006-2012
Published: 2006-04-25
Description: Format string vulnerability in Skulltag 0.96f and earlier allows remote attackers to cause a denial of service via the version string.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/skulltagfs-adv.txt; http://secunia.com/advisories/19767; http://www.securityfocus.com/archive/1/431872/100/0/threaded
CVE: CVE-2006-2013
Published: 2006-04-25
Description: SQL injection vulnerability in page.php in SL_site 1.0 allows remote attackers to execute arbitrary SQL commands via the id_page parameter. NOTE: this issue could be used to produce resultant XSS from an error message.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19792; http://securitytracker.com/id?1015972; http://www.osvdb.org/24896
CVE: CVE-2006-2014
Published: 2006-04-25
Description: Directory traversal vulnerability in gallerie.php in SL_site 1.0 allows remote attackers to list images in arbitrary directories via ".." sequences in the rep parameter, which is used to construct a directory name in admin/config.inc.php.  NOTE: this issue could be used to produce resultant XSS from an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19792; http://securitytracker.com/id?1015972; http://www.osvdb.org/24897
CVE: CVE-2006-2015
Published: 2006-04-25
Description: Cross-site scripting (XSS) vulnerability in SL_site 1.0 allows remote attackers to inject arbitrary web script or HTML via the recherche parameter in recherche.php.  NOTE: other XSS vectors, as reported in the original disclosure, are resultant from other primary vulnerabilities that have separate CVE names.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19792; http://securitytracker.com/id?1015972; http://www.osvdb.org/24898
CVE: CVE-2006-2016
Published: 2006-04-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b) copy_form.php, (c) rename_form.php, (d) template_engine.php, and (e) delete_form.php; (2) scope parameter in (f) search.php; and (3) Container DN, (4) Machine Name, and (5) UID Number fields in (g) template_engine.php.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://pridels0.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html; http://secunia.com/advisories/19747; http://secunia.com/advisories/20124
CVE: CVE-2006-2017
Published: 2006-04-25
Description: Dnsmasq 2.29 allows remote attackers to cause a denial of service (application crash) via a DHCP client broadcast reply request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19760; http://thekelleys.org.uk/dnsmasq/CHANGELOG; http://www.osvdb.org/24884
CVE: CVE-2006-2018
Published: 2006-04-25
Description: SQL injection vulnerability in calendar.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL commands via the eventid parameter.  NOTE: the affected version has been disputed by the vendor.  It appears that this is the same issue as CVE-2004-0036, which was fixed in 2.3.4.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/431901; http://www.securityfocus.com/archive/1/431951/30/5370/threaded; http://www.securityfocus.com/archive/1/431901
CVE: CVE-2006-2019
Published: 2006-04-25
Description: Apple Mac OS X Safari 2.0.3, 1.3.1, and possibly other versions allows remote attackers to cause a denial of service (CPU consumption and crash) via a TD element with a large number in the rowspan attribute.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045472.html; http://secunia.com/advisories/19763; http://securitytracker.com/id?1015982
CVE: CVE-2006-2020
Published: 2006-04-25
Description: Asterisk Recording Interface (ARI) in Asterisk@Home before 2.8 stores recordings/includes/main.conf under the web document root with insufficient access control, which allows remote attackers to obtain password information.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/19744; http://www.osvdb.org/24805; http://www.securityfocus.com/archive/1/431655/100/0/threaded
CVE: CVE-2006-2021
Published: 2006-04-25
Description: Absolute path traversal vulnerability in recordings/misc/audio.php in the Asterisk Recording Interface (ARI) web interface in Asterisk@Home before 2.8 allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the recording parameter.  NOTE: this issue can also be used to determine existence of files.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19744; http://securityreason.com/securityalert/750; http://www.osvdb.org/24806
CVE: CVE-2006-2022
Published: 2006-04-25
Description: Buffer overflow in the parse_url function in the RTSP module (rtsp/parse_url.c) in Fenice 1.10 and earlier allows remote attackers to execute arbitrary code via a long URL.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/fenicex-adv.txt; http://secunia.com/advisories/19770; http://securityreason.com/securityalert/794
CVE: CVE-2006-2023
Published: 2006-04-25
Description: Integer overflow in the RTSP_msg_len function in rtsp/RTSP_msg_len.c in Fenice 1.10 and earlier allows remote attackers to cause a denial of service (application crash) via a large HTTP Content-Length value, which leads to an invalid memory access.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/fenicex-adv.txt; http://secunia.com/advisories/19770; http://securityreason.com/securityalert/794
CVE: CVE-2006-1863
Published: 2006-04-25
Description: Directory traversal vulnerability in CIFS in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences, a similar vulnerability to CVE-2006-1864.
CVSS Score: 2.1 (LOW)
References: http://rhn.redhat.com/errata/RHBA-2007-0304.html; http://secunia.com/advisories/19868; http://secunia.com/advisories/20398
CVE: CVE-2006-2024
Published: 2006-04-25
Description: Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray function in (a) tif_dirread.c; (2) certain "codec cleanup methods" in (b) tif_lzw.c, (c) tif_pixarlog.c, and (d) tif_zip.c; (3) and improper restoration of setfield and getfield methods in cleanup functions within (e) tif_jpeg.c, tif_pixarlog.c, (f) tif_fax3.c, and tif_zip.c.
CVSS Score: 4.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://bugzilla.remotesensing.org/show_bug.cgi?id=1102; http://secunia.com/advisories/19838
CVE: CVE-2006-2025
Published: 2006-04-25
Description: Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted TIFF image.
CVSS Score: 6.5 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://bugzilla.remotesensing.org/show_bug.cgi?id=1102; http://secunia.com/advisories/19838
CVE: CVE-2006-2026
Published: 2006-04-25
Description: Double free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers errors related to "setfield/getfield methods in cleanup functions."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc; http://bugzilla.remotesensing.org/show_bug.cgi?id=1102; http://secunia.com/advisories/19838
CVE: CVE-2006-0048
Published: 2006-04-26
Description: Francesco Stablum tcpick 0.2.1 allows remote attackers to cause a denial of service (segmentation fault) via certain fragmented packets, possibly involving invalid headers and an attacker-controlled payload length.  NOTE: this issue might be a buffer overflow or overread.
CVSS Score: 5.0 (MEDIUM)
References: http://sourceforge.net/mailarchive/forum.php?thread_id=9989610&forum_id=37151; http://www.securityfocus.com/bid/17665; http://www.vupen.com/english/advisories/2006/1466
CVE: CVE-2006-2027
Published: 2006-04-26
Description: Buffer overflow in Unicode processing in the logging functionality in Pablo Software Solutions Quick 'n Easy FTP Server Professional and Lite, probably 3.0, allows remote authenticated users to execute arbitrary code by sending a command with a long argument, which triggers a buffer overflow when an admin selects the Logging section in the FTP server main window.  NOTE: the original researcher claims that the vendor disputes this issue.
CVSS Score: 6.5 (MEDIUM)
References: http://securityreason.com/securityalert/788; http://www.osvdb.org/25235; http://www.securityfocus.com/archive/1/431920/100/0/threaded