deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0072
Published: 2006-01-04
Description: Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument.  NOTE: this is probably a different vulnerability than CVE-2005-0351 since it involves a distinct attack vector.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/Openserver_bof.c; http://www.securityfocus.com/archive/1/420677; http://www.securityfocus.com/bid/16122
CVE: CVE-2006-0073
Published: 2006-01-04
Description: Cross-site scripting (XSS) vulnerability in DiscusWare Discus Freeware 3.10.5 and Professional 3.10.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a URL, which is not properly sanitized from the resulting error message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18283; http://www.osvdb.org/22153; http://www.securityfocus.com/bid/16119
CVE: CVE-2006-0074
Published: 2006-01-04
Description: SQL injection vulnerability in profile.php in PHPenpals allows remote attackers to execute arbitrary SQL commands via the personalID parameter.  NOTE: it was later reported that 1.1 and earlier are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://evuln.com/vulns/5/summary.html; http://secunia.com/advisories/18269; http://www.osvdb.org/22150
CVE: CVE-2006-0075
Published: 2006-01-04
Description: Direct static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail field (mail variable) in a new message, which is written to a PHP file.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/6/summary.html; http://secunia.com/advisories/18268; http://www.securityfocus.com/archive/1/420698/100/0/threaded
CVE: CVE-2006-0076
Published: 2006-01-04
Description: PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/3/summary.html; http://securitytracker.com/id?1016211; http://www.securityfocus.com/archive/1/420676/100/0/threaded
CVE: CVE-2006-0077
Published: 2006-01-04
Description: Off-by-one error in the getfattr function in File::ExtAttr before 0.03 allows attackers to trigger a buffer overflow via unspecified attack vectors.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/18253; http://sourceforge.net/project/shownotes.php?release_id=382199&group_id=153116; http://www.osvdb.org/22160
CVE: CVE-2006-0078
Published: 2006-01-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in B-net Software 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) shout variables to (a) shout.php, or the (3) title and (4) message variables to (b) guestbook.php.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/10/summary.html; http://secunia.com/advisories/18271; http://securityreason.com/securityalert/316
CVE: CVE-2006-0079
Published: 2006-01-04
Description: SQL injection vulnerability in auth.php in ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field (adminname variable).
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/11/summary.html; http://secunia.com/advisories/8476; http://securityreason.com/securityalert/318
CVE: CVE-2006-0080
Published: 2006-01-04
Description: Cross-site scripting (XSS) vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by (1) calendar.php and (2) reminder.php.
CVSS Score: 4.3 (MEDIUM)
References: http://kapda.ir/advisory-177.html; http://secunia.com/advisories/18299; http://www.osvdb.org/22210
CVE: CVE-2006-0081
Published: 2006-01-04
Description: ialmnt5.sys in the ialmrnt5 display driver in Intel Graphics Accelerator Driver 6.14.10.4308 allows attackers to cause a denial of service (crash or screen resolution change) via a long text field, as demonstrated using a long window title.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://seclists.org/fulldisclosure/2006/Jan/32; http://seclists.org/fulldisclosure/2006/Jan/8; http://secunia.com/advisories/18286
CVE: CVE-2006-0082
Published: 2006-01-04
Description: Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions, and GraphicsMagick, allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a numeric format string specifier such as %d in the file name, a variant of CVE-2005-0397, and as demonstrated using the convert program.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-134
References: ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345876; http://rhn.redhat.com/errata/RHSA-2006-0178.html
CVE: CVE-2006-0084
Published: 2006-01-05
Description: Cross-site scripting vulnerability in index.php in raSMP 2.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the $_SERVER[HTTP_USER_AGENT] variable (User-Agent header).
CVSS Score: 5.0 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-January/000486.html; http://evuln.com/vulns/13/summary.html; http://secunia.com/advisories/18292
CVE: CVE-2006-0085
Published: 2006-01-05
Description: SQL injection vulnerability in Nkads 1.0 alfa 3 allows remote attackers to execute arbitrary SQL commands via the (1) usuario_nkads_admin or (2) password_nkads_admin parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18302; http://www.osvdb.org/22206; http://www.soulblack.com.ar/repo/papers/advisory/nkads_advisory.txt
CVE: CVE-2006-0086
Published: 2006-01-05
Description: Cross-site scripting vulnerability in index.php in Next Generation Image Gallery 0.0.1 Lite Edition allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/ref/22/22202-nextgen.txt; http://secunia.com/advisories/18309; http://www.osvdb.org/22202
CVE: CVE-2006-0087
Published: 2006-01-05
Description: SQL injection vulnerability in (1) pages.php and (2) detail.php in Lizard Cart CMS 1.04 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18297; http://securityreason.com/securityalert/314; http://securitytracker.com/id?1015435
CVE: CVE-2006-0088
Published: 2006-01-05
Description: SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/8/summary.html; http://www.osvdb.org/22382; http://www.securityfocus.com/archive/1/420672/100/0/threaded
CVE: CVE-2006-0089
Published: 2006-01-05
Description: Buffer overflow in ESRI ArcPad 7.0.0.156 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .amp file with a COORDSYS tag with a long string attribute.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18294; http://users.pandora.be/bratax/advisories/b007.html; http://www.osvdb.org/22208
CVE: CVE-2006-0090
Published: 2006-01-05
Description: Directory traversal vulnerability in index.php in IDV Directory Viewer before 2005.1 allows remote attackers to view arbitrary directory contents via a .. (dot dot) in the dir parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18298; http://sourceforge.net/project/shownotes.php?release_id=382593&group_id=152499; http://www.securityfocus.com/bid/16137
CVE: CVE-2006-0091
Published: 2006-01-05
Description: Cross-site scripting (XSS) vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5679&w=2; http://secunia.com/advisories/18285; http://securitytracker.com/id?1015431
CVE: CVE-2006-0092
Published: 2006-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-0992, CVE-2006-0158.  Reason: this candidate was intended for one issue, but a typo caused it to be associated with a Novell/Groupwise issue.  In addition, this issue was a duplicate of a SiteSuite issue that was also assigned CVE-2006-0158.  Notes: All CVE users should consult CVE-2006-0992 and CVE-2006-0158 to determine which ID is appropriate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-0093
Published: 2006-01-05
Description: Cross-site scripting (XSS) vulnerability in index.php in @Card ME PHP allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/22/22203-ecardmax.txt; http://secunia.com/advisories/18306; http://www.osvdb.org/22203
CVE: CVE-2006-0094
Published: 2006-01-05
Description: PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_stat parameter, a different vulnerability than CVE-2006-0076. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/17373; http://www.vupen.com/english/advisories/2006/0028; http://secunia.com/advisories/17373
CVE: CVE-2006-0063
Published: 2006-01-05
Description: Cross-site scripting (XSS) vulnerability in phpBB 2.0.19, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary web script or HTML via a permitted HTML tag with ' (single quote) characters and active attributes such as onmouseover, a variant of CVE-2005-4357.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/achievement_securityalert/30; http://securityreason.com/securityalert/313; http://www.osvdb.org/22672
CVE: CVE-2006-0341
Published: 2006-01-06
Description: Cross-site scripting (XSS) vulnerability in WCONSOLE.DLL in Rockliffe MailSite 5.x and 6.1.22 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2043&w=2; http://secunia.com/advisories/18551; http://www.osvdb.org/22677
CVE: CVE-2006-0095
Published: 2006-01-06
Description: dm-crypt in Linux kernel 2.6.15 and earlier does not clear a structure before it is freed, which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]2572&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]2886&w=2; http://secunia.com/advisories/18487
CVE: CVE-2006-0096
Published: 2006-01-06
Description: wan/sdla.c in Linux kernel 2.6.x before 2.6.11 and 2.4.x before 2.4.29 does not require the CAP_SYS_RAWIO privilege for an SDLA firmware upgrade, with unknown impact and local attack vectors.  NOTE: further investigation suggests that this issue requires root privileges to exploit, since it is protected by CAP_NET_ADMIN; thus it might not be a vulnerability, although capabilities provide finer distinctions between privilege levels.
CVSS Score: 7.2 (HIGH)
References: http://linux.bkbits.net:8080/linux-2.4/cset%401.1448.91.23?nav=index.html%7Csrc/%7Csrc/drivers%7Csrc/drivers/net%7Csrc/drivers/net/wan%7Crelated/drivers/net/wan/sdla.c; http://secunia.com/advisories/18527; http://secunia.com/advisories/18977
CVE: CVE-2006-0097
Published: 2006-01-06
Description: Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the host argument to the mysql_connect function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0274.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041013.html; http://secunia.com/advisories/18275
CVE: CVE-2006-0098
Published: 2006-01-06
Description: The dupfdopen function in sys/kern/kern_descrip.c in OpenBSD 3.7 and 3.8 allows local users to re-open arbitrary files by using setuid programs to access file descriptors using /dev/fd/.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/008_fd.patch; http://secunia.com/advisories/18296; http://securitytracker.com/id?1015437
CVE: CVE-2006-0099
Published: 2006-01-06
Description: PHP remote file include vulnerability in (1) include/templates/categories/default.php and (2) certain other include/templates/categories/ PHP scripts in Valdersoft Shopping Cart 3.0 allows remote attackers to execute arbitrary code via a URL in the catalogDocumentRoot parameter.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/cijfer-vscxpl.pl; http://www.securityfocus.com/bid/16126; https://www.exploit-db.com/exploits/1401
CVE: CVE-2006-0100
Published: 2006-01-06
Description: Buffer overflow in NicoFTP 3.0.1.19 and earlier might allow local users to execute arbitrary code via a long string in the "Name of site" field of an FTP account.  NOTE: because this program executes with the privileges of the invoking user, and because remote programs do not normally have the ability to create or modify FTP accounts in this program, there may not be a typical attack vector for the issue that crosses privilege boundaries.  Therefore this may not be a vulnerability.
CVSS Score: 4.6 (MEDIUM)
References: http://securityreason.com/securityalert/317; http://www.securityfocus.com/archive/1/420670/100/0/threaded; http://securityreason.com/securityalert/317
CVE: CVE-2006-0101
Published: 2006-01-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in sBLOG 0.7.1 Beta 20051202 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p and (2) keyword parameters in (a) index.php and (b) search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/ref/22/22373-sblog.txt; http://www.osvdb.org/22373; http://www.osvdb.org/22374
CVE: CVE-2006-0102
Published: 2006-01-06
Description: Cross-site scripting (XSS) vulnerability in TinyPHPForum (TPF) 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "[a]" bbcode tag, possibly the txt parameter to action.php.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/14/summary.html; http://secunia.com/advisories/18293; http://securityreason.com/securityalert/320
CVE: CVE-2006-0103
Published: 2006-01-06
Description: TinyPHPForum 3.6 and earlier stores the (1) users/[USERNAME].hash and (2) users/[USERNAME].email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://evuln.com/vulns/14/summary.html; http://secunia.com/advisories/18293; http://securityreason.com/securityalert/320
CVE: CVE-2006-0104
Published: 2006-01-06
Description: Directory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. (dot dot) in the uname parameter to profile.php.
CVSS Score: 5.0 (MEDIUM)
References: http://evuln.com/vulns/14/exploit.html; http://evuln.com/vulns/14/summary.html; http://secunia.com/advisories/18293
CVE: CVE-2006-0106
Published: 2006-01-06
Description: gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile (WMF) files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346197; http://lists.immunitysec.com/pipermail/dailydave/2006-January/002806.html; http://secunia.com/advisories/18323
CVE: CVE-2006-0107
Published: 2006-01-07
Description: SQL injection vulnerability in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the viewID parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  Due to the unavailability of the original source, it cannot be determined if this is the same issue as identified by CVE-2006-0108.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18324; http://www.osvdb.org/22252; http://www.securityfocus.com/bid/16159
CVE: CVE-2006-0108
Published: 2006-01-07
Description: SQL injection vulnerability in mcl_login.asp in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the email parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  Due to the unavailability of the original source, it cannot be determined if this is the same issue as identified by CVE-2006-0107.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/22252; http://www.osvdb.org/22253; http://www.vupen.com/english/advisories/2006/0078
CVE: CVE-2006-0109
Published: 2006-01-07
Description: Cross-site scripting vulnerability in category.php in Modular Merchant Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-February/000548.html; http://osvdb.org/ref/22/22243-modular.txt; http://secunia.com/advisories/18320
CVE: CVE-2006-0110
Published: 2006-01-07
Description: Cross-site scripting (XSS) vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to inject arbitrary web script via the email parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/16/summary.html; http://secunia.com/advisories/18327; http://www.osvdb.org/22263
CVE: CVE-2006-0111
Published: 2006-01-07
Description: Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the (1) parent or (2) pg parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/ref/22/22360-boxcar.txt; http://www.osvdb.org/22360; http://www.vupen.com/english/advisories/2006/0080
CVE: CVE-2006-0112
Published: 2006-01-07
Description: Cross-site scripting (XSS) vulnerability in index.php in Enhanced Simple PHP Gallery 1.7 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/22/22201-espg.txt; http://secunia.com/advisories/18310; http://www.osvdb.org/22201
CVE: CVE-2006-0113
Published: 2006-01-07
Description: Enhanced Simple PHP Gallery 1.7 allows remote attackers to obtain the full path of the application via a direct request to sp_helper_functions.php, which leaks the pathname in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/ref/22/22201-espg.txt; http://secunia.com/advisories/18310; http://www.osvdb.org/22417
CVE: CVE-2006-0114
Published: 2006-01-09
Description: The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contact_id parameter to index2.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://forge.joomla.org/sf/go/artf2950; http://forum.joomla.org/index.php/topic%2C29031.0.html; http://secunia.com/advisories/18361
CVE: CVE-2006-0115
Published: 2006-01-09
Description: Multiple SQL injection vulnerabilities in OnePlug Solutions OnePlug CMS allow remote attackers to execute arbitrary SQL commands via the (1) Press_Release_ID parameter in press/details.asp, (2) Service_ID parameter in services/details.asp, and (3) Product_ID parameter in products/details.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/ref/22/22248-oneplug.txt; http://secunia.com/advisories/18325; http://www.osvdb.org/22248
CVE: CVE-2006-0116
Published: 2006-01-09
Description: Cross-site scripting vulnerability search.inetstore in iNETstore Ebusiness Software 2.0 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/ref/22/22251-inetstore.txt; http://secunia.com/advisories/18322; http://www.attrition.org/pipermail/vim/2006-January/000515.html
CVE: CVE-2006-0117
Published: 2006-01-09
Description: Buffer overflow in IBM Lotus Notes and Domino Server before 6.5.5 allows attackers to cause a denial of service (router crash or hang) via unspecified vectors involving "CD to MIME Conversion".
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18328; http://www-1.ibm.com/support/docview.wss?uid=swg27007054; http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e[PII_REDACTED]062619d/50c634bfe193efa5852570e4001baace?OpenDocument
CVE: CVE-2006-0118
Published: 2006-01-09
Description: Unspecified vulnerability in IBM Lotus Notes and Domino Server before 6.5.5, when running on AIX, allows attackers to cause a denial of service (deep recursion leading to stack overflow and crash) via long formulas.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18328; http://www-1.ibm.com/support/docview.wss?uid=swg27007054; http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e[PII_REDACTED]062619d/50c634bfe193efa5852570e4001baace?OpenDocument
CVE: CVE-2006-0119
Published: 2006-01-09
Description: Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 have unknown impact and attack vectors, due to "potential security issues" as identified by SPR numbers (1) GPKS6C9J67 in Agents, (2) JGAN6B6TZ3 and (3) KSPR699NBP in the Router, (4) GPKS5YQGPT in Security, or (5) HSAO6BNL6Y in the Web Server. NOTE: vector 3 is related to an issue in NROUTER in IBM Lotus Notes and Domino Server before 6.5.4 FP1, 6.5.5, and 7.0, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted vCal meeting request sent via SMTP (aka SPR# KSPR699NBP).
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18328; http://secunia.com/advisories/20855; http://securitytracker.com/id?1016390
CVE: CVE-2006-0120
Published: 2006-01-09
Description: Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (application crash) via multiple vectors, involving (1) a malformed message sent to an "Out Of Office" agent (SPR LPEE6DMQWJ), (2) the compact command (RTIN5U2SAJ), (3) malformed bitmap images (MYAA6FH5HW), (4) the "Delete Attachment" action (YPHG6844LD), (5) parsing certificates from a remote Certificate Table (AELE6DZFJW), and (6) creating a SSL key ring with the Domino Administration client (NSUA4FQPTN).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18328; http://www-1.ibm.com/support/docview.wss?uid=swg27007054; http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e[PII_REDACTED]062619d/258394eaa824f2c08525708a004209d3?OpenDocument