deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1000
Published: 2006-03-06
Description: Multiple SQL injection vulnerabilities in Pentacle In-Out Board 3.0 and earlier allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) newsid parameter to newsdetailsview.asp and (2) password parameter to login.asp.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042524.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042525.html; http://secunia.com/advisories/19024
CVE: CVE-2006-1001
Published: 2006-03-06
Description: SQL injection vulnerability in the board module in LanSuite LanParty Intranet System 2.0.6 and 2.1.0 beta allows remote attackers to execute arbitrary SQL commands via the fid parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19048; http://www.osvdb.org/23533; http://www.securityfocus.com/bid/16836
CVE: CVE-2006-1002
Published: 2006-03-06
Description: NETGEAR WGT624 Wireless DSL router has a default account of super_username "Gearguy" and super_passwd "Geardog", which allows remote attackers to modify the configuration.  NOTE: followup posts have suggested that this might not occur with all WGT624 routers.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.securityfocus.com/archive/1/426187/100/0/threaded; http://www.securityfocus.com/archive/1/426313/100/0/threaded; http://www.securityfocus.com/archive/1/431026/30/5580/threaded
CVE: CVE-2006-1003
Published: 2006-03-06
Description: The backup configuration option in NETGEAR WGT624 Wireless Firewall Router stores sensitive information in cleartext, which allows remote attackers to obtain passwords and gain privileges.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/426185; http://www.securityfocus.com/bid/16837; https://exchange.xforce.ibmcloud.com/vulnerabilities/24927
CVE: CVE-2006-1004
Published: 2006-03-06
Description: Cross-site scripting (XSS) vulnerability in agencyprofile.asp in Parodia 6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the AG_ID parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19025; http://www.osvdb.org/23548; http://www.securityfocus.com/bid/16865
CVE: CVE-2006-1005
Published: 2006-03-06
Description: agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AG_ID parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19025; http://secunia.com/advisories/19025
CVE: CVE-2006-1006
Published: 2006-03-06
Description: Multiple SQL injection vulnerabilities in sendcard.php in sendcard before 3.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/19056; http://sourceforge.net/forum/forum.php?forum_id=544749; http://www.securityfocus.com/bid/16900
CVE: CVE-2006-1007
Published: 2006-03-06
Description: Multiple SQL injection vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) dir and (2) page_id parameter to index.php.
CVSS Score: 7.5 (HIGH)
References: http://biyosecurity.be/bugs/n8cms.txt; http://secunia.com/advisories/19068; http://www.securityfocus.com/archive/1/427222/100/0/threaded
CVE: CVE-2006-1008
Published: 2006-03-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) dir and (2) page_id parameter to (a) index.php and (3) userid parameter to (b) mailto.php.  NOTE: it is possible that issues 1 and 2 are resultant from SQL injection.
CVSS Score: 5.8 (MEDIUM)
References: http://biyosecurity.be/bugs/n8cms.txt; http://secunia.com/advisories/19068; http://securityreason.com/securityalert/562
CVE: CVE-2006-1009
Published: 2006-03-06
Description: M4 Project enigma-suite before 0.73.3 (Windows) has a default password of "nominal" for the "enigma-client" account, which allows local users to gain access.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/19077; http://www.bytereef.org/m4-project-blog.html; http://www.osvdb.org/23572
CVE: CVE-2006-0814
Published: 2006-03-06
Description: response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18886; http://secunia.com/secunia_research/2006-9/advisory/; http://securityreason.com/securityalert/523
CVE: CVE-2006-0949
Published: 2006-03-06
Description: RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving (1) "." (dot), (2) space, and (3) "/" (slash) characters.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19032; http://secunia.com/secunia_research/2006-15/advisory/; http://www.osvdb.org/23616
CVE: CVE-2006-1010
Published: 2006-03-06
Description: Buffer overflow in socket/request.c in CrossFire before 1.9.0, when oldsocketmode is enabled, allows remote attackers to cause a denial of service (segmentation fault) and possibly execute code by sending the server a large request.
CVSS Score: 6.4 (MEDIUM)
References: http://aluigi.altervista.org/poc/crossfirebof.zip; http://cvs.sourceforge.net/viewcvs.py/crossfire/crossfire/socket/request.c?r1=1.80&r2=1.81; http://secunia.com/advisories/19044
CVE: CVE-2006-1011
Published: 2006-03-06
Description: LetterMerger 1.2 stores user information in Access database files with insecure permissions, which allows local users to obtain sensitive information.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19074; http://www.osvdb.org/23599; http://www.securityfocus.com/bid/16917
CVE: CVE-2006-1012
Published: 2006-03-06
Description: SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an HTTP header for a comment.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19109; http://secunia.com/advisories/19123; http://www.gentoo.org/security/en/glsa/glsa-200603-01.xml
CVE: CVE-2006-0458
Published: 2006-03-06
Description: The DCC ACCEPT command handler in irssi before 0.8.9+0.8.10rc5-0ubuntu4.1 in Ubuntu Linux, and possibly other distributions, allows remote attackers to cause a denial of service (application crash) via certain crafted arguments in a DCC command.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19090; http://www.securityfocus.com/bid/16913; https://exchange.xforce.ibmcloud.com/vulnerabilities/25147
CVE: CVE-2006-0815
Published: 2006-03-06
Description: NetworkActiv Web Server 3.5.15 allows remote attackers to read script source code via a crafted URL with a "/" (forward slash) after the file extension.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18947; http://secunia.com/secunia_research/2006-10/advisory; http://www.networkactiv.com/WebServer.html
CVE: CVE-2006-1013
Published: 2006-03-07
Description: PHP remote file include vulnerability in index.php in SMartBlog (aka SMBlog) 1.2 allows remote attackers to include and execute arbitrary PHP files via (1) the pg parameter and (2) a query string without a parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/426498/100/0/threaded; http://www.securityfocus.com/bid/16905; https://exchange.xforce.ibmcloud.com/vulnerabilities/25220
CVE: CVE-2006-1014
Published: 2006-03-07
Description: Argument injection vulnerability in certain PHP 4.x and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mb_send_mail function, allows context-dependent attackers to read and create arbitrary files by providing extra -C and -X arguments to sendmail.  NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.
CVSS Score: 3.2 (LOW)
References: http://secunia.com/advisories/18694; http://secunia.com/advisories/19979; http://www.novell.com/linux/security/advisories/05-05-2006.html
CVE: CVE-2006-1015
Published: 2006-03-07
Description: Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mail function, allows remote attackers to read and create arbitrary files via the sendmail -C and -X arguments.  NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19979; http://securityreason.com/securityalert/517; http://www.novell.com/linux/security/advisories/05-05-2006.html
CVE: CVE-2006-1016
Published: 2006-03-07
Description: Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument.
CVSS Score: 7.5 (HIGH)
References: http://metasploit.com/projects/Framework/exploits.html#ie_iscomponentinstalled; http://www.metasploit.com/projects/Framework/modules/exploits/ie_iscomponentinstalled.pm; http://www.securityfocus.com/bid/16870
CVE: CVE-2006-1017
Published: 2006-03-07
Description: The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the (1) safe_mode or (2) open_basedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imap_open function, allow remote attackers to obtain access to an IMAP stream data structure and conduct unauthorized IMAP actions.
CVSS Score: 9.3 (HIGH)
References: http://bugs.php.net/bug.php?id=37265; http://secunia.com/advisories/18694; http://secunia.com/advisories/21050
CVE: CVE-2006-1018
Published: 2006-03-07
Description: SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.osvdb.org/23827; http://www.securityfocus.com/archive/1/426622/100/0/threaded; http://www.securityfocus.com/bid/16909
CVE: CVE-2006-1019
Published: 2006-03-07
Description: Cross-site scripting (XSS) vulnerability in fce.php in UKiBoard 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a BBCode url tag when using the show_post function.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information, some of which reference a source URL that appears to be for an unrelated issue.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/16912; https://exchange.xforce.ibmcloud.com/vulnerabilities/24990; http://www.securityfocus.com/bid/16912
CVE: CVE-2006-1020
Published: 2006-03-07
Description: SQL injection vulnerability in forumlib.php in Johnny_Vegas Vegas Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/90/summary.html; http://secunia.com/advisories/19219; http://securityreason.com/securityalert/574
CVE: CVE-2006-1021
Published: 2006-03-07
Description: Cross-site scripting (XSS) vulnerability in sol_menu.php in PeHePe Uyelik Sistemi (aka PeHePe MemberShip Management System) 3 allows remote attackers to inject arbitrary web script or HTML via the kuladi parameter ($kul_adi variable).
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19055; http://www.securityfocus.com/archive/1/426363/100/0/threaded; http://www.securityfocus.com/bid/16885
CVE: CVE-2006-1022
Published: 2006-03-07
Description: PHP remote file include vulnerability in sol_menu.php in PeHePe Uyelik Sistemi (aka PeHePe MemberShip Management System) 3 allows remote attackers to include and execute arbitrary PHP code via a URL in the uye_klasor parameter, along with a misafir[] parameter that is set to UYE_SEVIYE.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19055; http://securityreason.com/securityalert/515; http://www.osvdb.org/23567
CVE: CVE-2006-1023
Published: 2006-03-07
Description: Directory traversal vulnerability in HP System Management Homepage (SMH) 2.0.0 through 2.1.4 on Windows allows remote attackers to access certain files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19059; http://securitytracker.com/id?1015692; http://www.securityfocus.com/archive/1/426345/100/0/threaded
CVE: CVE-2006-1024
Published: 2006-03-07
Description: SQL injection vulnerability in MgrLogin.asp in Addsoft StoreBot 2005 Professional allows remote attackers to execute arbitrary SQL commands via the Pwd parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19019; http://www.osvdb.org/23575; http://www.securityfocus.com/bid/16897
CVE: CVE-2006-1025
Published: 2006-03-07
Description: Cross-site scripting (XSS) vulnerability in manage.asp in Addsoft StoreBot 2002 Standard allows remote attackers to inject arbitrary web script or HTML via the ShipMethod parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/19060; http://www.osvdb.org/23574; http://www.securityfocus.com/bid/16898
CVE: CVE-2006-1026
Published: 2006-03-07
Description: JFacets before 0.2 allows remote attackers to gain privileges as any account via a GET request with a modified account profileID.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19031; http://sourceforge.net/project/shownotes.php?group_id=154666&release_id=396824; http://sourceforge.net/tracker/index.php?func=detail&aid=1439037&group_id=154666&atid=792697
CVE: CVE-2006-1027
Published: 2006-03-07
Description: feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via a "/" (slash) in the feed parameter to index.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/527; http://www.joomla.org/content/view/938/78/; http://www.osvdb.org/23815
CVE: CVE-2006-1028
Published: 2006-03-07
Description: feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to cause a denial of service (stressed file cache) by creating many files via filenames in the feed parameter to index.php.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/19105; http://securityreason.com/securityalert/527; http://www.joomla.org/content/view/938/78/
CVE: CVE-2006-1029
Published: 2006-03-07
Description: The cross-site scripting (XSS) countermeasures in class.inputfilter.php in Joomla! 1.0.7 allow remote attackers to cause a denial of service via a crafted mosmsg parameter to index.php with a malformed sequence of multiple tags, as demonstrated using "<<>AAA<><>", possibly due to nested or empty tags.
CVSS Score: 4.3 (MEDIUM)
References: http://www.joomla.org/content/view/938/78/; http://www.osvdb.org/23816; http://www.securityfocus.com/archive/1/426538/100/0/threaded
CVE: CVE-2006-1030
Published: 2006-03-07
Description: Unspecified vulnerability in mod_templatechooser in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via an unspecified attack vector that reveals the path.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19105; http://www.joomla.org/content/view/938/78/; http://www.osvdb.org/23818
CVE: CVE-2006-0554
Published: 2006-03-07
Description: Linux kernel 2.6 before 2.6.15.5 allows local users to obtain sensitive information via a crafted XFS ftruncate call, which may return stale data.
CVSS Score: 1.7 (LOW)
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.5; http://secunia.com/advisories/19083; http://secunia.com/advisories/19220
CVE: CVE-2006-0555
Published: 2006-03-07
Description: The Linux Kernel before 2.6.15.5 allows local users to cause a denial of service (NFS client panic) via unknown attack vectors related to the use of O_DIRECT (direct I/O).
CVSS Score: 2.1 (LOW)
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.5; http://secunia.com/advisories/19083; http://secunia.com/advisories/19108
CVE: CVE-2006-0741
Published: 2006-03-07
Description: Linux kernel before 2.6.15.5, when running on Intel processors, allows local users to cause a denial of service ("endless recursive fault") via unknown attack vectors related to a "bad elf entry address."
CVSS Score: 1.2 (LOW)
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.5; http://secunia.com/advisories/19083; http://secunia.com/advisories/19108
CVE: CVE-2006-0883
Published: 2006-03-07
Description: OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.asc; http://bugzilla.mindrot.org/show_bug.cgi?id=839; http://securityreason.com/securityalert/520
CVE: CVE-2006-0047
Published: 2006-03-07
Description: packets.c in Freeciv 2.0 before 2.0.8 allows remote attackers to cause a denial of service (server crash) via crafted packets with negative compressed size values.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=355211; http://secunia.com/advisories/19120; http://secunia.com/advisories/19227
CVE: CVE-2006-1031
Published: 2006-03-07
Description: config/config_inc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SG_HOME parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://retrogod.altervista.org/igenus_202_xpl_pl.html; http://secunia.com/advisories/19036; http://www.osvdb.org/23530
CVE: CVE-2006-1032
Published: 2006-03-07
Description: Eval injection vulnerability in the decode function in rpc_decoder.php for phpRPC 0.7 and earlier, as used by runcms, exoops, and possibly other programs, allows remote attackers to execute arbitrary PHP code via the base64 tag.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19028; http://secunia.com/advisories/19058; http://securityreason.com/securityalert/502
CVE: CVE-2006-1033
Published: 2006-03-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) uname, (2) error, (3) profile or (4) the username filed parameter to the (a) Your_Account module, (5) catid, (6) sid, (7) Story Text or (8) Extended text text fields in the (b) News module, (9) month, (10) year or (11) sa parameter to the (c) Stories_Archive module, (12) show, (13) cid, (14) ratetype, or (15) orderby parameter to the (d) Web_Links module, (16) op, or (17) pollid parameter to the (e) Surveys module, (18) c parameter to the (f) Downloads module, (19) meta, or (20) album parameter to the (g) coppermine module, or the search box in the (21) Search, (22) Stories_Archive, (23) Downloads, and (24) Topics module.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2006/02/multiple-cross-site-scripting-in.html; http://secunia.com/advisories/18940; http://securitytracker.com/id?1015661
CVE: CVE-2006-1034
Published: 2006-03-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Woltlab Burning Board (wBB) allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to galerie_index.php and possibly (2) galerie_onfly.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. The second vector might not be XSS.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/16843; http://www.securityfocus.com/bid/16843
CVE: CVE-2006-1035
Published: 2006-03-07
Description: Unspecified vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to access diagnostics tests via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19076; http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdf; http://www.kb.cert.org/vuls/id/298958
CVE: CVE-2006-1036
Published: 2006-03-07
Description: Multiple unspecified vulnerabilities in the Oracle Diagnostics module 2.2 and earlier have unknown impact and attack vectors, related to "permissions."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19076; http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdf; http://www.securityfocus.com/bid/16844
CVE: CVE-2006-1037
Published: 2006-03-07
Description: SQL injection vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19076; http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdf; http://www.securityfocus.com/bid/16844
CVE: CVE-2006-1038
Published: 2006-03-07
Description: Buffer overflow in SecureCRT 5.0.4 and earlier and SecureFX 3.0.4 and earlier allows remote attackers to have an unknown impact when a Unicode string is converted to a "narrow" string.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/19040; http://www.securityfocus.com/bid/16935; http://www.vandyke.com/products/securecrt/history.txt
CVE: CVE-2006-1039
Published: 2006-03-07
Description: SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/19085; http://securitytracker.com/id?1015702; http://www.securityfocus.com/archive/1/426449/100/0/threaded
CVE: CVE-2006-1040
Published: 2006-03-07
Description: Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in sendmsg.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19100; http://www.kapda.ir/advisory-266.html; http://www.osvdb.org/23614
CVE: CVE-2006-1041
Published: 2006-03-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gregarius 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) rss_query parameter to search.php or (2) tag parameter to tags.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19102; http://www.osvdb.org/23678; http://www.osvdb.org/23679
CVE: CVE-2006-1042
Published: 2006-03-07
Description: Multiple SQL injection vulnerabilities in Gregarius 0.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) folder parameter to feed.php or (2) rss_query parameter to search.php.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19102; http://securityreason.com/securityalert/537; http://www.osvdb.org/23680