deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-5794
Published: 2006-11-08
Description: Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc; http://rhn.redhat.com/errata/RHSA-2006-0738.html; http://secunia.com/advisories/22771
CVE: CVE-2006-5795
Published: 2006-11-08
Description: Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the srcdir parameter to (a) billing_process.php, (b) billing_report.php, (c) billing_report_xml.php, and (d) print_billing_report.php in interface/billing/; (e) login.php; (f) interface/batchcom/batchcom.php; (g) interface/login/login.php; (h) main_info.php and (i) main.php in interface/main/; (j) interface/new/new_patient_save.php; (k) interface/practice/ins_search.php; (l) interface/logout.php; (m) custom_report_range.php, (n) players_report.php, and (o) front_receipts_report.php in interface/reports/; (p) facility_admin.php, (q) usergroup_admin.php, and (r) user_info.php in interface/usergroup/; or (s) custom/import_xml.php.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv60-theday-2006.txt; http://secunia.com/advisories/22695; http://securityreason.com/securityalert/1834
CVE: CVE-2006-5796
Published: 2006-11-08
Description: Multiple PHP remote file inclusion vulnerabilities in Soholaunch Pro Edition 4.9 r46 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the _SESSION[docroot_path] parameter to (1) includes/shared_functions.php or (2) client_files/shopping_cart/pgm-shopping_css.inc.php.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv57-theday-2006.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4510&w=2; http://secunia.com/advisories/22735
CVE: CVE-2006-5797
Published: 2006-11-08
Description: Multiple SQL injection vulnerabilities in default.asp in Xenis.creator CMS allow remote attackers to execute arbitrary SQL commands via the (1) nav, (2) s, or (3) print parameters.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4762&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2120&w=2; http://secunia.com/advisories/22716
CVE: CVE-2006-5798
Published: 2006-11-08
Description: SQL injection vulnerability in default.asp in Xenis.creator CMS allows remote attackers to execute arbitrary SQL commands via the contid parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2120&w=2; http://securitytracker.com/id?1017162; http://www.securityfocus.com/bid/20908
CVE: CVE-2006-5799
Published: 2006-11-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in default.asp in xenis.creator CMS allow remote attackers to inject arbitrary web script or HTML via the (1) contid or (2) search parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4762&w=2; http://secunia.com/advisories/22716; http://securitytracker.com/id?1017162
CVE: CVE-2006-5800
Published: 2006-11-08
Description: Cross-site scripting (XSS) vulnerability in default.asp in xenis.creator CMS allows remote attackers to inject arbitrary web script or HTML via the nav parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.6 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/30019; https://exchange.xforce.ibmcloud.com/vulnerabilities/30019
CVE: CVE-2006-5801
Published: 2006-11-08
Description: The owserver module in owfs and owhttpd 2.5p5 and earlier does not properly check the path type, which allows attackers to cause a denial of service (application crash) related to use of the path in owshell.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22700; http://sourceforge.net/project/shownotes.php?release_id=461204; http://www.securityfocus.com/bid/20953
CVE: CVE-2006-5802
Published: 2006-11-08
Description: SQL injection vulnerability in message_details.php in The Web Drivers Simple Forum, dated 20060318, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22706; http://www.securityfocus.com/bid/20937; http://www.vupen.com/english/advisories/2006/4351
CVE: CVE-2006-5803
Published: 2006-11-08
Description: PHP remote file inclusion vulnerability in modules/mx_smartor/album.php in the mxBB Smartor Album module 1.02 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20932; https://exchange.xforce.ibmcloud.com/vulnerabilities/30015; https://www.exploit-db.com/exploits/2723
CVE: CVE-2006-5804
Published: 2006-11-08
Description: PHP remote file inclusion vulnerability in admin.php in Advanced Guestbook 2.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22756; http://securityreason.com/securityalert/1833; http://www.osvdb.org/30230
CVE: CVE-2006-4810
Published: 2006-11-08
Description: Buffer overflow in the readline function in util/texindex.c, as used by the (1) texi2dvi and (2) texindex commands, in texinfo 4.8 and earlier allows local users to execute arbitrary code via a crafted Texinfo file.
CVSS Score: 4.6 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://cvs.savannah.gnu.org/viewcvs/texinfo/texinfo/util/texindex.c?r1=1.16&r2=1.17; http://secunia.com/advisories/22725
CVE: CVE-2006-5462
Published: 2006-11-08
Description: Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.
CVSS Score: 6.4 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://rhn.redhat.com/errata/RHSA-2006-0733.html; http://rhn.redhat.com/errata/RHSA-2006-0734.html
CVE: CVE-2006-5464
Published: 2006-11-08
Description: Multiple unspecified vulnerabilities in the layout engine in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allow remote attackers to cause a denial of service (crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://rhn.redhat.com/errata/RHSA-2006-0733.html; http://rhn.redhat.com/errata/RHSA-2006-0734.html
CVE: CVE-2006-5747
Published: 2006-11-08
Description: Unspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to execute arbitrary code via the XML.prototype.hasOwnProperty JavaScript function.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://rhn.redhat.com/errata/RHSA-2006-0733.html; http://rhn.redhat.com/errata/RHSA-2006-0734.html
CVE: CVE-2006-5748
Published: 2006-11-08
Description: Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger memory corruption.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://rhn.redhat.com/errata/RHSA-2006-0733.html; http://rhn.redhat.com/errata/RHSA-2006-0734.html
CVE: CVE-2006-5463
Published: 2006-11-08
Description: Unspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to execute arbitrary JavaScript bytecode via unspecified vectors involving modification of a Script object while it is executing.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://rhn.redhat.com/errata/RHSA-2006-0733.html; http://rhn.redhat.com/errata/RHSA-2006-0734.html
CVE: CVE-2006-5805
Published: 2006-11-08
Description: Microsoft Internet Explorer 7 allows remote attackers to cause a security certificate from a secure web site to appear invalid via a link to res://ieframe.dll/invalidcert.htm with the target site as an argument, which displays the site's URL in the address bar but causes Internet Explorer to report that the certificate is invalid.
CVSS Score: 5.0 (MEDIUM)
References: http://ingehenriksen.blogspot.com/2006/11/ie7-website-security-certificate.html; http://securitytracker.com/id?1017165; http://www.securityfocus.com/archive/1/450722/100/0/threaded
CVE: CVE-2006-5806
Published: 2006-11-08
Description: SSL VPN Client in Cisco Secure Desktop before 3.1.1.45, when configured to spawn a web browser after a successful connection, stores sensitive browser session information in a directory outside of the CSD vault and does not restrict the user from saving files outside of the vault, which is not cleared after the VPN connection terminates and allows local users to read unencrypted data.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/22747; http://securitytracker.com/id?1017195; http://www.cisco.com/warp/public/707/cisco-sa-20061108-csd.shtml
CVE: CVE-2006-5807
Published: 2006-11-08
Description: Cisco Secure Desktop (CSD) before 3.1.1.45 allows local users to escape out of the secure desktop environment by using certain applications that switch to the default desktop, aka "System Policy Evasion".
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/22747; http://securitytracker.com/id?1017195; http://www.cisco.com/warp/public/707/cisco-sa-20061108-csd.shtml
CVE: CVE-2006-5808
Published: 2006-11-08
Description: The installation of Cisco Secure Desktop (CSD) before 3.1.1.45 uses insecure default permissions (all users full control) for the CSD directory and its parent directory, which allow local users to gain privileges by replacing CSD executables, aka "Local Privilege Escalation".
CVSS Score: 4.6 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=442; http://secunia.com/advisories/22747; http://securitytracker.com/id?1017195
CVE: CVE-2006-5809
Published: 2006-11-08
Description: Multiple unspecified vulnerabilities in Jonathon J. Freeman OvBB before 0.13a have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.ovbb.org/release.php?id=4; http://www.vupen.com/english/advisories/2006/4257; http://www.ovbb.org/release.php?id=4
CVE: CVE-2006-5810
Published: 2006-11-08
Description: Cross-site scripting (XSS) vulnerability in modules/wfdownloads/newlist.php in XOOPS 1.0 allows remote attackers to inject arbitrary web script or HTML via the newdownloadshowdays parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://worldphantom.org/foro/index.php?PHPSESS=475e274a8eeb5ffa159e890b2a9cae64&topic=417.new; http://www.securityfocus.com/bid/20927; http://worldphantom.org/foro/index.php?PHPSESS=475e274a8eeb5ffa159e890b2a9cae64&topic=417.new
CVE: CVE-2006-5811
Published: 2006-11-08
Description: PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[srcdir] parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://advisories.echo.or.id/adv/adv60-theday-2006.txt; http://secunia.com/advisories/22695; http://securityreason.com/securityalert/1844
CVE: CVE-2006-5812
Published: 2006-11-08
Description: Unspecified vulnerability in Kerio MailServer allows attackers to cause a denial of service, as demonstrated by vd_kms4.pm, a "Kerio MailServer DoS." NOTE: As of 20061108, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 5.0 (MEDIUM)
References: http://gleg.net/vulndisco_meta.shtml; http://secunia.com/advisories/22861; http://securitytracker.com/id?1017171
CVE: CVE-2006-5813
Published: 2006-11-08
Description: Unspecified vulnerability in Novell eDirectory 8.8 allows attackers to cause a denial of service, as demonstrated by vd_novell3.pm, a "Novell eDirectory 8.8 DoS." NOTE: As of 20061108, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 5.0 (MEDIUM)
References: http://gleg.net/vulndisco_meta.shtml; http://securitytracker.com/id?1017169; https://exchange.xforce.ibmcloud.com/vulnerabilities/30149
CVE: CVE-2006-5814
Published: 2006-11-08
Description: Unspecified vulnerability in Novell eDirectory allows remote attackers to execute arbitrary code, as demonstrated by vd_novell.pm, a "Novell eDirectory remote exploit." NOTE: As of 20061108, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.5 (HIGH)
References: http://gleg.net/vulndisco_meta.shtml; http://securitytracker.com/id?1017169; https://exchange.xforce.ibmcloud.com/vulnerabilities/30150
CVE: CVE-2006-5815
Published: 2006-11-08
Description: Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.proftpd.org/show_bug.cgi?id=2858; http://gleg.net/vulndisco_meta.shtml; http://secunia.com/advisories/22803
CVE: CVE-2006-5816
Published: 2006-11-08
Description: Multiple PHP remote file inclusion vulnerabilities in Dmitry Sheiko Business Card Web Builder (BCWB) 2.5 allow remote attackers to execute arbitrary PHP code via a URL in the root_path_admin parameter to (1) /include/startup.inc.php, (2) dcontent/default.css.php, or (3) system/default.css.php, different vectors than CVE-2006-4946.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1836; http://www.securityfocus.com/archive/1/450069/100/100/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/29905
CVE: CVE-2006-5817
Published: 2006-11-08
Description: prl_dhcpd in Parallels Desktop for Mac Build 1940 uses insecure permissions (0666) for /Library/Parallels/.dhcpd_configuration, which allows local users to modify DHCP configuration.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0582.html; http://secunia.com/advisories/22634; http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0582.html
CVE: CVE-2006-5818
Published: 2006-11-08
Description: Multiple buffer overflows in tunekrnl in IBM Lotus Domino 6.x before 6.5.5 FP2 and 7.x before 7.0.2 allow local users to gain privileges and execute arbitrary code via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=440; http://secunia.com/advisories/22724; http://securitytracker.com/id?1017198
CVE: CVE-2006-5680
Published: 2006-11-09
Description: The libarchive library in FreeBSD 6-STABLE after 2006-09-05 and before 2006-11-08 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive that causes libarchive to skip a region past the actual end of the archive, which triggers an infinite loop that attempts to read more data.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22723; http://secunia.com/advisories/22801; http://security.freebsd.org/advisories/FreeBSD-SA-06:24.libarchive.asc
CVE: CVE-2006-5782
Published: 2006-11-09
Description: radexecd.exe in HP OpenView Client Configuraton Manager (CCM) does not require authentication before executing commands in the installation directory, which allows remote attackers to cause a denial of service (reboot) by calling radbootw.exe or create arbitrary files by calling radcrecv.
CVSS Score: 7.8 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00795552; http://secunia.com/advisories/22780; http://securityreason.com/securityalert/1842
CVE: CVE-2006-5823
Published: 2006-11-09
Description: The zlib_inflate function in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via a malformed filesystem that uses zlib compression that triggers memory corruption, as demonstrated using cramfs.
CVSS Score: 4.0 (MEDIUM)
References: http://projects.info-pull.com/mokb/MOKB-07-11-2006.html; http://rhn.redhat.com/errata/RHSA-2007-0014.html; http://rhn.redhat.com/errata/RHSA-2007-0436.html
CVE: CVE-2006-5824
Published: 2006-11-09
Description: Integer overflow in the ffs_rdextattr function in FreeBSD 6.1 allows local users to cause a denial of service (kernel panic) and trigger a heap-based buffer overflow via a crafted UFS filesystem, a different vulnerability than CVE-2006-5679.  NOTE: a third party states that this issue does not cross privilege boundaries in FreeBSD because only root may mount a filesystem.
CVSS Score: 4.9 (MEDIUM)
References: http://lists.freebsd.org/pipermail/freebsd-security/2007-January/004218.html; http://projects.info-pull.com/mokb/MOKB-08-11-2006.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/30144
CVE: CVE-2006-5825
Published: 2006-11-10
Description: Cross-site scripting (XSS) vulnerability in index.php in Kayako SupportSuite 3.00.32 allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
References: http://builds.kayako.net/; http://securityreason.com/securityalert/1838; http://www.securityfocus.com/archive/1/450829/100/0/threaded
CVE: CVE-2006-5826
Published: 2006-11-10
Description: Buffer overflow in Texas Imperial Software WFTPD Pro Server 3.23.1.1 allows remote authenticated users to execute arbitrary code or cause a denial of service (application crash) via crafted APPE commands that contain "/" (slash) or "\" (backslash) characters.
CVSS Score: 5.8 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2958&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4746&w=2; http://securityreason.com/securityalert/1837
CVE: CVE-2006-5827
Published: 2006-11-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpComasy CMS 0.7.9pre and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username or (2) password parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22760; http://securityreason.com/securityalert/1843; http://www.majorsecurity.de/index_2.php?major_rls=major_rls32
CVE: CVE-2006-5828
Published: 2006-11-10
Description: SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.1 and earlier allows remote attackers to execute arbitrary SQL commands via the user_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22704; http://www.securityfocus.com/bid/20935; http://www.vupen.com/english/advisories/2006/4403
CVE: CVE-2006-5829
Published: 2006-11-10
Description: Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) choosed_language parameter to (a) cp_dpage.php, (b) cp_news.php, (c) cp_forum_view.php, (d) cp_edit_user.php, (e) cp_newsletter.php, (f) cp_links.php, (g) cp_contact_us.php, (h) cp_login.php, and (i) cp_codice_fiscale.php in public/code/; (2) news_category parameter to public/code/cp_news.php; (3) nlmsg_nlcatid parameter to public/code/cp_newsletter.php; (4) links_category parameter to public/code/cp_links.php; (5) product_category_id parameter to public/code/cp_show_ec_products.php; (6) order_field parameter to public/code/cp_show_ec_products.php; (7) firstrow parameter to public/code/cp_users_online.php; and (8) orderdir parameter to public/code/cp_links_search.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/22719; http://securityreason.com/securityalert/1839; http://sourceforge.net/project/shownotes.php?release_id=478370
CVE: CVE-2006-5830
Published: 2006-11-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topid, (2) forid, and (3) catid parameters to code/cp_forum_view.php; (4) choosed_language parameter to cp_dpage.php; (5) orderdir parameter to cp_links_search.php; (6) order_field parameter to (a) cp_show_ec_products.php and (b) cp_users_online.php; and the (7) signature and (8) fiscal code fields in the user profile.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22719; http://securityreason.com/securityalert/1839; http://sourceforge.net/project/shownotes.php?release_id=478370
CVE: CVE-2006-5831
Published: 2006-11-10
Description: PHP remote file inclusion vulnerability in admin/code/index.php in All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the load_page parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1839; http://sourceforge.net/project/shownotes.php?release_id=478370; http://www.securityfocus.com/archive/1/450701/100/0/threaded
CVE: CVE-2006-5832
Published: 2006-11-10
Description: All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to (1) public/code/cp_dpage.php, possibly involving the aiocp_dp[] parameter, (2) public/code/cp_show_ec_products.php, possibly involving the order_field[] parameter, and (3) public/code/cp_show_page_help.php, possibly involving the hp[] parameter, which reveal the path in various error messages.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1839; http://sourceforge.net/project/shownotes.php?release_id=478370; http://www.securityfocus.com/archive/1/450701/100/0/threaded
CVE: CVE-2006-5833
Published: 2006-11-10
Description: gbcms_php_files/up_loader.php GreenBeast CMS 1.3 does not require authentication to upload files, which allows remote attackers to cause a denial of service (disk consumption) and execute arbitrary code by uploading arbitrary files, such as executing PHP code via an uploaded PHP file.
CVSS Score: 7.5 (HIGH)
References: http://newhack.org/advisories/GreenBeastCMS.txt; http://secunia.com/advisories/22769; http://securityreason.com/securityalert/1841
CVE: CVE-2006-5834
Published: 2006-11-10
Description: Directory traversal vulnerability in general.php in OpenSolution Quick.Cms.Lite 0.3 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the sLanguage Cookie parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22703; http://www.securityfocus.com/bid/20923; http://www.vupen.com/english/advisories/2006/4402
CVE: CVE-2006-5835
Published: 2006-11-10
Description: The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22741; http://securitytracker.com/id?1017203; http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21248026