deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-2880
Published: 2006-06-07
Description: Cross-site scripting (XSS) vulnerability in the Contributed Packages for PyBlosxom 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the Comments plugin in the (1) url and (2) author fields.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20436; http://sourceforge.net/project/shownotes.php?release_id=422015; http://www.securityfocus.com/bid/18292
CVE: CVE-2006-2881
Published: 2006-06-07
Description: Multiple PHP remote file inclusion vulnerabilities in DreamAccount 3.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the da_path parameter in the (1) auth.cookie.inc.php, (2) auth.header.inc.php, or (3) auth.sessions.inc.php scripts.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20468; http://securityreason.com/securityalert/1062; http://securitytracker.com/id?1016272
CVE: CVE-2006-2882
Published: 2006-06-07
Description: Multiple cross-site scripting (XSS) vulnerabilities submit.asp in ASPScriptz Guest Book 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) GBOOK_UNAME, (2) GBOOK_EMAIL, (3) GBOOK_CITY, (4) GBOOK_COU, (5) GBOOK_WWW, and (6) GBOOK_MESS form fields.
CVSS Score: 4.3 (MEDIUM)
References: http://colander.altervista.org/advisory/ASzGB.txt; http://secunia.com/advisories/20416; http://securityreason.com/securityalert/1056
CVE: CVE-2006-2883
Published: 2006-06-07
Description: Cross-site scripting (XSS) vulnerability in search.php in Kmita FAQ 1.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20471; http://securityreason.com/securityalert/1055; http://securitytracker.com/id?1016226
CVE: CVE-2006-2884
Published: 2006-06-07
Description: SQL injection vulnerability in index.php in Kmita FAQ 1.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20471; http://securityreason.com/securityalert/1055; http://securitytracker.com/id?1016226
CVE: CVE-2006-2885
Published: 2006-06-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in KnowledgeTree Open Source 3.0.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) fDocumentId parameter in view.php and the (2) fSearchableText parameter in /search/simpleSearch.php.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/knowledgetree-open-source-xss-vuln.html; http://secunia.com/advisories/20455; http://www.osvdb.org/26179
CVE: CVE-2006-2886
Published: 2006-06-07
Description: view.php in KnowledgeTree Open Source 3.0.3 and earlier allows remote attackers to obtain the full installation path via a crafted fDocumentId parameter, which displays the path in the resulting error message.  NOTE: this might be resultant from another vulnerability, since this vector also produces XSS.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/knowledgetree-open-source-xss-vuln.html; http://www.osvdb.org/26297; https://exchange.xforce.ibmcloud.com/vulnerabilities/26943
CVE: CVE-2006-2887
Published: 2006-06-07
Description: Multiple SQL injection vulnerabilities in myNewsletter 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the UserName parameter in (1) validatelogin.asp or (2) adminlogin.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20423; http://securityreason.com/securityalert/1054; http://securitytracker.com/id?1016229
CVE: CVE-2006-2888
Published: 2006-06-07
Description: PHP remote file inclusion vulnerability in _wk/wk_lang.php in Wikiwig 4.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the WK[wkPath] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20487; http://www.securityfocus.com/bid/18291; http://www.vupen.com/english/advisories/2006/2167
CVE: CVE-2006-2889
Published: 2006-06-07
Description: Multiple SQL injection vulnerabilities in index.php in Pixelpost 1-5rc1-2 and earlier allow remote attackers to execute arbitrary SQL commands, and leverage them to gain administrator privileges, via the (1) category or (2) archivedate parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://retrogod.altervista.org/pixelpost_15rc12_xpl.html; http://securityreason.com/securityalert/1061; http://securitytracker.com/id?1016217
CVE: CVE-2006-2890
Published: 2006-06-07
Description: Pixelpost 1-5rc1-2 and earlier, when register_globals is enabled, allows remote attackers to gain administrator privileges and conduct other attacks by setting the _SESSION["pixelpost_admin"] parameter to 1 in calls to admin scripts such as admin/view_info.php.
CVSS Score: 5.1 (MEDIUM)
References: http://retrogod.altervista.org/pixelpost_15rc12_xpl.html; http://securityreason.com/securityalert/1061; http://securitytracker.com/id?1016217
CVE: CVE-2006-2891
Published: 2006-06-07
Description: Cross-site scripting (XSS) vulnerability in admin/index.php for Pixelpost 1-5rc1-2 and earlier allows remote attackers to inject arbitrary HTML or web script via the loginmessage parameter.
CVSS Score: 2.6 (LOW)
References: http://retrogod.altervista.org/pixelpost_15rc12_xpl.html; http://securityreason.com/securityalert/1061; http://www.securityfocus.com/archive/1/435856/100/0/threaded
CVE: CVE-2006-2892
Published: 2006-06-07
Description: Cross-site scripting (XSS) vulnerability in index.php in GANTTy 1.0.3 allows remote attackers to inject arbitrary HTML and web script via the message parameter in a login action.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20498; http://securityreason.com/securityalert/1060; http://www.securityfocus.com/archive/1/436125/100/0/threaded
CVE: CVE-2006-2893
Published: 2006-06-07
Description: index.php in GANTTy 1.0.3 allows remote attackers to obtain the full path of the web server via an invalid lang parameter in an authenticate action.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20498; http://securityreason.com/securityalert/1060; http://www.securityfocus.com/archive/1/436125/100/0/threaded
CVE: CVE-2006-2894
Published: 2006-06-07
Description: Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and earlier allow user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2007-02/0166.html; http://archives.neohapsis.com/archives/bugtraq/2007-02/0187.html; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
CVE: CVE-2006-2895
Published: 2006-06-07
Description: Cross-site scripting (XSS) vulnerability in MediaWiki 1.6.0 up to versions before 1.6.7 allows remote attackers to inject arbitrary HTML and web script via the edit form.
CVSS Score: 2.6 (LOW)
References: http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-June/000048.html; http://secunia.com/advisories/20458; http://svn.wikimedia.org/viewvc/mediawiki/tags/REL1_6_7/phase3/RELEASE-NOTES
CVE: CVE-2006-2896
Published: 2006-06-07
Description: profile.php in FunkBoard CF0.71 allows remote attackers to change arbitrary passwords via a modified uid hidden form field in an Edit Profile action.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20433; http://securityreason.com/securityalert/1066; http://www.funkboard.co.uk/forum/thread.php?id=302
CVE: CVE-2006-2897
Published: 2006-06-07
Description: Cross-site scripting (XSS) vulnerability in FunkBoard 0.71 allows remote attackers to inject arbitrary HTML or web script via unspecified vectors.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20433; http://www.funkboard.co.uk/forum/thread.php?id=302; http://www.vupen.com/english/advisories/2006/2158
CVE: CVE-2006-2898
Published: 2006-06-07
Description: The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check.  NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/20497; http://secunia.com/advisories/20658; http://secunia.com/advisories/20899
CVE: CVE-2006-2899
Published: 2006-06-07
Description: Unspecified vulnerability in ESTsoft InternetDISK versions before 2006/04/20 allows remote authenticated users to execute arbitrary code, possibly by uploading a file with multiple extensions into the WebLink directory.
CVSS Score: 6.5 (MEDIUM)
References: http://securityreason.com/securityalert/1063; http://securitytracker.com/id?1016233; http://www.securityfocus.com/archive/1/436001/100/0/threaded
CVE: CVE-2006-2900
Published: 2006-06-07
Description: Internet Explorer 6 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046610.html; http://secunia.com/advisories/20449; http://securityreason.com/securityalert/1059
CVE: CVE-2006-2901
Published: 2006-06-07
Description: The web server for D-Link Wireless Access-Point (DWL-2100ap) firmware 2.10na and earlier allows remote attackers to obtain sensitive system information via a request to an arbitrary .cfg file, which returns configuration information including passwords.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20474; http://securityreason.com/securityalert/1064; http://securitytracker.com/id?1016234
CVE: CVE-2006-1173
Published: 2006-06-07
Description: Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:17.sendmail.asc; ftp://patches.sgi.com/support/free/security/advisories/20060601-01-P; ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc
CVE: CVE-2006-2902
Published: 2006-06-08
Description: Directory traversal vulnerability in Particle Links 1.2.2 might allow remote attackers to access arbitrary files via ".." sequences in an HTTP request.  NOTE: it is not clear whether this issue is legitimate, as the original researcher seems unsure.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/436112/100/0/threaded; http://www.securityfocus.com/archive/1/436112/100/0/threaded
CVE: CVE-2006-2903
Published: 2006-06-08
Description: Cross-site scripting (XSS) vulnerability in admin.php in Particle Links 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20491; http://www.securityfocus.com/archive/1/436112/100/0/threaded; http://www.securityfocus.com/bid/18344
CVE: CVE-2006-2904
Published: 2006-06-08
Description: SQL injection vulnerability in index.php in Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20491; http://www.securityfocus.com/archive/1/436112/100/0/threaded; http://www.securityfocus.com/bid/18342
CVE: CVE-2006-2905
Published: 2006-06-08
Description: Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to (1) page_footer.php and (2) page_header.php, which displays the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20491; http://www.securityfocus.com/archive/1/436112/100/0/threaded; http://www.vupen.com/english/advisories/2006/2169
CVE: CVE-2006-2906
Published: 2006-06-08
Description: The LZW decoding in the gdImageCreateFromGifPtr function in the Thomas Boutell graphics draw (GD) library (aka libgd) 2.0.33 allows remote attackers to cause a denial of service (CPU consumption) via malformed GIF data that causes an infinite loop.
CVSS Score: 5.4 (MEDIUM)
References: http://secunia.com/advisories/20500; http://secunia.com/advisories/20571; http://secunia.com/advisories/20676
CVE: CVE-2006-2193
Published: 2006-06-08
Description: Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=370355; http://bugzilla.remotesensing.org/show_bug.cgi?id=1196; http://lists.suse.com/archive/suse-security-announce/2006-Jun/0008.html
CVE: CVE-2006-2919
Published: 2006-06-09
Description: Unspecified vulnerability in Microsoft NetMeeting 3.01 allows remote attackers to cause a denial of service (crash or CPU consumption) and possibly execute arbitrary code via crafted inputs that trigger memory corruption.
CVSS Score: 7.8 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046636.html; http://secunia.com/advisories/20477; http://securitytracker.com/id?1016238
CVE: CVE-2006-2920
Published: 2006-06-09
Description: Sylpheed-Claws before 2.2.2 and Sylpheed before 2.2.6 allow remote attackers to bypass the URI check functionality and makes it easier to conduct phishing attacks via a URI that begins with a space character.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://secunia.com/advisories/20476; http://secunia.com/advisories/20577; http://sourceforge.net/project/shownotes.php?release_id=422662&group_id=25528
CVE: CVE-2006-2452
Published: 2006-06-09
Description: GNOME GDM 2.8, 2.12, 2.14, and 2.15, when the "face browser" feature is enabled, allows local users to access the "Configure Login Manager" functionality using their own password instead of the root password, which can be leveraged to gain additional privileges.
CVSS Score: 3.7 (LOW)
References: http://bugzilla.gnome.org/show_bug.cgi?id=343476; http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html; http://secunia.com/advisories/20532
CVE: CVE-2006-2912
Published: 2006-06-09
Description: Multiple SQL injection vulnerabilities in SelectaPix 1.31 allow remote attackers to execute arbitrary SQL commands via the (1) albumID parameter to (a) view_album.php or (b) index.php, (2) imageID parameter to (c) popup.php, or (3) username and (4) password parameters to (d) admin/member.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20134; http://secunia.com/secunia_research/2006-39/advisory/; http://securitytracker.com/id?1016256
CVE: CVE-2006-2913
Published: 2006-06-09
Description: Cross-site scripting (XSS) vulnerability in SelectaPix 1.31 allows remote attackers to inject arbitrary web script or HTML via the albumID parameter to (1) popup.php and (2) view_album.php.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/20134; http://secunia.com/secunia_research/2006-39/advisory/; http://www.osvdb.org/26247
CVE: CVE-2006-2921
Published: 2006-06-09
Description: PHP remote file inclusion vulnerability in cmpro_header.inc.php in Clan Manager Pro (CMPRO) 1.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the (1) cm_ext_server and (2) sitepath parameters.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20480; http://sx02.coresec.de/advisories/149.txt; http://www.vupen.com/english/advisories/2006/2166
CVE: CVE-2006-2922
Published: 2006-06-09
Description: Multiple PHP remote file inclusion vulnerabilities in MiraksGalerie 2.62 allow remote attackers to execute arbitrary PHP code via a URL in the (1) g_pcltar_lib_dir parameter in (a) pcltar.lib.php when register_globals is enabled, and (2) listconfigfile[] parameter in (b) galsecurity.lib.php and (c) galimage.lib.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20475; http://securitytracker.com/id?1016249; http://www.osvdb.org/26194
CVE: CVE-2006-2923
Published: 2006-06-09
Description: The iax_net_read function in the iaxclient open source library, as used in multiple products including (a) LoudHush 1.3.6, (b) IDE FISK 1.35 and earlier, (c) Kiax 0.8.5 and earlier, (d) DIAX, (e) Ziaxphone, (f) IAX Phone, (g) X-lite, (h) MediaX, (i) Extreme Networks ePhone, and (j) iaxComm before 1.2.0, allows remote attackers to execute arbitrary code via crafted IAX 2 (IAX2) packets with truncated (1) full frames or (2) mini-frames, which are detected in a length check but still processed, leading to buffer overflows related to negative length values.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://iaxclient.sourceforge.net/iaxcomm/; http://secunia.com/advisories/20466; http://secunia.com/advisories/20560
CVE: CVE-2006-2924
Published: 2006-06-09
Description: Ingate Firewall in the SIP module before 4.4.1 and SIParator before 4.4.1, when TLS is enabled or when SSL/TLS is enabled in the web server, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20479; http://securitytracker.com/id?1016244; http://securitytracker.com/id?1016245
CVE: CVE-2006-2925
Published: 2006-06-09
Description: Cross-site scripting (XSS) vulnerability in the web interface in Ingate Firewall before 4.4.1 and SIParator before 4.4.1 allows remote attackers to inject arbitrary web script or HTML, and steal cookies, via unspecified vectors related to "XSS exploits" in administrator functionality.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/20479; http://securitytracker.com/id?1016244; http://securitytracker.com/id?1016245
CVE: CVE-2006-2926
Published: 2006-06-09
Description: Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL HTTP request.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046646.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046649.html; http://secunia.com/advisories/20483
CVE: CVE-2006-2927
Published: 2006-06-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in post.asp in CodeAvalanche FreeForum (aka CAForum) 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_subject and (2) msg_body parameters.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20411; http://www.securityfocus.com/bid/18239; http://www.vupen.com/english/advisories/2006/2117
CVE: CVE-2006-2928
Published: 2006-06-09
Description: Multiple PHP remote file inclusion vulnerabilities in CMS-Bandits 2.5 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter in (1) dialogs/img.php and (2) dialogs/td.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20507; http://securityreason.com/securityalert/1068; http://www.osvdb.org/26241
CVE: CVE-2006-2929
Published: 2006-06-09
Description: PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[fileroot] parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20505; http://www.vupen.com/english/advisories/2006/2196; https://exchange.xforce.ibmcloud.com/vulnerabilities/26984
CVE: CVE-2006-2930
Published: 2006-06-09
Description: Unspecified vulnerability in Sun Grid Engine 5.3 and Sun N1 Grid Engine 6.0, when configured in Certificate Security Protocol (CSP) Mode, allows local users to shut down the grid service or gain access, even if access is denied.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/20518; http://securitytracker.com/id?1016247; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102321-1
CVE: CVE-2006-2943
Published: 2006-06-12
Description: Unspecified vulnerability in CGI-RESCUE WebFORM 4.1 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages.  NOTE: the details for this issue are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/20515; http://www.rescue.ne.jp/whatsnew/blog.cgi/permalink/[PII_REDACTED]4645
CVE: CVE-2006-2944
Published: 2006-06-12
Description: Unspecified vulnerability in CGI-RESCUE FORM2MAIL 1.21 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages.  NOTE: the details for this issue are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/20515; http://www.rescue.ne.jp/whatsnew/blog.cgi/permalink/[PII_REDACTED]4645
CVE: CVE-2006-2945
Published: 2006-06-12
Description: Unspecified vulnerability in the user profile change functionality in DokuWiki, when Access Control Lists are enabled, allows remote authenticated users to read unauthorized files via unknown attack vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.splitbrain.org/?do=details&id=825; http://secunia.com/advisories/20478; http://www.vupen.com/english/advisories/2006/2172
CVE: CVE-2006-2946
Published: 2006-06-12
Description: Dmx Forum 2.1a stores _includes/bd.inc under the web root with insufficient access control, which allows remote attackers to obtain database username and password information.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0799.html; http://secunia.com/advisories/20450; http://www.vupen.com/english/advisories/2006/2154
CVE: CVE-2006-2947
Published: 2006-06-12
Description: Dmx Forum 2.1a allows remote attackers to obtain username and password information via a direct request to pops/edit.php with a modified membre parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0799.html; http://secunia.com/advisories/20450; http://www.securityfocus.com/bid/18286
CVE: CVE-2006-2948
Published: 2006-06-12
Description: A-CART 2.0 stores the acart2_0.mdb file under the web document root with insufficient access control, which allows remote attackers to obtain username and password information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/20508; http://securitytracker.com/id?1005171; http://www.securiteam.com/windowsntfocus/5JP081F8AY.html
CVE: CVE-2006-2949
Published: 2006-06-12
Description: Cross-site scripting (XSS) vulnerability in private.php in MyBB 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the do parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20492; http://www.securityfocus.com/archive/1/436286/100/0/threaded; http://www.securityfocus.com/bid/18297