deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-5519
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in Savant2/Savant2_Plugin_options.php in the MambWeather 1.8.1 and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/22521; http://www.securityfocus.com/bid/20667; http://www.vupen.com/english/advisories/2006/4150
CVE: CVE-2006-5520
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in functions.php in DeltaScripts PHP Classifieds 7.1 allows remote attackers to execute arbitrary PHP code via a URL in the set_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1778; http://www.securityfocus.com/archive/1/449295/100/0/threaded; http://www.securityfocus.com/bid/20649
CVE: CVE-2006-5521
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in DNS/RR.php in Net_DNS 0.03 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpdns_basedir parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22522; http://www.securityfocus.com/bid/20666; http://www.vupen.com/english/advisories/2006/4185
CVE: CVE-2006-5522
Published: 2006-10-26
Description: Multiple PHP remote file inclusion vulnerabilities in Johannes Erdfelt Kawf 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config parameter in (1) main.php or (2) user/account/main.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20659; https://exchange.xforce.ibmcloud.com/vulnerabilities/29709; https://www.exploit-db.com/exploits/2607
CVE: CVE-2006-5523
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in common.php in EZ-Ticket 0.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the ezt_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://arfis.wordpress.com/2007/09/14/rfi-02-ez-ticket/; http://www.securityfocus.com/bid/20669; https://exchange.xforce.ibmcloud.com/vulnerabilities/29702
CVE: CVE-2006-5524
Published: 2006-10-26
Description: Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter.  NOTE: This issue might overlap CVE-2006-5321.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22431; http://securityreason.com/securityalert/1779; http://securitytracker.com/alerts/2006/Oct/1017102.html
CVE: CVE-2006-5525
Published: 2006-10-26
Description: Incomplete blacklist vulnerability in mainfile.php in PHP-Nuke 7.9 and earlier allows remote attackers to conduct SQL injection attacks via (1) "/**/UNION " or (2) " UNION/**/" sequences, which are not rejected by the protection mechanism, as demonstrated by a SQL injection via the eid parameter in a search action in the Encyclopedia module in modules.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22511; http://www.neosecurityteam.net/index.php?action=advisories&id=27; http://www.securityfocus.com/bid/20674
CVE: CVE-2006-5526
Published: 2006-10-26
Description: Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing, as modified in Fully Modded phpBB (phpbbfm) 2021.4.40 and earlier, allow remote attackers to execute arbitrary PHP code via a URL in the foing_root_path parameter in (a) faq.php, (b) index.php, (c) list.php, (d) login.php, (e) playlist.php, (f) song.php, (g) gen_m3u.php, (h) view_artist.php, (i) view_song.php, (j) flash/set_na.php, (k) flash/initialise.php, (l) flash/get_song.php, (m) includes/common.php, (n) admin/nav.php, (o) admin/main.php, (p) admin/list_artists.php, (q) admin/index.php, (r) admin/genres.php, (s) admin/edit_artist.php, (t) admin/edit_album.php, (u) admin/config.php, and (v) admin/admin_status.php in player/, different vectors than CVE-2006-3045.  NOTE: CVE analysis as of 20061026 indicates that files in the admin/ and flash/ directories define foing_root_path before use.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22499; http://www.osvdb.org/30035; http://www.vupen.com/english/advisories/2006/4165
CVE: CVE-2006-5527
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in lib.editor.inc.php in Intelimen InteliEditor 1.2.x allows remote attackers to execute arbitrary PHP code via a URL in the sys_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22428; http://securityreason.com/securityalert/1785; http://securitytracker.com/id?1017117
CVE: CVE-2006-5528
Published: 2006-10-26
Description: Directory traversal vulnerability in mod.php in SchoolAlumni Portal 2.26 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1017105; http://www.securityfocus.com/bid/20673; http://securitytracker.com/id?1017105
CVE: CVE-2006-5529
Published: 2006-10-26
Description: Cross-site scripting (XSS) vulnerability in smumdadotcom_ascyb_alumni/mod.php in SchoolAlumni Portal 2.26 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search operation in the katalog module.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
References: http://securitytracker.com/id?1017105; http://www.securityfocus.com/bid/20673; http://securitytracker.com/id?1017105
CVE: CVE-2006-5530
Published: 2006-10-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Boesch SimpNews before 2.34.01 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) admin/index.php, (2) admin/pwlost.php, and unspecified other files.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/22535; http://www.boesch-it.de/sw/php-scripts/simpnews/english/index.php; http://www.securityfocus.com/bid/20714
CVE: CVE-2006-5531
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in embedded.php in Ascended Guestbook 1.0.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[path] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22554; http://www.securityfocus.com/bid/20710; http://www.vupen.com/english/advisories/2006/4187
CVE: CVE-2006-5532
Published: 2006-10-26
Description: Cross-site scripting (XSS) vulnerability in rmgs/images.php in RMSOFT Gallery System 2.0 allows remote attackers to inject arbitrary web script or HTML via the kw parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22426; http://securitytracker.com/id?1017112; http://www.securityfocus.com/archive/1/449458/100/0/threaded
CVE: CVE-2006-5533
Published: 2006-10-26
Description: Multiple PHP remote file inclusion vulnerabilities in AROUNDMe 0.6.9, and possibly earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the templatePath parameter in template/barnraiser_01/pol_view.tpl.php and other unspecified PHP scripts, a different vector than CVE-2006-5401.
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9515&w=2; http://securityreason.com/securityalert/1786; http://securitytracker.com/id?1017106
CVE: CVE-2006-5534
Published: 2006-10-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.htm in Zwahlen Online Shop Freeware 5.2.2.50, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) cat, (2) Kat, (3) id, or (4) no parameters. NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://attrition.org/pipermail/vim/2006-November/001106.html; http://secunia.com/advisories/22571; http://www.osvdb.org/30016
CVE: CVE-2006-5535
Published: 2006-10-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebHostManager (WHM) 10.8.0 cPanel 10.9.0 R50 allow remote attackers to inject arbitrary web script or HTML via the (1) theme parameter to scripts/dosetmytheme and the (2) template parameter to scripts2/editzonetemplate.
CVSS Score: 4.3 (MEDIUM)
References: http://changelog.cpanel.net/; http://secunia.com/advisories/22555; http://securityreason.com/securityalert/1780
CVE: CVE-2006-5536
Published: 2006-10-26
Description: Directory traversal vulnerability in cgi-bin/webcm in D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allows remote attackers to read arbitrary files via a .. (dot dot) in the getpage parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22524; http://securityreason.com/securityalert/1781; http://www.eazel.es/advisory005-D-Link-DSL-G624T-directoy-transversal-xss-cross-site-scripting-directory-listing-vulnerabilities.html
CVE: CVE-2006-5537
Published: 2006-10-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/webcm in D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allow remote attackers to inject arbitrary web script or HTML via the (1) upnp:settings/state or (2) upnp:settings/connection parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/22524; http://securityreason.com/securityalert/1781; http://www.eazel.es/advisory005-D-Link-DSL-G624T-directoy-transversal-xss-cross-site-scripting-directory-listing-vulnerabilities.html
CVE: CVE-2006-5538
Published: 2006-10-26
Description: D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allows remote attackers to list contents of the cgi-bin directory via unspecified vectors, probably a direct request.
CVSS Score: 5.0 (MEDIUM)
References: http://www.eazel.es/advisory005-D-Link-DSL-G624T-directoy-transversal-xss-cross-site-scripting-directory-listing-vulnerabilities.html; http://www.securityfocus.com/archive/1/449486/100/0/threaded; http://www.eazel.es/advisory005-D-Link-DSL-G624T-directoy-transversal-xss-cross-site-scripting-directory-listing-vulnerabilities.html
CVE: CVE-2006-5539
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in login/secure.php in UeberProject Management System 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfg[homepath] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22565; http://www.osvdb.org/30015; http://www.securityfocus.com/bid/20719
CVE: CVE-2006-5540
Published: 2006-10-26
Description: backend/parser/analyze.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via certain aggregate functions in an UPDATE statement, which are not properly handled during a "MIN/MAX index optimization."
CVSS Score: 4.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://projects.commandprompt.com/public/pgsql/changeset/25504; http://secunia.com/advisories/22562
CVE: CVE-2006-5541
Published: 2006-10-26
Description: backend/parser/parse_coerce.c in PostgreSQL 7.4.1 through 7.4.14, 8.0.x before 8.0.9, and 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via a coercion of an unknown element to ANYARRAY.
CVSS Score: 4.0 (MEDIUM)
References: http://projects.commandprompt.com/public/pgsql/changeset/26457; http://secunia.com/advisories/22562; http://secunia.com/advisories/22584
CVE: CVE-2006-5542
Published: 2006-10-26
Description: backend/tcop/postgres.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) related to duration logging of V3-protocol Execute messages for (1) COMMIT and (2) ROLLBACK SQL statements.
CVSS Score: 4.0 (MEDIUM)
References: http://projects.commandprompt.com/public/pgsql/changeset/25953; http://secunia.com/advisories/22562; http://secunia.com/advisories/22584
CVE: CVE-2006-5543
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in misc/function.php3 in PHP Generator of Object SQL Database (PGOSD), when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/1783; http://www.attrition.org/pipermail/vim/2006-October/001097.html; http://www.securityfocus.com/archive/1/449475/100/0/threaded
CVE: CVE-2006-5544
Published: 2006-10-26
Description: Visual truncation vulnerability in Microsoft Internet Explorer 7 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a malicious URL containing non-breaking spaces (%A0), which causes the address bar to omit some characters from the URL.
CVSS Score: 6.4 (MEDIUM)
References: http://blogs.technet.com/msrc/archive/2006/10/26/ie-address-bar-issue.aspx; http://secunia.com/advisories/22542; http://secunia.com/internet_explorer_7_popup_address_bar_spoofing_test/
CVE: CVE-2006-5545
Published: 2006-10-26
Description: Premium Antispam in Symantec Mail Security for Domino Server 5.1.x before 5.1.2.28 does not filter certain SMTP address formats, which allows remote attackers to use the product as a spam relay.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22490; http://securityresponse.symantec.com/avcenter/security/Content/2006.10.19.html; http://securitytracker.com/id?1017094
CVE: CVE-2006-5546
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 1.3.0 through 1.4.1 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config][otscms][directories][classes] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-October/001096.html; http://secunia.com/advisories/22577; http://www.securityfocus.com/bid/20694
CVE: CVE-2006-5547
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 1.0.0 through 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config][otscms][directories][includes] parameter.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2006-October/001096.html; http://secunia.com/advisories/22577; http://www.securityfocus.com/bid/20694
CVE: CVE-2006-5548
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 2.0.0 through 2.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config][directories][classes] parameter.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2006-October/001096.html; http://secunia.com/advisories/22548; http://www.securityfocus.com/bid/20694
CVE: CVE-2006-5549
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in libraries/amfphp/amf-core/custom/CachedGateway.php in Adobe PHP SDK allows remote attackers to execute arbitrary PHP code via the AMFPHP_BASE parameter.  NOTE: this issue has been disputed by a third-party researcher who states that AMFPHP_BASE is a constant
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1784; http://www.securityfocus.com/archive/1/449576/100/0/threaded; http://www.securityfocus.com/archive/1/449616/100/0/threaded
CVE: CVE-2006-5550
Published: 2006-10-26
Description: The kernel in FreeBSD 6.1 and OpenBSD 4.0 allows local users to cause a denial of service via unspecified vectors involving certain ioctl requests to /dev/crypto.
CVSS Score: 4.9 (MEDIUM)
References: http://elegerov.blogspot.com/2006/10/here-is-lame-proof-of-concept-code-for.html; http://secunia.com/advisories/22543; http://www.securityfocus.com/bid/20713
CVE: CVE-2006-5551
Published: 2006-10-26
Description: Stack-based buffer overflow in QK SMTP 3.01 and earlier might allow remote attackers to execute arbitrary code via a long argument to the RCPT TO command.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22563; http://securitytracker.com/id?1017114; http://www.securityfocus.com/bid/20681
CVE: CVE-2006-5552
Published: 2006-10-26
Description: Multiple heap-based buffer overflows in RevilloC MailServer 1.21 and earlier allow remote attackers to cause a denial of service (CPU consumption or application crash) or execute arbitrary code via a long argument to the (1) MAIL FROM or (2) RCPT TO command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/22559; http://www.securityfocus.com/bid/20709; http://www.vupen.com/english/advisories/2006/4181
CVE: CVE-2006-5553
Published: 2006-10-26
Description: Cisco Security Agent (CSA) for Linux 4.5 before 4.5.1.657 and 5.0 before 5.0.0.193, as used by Unified CallManager (CUCM) and Unified Presence Server (CUPS), allows remote attackers to cause a denial of service (resource consumption) via a port scan with certain options.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/22574; http://securitytracker.com/id?1017118; http://www.cisco.com/en/US/products/products_security_advisory09186a00807693c7.shtml
CVE: CVE-2006-5554
Published: 2006-10-26
Description: Directory traversal vulnerability in index.php in Imageview 5 allows remote attackers to read or execute arbitrary local files via a .. (dot dot) in the user_settings cookie, as demonstrated by using the MyFile parameter in albumview.php to upload a text/plain .gif file containing PHP code, which is executed by index.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22552; http://www.securityfocus.com/bid/20731; http://www.vupen.com/english/advisories/2006/4188
CVE: CVE-2006-5555
Published: 2006-10-26
Description: PHP remote file inclusion vulnerability in constantes.inc.php in EPNadmin 0.7 and 0.7.1 allows remote attackers to execute arbitrary PHP code via the langage parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22508; http://www.attrition.org/pipermail/vim/2006-October/001098.html; http://www.securityfocus.com/bid/20624
CVE: CVE-2006-5556
Published: 2006-10-27
Description: Buffer overflow in the localtime_r function, and certain other functions, in libc in HP-UX B.11.11 and possibly other versions allows local users to execute arbitrary code via a long TZ environment variable.
CVSS Score: 4.6 (MEDIUM)
References: http://blogs.23.nu/prdelka/stories/13144/; http://www.securityfocus.com/bid/20718; https://exchange.xforce.ibmcloud.com/vulnerabilities/29777
CVE: CVE-2006-5557
Published: 2006-10-27
Description: Stack-based buffer overflow in the (1) swpackage and (2) swmodify commands in HP-UX B.11.11 and possibly other versions allows local users to execute arbitrary code via a long -S argument.  NOTE: this might be a duplicate of CVE-2006-2574, but the details relating to CVE-2006-2574 are too vague to be certain.
CVSS Score: 4.6 (MEDIUM)
References: http://blogs.23.nu/prdelka/stories/13144/; http://osvdb.org/33993; http://osvdb.org/33994
CVE: CVE-2006-5558
Published: 2006-10-27
Description: Format string vulnerability in the swask command in HP-UX B.11.11 and possibly other versions allows local users to execute arbitrary code via format string specifiers in the -s argument.  NOTE: this might be a duplicate of CVE-2006-2574, but the details relating to CVE-2006-2574 are too vague to be certain.
CVSS Score: 10.0 (HIGH)
References: http://blogs.23.nu/prdelka/stories/13144/; http://www.securityfocus.com/bid/20726; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5804
CVE: CVE-2006-5559
Published: 2006-10-27
Description: The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR, which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://blogs.technet.com/msrc/archive/2006/10/27/adodb-connection-poc-published.aspx; http://research.eeye.com/html/alerts/zeroday/20061027.html; http://secunia.com/advisories/22452
CVE: CVE-2006-5560
Published: 2006-10-27
Description: Cross-site scripting (XSS) vulnerability in heading.php in Boesch ProgSys 0.151 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php, and unspecified vectors related to certain other files.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/22532; http://securityreason.com/securityalert/1782; http://www.securityfocus.com/archive/1/449571/100/0/threaded
CVE: CVE-2006-5561
Published: 2006-10-27
Description: SQL injection vulnerability in admincp.php in Discuz! GBK 5.0.0 allows remote attackers to execute arbitrary SQL commands via the cdb_auth cookie.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22534; http://www.securityfocus.com/bid/20734; http://www.vupen.com/english/advisories/2006/4210
CVE: CVE-2006-5562
Published: 2006-10-27
Description: PHP remote file inclusion vulnerability in include/database.php in SourceForge (aka alexandria) 1.0.4 allows remote attackers to execute arbitrary PHP code via the sys_dbtype parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20692; https://exchange.xforce.ibmcloud.com/vulnerabilities/29751; https://www.exploit-db.com/exploits/2623
CVE: CVE-2006-5563
Published: 2006-10-27
Description: Unspecified vulnerability in Yahoo! Messenger (Service 18) before 8.1.0.195 allows remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted room name in a Conference Invite.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0518.html; http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0566.html; http://secunia.com/advisories/22510
CVE: CVE-2006-5564
Published: 2006-10-27
Description: Cross-site scripting (XSS) vulnerability in user.php in MAXdev MD-Pro 1.0.76 allows remote attackers to inject arbitrary web script or HTML via the op parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/22564; http://www.securityfocus.com/bid/20752; http://www.vupen.com/english/advisories/2006/4195
CVE: CVE-2006-5565
Published: 2006-10-27
Description: CRLF injection vulnerability in MAXdev MD-Pro 1.0.76 allows remote attackers to inject arbitrary HTTP headers via a CRLF sequence in the (1) name, (2) file, (3) module, and (4) func parameters in (a) index.php; and the (5) file parameter in (b) modules.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22564; http://www.securityfocus.com/bid/20754; http://www.vupen.com/english/advisories/2006/4195
CVE: CVE-2006-5566
Published: 2006-10-27
Description: CRLF injection vulnerability in premium/index.php in Shop-Script allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the (1) links_exchange, (2) news, (3) search_with_change_category_ability, (4) logging, (5) feedback, (6) show_price, (7) register, (8) answer, (9) productID, and (10) inside parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22541; http://securityreason.com/securityalert/1791; http://www.securityfocus.com/archive/1/449499/100/0/threaded