deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3934
Published: 2006-07-31
Description: Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt; http://secunia.com/advisories/21193; http://securityreason.com/securityalert/1302
CVE: CVE-2006-3935
Published: 2006-07-31
Description: system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2) list all users (/accounts/users), (3) add webusers (/accounts/webusers/new), (4) upload database import and export files (/database/importhttp), (5) upload arbitrary program modules (/modules/modules_import), and (6) read the log file (/workplace/logfileview) by setting the appropriate value for the path parameter in a direct request to admin-main.jsp.
CVSS Score: 6.5 (MEDIUM)
References: http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt; http://secunia.com/advisories/21193; http://securityreason.com/securityalert/1302
CVE: CVE-2006-3936
Published: 2006-07-31
Description: system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
CVSS Score: 4.0 (MEDIUM)
References: http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt; http://secunia.com/advisories/21193; http://securityreason.com/securityalert/1302
CVE: CVE-2006-3937
Published: 2006-07-31
Description: post.php in x_atrix xGuestBook 1.02 allows remote attackers to obtain sensitive information via a request without the (1) user, (2) mail, (3) p, or (4) url parameter, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1304; http://www.securityfocus.com/archive/1/441170/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/27979
CVE: CVE-2006-3938
Published: 2006-07-31
Description: DotClear allows remote attackers to obtain sensitive information via a direct request for (1) edit_cat.php, (2) index.php, (3) edit_link.php in ecrire/tools/blogroll/; (4) syslog/index.php, (5) thememng/index.php, (6) toolsmng/index.php, (7) utf8convert/index.php in /ecrire/tools/; (8) /ecrire/inc/connexion.php and (9) /inc/session.php; (10) class.blog.php, (11) class.blogcomment.php, (12) and class.blogpost.php in /inc/classes/; (13) append.php, (14) class.xblog.php, (15) class.xblogcomment.php, and (16) class.xblogpost.php in /layout/; (17) form.php, (18) list.php, (19) post.php, or (20) template.php in /themes/default/, which reveal the installation path in error messages.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1307; http://www.osvdb.org/29812; http://www.osvdb.org/29813
CVE: CVE-2006-3939
Published: 2006-07-31
Description: ScriptsCenter ezUpload Pro 2.2.0 allows remote attackers to perform administrative activities without authentication in (1) filter.php, which permits changing the Extensions Mode file type; (2) access.php, which permits changing the Protection Method; (3) edituser.php, which permits adding upload capabilities to user accounts; (4) settings.php, which permits changing the admin information; and (5) index.php, which permits uploading of arbitrary files.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1305; http://www.securityfocus.com/archive/1/441172/100/0/threaded; http://www.securityfocus.com/bid/19175
CVE: CVE-2006-3940
Published: 2006-07-31
Description: Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL commands via (1) the ar parameter in auction_room.php and (2) the u parameter in auction_store.php. NOTE: the auction_rating.php vector is already covered by CVE-2005-1234.  NOTE: the original disclosure states that the product name is "PHP-Auction", but this is probably an error.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1306; http://www.aria-security.net/advisory/phpauction.txt; http://www.securityfocus.com/archive/1/441190/100/0/threaded
CVE: CVE-2006-3941
Published: 2006-07-31
Description: Unspecified vulnerability in the daemons for Sun N1 Grid Engine 5.3 and N1 Grid Engine 6.0 allows local users to cause a denial of service (grid service shutdown) and possibly execute arbitrary code using buffer overflows via unknown vectors that cause (1) qmaster or (2) execd to terminate.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21185; http://secunia.com/advisories/22425; http://securitytracker.com/id?1016607
CVE: CVE-2006-3942
Published: 2006-07-31
Description: The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability.  NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://blogs.technet.com/msrc/archive/2006/07/28/443837.aspx; http://secunia.com/advisories/21276; http://securitytracker.com/id?1016606
CVE: CVE-2006-3943
Published: 2006-07-31
Description: Stack-based buffer overflow in NDFXArtEffects in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) via long (1) RGBExtraColor, (2) RGBForeColor, and (3) RGBBackColor properties.
CVSS Score: 2.6 (LOW)
References: http://browserfun.blogspot.com/2006/07/mobb-27-ndfxarteffects-rgbextracolor.html; http://www.osvdb.org/27530; http://www.securityfocus.com/bid/19184
CVE: CVE-2006-3944
Published: 2006-07-31
Description: Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) via a (1) Forms.ListBox.1 or (2) Forms.ListBox.1 object with the ListWidth property set to (a) 0x7fffffff, which triggers an integer overflow exception, or to (b) 0x7ffffffe, which triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-24-formslistbox1-listwidth.html; http://www.osvdb.org/27372; http://www.securityfocus.com/bid/19113
CVE: CVE-2006-3945
Published: 2006-07-31
Description: The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-787
References: http://browserfun.blogspot.com/2006/07/mobb-26-opera-css-background.html; http://www.osvdb.org/27374; http://www.vupen.com/english/advisories/2006/2987
CVE: CVE-2006-3946
Published: 2006-07-31
Description: WebCore in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted HTML that triggers a "memory management error" in WebKit, possibly due to a buffer overflow, as originally reported for the KHTMLParser::popOneBlock function in Apple Safari 2.0.4 using Javascript that changes document.body.innerHTML within a DIV tag.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://browserfun.blogspot.com/2006/07/mobb-31-safari-khtmlparserpoponeblock.html; http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html; http://secunia.com/advisories/21271
CVE: CVE-2006-3947
Published: 2006-08-01
Description: PHP remote file inclusion vulnerability in components/com_mambatstaff/mambatstaff.php in the Mambatstaff 3.1b and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21292; http://securityreason.com/securityalert/1313; http://www.osvdb.org/27653
CVE: CVE-2006-3948
Published: 2006-08-01
Description: Cross-site scripting (XSS) vulnerability in modules.php in PHP-Nuke INP allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1311; http://www.aria-security.net/advisory/inp.txt; http://www.securityfocus.com/archive/1/441490/100/0/threaded
CVE: CVE-2006-3949
Published: 2006-08-01
Description: PHP remote file inclusion vulnerability in artlinks.dispnew.php in the Artlinks component (com_artlinks) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://securityreason.com/securityalert/1318; http://www.securityfocus.com/archive/1/441541/100/0/threaded; http://www.securityfocus.com/bid/19223
CVE: CVE-2006-3950
Published: 2006-08-01
Description: SQL injection vulnerability in x-statistics.php in X-Scripts X-Statistics 1.20 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0722.html; http://secunia.com/advisories/21281; http://www.osvdb.org/27636
CVE: CVE-2006-3951
Published: 2006-08-01
Description: PHP remote file inclusion vulnerability in moodle.php in Mam-moodle alpha component (com_moodle) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19124; http://www.vupen.com/english/advisories/2006/2939; https://exchange.xforce.ibmcloud.com/vulnerabilities/27920
CVE: CVE-2006-3952
Published: 2006-08-01
Description: Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to the PASS command.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21289; http://www.osvdb.org/27646; http://www.securityfocus.com/bid/19243
CVE: CVE-2006-3953
Published: 2006-08-01
Description: Cross-site scripting (XSS) vulnerability in usercp.php in MyBB (aka MyBulletinBoard) 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1319; http://www.securityfocus.com/archive/1/441534/100/0/threaded; http://www.securityfocus.com/bid/19193
CVE: CVE-2006-3954
Published: 2006-08-01
Description: Directory traversal vulnerability in usercp.php in MyBB (aka MyBulletinBoard) 1.x allows remote attackers to read arbitrary files via a .. (dot dot) in the gallery parameter in a (1) avatar or (2) do_avatar action.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1319; http://www.securityfocus.com/archive/1/441534/100/0/threaded; http://www.securityfocus.com/bid/19195
CVE: CVE-2006-3955
Published: 2006-08-01
Description: Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to (1) news.php, (2) search.php, or (3) whosOnline.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1315; http://securitytracker.com/id?1016557; http://securitytracker.com/id?1016558
CVE: CVE-2006-3956
Published: 2006-08-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in contact.php in Advanced Webhost Billing System (AWBS) 2.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) AccountUsername and (3) Message parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21296; http://securityreason.com/securityalert/1317; http://www.osvdb.org/27629
CVE: CVE-2006-3957
Published: 2006-08-01
Description: PHP remote file inclusion vulnerability in payment.php in BosDev BosDates allows remote attackers to execute arbitrary PHP code via a URL in the insPath parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1016585; http://www.jaascois.com/exploits/18602020; http://www.securityfocus.com/bid/19191
CVE: CVE-2006-3958
Published: 2006-08-01
Description: Multiple unspecified cross-site scripting (XSS) vulnerabilities in Taskjitsu 2.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) the Search Tasks system, or authenticated users via (2) the Edit Task system, (3) the back-end Category Editor system, and (4) "Pages that display task status, email addresses, URL, customer, and project information."
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21242; http://www.osvdb.org/27637; http://www.pkrinternet.com/download/RELEASE-NOTES.txt
CVE: CVE-2006-3959
Published: 2006-08-01
Description: SQL injection vulnerability in protect.php in X-Scripts X-Protection 1.10, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameter.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/x-protection_poc.txt; http://secunia.com/advisories/21282; http://www.osvdb.org/27635
CVE: CVE-2006-3960
Published: 2006-08-01
Description: SQL injection vulnerability in top.php in X-Scripts X-Poll, probably 2.30, allows remote attackers to execute arbitrary SQL commands via the poll parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0720.html; http://downloads.securityfocus.com/vulnerabilities/exploits/x-poll_poc.txt; http://secunia.com/advisories/21283
CVE: CVE-2006-3961
Published: 2006-08-01
Description: Buffer overflow in McSubMgr ActiveX control (mcsubmgr.dll) in McAfee Security Center 6.0.23 for Internet Security Suite 2006, Wireless Home Network Security, Personal Firewall Plus, VirusScan, Privacy Service, SpamKiller, AntiSpyware, and QuickClean allows remote user-assisted attackers to execute arbitrary commands via long string parameters, which are later used in vsprintf.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/21264; http://securitytracker.com/id?1016614; http://ts.mcafeehelp.com/faq3.asp?docid=407052
CVE: CVE-2006-3962
Published: 2006-08-01
Description: PHP remote file inclusion vulnerability in administrator/components/com_bayesiannaivefilter/lang.php in the bayesiannaivefilter component (com_bayesiannaivefilter) 1.1 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19231; https://www.exploit-db.com/exploits/2090; http://www.securityfocus.com/bid/19231
CVE: CVE-2006-3963
Published: 2006-08-01
Description: Multiple SQL injection vulnerabilities in Banex PHP MySQL Banner Exchange 2.21 allow remote attackers to execute arbitrary SQL commands via the (1) site_name parameter to (a) signup.php, and the (2) id, (3) deleteuserbanner, (4) viewmem, (5) viewmemunb, (6) viewunmem,or (7) deleteuser parameters to (b) admin.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6111&w=2; http://www.securityfocus.com/bid/19240; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6111&w=2
CVE: CVE-2006-3964
Published: 2006-08-01
Description: PHP remote file inclusion vulnerability in members.php in Banex PHP MySQL Banner Exchange 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the cfg_root parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6111&w=2; http://www.securityfocus.com/bid/19240; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6111&w=2
CVE: CVE-2006-3965
Published: 2006-08-01
Description: Banex PHP MySQL Banner Exchange 2.21 stores lib.inc under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as database usernames and passwords.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6111&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6111&w=2
CVE: CVE-2006-3966
Published: 2006-08-01
Description: PHP remote file inclusion vulnerability in /lib/tree/layersmenu.inc.php in the PHP Layers Menu 2.3.5 package for MyNewsGroups :) 0.6b and earlier allows remote attackers to execute arbitrary PHP code via a URL in the myng_root parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/21263; http://securityreason.com/securityalert/1316; http://securitytracker.com/id?1016613
CVE: CVE-2006-3967
Published: 2006-08-01
Description: PHP remote file inclusion vulnerability in component/option,com_moskool/Itemid,34/admin.moskool.php in MamboXChange Moskool 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1314; http://www.securityfocus.com/archive/1/441710/100/0/threaded; http://www.securityfocus.com/bid/19245
CVE: CVE-2006-3968
Published: 2006-08-01
Description: The crypto provider in Sun Solaris 10 3/05 HW2 without patch 121236-01, when running on Sun Fire T2000 platforms, incorrectly verifies a DSA signature, which might prevent applications from detecting that the data has been modified.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21279; http://securitytracker.com/id?1016625; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102543-1
CVE: CVE-2006-3969
Published: 2006-08-01
Description: PHP remote file inclusion vulnerability in administrator/components/com_colophon/admin.colophon.php in Colophon 1.2 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21288; http://www.osvdb.org/27659; http://www.securityfocus.com/bid/19252
CVE: CVE-2006-3970
Published: 2006-08-01
Description: PHP remote file inclusion vulnerability in lmo.php in the LMO Component (com_lmo) 1.0b2 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://developer.joomla.org/sf/sfmain/do/viewProject/projects.lmo; http://forum.joomla.org/index.php/topic%2C100164.0.html; http://forum.joomla.org/index.php/topic%2C81590.0.html
CVE: CVE-2006-1472
Published: 2006-08-02
Description: Unspecified vulnerability in AFP Server in Apple Mac OS X 10.3.9 allows remote attackers to determine names of unauthorized files and folders via unknown vectors related to the search results.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html; http://secunia.com/advisories/21253; http://securitytracker.com/id?1016620
CVE: CVE-2006-1473
Published: 2006-08-02
Description: Integer overflow in AFP Server for Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html; http://secunia.com/advisories/21253; http://securitytracker.com/id?1016620
CVE: CVE-2006-3495
Published: 2006-08-02
Description: AFP Server in Apple Mac OS X 10.3.9 and 10.4.7 stores reconnect keys in a world-readable file, which allows local users to obtain the keys and access files and folders of other users.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html; http://secunia.com/advisories/21253; http://securitytracker.com/id?1016620
CVE: CVE-2006-3496
Published: 2006-08-02
Description: AFP Server in Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to cause denial of service (crash) via an invalid AFP request that triggers an unchecked error condition.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html; http://secunia.com/advisories/21253; http://securitytracker.com/id?1016620
CVE: CVE-2006-3497
Published: 2006-08-02
Description: Unspecified vulnerability in the "compression state handling" in Bom for Apple Mac OS X 10.3.9 and 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Zip archive.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html; http://secunia.com/advisories/21253; http://www.kb.cert.org/vuls/id/514740
CVE: CVE-2006-3498
Published: 2006-08-02
Description: Stack-based buffer overflow in bootpd in the DHCP component for Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to execute arbitrary code via a crafted BOOTP request.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html; http://secunia.com/advisories/21253; http://www.kb.cert.org/vuls/id/776628
CVE: CVE-2006-3971
Published: 2006-08-02
Description: Cross-site scripting (XSS) vulnerability in visitor/livesupport/chat.php in Scott Weedon Ajax Chat, possibly 0.1, allows remote attackers to inject arbitrary web script or HTML via the userid parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0716.html; http://secunia.com/advisories/21286; http://www.osvdb.org/27643
CVE: CVE-2006-3972
Published: 2006-08-02
Description: Directory traversal vulnerability in includes/operator_chattranscript.php in Scott Weedon Ajax Chat, possibly 0.1, allows remote attackers to read arbitrary files via a .. (dot dot) in the chatid parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0716.html; http://secunia.com/advisories/21286; http://www.osvdb.org/27642
CVE: CVE-2006-0392
Published: 2006-08-03
Description: Buffer overflow in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Canon RAW image.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html; http://secunia.com/advisories/21253; http://www.kb.cert.org/vuls/id/527236
CVE: CVE-2006-0393
Published: 2006-08-03
Description: OpenSSH in Apple Mac OS X 10.4.7 allows remote attackers to cause a denial of service or determine account existence by attempting to log in using an invalid user, which causes the server to hang.
CVSS Score: 4.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html; http://secunia.com/advisories/21253; http://securitytracker.com/id?1016672
CVE: CVE-2006-3459
Published: 2006-08-03
Description: Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P; ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html