deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6816
Published: 2006-12-29
Description: Multiple SQL injection vulnerabilities in DMXReady Secure Login Manager 1.0 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) set_preferences.asp, (2) send_password_preferences.asp, and (3) SecureLoginManager/list.asp in the Local-Admin Panel; (4) the sent parameter to (a) login.asp, (b) content.asp, and (c) members.asp in the Remote-WebSite; and (5) the sent parameter to applications/SecureLoginManager/inc_secureloginmanager.asp in the Live Demo.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/33333; http://www.osvdb.org/33334; http://www.osvdb.org/33335
CVE: CVE-2006-6817
Published: 2006-12-29
Description: AlstraSoft Web Host Directory allows remote attackers to obtain sensitive information by requesting any invalid URI, which reveals the path in an error message, a different vulnerability than CVE-2006-2617.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/455352/100/0/threaded; http://www.securityfocus.com/archive/1/455352/100/0/threaded
CVE: CVE-2006-6818
Published: 2006-12-29
Description: AlstraSoft Web Host Directory allows remote attackers to bypass authentication and change the admin password via a direct request to admin/config.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/455352/100/0/threaded; http://www.securityfocus.com/bid/21787; https://exchange.xforce.ibmcloud.com/vulnerabilities/31123
CVE: CVE-2006-6819
Published: 2006-12-29
Description: AlstraSoft Web Host Directory stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a backup database via a direct request for admin/backup/db.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/23500; http://www.securityfocus.com/archive/1/455352/100/0/threaded; http://secunia.com/advisories/23500
CVE: CVE-2006-6820
Published: 2006-12-29
Description: myprofile.asp in Enthrallweb eCoupons does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MM_recordId parameter.
CVSS Score: 3.5 (LOW)
References: http://secunia.com/advisories/23517; http://www.securityfocus.com/bid/21739; http://www.vupen.com/english/advisories/2006/5155
CVE: CVE-2006-6821
Published: 2006-12-29
Description: myprofile.asp in Enthrallweb eNews does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MM_recordId parameter.
CVSS Score: 3.5 (LOW)
References: http://secunia.com/advisories/23518; http://www.securityfocus.com/bid/21739; http://www.vupen.com/english/advisories/2006/5156
CVE: CVE-2006-6822
Published: 2006-12-29
Description: myprofile.asp in Enthrallweb eClassifieds does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MM_recordId parameter.
CVSS Score: 3.5 (LOW)
References: http://www.securityfocus.com/bid/21739; http://www.vupen.com/english/advisories/2006/5154; https://www.exploit-db.com/exploits/2994
CVE: CVE-2006-6823
Published: 2006-12-29
Description: PHP remote file inclusion vulnerability in plugins/metasearch/plug.inc.php in Yrch! 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21794; http://www.vupen.com/english/advisories/2006/5196; https://exchange.xforce.ibmcloud.com/vulnerabilities/31120
CVE: CVE-2006-6824
Published: 2006-12-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php, (b) month.php, (c) year.php, (d) week.php, (e) search.php, (f) rss/index.php, (g) print.php, and (h) preferences.php; the (2) cpath parameter in (i) day.php, (j) month.php, (k) year.php, (l) week.php, and (m) search.php; the (3) query parameter in search.php; and possibly the cpath, (4) unset, and (5) set parameters in a setcookie action in preferences.php; different vectors than CVE-2006-3319.  NOTE: it was later reported that vectors b, c, and d also affect 2.24.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2006/12/php-icalendar-multiple-variable-cross.html; http://secunia.com/advisories/23499; http://securitytracker.com/id?1017449
CVE: CVE-2006-6825
Published: 2006-12-29
Description: Calendar MX BASIC 1.0.2 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for calendar.mdb.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/5151; http://www.vupen.com/english/advisories/2006/5151
CVE: CVE-2006-6826
Published: 2006-12-29
Description: Unspecified vulnerability in the tab editor for Personal .NET Portal before 2.0.0 has unknown impact and attack vectors related to a "Security leak."
CVSS Score: 7.5 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=460503; http://www.vupen.com/english/advisories/2006/4452; https://exchange.xforce.ibmcloud.com/vulnerabilities/30181
CVE: CVE-2006-1305
Published: 2006-12-31
Description: Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to cause a denial of service (memory exhaustion and interrupted mail recovery) via malformed e-mail header information, possibly related to (1) long subject lines or (2) large numbers of recipients in To or CC headers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://blogs.securiteam.com/index.php/archives/347; http://linuxbox.org/pipermail/funsec/2006-March/005208.html; http://osvdb.org/ref/24/24081-outlook1.txt
CVE: CVE-2006-3432
Published: 2006-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-0028.  Reason: This candidate is a reservation duplicate of CVE-2007-0028.  The original assigner switched to a new CVE number.  Notes: All CVE users should reference CVE-2007-0028 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-4097
Published: 2006-12-31
Description: Multiple unspecified vulnerabilities in the CSRadius service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allow remote attackers to cause a denial of service (crash) via a crafted RADIUS Access-Request packet.  NOTE: it has been reported that at least one issue is a heap-based buffer overflow involving the Tunnel-Password attribute.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/36125; http://secunia.com/advisories/23629; http://securitytracker.com/id?1017475
CVE: CVE-2006-4098
Published: 2006-12-31
Description: Stack-based buffer overflow in the CSRadius service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted RADIUS Accounting-Request packet.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/36126; http://secunia.com/advisories/23629; http://securitytracker.com/id?1017475
CVE: CVE-2006-4220
Published: 2006-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in webacc in Novell GroupWise WebAccess before 7 Support Pack 3 Public Beta allow remote attackers to inject arbitrary web script or HTML via the (1) User.html, (2) Error, (3) User.Theme.index, and (4) and User.lang parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28778; http://www.novell.com/documentation/gw7/readmeusgw7sp3/readmeusgw7sp3.html#b4qb42z; http://www.osvdb.org/27531
CVE: CVE-2006-4575
Published: 2006-12-31
Description: Multiple SQL injection vulnerabilities in The Address Book 1.04e allow remote attackers to execute arbitrary SQL commands via the (1) lastname, (2) firstname, (3) passwordOld, (4) passwordNew, (5) id, (6) language, (7) defaultLetter, (8) newuserPass, (9) newuserType, (10) newuserEmail parameters in (a) user.php; the (11) goTo and (12) search parameters in (b) search.php; and the (13) groupAddName parameter in (c) save.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32568; http://osvdb.org/32569; http://osvdb.org/32570
CVE: CVE-2006-4576
Published: 2006-12-31
Description: Cross-site scripting (XSS) vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Explorer.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32567; http://secunia.com/advisories/21694; http://secunia.com/secunia_research/2006-76/advisory/
CVE: CVE-2006-4577
Published: 2006-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) email, (2) websites, and (3) groupAddName parameters in (a) save.php; the (4) errorMsg parameter in (b) index.php; and the (5) goTo and (6) search parameters in (c) search.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32564; http://osvdb.org/32565; http://osvdb.org/32566
CVE: CVE-2006-4578
Published: 2006-12-31
Description: export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32563; http://secunia.com/advisories/21694; http://secunia.com/secunia_research/2006-76/advisory/
CVE: CVE-2006-4579
Published: 2006-12-31
Description: Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a .. (dot dot) in the language parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32562; http://secunia.com/advisories/21694; http://secunia.com/secunia_research/2006-76/advisory/
CVE: CVE-2006-4580
Published: 2006-12-31
Description: register.php in The Address Book 1.04e allows remote attackers to bypass the "Allow User Self-Registration" setting and create arbitrary users by setting the mode parameter to "confirm".
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32561; http://secunia.com/advisories/21694; http://secunia.com/secunia_research/2006-76/advisory/
CVE: CVE-2006-4581
Published: 2006-12-31
Description: Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to upload arbitrary PHP scripts.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32560; http://secunia.com/advisories/21694; http://secunia.com/secunia_research/2006-76/advisory/
CVE: CVE-2006-4582
Published: 2006-12-31
Description: Cross-site request forgery (CSRF) vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32559; http://secunia.com/advisories/21694; http://secunia.com/secunia_research/2006-76/advisory/
CVE: CVE-2006-4695
Published: 2006-12-31
Description: Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via a crafted URL, aka "Office Web Components URL Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7305&w=2; http://secunia.com/advisories/29328; http://www.kb.cert.org/vuls/id/654577
CVE: CVE-2006-4727
Published: 2006-12-31
Description: Cross-site scripting (XSS) vulnerability in emfadmin/statusView.do in Tumbleweed EMF Administration Module 6.2.2 Build 4123, and possibly other versions before 6.3.2, allows remote attackers to inject arbitrary web script or HTML via the (1) lineId and (2) sort parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/ref/28/28722-tumbleweed-emf.txt; http://www.osvdb.org/28722; https://exchange.xforce.ibmcloud.com/vulnerabilities/42392
CVE: CVE-2006-5265
Published: 2006-12-31
Description: Unspecified vulnerability in Microsoft Dynamics GP (formerly Great Plains) 9.0 and earlier allows remote attackers to cause a denial of service (crash) via an invalid magic number in a Distributed Process Server (DPS) message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/29991; https://exchange.xforce.ibmcloud.com/vulnerabilities/25844; http://www.securityfocus.com/bid/29991
CVE: CVE-2006-5266
Published: 2006-12-31
Description: Multiple buffer overflows in Microsoft Dynamics GP (formerly Great Plains) 9.0 and earlier allow remote attackers to execute arbitrary code via (1) a crafted Distributed Process Manager (DPM) message to the (a) DPM component, or a (2) long string or (3) long IP address in a Distributed Process Server (DPS) message to the DPM or (b) DPS component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/29991; https://exchange.xforce.ibmcloud.com/vulnerabilities/25840; https://exchange.xforce.ibmcloud.com/vulnerabilities/25841
CVE: CVE-2006-5574
Published: 2006-12-31
Description: Unspecified vulnerability in the Brazilian Portuguese Grammar Checker in Microsoft Office 2003 and the Multilingual Interface for Office 2003, Project 2003, and Visio 2003 allows user-assisted remote attackers to execute arbitrary code via crafted text that is not properly parsed.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/23671; http://securitytracker.com/id?1017486; http://www.osvdb.org/31251
CVE: CVE-2006-5749
Published: 2006-12-31
Description: The isdn_ppp_ccp_reset_alloc_state function in drivers/isdn/isdn_ppp.c in the Linux 2.4 kernel before 2.4.34-rc4 does not call the init_timer function for the ISDN PPP CCP reset state timer, which has unknown attack vectors and results in a system crash.
CVSS Score: 1.7 (LOW)
References: http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.34; http://secunia.com/advisories/23529; http://secunia.com/advisories/23609
CVE: CVE-2006-5755
Published: 2006-12-31
Description: Linux kernel before 2.6.18, when running on x86_64 systems, does not properly save or restore EFLAGS during a context switch, which allows local users to cause a denial of service (crash) by causing SYSENTER to set an NT flag, which can trigger a crash on the IRET of the next task.
CVSS Score: 4.9 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=658fdbef66e5e9be79b457edc2cbbb3add840aa9; http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=658fdbef66e5e9be79b457edc2cbbb3add840aa9; http://secunia.com/advisories/24098
CVE: CVE-2006-5857
Published: 2006-12-31
Description: Adobe Reader and Acrobat 7.0.8 and earlier allows user-assisted remote attackers to execute code via a crafted PDF file that triggers memory corruption and overwrites a subroutine pointer during rendering.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0200.html; http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html; http://osvdb.org/31316
CVE: CVE-2006-5858
Published: 2006-12-31
Description: Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=466; http://osvdb.org/32123; http://secunia.com/advisories/23668
CVE: CVE-2006-5867
Published: 2006-12-31
Description: fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://docs.info.apple.com/article.html?artnum=305391; http://fedoranews.org/cms/node/2429
CVE: CVE-2006-5870
Published: 2006-12-31
Description: Multiple integer overflows in OpenOffice.org (OOo) 2.0.4 and earlier, and possibly other versions before 2.1.0; and StarOffice 6 through 8; allow user-assisted remote attackers to execute arbitrary code via a crafted (a) WMF or (b) EMF file that triggers heap-based buffer overflows in (1) wmf/winwmf.cxx, during processing of META_ESCAPE records; and wmf/enhwmf.cxx, during processing of (2) EMR_POLYPOLYGON and (3) EMR_POLYPOLYGON16 records.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: ftp://patches.sgi.com/support/free/security/advisories/20070101-01-P.asc; http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0002.htmly; http://fedoranews.org/cms/node/2344
CVE: CVE-2006-5974
Published: 2006-12-31
Description: fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the (1) ferror or (2) fflush functions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://fedoranews.org/cms/node/2429; http://fetchmail.berlios.de/fetchmail-SA-2006-03.txt; http://osvdb.org/31836
CVE: CVE-2006-6101
Published: 2006-12-31
Description: Integer overflow in the ProcRenderAddGlyphs function in the Render extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of glyph management data structures.
CVSS Score: 6.6 (MEDIUM)
References: http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-002.txt.asc; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01075678; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=463
CVE: CVE-2006-6102
Published: 2006-12-31
Description: Integer overflow in the ProcDbeGetVisualInfo function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.
CVSS Score: 10.0 (HIGH)
References: http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-002.txt.asc; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01075678; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=464
CVE: CVE-2006-6103
Published: 2006-12-31
Description: Integer overflow in the ProcDbeSwapBuffers function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.
CVSS Score: 6.6 (MEDIUM)
References: http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-002.txt.asc; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01075678; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=465
CVE: CVE-2006-6143
Published: 2006-12-31
Description: The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-824
References: http://docs.info.apple.com/article.html?artnum=305391; http://fedoranews.org/cms/node/2375; http://fedoranews.org/cms/node/2376
CVE: CVE-2006-6144
Published: 2006-12-31
Description: The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.
CVSS Score: 5.0 (MEDIUM)
References: http://fedoranews.org/cms/node/2375; http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html; http://osvdb.org/31280
CVE: CVE-2006-6336
Published: 2006-12-31
Description: Heap-based buffer overflow in the Mail Management Server (MAILMA.exe) in Eudora WorldMail 3.1.x allows remote attackers to execute arbitrary code via a crafted request containing successive delimiters.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/32587; http://secunia.com/advisories/23622; http://securitytracker.com/id?1017474
CVE: CVE-2006-6488
Published: 2006-12-31
Description: Stack-based buffer overflow in the DoModal function in the Dialog Wrapper Module ActiveX control (DlgWrapper.dll) before 8.4.166.0, as used by ICONICS OPC Enabled Gauge, Switch, and Vessel ActiveX, allows remote attackers to execute arbitrary code via a long (1) FileName or (2) Filter argument.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32552; http://secunia.com/advisories/23583; http://www.kb.cert.org/vuls/id/251969
CVE: CVE-2006-6827
Published: 2006-12-31
Description: Flash8b.ocx in Macromedia Flash 8 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long string in the Flash8b.AllowScriptAccess method.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/21818; https://exchange.xforce.ibmcloud.com/vulnerabilities/31156; https://www.exploit-db.com/exploits/3041
CVE: CVE-2006-6828
Published: 2006-12-31
Description: Multiple SQL injection vulnerabilities in Efkan Forum 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the grup parameter in admin.asp, or the id parameter in (2) default.asp or (3) admin.asp.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. The default.asp/grup vector is already covered by CVE-2006-6794.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/5150; http://www.vupen.com/english/advisories/2006/5150
CVE: CVE-2006-6829
Published: 2006-12-31
Description: Efkan Forum 1.0 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for forum.mdb.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.8 (HIGH)
References: http://www.vupen.com/english/advisories/2006/5150; http://www.vupen.com/english/advisories/2006/5150
CVE: CVE-2006-6830
Published: 2006-12-31
Description: PHP remote file inclusion vulnerability in b2verifauth.php in b2 Blog 0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the index parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21749; https://exchange.xforce.ibmcloud.com/vulnerabilities/31139; https://www.exploit-db.com/exploits/2983
CVE: CVE-2006-6831
Published: 2006-12-31
Description: SQL injection vulnerability in faqDsp.asp in aFAQ 1.0 allows remote attackers to execute arbitrary SQL commands via the catcode parameter.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/31130; https://www.exploit-db.com/exploits/3031; https://exchange.xforce.ibmcloud.com/vulnerabilities/31130