deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4198
Published: 2006-08-17
Description: PHP remote file inclusion vulnerability in includes/session.php in Wheatblog (wB) 1.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the wb_class_dir parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/25903; http://securityreason.com/securityalert/1410; http://secwatch.org/advisories/1015085/
CVE: CVE-2006-4199
Published: 2006-08-17
Description: Cross-site scripting (XSS) vulnerability in Soft3304 04WebServer 1.83 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly sanitized before it is returned in an error page, a different vulnerability than CVE-2004-1512.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21504; http://www.securityfocus.com/bid/19496; http://www.soft3304.net/04WebServer/Security.html
CVE: CVE-2006-4200
Published: 2006-08-17
Description: Unspecified vulnerability in 04WebServer 1.83 and earlier allows remote attackers to bypass user authentication via unspecified vectors related to request processing.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21504; http://www.securityfocus.com/bid/19496; http://www.soft3304.net/04WebServer/Security.html
CVE: CVE-2006-4201
Published: 2006-08-17
Description: Unspecified vulnerability in the backup agent and Cell Manager in HP OpenView Storage Data Protector 5.1 and 5.5 before 20060810 allows remote attackers to execute arbitrary code on an agent via unspecified vectors related to authentication and input validation.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00742778; http://jvn.jp/niscc/NISCC-412866/; http://secunia.com/advisories/21485
CVE: CVE-2006-4202
Published: 2006-08-17
Description: SQL injection vulnerability in proje_goster.php in Spidey Blog Script 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21482; http://www.securityfocus.com/bid/19518; https://exchange.xforce.ibmcloud.com/vulnerabilities/28374
CVE: CVE-2006-4203
Published: 2006-08-17
Description: PHP remote file inclusion vulnerability in help.mmp.php in the MMP Component (com_mmp) 1.2 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21479; http://www.securityfocus.com/bid/19502; http://www.vupen.com/english/advisories/2006/3278
CVE: CVE-2006-4204
Published: 2006-08-17
Description: Multiple PHP remote file inclusion vulnerabilities in PHProjekt 5.1 and possibly earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) path_pre parameter in lib/specialdays.php and the (2) lib_path parameter in lib/dbman_filter.inc.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://phprojekt.com/modules.php?op=modload&name=News&file=article&sid=257&mode=thread&order=0; http://secunia.com/advisories/21526; http://www.securityfocus.com/bid/19541
CVE: CVE-2006-4205
Published: 2006-08-17
Description: Multiple PHP remote file inclusion vulnerabilities in WebDynamite ProjectButler 0.8.4 allow remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter to /classes/ scripts including (1) Cache.class.php, (2) Customer.class.php, (3) Performance.class.php, (4) Project.class.php, (5) Representative.class.php, (6) User.class.php, or (7) common.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19503; http://www.vupen.com/english/advisories/2006/3294; https://exchange.xforce.ibmcloud.com/vulnerabilities/28362
CVE: CVE-2006-4206
Published: 2006-08-17
Description: Cross-site scripting (XSS) vulnerability in calendar.asp in ASPPlayground.NET Forum Advanced Edition 2.4.5 Unicode, and possibly other versions before October 15, 2006, allows remote attackers to inject arbitrary web script or HTML via the calendarID parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-4206; http://securityreason.com/securityalert/1405; http://www.osvdb.org/29232
CVE: CVE-2006-4207
Published: 2006-08-17
Description: Multiple PHP remote file inclusion vulnerabilities in Bob Jewell Discloser 0.0.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the fileloc parameter to (1) content/content.php or (2) /inc/indexhead.php.
CVSS Score: 7.5 (HIGH)
References: http://securitydot.net/xpl/exploits/vulnerabilities/articles/1314/exploit.html; http://securitytracker.com/id?1016714; http://www.securityfocus.com/bid/19532
CVE: CVE-2006-4208
Published: 2006-08-17
Description: Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier allows remote authenticated users with administrative privileges to read arbitrary files via a .. (dot dot) in the backup parameter to edit.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21486; http://securityreason.com/securityalert/1401; http://trac.wordpress.org/changeset/4095
CVE: CVE-2006-4209
Published: 2006-08-17
Description: PHP remote file inclusion vulnerability in install3.php in WEBInsta Mailing List Manager 1.3e allows remote attackers to execute arbitrary PHP code via a URL in the cabsolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1404; http://www.bb-pcsecurity.de/Websecurity/311/org/WEBInsta_Mailing_list_manager_%28cabsolute_path%29_1.3e_RFI.htm; http://www.securityfocus.com/archive/1/442983/100/0/threaded
CVE: CVE-2006-4210
Published: 2006-08-17
Description: nu_mail.inc.php in Andreas Kansok phPay 2.02 and 2.02.1, when register_globals is enabled, allows remote attackers to use the server as an open mail relay via modified mail_text2, user_row[5], nu_mail_1, and shop_mail parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/21454; http://www.securityfocus.com/bid/19517; https://exchange.xforce.ibmcloud.com/vulnerabilities/28366
CVE: CVE-2006-4211
Published: 2006-08-17
Description: Cross-site scripting (XSS) vulnerability in b0zz and Chris Vincent Owl Intranet Engine 0.90 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/21519; http://sourceforge.net/tracker/index.php?func=detail&aid=1540643&group_id=9444&atid=309444
CVE: CVE-2006-4212
Published: 2006-08-17
Description: SQL injection vulnerability in b0zz and Chris Vincent Owl Intranet Engine 0.90 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/21519; http://sourceforge.net/tracker/index.php?func=detail&aid=1540643&group_id=9444&atid=309444
CVE: CVE-2006-4213
Published: 2006-08-17
Description: PHP remote file inclusion vulnerability in config.php in David Kent Norman Thatware 0.4.6 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/3257; https://exchange.xforce.ibmcloud.com/vulnerabilities/28313; https://www.exploit-db.com/exploits/2166
CVE: CVE-2006-4214
Published: 2006-08-17
Description: Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) GPC data to the ipn_get_stored_session function in ipn_main_handler.php, which can be leveraged to modify elements of $_SESSION; and allow remote authenticated users to execute arbitrary SQL commands via (2) a session id within a cookie to whos_online_session_recreate, (3) the quantity field to the add_cart function, (4) an id[] parameter when adding an item to a shopping cart, or (5) a redemption code when checking out (dc_redeem_code parameter to includes/modules/order_total/ot_coupon.php).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/21484; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6; http://www.osvdb.org/28144
CVE: CVE-2006-4215
Published: 2006-08-17
Description: PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig[999][0][loadFile] parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21484; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6; http://www.osvdb.org/28149
CVE: CVE-2006-4216
Published: 2006-08-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-4159.  Reason: This candidate is a duplicate of CVE-2006-4159.  Notes: All CVE users should reference CVE-2006-4159 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-4217
Published: 2006-08-17
Description: PHP remote file inclusion vulnerability in modules/usersonline/users.php in WEBInsta CMS 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the module_dir parameter, a different vulnerability than CVE-2006-4196.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21463; https://exchange.xforce.ibmcloud.com/vulnerabilities/28557; http://secunia.com/advisories/21463
CVE: CVE-2006-4218
Published: 2006-08-17
Description: Directory traversal vulnerability in Zen Cart 1.3.0.2 and earlier allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences in the typefilter parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21484; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6; http://www.securityfocus.com/bid/19543
CVE: CVE-2006-4219
Published: 2006-08-18
Description: The Terminal Services COM object (tsuserex.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by instantiating it as an ActiveX object in Internet Explorer 6.0 SP1 on Microsoft Windows 2003 EE SP1 CN.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1403; http://www.securityfocus.com/archive/1/443493/100/0/threaded; http://www.securityfocus.com/bid/19570
CVE: CVE-2006-4221
Published: 2006-08-18
Description: Stack-based buffer overflow in the IBM Access Support eGatherer ActiveX control before 3.20.0284.0 allows remote attackers to execute arbitrary code via a long filename parameter to the RunEgatherer method.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/21528; http://securityreason.com/securityalert/1424; http://securitytracker.com/id?1016705
CVE: CVE-2006-4222
Published: 2006-08-18
Description: Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.0.2.13 have unspecified vectors and impact, including (1) an "authority problem" in ThreadIdentitySupport as identified by PK25199, and "Potential security exposure" issues as identified by (2) PK22747, (3) PK24334, (4) PK25740, and (5) PK26123.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21487; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006876#60213; http://www.vupen.com/english/advisories/2006/3281
CVE: CVE-2006-4223
Published: 2006-08-18
Description: IBM WebSphere Application Server (WAS) before 6.0.2.13 allows context-dependent attackers to obtain sensitive information via unspecified vectors related to "JSP source code exposure" (PK23475), which occurs when ibm-web-ext.xmi sets fileServingEnabled to true or ExtendedDocumentRoot is used to place a JSP outside a WAR.file; (3) the First Failure Data Capture (ffdc) log file (PK24834); and (4) traces (PK25568), a different issue than CVE-2006-4137.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/21487; http://secunia.com/advisories/24478; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006876#60213
CVE: CVE-2006-4224
Published: 2006-08-18
Description: Cross-site scripting (XSS) vulnerability in calendar.php in Virtual War (VWar) 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the year parameter.  NOTE: The page parameter vector is covered by CVE-2006-4009.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1413; http://www.securityfocus.com/archive/1/443171/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/28552
CVE: CVE-2006-4225
Published: 2006-08-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-3139.  Reason: This candidate is a duplicate of CVE-2006-3139.  Notes: All CVE users should reference CVE-2006-3139 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-4226
Published: 2006-08-18
Description: MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.
CVSS Score: 3.6 (LOW)
References: http://bugs.mysql.com/bug.php?id=17647; http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html; http://docs.info.apple.com/article.html?artnum=305214
CVE: CVE-2006-4227
Published: 2006-08-18
Description: MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://bugs.mysql.com/bug.php?id=18630; http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html; http://lists.mysql.com/commits/7918
CVE: CVE-2006-4228
Published: 2006-08-18
Description: Symantec Veritas NetBackup PureDisk Remote Office Edition 6.0 before MP1 20060816 allows remote attackers to bypass authentication and gain privileges via unknown attack vectors in the management interface.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/21507; http://securityreason.com/securityalert/1412; http://securityresponse.symantec.com/avcenter/security/Content/2006.08.16.html
CVE: CVE-2006-4229
Published: 2006-08-18
Description: PHP remote file inclusion vulnerability in archive.php in the mosListMessenger Component (com_lm) before 20060719 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://blog.phil-taylor.com/2006/08/09/information-on-moslistmessenger-security-hardening/; http://forum.joomla.org/index.php?topic=86460.msg439766#msg439766; http://secunia.com/advisories/21531
CVE: CVE-2006-4230
Published: 2006-08-18
Description: Multiple PHP remote file inclusion vulnerabilities in index.php in Lizge V.20 Web Portal allow remote attackers to execute arbitrary PHP code via a URL in the (1) lizge or (2) bade parameters.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1415; http://www.securityfocus.com/archive/1/443309/100/0/threaded; http://www.securityfocus.com/bid/19533
CVE: CVE-2006-4231
Published: 2006-08-18
Description: IrfanView 3.98 (with plugins) allows remote attackers to cause a denial of service (application crash) via a crafted CUR image file.
CVSS Score: 2.6 (LOW)
References: http://securityreason.com/securityalert/1414; http://www.securityfocus.com/archive/1/443187/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/28377
CVE: CVE-2006-4232
Published: 2006-08-18
Description: Race condition in the grid-proxy-init tool in Globus Toolkit 3.2.x, 4.0.x, and 4.1.0 before 20060815 allows local users to steal credential data by replacing the proxy credentials file in between file creation and the check for exclusive file access.
CVSS Score: 1.2 (LOW)
References: http://secunia.com/advisories/21516; http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html; http://www.securityfocus.com/bid/19549
CVE: CVE-2006-4233
Published: 2006-08-18
Description: Globus Toolkit 3.2.x, 4.0.x, and 4.1.0 before 20060815 allow local users to obtain sensitive information (proxy certificates) and overwrite arbitrary files via a symlink attack on temporary files in the /tmp directory, as demonstrated by files created by (1) myproxy-admin-adduser, (2) grid-ca-sign, and (3) grid-security-config.
CVSS Score: 3.6 (LOW)
References: http://secunia.com/advisories/21516; http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html; http://www.securityfocus.com/bid/19549
CVE: CVE-2006-4234
Published: 2006-08-18
Description: PHP remote file inclusion vulnerability in classes/query.class.php in dotProject 2.0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the baseDir parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19547; http://www.vupen.com/english/advisories/2006/3297; https://exchange.xforce.ibmcloud.com/vulnerabilities/28401
CVE: CVE-2006-0948
Published: 2006-08-21
Description: AOL 9.0 Security Edition revision 4184.2340, and probably other versions, uses insecure permissions (Everyone/Full Control) for the "America Online 9.0" directory, which allows local users to gain privileges by replacing critical files.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/18734; http://secunia.com/secunia_research/2006-08; http://securityreason.com/securityalert/1416
CVE: CVE-2006-4235
Published: 2006-08-21
Description: Buffer overflow in the import project functionality in Sony SonicStage Mastering Studio 1.1.00 through 2.2.01 allows remote attackers to execute arbitrary code via a crafted SMP file.
CVSS Score: 7.5 (HIGH)
References: http://kb.sony-europe.com/KB/Solutions/EN/V00000_V00499/v00244.html; http://secunia.com/advisories/21510; http://www.kb.cert.org/vuls/id/697761
CVE: CVE-2006-4236
Published: 2006-08-21
Description: Multiple PHP remote file inclusion vulnerabilities in POWERGAP allow remote attackers to execute arbitrary PHP code via a URL in the (1) shopid parameter to (a) s01.php, (b) s02.php, (c) s03.php, and (d) s04.php; and possibly a URL located after "shopid=" or "sid=" in the PATH_INFO.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1417; http://securitytracker.com/id?1016715; http://www.osvdb.org/29496
CVE: CVE-2006-4237
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in pageheaderdefault.inc.php in Invisionix Roaming System Remote (IRSR) 0.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _sysSessionPath parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19567; https://exchange.xforce.ibmcloud.com/vulnerabilities/28427; https://www.exploit-db.com/exploits/2199
CVE: CVE-2006-4238
Published: 2006-08-21
Description: SQL injection vulnerability in torrents.php in WebTorrent (WTcom) 0.2.4 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter in category mode.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19569; https://exchange.xforce.ibmcloud.com/vulnerabilities/28426; https://www.exploit-db.com/exploits/2200
CVE: CVE-2006-4239
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in include/urights.php in Outreach Project Tool (OPT) Max 1.2.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CRM_inc parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21517; http://www.securityfocus.com/bid/19548; http://www.vupen.com/english/advisories/2006/3296
CVE: CVE-2006-4240
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in index.php in Fusion News 3.7 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0317.html; http://securityreason.com/securityalert/1420; http://securitytracker.com/id?1016701
CVE: CVE-2006-4241
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in processor/reporter.sql.php in the Reporter Mambo component (com_reporter) allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1419; http://www.securityfocus.com/archive/1/443373/100/0/threaded; http://www.securityfocus.com/bid/19553
CVE: CVE-2006-4242
Published: 2006-08-21
Description: PHP remote file inclusion vulnerability in install.jim.php in the JIM 1.0.1 component for Joomla or Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21545; http://securityreason.com/securityalert/1418; http://www.osvdb.org/27990
CVE: CVE-2006-3506
Published: 2006-08-21
Description: Buffer overflow in the Xsan Filesystem driver on Mac OS X 10.4.7 and OS X Server 10.4.7 allows local users with Xsan write access, to execute arbitrary code via unspecified vectors related to "processing a path name."
CVSS Score: 4.6 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304188; http://secunia.com/advisories/21551; http://securitytracker.com/id?1016711
CVE: CVE-2006-4145
Published: 2006-08-21
Description: The Universal Disk Format (UDF) filesystem driver in Linux kernel 2.6.17 and earlier allows local users to cause a denial of service (hang and crash) via certain operations involving truncated files, as demonstrated via the dd command.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://lkml.org/lkml/2006/6/16/6; http://secunia.com/advisories/21515; http://secunia.com/advisories/21695
CVE: CVE-2006-4253
Published: 2006-08-21
Description: Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple Javascript timed events that load a deeply nested XML file, followed by redirecting the browser to another page, which leads to a concurrency failure that causes structures to be freed incorrectly, as demonstrated by (1) ffoxdie and (2) ffoxdie3.  NOTE: it has been reported that Netscape 8.1 and K-Meleon 1.0.1 are also affected by ffoxdie.  Mozilla confirmed to CVE that ffoxdie and ffoxdie3 trigger the same underlying vulnerability.  NOTE: it was later reported that Firefox 2.0 RC2 and 1.5.0.7 are also affected.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://lcamtuf.coredump.cx/ffoxdie.html; http://lcamtuf.coredump.cx/ffoxdie3.html
CVE: CVE-2006-4254
Published: 2006-08-21
Description: Unspecified vulnerability in setlocale in IBM AIX 5.1.0 through 5.3.0 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://secunia.com/advisories/21541; http://securitytracker.com/id?1016712
CVE: CVE-2006-4255
Published: 2006-08-21
Description: Cross-site scripting (XSS) vulnerability in horde/imp/search.php in Horde IMP H3 before 4.1.3 allows remote attackers to include arbitrary web script or HTML via multiple unspecified vectors related to folder names, as injected into the vfolder_label form field in the IMP search screen.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.horde.org/archives/announce/2006/000294.html; http://secunia.com/advisories/21533; http://securityreason.com/securityalert/1423