deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6395
Published: 2006-12-08
Description: Multiple memory leaks in Ulrik Petersen Emdros Database Engine before 1.2.0.pre231 allow local users to cause a denial of service (memory consumption) via unspecified vectors, a different issue than CVE-2005-0415.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23231; http://sourceforge.net/mailarchive/forum.php?thread_id=31151112&forum_id=2949; http://sourceforge.net/project/shownotes.php?release_id=468120
CVE: CVE-2006-6396
Published: 2006-12-08
Description: Stack-based buffer overflow in BlazeVideo HDTV Player 2.1, and possibly earlier, allows remote attackers to execute arbitrary code via a long filename in a PLF playlist, a different product than CVE-2006-6199.  NOTE: it was later reported that 3.5 is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/23192; http://www.securityfocus.com/bid/21399; http://www.securityfocus.com/bid/30442
CVE: CVE-2006-6397
Published: 2006-12-08
Description: Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner.  NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is not a vulnerability
CVSS Score: 4.4 (MEDIUM)
References: http://www.securityfocus.com/archive/1/452322/100/200/threaded; http://www.securityfocus.com/archive/1/452330/100/200/threaded; http://www.securityfocus.com/archive/1/452374/100/200/threaded
CVE: CVE-2006-6398
Published: 2006-12-08
Description: Multiple SQL injection vulnerabilities in Superfreaker Studios UPublisher 1.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors in (a) sendarticle.asp and (b) printarticle.asp, and the ID parameter to (c) index.asp and (d) preferences.asp, different vectors than CVE-2006-5888.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22840; http://www.securityfocus.com/archive/1/453462/100/0/threaded; http://secunia.com/advisories/22840
CVE: CVE-2006-6399
Published: 2006-12-08
Description: SQL injection vulnerability in Superfreaker Studios UPublisher 1.0 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22840; http://secunia.com/advisories/22840
CVE: CVE-2006-5874
Published: 2006-12-10
Description: Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a null pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23327; http://secunia.com/advisories/23362; http://secunia.com/advisories/23411
CVE: CVE-2006-6221
Published: 2006-12-10
Description: 2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23248; http://securityreason.com/securityalert/2012; http://securitytracker.com/id?1017350
CVE: CVE-2006-6400
Published: 2006-12-10
Description: Buffer overflow in JustSystems Hanako 2004 through 2006, Hanako viewer 1.x, Ichitaro 2004, Ichitaro 2005, Ichitaro Lite2, Ichitaro viewer 4.x, and Sanshiro 2005 allows remote attackers to execute arbitrary code via the (1) Keyword and (2) Title fields, related to string length fields.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/23185; http://securitytracker.com/id?1017336
CVE: CVE-2006-6401
Published: 2006-12-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in mystats.php in MyStats 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) connexion, (2) by, and (3) details parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2988&w=2; http://secunia.com/advisories/22813; http://securitytracker.com/id?1017210
CVE: CVE-2006-6402
Published: 2006-12-10
Description: SQL injection vulnerability in mystats.php in MyStats 1.0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the details parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2988&w=2; http://secunia.com/advisories/22813; http://securitytracker.com/id?1017210
CVE: CVE-2006-6403
Published: 2006-12-10
Description: mystats.php in MyStats 1.0.8 and earlier allows remote attackers to obtain the installation path via (1) details and (2) by array parameters, probably resulting in a path disclosure in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2988&w=2; http://securitytracker.com/id?1017210; https://exchange.xforce.ibmcloud.com/vulnerabilities/30213
CVE: CVE-2006-6405
Published: 2006-12-10
Description: BitDefender Mail Protection for SMB 2.0 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
CVSS Score: 5.0 (MEDIUM)
References: http://www.quantenblog.net/security/virus-scanner-bypass; http://www.securityfocus.com/archive/1/453654/100/0/threaded; http://www.securityfocus.com/bid/21461
CVE: CVE-2006-6406
Published: 2006-12-10
Description: Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
CVSS Score: 5.0 (MEDIUM)
References: http://kolab.org/security/kolab-vendor-notice-14.txt; http://secunia.com/advisories/23362; http://secunia.com/advisories/23379
CVE: CVE-2006-6407
Published: 2006-12-10
Description: F-Prot Antivirus for Linux x86 Mail Servers 4.6.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
CVSS Score: 5.0 (MEDIUM)
References: http://www.quantenblog.net/security/virus-scanner-bypass; http://www.securityfocus.com/archive/1/453654/100/0/threaded; http://www.securityfocus.com/bid/21461
CVE: CVE-2006-6408
Published: 2006-12-10
Description: Kaspersky Anti-Virus for Linux Mail Servers 5.5.10 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
CVSS Score: 5.0 (MEDIUM)
References: http://www.quantenblog.net/security/virus-scanner-bypass; http://www.securityfocus.com/archive/1/453654/100/0/threaded; http://www.securityfocus.com/bid/21461
CVE: CVE-2006-6409
Published: 2006-12-10
Description: F-Secure Anti-Virus for Linux Gateways 4.65 allows remote attackers to cause a denial of service (possibly fatal scan error), and possibly bypass virus detection, by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
CVSS Score: 10.0 (HIGH)
References: http://www.quantenblog.net/security/virus-scanner-bypass; http://www.securityfocus.com/archive/1/453654/100/0/threaded; http://www.securityfocus.com/bid/21461
CVE: CVE-2006-6410
Published: 2006-12-10
Description: Buffer overflow in an ActiveX control in VMWare 5.5.1 allows local users to execute arbitrary code via a long VmdbDb parameter to the Initialize function.
CVSS Score: 4.6 (MEDIUM)
References: http://securityreason.com/securityalert/2008; http://www.open-security.org/advisories/17; http://www.securityfocus.com/archive/1/452746/100/100/threaded
CVE: CVE-2006-6411
Published: 2006-12-10
Description: PhoneCtrl.exe in Linksys WIP 330 Wireless-G IP Phone 1.00.06A allows remote attackers to cause a denial of service (crash) via a TCP SYN scan, as demonstrated using TCP ports 1-65535 with nmap.
CVSS Score: 7.8 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051140.html; http://secunia.com/advisories/23256; http://securityreason.com/securityalert/2009
CVE: CVE-2006-6332
Published: 2006-12-10
Description: Stack-based buffer overflow in net80211/ieee80211_wireless.c in MadWifi before 0.9.2.1 allows remote attackers to execute arbitrary code via unspecified vectors, related to the encode_ie and giwscan_cb functions.
CVSS Score: 7.5 (HIGH)
References: http://lists.immunitysec.com/pipermail/dailydave/2006-December/003888.html; http://madwifi.org/changeset/1842; http://madwifi.org/wiki/news/20061207/release-0-9-2-1-fixes-critical-security-issue
CVE: CVE-2006-6413
Published: 2006-12-10
Description: Cross-site scripting (XSS) vulnerability in Amateras sns 3.11 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://amateras.sourceforge.jp/cgi-bin/fswiki/wiki.cgi?page=sns; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/23257
CVE: CVE-2006-6414
Published: 2006-12-10
Description: Multiple SQL injection vulnerabilities in dettaglio.asp in dol storye allow remote attackers to execute arbitrary SQL commands via the (1) id_doc or (2) id_aut parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21463; http://www.securityfocus.com/bid/21463
CVE: CVE-2006-6415
Published: 2006-12-10
Description: PHP remote file inclusion vulnerability in admin/lib-maintenance.inc.php in phpAdsNew 2.0.4-pr2 allows remote attackers to execute arbitrary PHP code via a URL in the phpAds_path parameter, a different component than CVE-2006-3984.  NOTE: this issue is disputed by CVE, since phpAds_path is used as a constant
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2006-December/001171.html; http://www.securityfocus.com/archive/1/453773/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30774
CVE: CVE-2006-6416
Published: 2006-12-10
Description: Multiple PHP remote file inclusion vulnerabilities in PhpLeague - Univert PhpLeague 0.81 allow remote attackers to execute arbitrary PHP code via a URL in the cheminmini parameter to (1) consult/miniseul.php or (2) config.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23342; http://www.securityfocus.com/bid/20756; https://exchange.xforce.ibmcloud.com/vulnerabilities/29819
CVE: CVE-2006-6417
Published: 2006-12-10
Description: PHP remote file inclusion vulnerability in inc/CONTROL/import/import-mt.php in b2evolution 1.8.5 through 1.9 beta allows remote attackers to execute arbitrary PHP code via a URL in the inc_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23346; http://securityreason.com/securityalert/2006; http://www.securityfocus.com/archive/1/452998/100/100/threaded
CVE: CVE-2006-6418
Published: 2006-12-10
Description: Buffer overflow in the POSIX Threads library (libpthread) on HP Tru64 UNIX 4.0F PK8, 4.0G PK4, and 5.1A PK6 allows local users to gain root privileges via a long PTHREAD_CONFIG environment variable.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/22743; http://securitytracker.com/id?1017211; http://www.netragard.com/pdfs/research/HP-TRU64-LIBPTHREAD-20060811.txt
CVE: CVE-2006-6419
Published: 2006-12-10
Description: jce.php in the JCE Admin Component in Ryan Demmer Joomla Content Editor (JCE) 1.1.0 beta 2 and earlier for Joomla! (com_jce) allows remote attackers to include and possibly execute arbitrary local files via the (1) plugin or (2) file parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23160; http://www.securityfocus.com/bid/21491; http://www.vupen.com/english/advisories/2006/4903
CVE: CVE-2006-6420
Published: 2006-12-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in jce.php in the JCE Admin Component in Ryan Demmer Joomla Content Editor (JCE) 1.1.0 beta 2 and earlier for Joomla! (com_jce) allow remote attackers to inject arbitrary web script or HTML via the (1) img, (2) title, (3) w, or (4) h parameter, different vectors than CVE-2006-6166.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23160; http://www.securityfocus.com/bid/21496; http://www.vupen.com/english/advisories/2006/4903
CVE: CVE-2006-6421
Published: 2006-12-10
Description: Cross-site scripting (XSS) vulnerability in the private message box implementation (privmsg.php) in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/23283; http://securityreason.com/securityalert/2005; http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=489624
CVE: CVE-2006-6422
Published: 2006-12-10
Description: Agileco AgileBill 1.4.x and AgileVoice 1.4.x do not properly handle certain proxy requests, which allows remote attackers to disable the application by entering invalid license data on a form, possibly involving modules/core/license.inc.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23223; http://www.securityfocus.com/bid/21459; https://exchange.xforce.ibmcloud.com/vulnerabilities/30751
CVE: CVE-2006-6426
Published: 2006-12-10
Description: PHP remote file inclusion vulnerability in design/thinkedit/render.php in ThinkEdit 1.9.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the template_file parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23279; http://securitytracker.com/id?1017359; http://svn.berlios.de/viewcvs/thinkedit/trunk/design/thinkedit/render.php?rev=321&r1=230&r2=321
CVE: CVE-2006-6427
Published: 2006-12-10
Description: The Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows remote attackers to execute arbitrary commands via unspecified vectors involving "command injection" in (1) the TCP/IP hostname, (2) Scan-to-mailbox folder names, and (3) certain parameters in the Microsoft Networking configuration.  NOTE: vector 1 might be the same as CVE-2006-5290.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://secunia.com/advisories/23265; http://securitytracker.com/id?1017337; http://www.securityfocus.com/bid/21365
CVE: CVE-2006-6428
Published: 2006-12-10
Description: Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allow remote attackers to gain access via unspecified vectors related to "browser permissions."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23265; http://www.securityfocus.com/bid/21365; http://www.vupen.com/english/advisories/2006/4791
CVE: CVE-2006-6429
Published: 2006-12-10
Description: Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows attackers to modify certain configuration settings via unspecified vectors involving the "TFTP/BOOTP auto configuration option."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23265; http://www.securityfocus.com/bid/21365; http://www.vupen.com/english/advisories/2006/4791
CVE: CVE-2006-6430
Published: 2006-12-10
Description: Web services in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 do not require HTTPS, which allows remote attackers to obtain sensitive information by sniffing the unencrypted HTTP traffic.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/23265; http://www.securityfocus.com/bid/21365; http://www.vupen.com/english/advisories/2006/4791
CVE: CVE-2006-6431
Published: 2006-12-10
Description: Unspecified vulnerability in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows attackers to modify signatures of e-mail messages via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23265; http://www.vupen.com/english/advisories/2006/4791; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_006_v1b.pdf
CVE: CVE-2006-6432
Published: 2006-12-10
Description: Unspecified vulnerability in the Scan-to-mailbox feature in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows remote attackers to download certain files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23265; http://www.securityfocus.com/bid/21365; http://www.vupen.com/english/advisories/2006/4791
CVE: CVE-2006-6433
Published: 2006-12-10
Description: Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 does not record accurate timestamps, which makes it easier for remote attackers to avoid detection when an audit tries to rely on these timestamps.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23265; http://www.vupen.com/english/advisories/2006/4791; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_006_v1b.pdf
CVE: CVE-2006-6434
Published: 2006-12-10
Description: Unspecified vulnerability in the Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to bypass authentication controls via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6435
Published: 2006-12-10
Description: The SNMP implementation in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 does not generate authentication failure traps, which allows remote attackers to more easily gain system access and obtain sensitive information via a brute force attack.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6436
Published: 2006-12-10
Description: Cross-site scripting (XSS) vulnerability in the Network controller in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to inject arbitrary web script or HTML via HTTP TRACE messages.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6437
Published: 2006-12-10
Description: ops3-dmn in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows attackers to cause a denial of service (application crash and core dump) via a certain PS file.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6438
Published: 2006-12-10
Description: Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 leaves sensitive user data in http.log after an Immediate Image Overwrite (IIO), which allows local users to obtain the data by reading the http.log file.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6439
Published: 2006-12-10
Description: Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to download the audit log and obtain potentially sensitive information via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6440
Published: 2006-12-10
Description: Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allow remote attackers to have an unspecified impact via unspecified vectors relating to "HTTP Security issues."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6441
Published: 2006-12-10
Description: Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows local users to bypass security controls and boot Alchemy via certain alternate boot media, as demonstrated by a USB thumb drive.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6442
Published: 2006-12-10
Description: Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control (cddbcontrol.dll), as used in America Online (AOL) 7.0 4114.563, 8.0 4129.230, and 9.0 Security Edition 4156.910, and possibly other products, allows remote attackers to execute arbitrary code via a long ClientId argument.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://attrition.org/pipermail/vim/2006-December/001173.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051230.html; http://secunia.com/advisories/23043
CVE: CVE-2006-6379
Published: 2006-12-10
Description: Buffer overflow in the BrightStor Backup Discovery Service in multiple CA products, including ARCserve Backup r11.5 SP1 and earlier, ARCserve Backup 9.01 up to 11.1, Enterprise Backup 10.5, and CA Server Protection Suite r2, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2010; http://securitytracker.com/id?1017356; http://supportconnectw.ca.com/public/storage/infodocs/babsecurity-notice.asp
CVE: CVE-2006-6383
Published: 2006-12-10
Description: PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://cvs.php.net/viewcvs.cgi/php-src/ext/session/session.c?r1=1.336.2.53.2.7&r2=1.336.2.53.2.8; http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html; http://secunia.com/advisories/24022
CVE: CVE-2006-6443
Published: 2006-12-10
Description: Buffer overflow in the Novell Distributed Print Services (NDPS) Print Provider for Windows component (NDPPNT.DLL) in Novell Client 4.91 has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23271; http://support.novell.com/docs/Readmes/InfoDocument/2974843.html; http://www.securityfocus.com/bid/21479