deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1617
Published: 2006-04-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to comments.php or (2) poll_id parameter to page.php.  NOTE: it is possible that this issue is resultant from CVE-2006-1616.
CVSS Score: 4.3 (MEDIUM)
References: http://ns79.hosteur.com/~secuti/advancedpoll.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/25677; http://ns79.hosteur.com/~secuti/advancedpoll.txt
CVE: CVE-2006-1618
Published: 2006-04-05
Description: Format string vulnerability in the (1) Con_message and (2) conPrintf functions in con_main.c in Doomsday engine 1.8.6 allows remote attackers to execute arbitrary code via format string specifiers in an argument to the JOIN command, and possibly other command arguments.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/doomsdayfs-adv.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044865.html; http://secunia.com/advisories/19515
CVE: CVE-2006-1619
Published: 2006-04-05
Description: IBM WebSphere Application Server 4.0.1 through 4.0.3 allows remote attackers to cause a denial of service (application crash) via an HTTP request with a large header.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1015857; http://www-1.ibm.com/support/docview.wss?uid=swg21053738; http://www.vupen.com/english/advisories/2006/1214
CVE: CVE-2006-1620
Published: 2006-04-05
Description: admin/accounts/AccountActions.asp in Hosting Controller 2002 RC 1 allows remote attackers to modify passwords of other users, probably via an "Update User" ActionType with a modified UserName parameter and the PassCheck parameter set to TRUE.  It was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and earlier.
CVSS Score: 5.0 (MEDIUM)
References: http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html; http://secunia.com/advisories/28973; http://www.osvdb.org/24773
CVE: CVE-2006-1621
Published: 2006-04-05
Description: Directory traversal vulnerability in admin/folders/saveuploadfiles.asp in Hosting Controller 2002 RC 1 allows remote authenticated users to overwrite arbitrary files via an absolute path in the OpenPath parameter.
CVSS Score: 4.0 (MEDIUM)
References: http://www.osvdb.org/24772; http://www.securityfocus.com/archive/1/429731/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/25675
CVE: CVE-2006-1622
Published: 2006-04-05
Description: Cross-site scripting (XSS) vulnerability in PHPSelect linksubmit allows remote attackers to inject arbitrary web script or HTML via (1) the description parameter to linklist.php and possibly other vectors involving (2) index.php and (3) linksubmit.php.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/429608/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/25607; http://www.securityfocus.com/archive/1/429608/100/0/threaded
CVE: CVE-2006-1623
Published: 2006-04-05
Description: Unspecified vulnerability in main.php in an unspecified "file created by Andries Bruinsma," possibly a FleXiBle Development (FXB) application, allows remote attackers to include and execute arbitrary PHP code.  NOTE: this disclosure is extremely vague and has very little information about the specific vulnerability type.  In addition, there is little public information on the named product. Finally, an XSS vector is implied in the subject line, but because there is no other information and evidence of a cut-and-paste error, it will not be assigned a separate CVE identifier unless additional information is provided.
CVSS Score: 4.3 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-April/000680.html; http://www.securityfocus.com/archive/1/429613/100/0/threaded; http://www.securityfocus.com/archive/1/430334/100/0/threaded
CVE: CVE-2006-1624
Published: 2006-04-05
Description: The default configuration of syslogd in the Linux sysklogd package does not enable the -x (disable name lookups) option, which allows remote attackers to cause a denial of service (traffic amplification) via messages with spoofed source IP addresses.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/archive/1/429618/100/0/threaded; http://www.securityfocus.com/archive/1/429739/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/25672
CVE: CVE-2006-1625
Published: 2006-04-05
Description: Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode email tag, as demonstrated using the onmousemove event.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/19516; http://www.osvdb.org/24375; http://www.securityfocus.com/archive/1/429748/100/0/threaded
CVE: CVE-2006-1626
Published: 2006-04-05
Description: Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading.  NOTE: this is a different vulnerability than CVE-2006-1192.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/Internet_Explorer_Address_Bar_Spoofing_Vulnerability_Test/; http://secunia.com/advisories/19521; http://securitytracker.com/id?1016291
CVE: CVE-2006-1055
Published: 2006-04-05
Description: The fill_write_buffer function in sysfs/file.c in Linux kernel 2.6.12 up to versions before 2.6.17-rc1 does not zero terminate a buffer when a length of PAGE_SIZE or more is requested, which might allow local users to cause a denial of service (crash) by causing an out-of-bounds read.
CVSS Score: 4.9 (MEDIUM)
References: http://lwn.net/Alerts/180820/; http://secunia.com/advisories/19495; http://secunia.com/advisories/19735
CVE: CVE-2006-1631
Published: 2006-04-05
Description: Unspecified vulnerability in the HTTP compression functionality in Cisco CSS 11500 Series Content Services switches allows remote attackers to cause a denial of service (device reload) via (1) "valid, but obsolete" or (2) "specially crafted" HTTP requests.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19552; http://securitytracker.com/id?1015870; http://www.cisco.com/warp/public/707/cisco-sa-20060405-css.shtml
CVE: CVE-2006-1634
Published: 2006-04-06
Description: Cross-site scripting (XSS) vulnerability in index.php in LucidCMS 2.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the command parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/429744; http://www.securityfocus.com/bid/17360; https://exchange.xforce.ibmcloud.com/vulnerabilities/25632
CVE: CVE-2006-1635
Published: 2006-04-06
Description: LucidCMS 2.0.0 RC4 allows remote attackers to obtain sensitive information via a direct request to /lucid_phplib/translator.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/429744; https://exchange.xforce.ibmcloud.com/vulnerabilities/25633; http://www.securityfocus.com/archive/1/429744
CVE: CVE-2006-1636
Published: 2006-04-06
Description: PHP remote file inclusion vulnerability in get_header.php in VWar 1.5.0 R12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter.  NOTE: this is a different vulnerability than CVE-2006-1503.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://downloads.securityfocus.com/vulnerabilities/exploits/VWar_1.5.0_R12.pl; http://secunia.com/advisories/19524; http://www.osvdb.org/24480
CVE: CVE-2006-1637
Published: 2006-04-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in aWebBB 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) tname or (2) fpost parameters to (a) post.php; (3) fullname, (4) emailadd, (5) country, (6) sig, or (7) otherav parameters to (b) editac.php; or (8) fullname, (9) emailadd, or (10) country parameters to (c) register.php.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/117/summary.html; http://secunia.com/advisories/19486; http://www.osvdb.org/24337
CVE: CVE-2006-1638
Published: 2006-04-06
Description: Multiple SQL injection vulnerabilities in aWebBB 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter to (a) accounts.php, (b) changep.php, (c) editac.php, (d) feedback.php, (e) fpass.php, (f) login.php, (g) post.php, (h) reply.php, or (i) reply_log.php; (2) p parameter to (j) dpost.php; (3) c parameter to (k) list.php or (l) ndis.php; or (12) q parameter to (m) search.php.
CVSS Score: 5.1 (MEDIUM)
References: http://evuln.com/vulns/117/summary.html; http://secunia.com/advisories/19486; http://www.osvdb.org/24340
CVE: CVE-2006-1639
Published: 2006-04-06
Description: SQL injection vulnerability in index.php in wpBlog 0.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://evuln.com/vulns/119/summary.html; http://secunia.com/advisories/19538; http://securityreason.com/securityalert/734
CVE: CVE-2006-1640
Published: 2006-04-06
Description: Cross-site scripting (XSS) vulnerability in news.php in CzarNews 1.14 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVSS Score: 2.6 (LOW)
References: http://evuln.com/vulns/118/summary.html; http://secunia.com/advisories/19541; http://securityreason.com/securityalert/732
CVE: CVE-2006-1641
Published: 2006-04-06
Description: Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the (1) usern or (2) passw parameters to (a) cn_auth.php, (3) s parameter to (b) news.php, or (4) a parameter to (c) dpost.php.
CVSS Score: 5.1 (MEDIUM)
References: http://evuln.com/vulns/118/summary.html; http://secunia.com/advisories/19541; http://securitytracker.com/id?1015957
CVE: CVE-2006-1642
Published: 2006-04-06
Description: Cross-site scripting (XSS) vulnerability in Interact 2.1.1 allows remote attackers to inject arbitrary web script or HTML via (1) the search_terms parameter to (a) search.php, and (2) the first_name, (3) last_name, (4) email, (5) password, and (6) confirm_password parameters to (b) userinput.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party.  In addition, the lack of precision in the third party descriptions makes it unclear whether the named vectors are correct.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19488; http://www.osvdb.org/24389; http://www.osvdb.org/24461
CVE: CVE-2006-1643
Published: 2006-04-06
Description: SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the user_name parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19488; http://www.osvdb.org/24390; http://www.securityfocus.com/bid/17385
CVE: CVE-2006-1644
Published: 2006-04-06
Description: login.php in Interact 2.1.1 generates different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19488; http://www.osvdb.org/24388; http://www.vupen.com/english/advisories/2006/1244
CVE: CVE-2006-1645
Published: 2006-04-06
Description: Cross-site scripting (XSS) vulnerability in Anton Vlasov and Rostislav Gaitkuloff ReloadCMS 1.2.5 and earlier allows remote attackers to inject arbitrary web script or HTML and gain leverage to execute arbitrary PHP code via the User-Agent HTTP header, which is displayed by admin/modules/general/statistic.php in the administration panel.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/19470; http://www.osvdb.org/24327; http://www.securityfocus.com/archive/1/429666/100/0/threaded
CVE: CVE-2006-1646
Published: 2006-04-06
Description: The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in the Shoichi Sakane KAME Project racoon, as used by NetBSD 1.6, 2.x before 20060119, certain FreeBSD releases, and possibly other distributions of BSD or Linux operating systems, when running in aggressive mode, allows remote attackers to cause a denial of service (daemon crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-003.txt.asc; http://mail-index.netbsd.org/source-changes/2006/01/19/0017.html; http://secunia.com/advisories/19463
CVE: CVE-2006-1647
Published: 2006-04-06
Description: An unspecified "logical programming mistake" in SMART SynchronEyes Student and Teacher 6.0, and possibly earlier versions, allows remote attackers to cause a denial of service via a large packet to the Teacher discovery port (UDP port 5496), which causes a thread to terminate and prevents communications on that port.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/19535; http://securitytracker.com/id?1015869; http://www.securityfocus.com/archive/1/429843/100/0/threaded
CVE: CVE-2006-1648
Published: 2006-04-06
Description: SMART SynchronEyes Student and Teacher 6.0, and possibly earlier versions, allows remote attackers to cause a denial of service (memory consumption) via a certain packet to the Teacher discovery port that causes SynchronEyes to connect to the attacker's machine and read a value that is used as a parameter to malloc.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19535; http://securitytracker.com/id?1015869; http://www.osvdb.org/24392
CVE: CVE-2006-1649
Published: 2006-04-06
Description: The "restore to" selection in the "quarantine a file" capability of ESET NOD32 before 2.51.26 allows a restore to any directory that permits read access by the invoking user, which allows local users to create new files despite write-access directory permissions.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/19054; http://securityreason.com/securityalert/672; http://securitytracker.com/id?1015867
CVE: CVE-2006-1650
Published: 2006-04-06
Description: Firefox 1.5.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading.  NOTE: a followup was unable to replicate this issue.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/429927/100/0/threaded; http://www.securityfocus.com/archive/1/430348/30/5730/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/25634
CVE: CVE-2006-1651
Published: 2006-04-06
Description: Microsoft ISA Server 2004 allows remote attackers to bypass certain filtering rules, including ones for (1) ICMP and (2) TCP, via IPv6 packets.  NOTE: An established researcher has disputed this issue, saying that "Neither ISA Server 2004 nor Windows 2003 Basic Firewall support IPv6 filtering ... This is different network protocol.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/429816/100/0/threaded; http://www.securityfocus.com/archive/1/429846/100/0/threaded; http://www.securityfocus.com/archive/1/430281/100/0/threaded
CVE: CVE-2006-1652
Published: 2006-04-06
Description: Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attackers to execute arbitrary code via a malicious server that sends a long string to a client that connects on TCP port 5900, which triggers an overflow in Log::ReallyPrint; and (2) allow remote attackers to cause a denial of service (server crash) via a long HTTP GET request to TCP port 5800, which triggers an overflow in VNCLog::ReallyPrint.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044901.html; http://secunia.com/advisories/19513; http://securityreason.com/securityalert/674
CVE: CVE-2006-1653
Published: 2006-04-06
Description: PHP remote file inclusion vulnerability in loadkernel.php in AngelineCMS 0.8.1 allows remote attackers to execute arbitrary PHP code via a URL in the installPath parameter.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv27-K-159-2006.txt; http://www.osvdb.org/24610; http://www.securityfocus.com/archive/1/429983/100/0/threaded
CVE: CVE-2006-1654
Published: 2006-04-06
Description: Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 5225.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0085.html; http://secunia.com/advisories/19529; http://securitytracker.com/id?1015862
CVE: CVE-2006-1655
Published: 2006-04-06
Description: Multiple buffer overflows in mpg123 0.59r allow user-assisted attackers to trigger a segmentation fault and possibly have other impacts via a certain MP3 file, as demonstrated by mpg1DoS3.  NOTE: this issue might be related to CVE-2004-0991, but it is not clear.
CVSS Score: 6.5 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/mpg1DoS3.pl; http://secunia.com/advisories/20240; http://secunia.com/advisories/20275
CVE: CVE-2006-1656
Published: 2006-04-06
Description: vserver in util-vserver 0.30.209 executes a command as root when the suexec userid parameter is invalid and non-numeric, which might cause local users to inadvertently execute dangerous commands as root.
CVSS Score: 7.2 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=360438; http://www.securityfocus.com/bid/17361; https://savannah.nongnu.org/bugs/?func=detailitem&item_id=15996
CVE: CVE-2006-1614
Published: 2006-04-06
Description: Integer overflow in the cli_scanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV) before 0.88.1, when ArchiveMaxFileSize is disabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0002.html; http://secunia.com/advisories/19534
CVE: CVE-2006-1615
Published: 2006-04-06
Description: Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code.  NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0002.html; http://secunia.com/advisories/19534
CVE: CVE-2006-1629
Published: 2006-04-06
Description: OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.
CVSS Score: 9.0 (HIGH)
References: http://openvpn.net/changelog.html; http://secunia.com/advisories/19531; http://secunia.com/advisories/19598
CVE: CVE-2006-1630
Published: 2006-04-06
Description: The cli_bitset_set function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger an "invalid memory access."
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://lists.suse.com/archive/suse-security-announce/2006-Apr/0002.html; http://secunia.com/advisories/19534
CVE: CVE-2006-1657
Published: 2006-04-07
Description: Cross-site scripting (XSS) vulnerability in index.php in Chucky A. Ivey N.T. 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not filtered when the administrator views the "Login Log" page.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/121/summary.html; http://secunia.com/advisories/19526; http://securityreason.com/securityalert/741
CVE: CVE-2006-1658
Published: 2006-04-07
Description: Direct static code injection vulnerability in ticker.db.php in Chucky A. Ivey N.T.  1.1.0 allows remote administrators to insert arbitrary PHP code into the config file, which is included other N.T. scripts.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/121/summary.html; http://secunia.com/advisories/19526; http://www.osvdb.org/24398
CVE: CVE-2006-1659
Published: 2006-04-07
Description: Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in image_desc.php, (2) provided parameter in template.php, (3) cid parameter in suggest_image.php, (4) img_id parameter in insert_rating.php, and (5) cid parameter in images.php.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19523; http://www.osvdb.org/24368; http://www.osvdb.org/24369
CVE: CVE-2006-1660
Published: 2006-04-07
Description: Cross-site scripting (XSS) vulnerability in image_desc.php in Softbiz Image Gallery allows remote attackers to inject arbitrary web script or HTML via msg parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/19523; http://www.vupen.com/english/advisories/2006/1217; http://secunia.com/advisories/19523
CVE: CVE-2006-1661
Published: 2006-04-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in SKForum 1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) areaID parameter in area.View.action, (2) time parameter in planning.View.action, and (3) userID parameter in user.View.action.
CVSS Score: 6.8 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/skforum-xss-vuln.html; http://secunia.com/advisories/19484; http://www.osvdb.org/24430
CVE: CVE-2006-1662
Published: 2006-04-07
Description: The frontpage option in Limbo CMS 1.0.4.2 and 1.0.4.1 allows remote attackers to execute arbitrary PHP commands via the Itemid parameter in index.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0728.html; http://securityreason.com/securityalert/519; http://www.securityfocus.com/archive/1/426428
CVE: CVE-2006-1663
Published: 2006-04-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-0996.  Reason: This candidate is a reservation duplicate of CVE-2006-0996.  Notes: All CVE users should reference CVE-2006-0996 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-1664
Published: 2006-04-07
Description: Buffer overflow in xine_list_delete_current in libxine 1.14 and earlier, as distributed in xine-lib 1.1.1 and earlier, allows remote attackers to execute arbitrary code via a crafted MPEG stream.
CVSS Score: 7.5 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=128838; http://secunia.com/advisories/19853; http://secunia.com/advisories/19856
CVE: CVE-2006-1665
Published: 2006-04-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Arab Portal 2.0.1 stable allow remote attackers to inject arbitrary web script or HTML via the (1) adminJump and (2) forum_middle parameters in (a) forum.php, and the (3) form parameter in (b) members.php, (c) pm.php, and (d) mail.php.
CVSS Score: 2.6 (LOW)
References: http://www.securityfocus.com/archive/1/429940/100/0/threaded; http://www.securityfocus.com/bid/17375; https://exchange.xforce.ibmcloud.com/vulnerabilities/25657