deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0789
Published: 2006-02-19
Description: Certain unspecified Kyocera printers have a default "admin" account with a blank password, which allows remote attackers to access an administrative menu via a telnet session.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0344.html; http://evader.wordpress.com/2006/02/16/kyocera-printers/; http://secunia.com/advisories/18896
CVE: CVE-2006-0790
Published: 2006-02-19
Description: Rockliffe MailSite 7.0 and earlier allows remote attackers to cause a denial of service by sending crafted LDAP packets to port 389/TCP, as demonstrated by the ProtoVer LDAP testsuite.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.immunitysec.com/pipermail/dailydave/2006-February/002926.html; http://secunia.com/advisories/18888; http://www.securityfocus.com/bid/16675
CVE: CVE-2006-0791
Published: 2006-02-19
Description: PHP remote file inclusion vulnerability in index.php in DreamCost HostAdmin allows remote attackers to include arbitrary files via the $path variable, which is not initialized before use.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0340.html; http://secunia.com/advisories/18901; http://securitytracker.com/id?1016273
CVE: CVE-2006-0792
Published: 2006-02-19
Description: Cross-site scripting (XSS) vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the newid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18776; http://www.osvdb.org/23260; http://www.securityfocus.com/bid/16706
CVE: CVE-2006-0793
Published: 2006-02-19
Description: frameset.php in V-webmail 1.6.2 allows remote attackers to conduct phishing attacks by referencing arbitrary websites in the rframe parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18776; http://www.osvdb.org/23261; http://www.securityfocus.com/bid/16706
CVE: CVE-2006-0794
Published: 2006-02-19
Description: help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18776; http://www.osvdb.org/23262; http://www.vupen.com/english/advisories/2006/0639
CVE: CVE-2006-0795
Published: 2006-02-19
Description: Absolute path traversal vulnerability in convert.cgi in Quirex 2.0.2 and earlier allows remote attackers to read arbitrary files, and possibly execute arbitrary code, via the (1) quiz_head, (2) quiz_foot, and (3) template variables.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://evuln.com/vulns/78/summary.html; http://secunia.com/advisories/18926; http://www.securityfocus.com/archive/1/426188/100/0/threaded
CVE: CVE-2006-0796
Published: 2006-02-19
Description: Cross-site scripting (XSS) vulnerability in default.php in Clever Copy 3.0 allows remote attackers to inject arbitrary web script or HTML via the Subject field when sending private messages (privatemessages.php). NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18873; http://www.osvdb.org/23235; http://www.securityfocus.com/bid/16681
CVE: CVE-2006-0797
Published: 2006-02-19
Description: Nokia N70 cell phone allows remote attackers to cause a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length field is less than the actual length of the packet, possibly triggering a buffer overflow, as demonstrated using the Bluetooth Stack Smasher (BSS).
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0316.html; http://secunia.com/advisories/18724; http://www.osvdb.org/23061
CVE: CVE-2006-0798
Published: 2006-02-19
Description: Multiple directory traversal vulnerabilities in the IMAP service in Macallan Mail Solution before 4.8.05.004 allow remote authenticated users to read e-mails of other users or create, modify, or delete directories via a .. (dot dot) in the argument to the (1) CREATE, (2) SELECT, (3) DELETE, or (4) RENAME commands.
CVSS Score: 5.5 (MEDIUM)
References: http://macallan.club.fr/MMS/index.html; http://secunia.com/advisories/18775; http://secunia.com/secunia_research/2006-4/advisory/
CVE: CVE-2006-0799
Published: 2006-02-19
Description: Microsoft Internet Explorer allows remote attackers to spoof a legitimate URL in the status bar and conduct a phishing attack via a web page with an anchor element with a legitimate "href" attribute, a form whose action points to a malicious URL, and an INPUT submit element that is modified to look like a legitimate URL.  NOTE: this issue is very similar to CVE-2004-1104, although the manipulations are slightly different.
CVSS Score: 4.0 (MEDIUM)
References: http://www.osvdb.org/23609; http://www.securityfocus.com/archive/1/425298/100/0/threaded; http://www.securityfocus.com/archive/1/425386/100/0/threaded
CVE: CVE-2006-0800
Published: 2006-02-20
Description: Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0469.html; http://news.postnuke.com/index.php?name=News&file=article&sid=2754; http://secunia.com/advisories/18937
CVE: CVE-2006-0801
Published: 2006-02-20
Description: SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is off, allows remote attackers to execute arbitrary SQL commands via the language parameter to admin.php.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0469.html; http://news.postnuke.com/index.php?name=News&file=article&sid=2754; http://secunia.com/advisories/18937
CVE: CVE-2006-0802
Published: 2006-02-20
Description: Cross-site scripting (XSS) vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is enabled, allows remote attackers to inject arbitrary web script or HTML via the language parameter in a missing or translation operation.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0469.html; http://news.postnuke.com/index.php?name=News&file=article&sid=2754; http://secunia.com/advisories/18937
CVE: CVE-2006-0804
Published: 2006-02-21
Description: Off-by-one error in TIN 1.8.0 and earlier might allow attackers to execute arbitrary code via unknown vectors that trigger a buffer overflow.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19130; http://security.gentoo.org/glsa/glsa-200611-18.xml; http://www.novell.com/linux/security/advisories/2006_05_sr.html
CVE: CVE-2006-0805
Published: 2006-02-21
Description: The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent (HTTP_USER_AGENT), which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, then replaying that pair in the random_num and gfx_check parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18936; http://securityreason.com/securityalert/455; http://www.securityfocus.com/archive/1/425394/100/0/threaded
CVE: CVE-2006-0806
Published: 2006-02-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to PHP_SELF.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://phpesp.cvs.sourceforge.net/phpesp/phpESP/admin/include/lib/adodb/adodb-pager.inc.php?r1=1.1&r2=1.2; http://secunia.com/advisories/18928; http://secunia.com/advisories/19555
CVE: CVE-2006-0807
Published: 2006-02-21
Description: Stack-based buffer overflow in NJStar Chinese and Japanese Word Processor 4.x and 5.x before 5.10 allows user-assisted attackers to execute arbitrary code via font names in NJStar (.njx) documents.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/18702; http://secunia.com/secunia_research/2006-5/advisory/; http://securityreason.com/securityalert/461
CVE: CVE-2006-0808
Published: 2006-02-21
Description: MUTE 0.4 allows remote attackers to cause a denial of service (messages not forwarded) and obtain sensitive information about a target by filling a client's mWebCache cache with malicious "zombie" nodes.
CVSS Score: 6.4 (MEDIUM)
References: http://cvs.sourceforge.net/viewcvs.py/mute-net/MUTE/doc/notes/notes.txt?view=markup; http://secunia.com/advisories/18980; http://www.osvdb.org/23336
CVE: CVE-2006-0809
Published: 2006-02-21
Description: Multiple SQL injection vulnerabilities in Skate Board 0.9 allow remote attackers to execute arbitrary SQL commands via the (1) usern parameter in (a) sendpass.php, and the (2) usern and (3) passwd parameters and (4) sf_cookie cookie in (b) login.php and (c) logged.php.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/84/summary.html; http://secunia.com/advisories/18978; http://securityreason.com/securityalert/540
CVE: CVE-2006-0810
Published: 2006-02-21
Description: Unspecified vulnerability in config.php in Skate Board 0.9 allows remote authenticated administrators to execute arbitrary PHP code by causing certain variables in config.php to be modified, possibly due to XSS or direct static code injection.
CVSS Score: 3.5 (LOW)
References: http://evuln.com/vulns/84/summary.html; http://secunia.com/advisories/18978; http://securityreason.com/securityalert/540
CVE: CVE-2006-0811
Published: 2006-02-21
Description: Cross-site scripting (XSS) vulnerability in reguser.php in Skate Board 0.9 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters involved with the registration form.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/84/summary.html; http://secunia.com/advisories/18978; http://securityreason.com/securityalert/540
CVE: CVE-2006-0821
Published: 2006-02-21
Description: SQL injection vulnerability in index.php in BXCP 0.299 allows remote attackers to execute arbitrary SQL commands via the tid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18929; http://www.vupen.com/english/advisories/2006/0660; https://exchange.xforce.ibmcloud.com/vulnerabilities/24783
CVE: CVE-2006-0822
Published: 2006-02-21
Description: Unspecified vulnerability in EmuLinker Kaillera Server before 0.99.17 allows remote attackers to cause a denial of service (probably resource consumption) via a crafted packet that causes a "ghost game" to be left on the server.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18938; http://sourceforge.net/project/shownotes.php?release_id=394690&group_id=127754; http://www.securityfocus.com/bid/16733
CVE: CVE-2006-0823
Published: 2006-02-21
Description: Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the (1) userid variable to users.php or (2) sessid variable to lib-sessions.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18920; http://www.geeklog.net/article.php/geeklog-1.4.0sr1; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6
CVE: CVE-2006-0824
Published: 2006-02-21
Description: Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and execute arbitrary code via (1) absolute paths in unspecified parameters and (2) the language cookie, as demonstrated for code execution using error.log.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18920; http://www.geeklog.net/article.php/geeklog-1.4.0sr1; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6
CVE: CVE-2006-0825
Published: 2006-02-21
Description: Multiple unspecified vulnerabilities in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allow remote attackers to bypass authentication or gain "unauthorized network access" via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18952; http://securitytracker.com/id?1015648; http://www.osvdb.org/23359
CVE: CVE-2006-0826
Published: 2006-02-21
Description: Unspecified vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to cause a denial of service via a crafted Postscript request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18952; http://securitytracker.com/id?1015648; http://www.securityfocus.com/bid/16723
CVE: CVE-2006-0827
Published: 2006-02-21
Description: Cross-site scripting vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18952; http://www.securityfocus.com/bid/16727; http://www.vupen.com/english/advisories/2006/0668
CVE: CVE-2006-0828
Published: 2006-02-21
Description: Unspecified vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to "reduce effectiveness of security features" via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18952; http://securitytracker.com/id?1015648; http://www.vupen.com/english/advisories/2006/0668
CVE: CVE-2006-0829
Published: 2006-02-21
Description: Cross-site scripting vulnerability in E-Blah Platinum 9.7 allows remote attackers to inject arbitrary web script or HTML via the referer (HTTP_REFERER), which is not sanitized when the log file is viewed by the administrator using "Click Log".
CVSS Score: 5.0 (MEDIUM)
References: http://evuln.com/vulns/83/summary.html; http://secunia.com/advisories/18992; http://securityreason.com/securityalert/528
CVE: CVE-2006-0830
Published: 2006-02-21
Description: The scripting engine in Internet Explorer allows remote attackers to cause a denial of service (resource consumption) and possibly execute arbitrary code via a web page that contains a recurrent call to an infinite loop in Javascript or VBscript, which consumes the stack, as demonstrated by resetting the "location" variable within the loop.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/425283/100/0/threaded; http://www.securityfocus.com/archive/1/425378/100/0/threaded; http://www.securityfocus.com/bid/16687
CVE: CVE-2006-0831
Published: 2006-02-21
Description: PHP remote file include vulnerability in index.php in Tasarim Rehberi allows remote attackers to execute arbitrary PHP code via a URL in the (1) sayfaadi or (2) sayfa parameter.  NOTE: this might be a site-specific issue.  If so, it should not be included in CVE.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/425389/100/0/threaded; http://www.securityfocus.com/archive/1/425389/100/0/threaded
CVE: CVE-2006-0832
Published: 2006-02-22
Description: Multiple SQL injection vulnerabilities in admin.asp in WPC.easy allow remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18945; http://securityreason.com/securityalert/456; http://www.securityfocus.com/archive/1/425395/100/0/threaded
CVE: CVE-2006-0833
Published: 2006-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Barracuda Directory 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) Add URL and (2) Suggest Category module.  NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18965; http://www.osvdb.org/23372; http://www.securityfocus.com/bid/16746
CVE: CVE-2006-0834
Published: 2006-02-22
Description: Uniden UIP1868P VoIP Telephone and Router has a default password of admin for the web-based configuration utility, which allows remote attackers to obtain sensitive information on the device such as telephone numbers called, and possibly connect to other hosts.  NOTE: it is possible that this password was configured by a reseller, not the original vendor; if so, then this is not a vulnerability in the product.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/425362/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24786; http://www.securityfocus.com/archive/1/425362/100/0/threaded
CVE: CVE-2006-0835
Published: 2006-02-22
Description: SQL injection vulnerability in dropbase.php in MitriDAT Web Calendar Pro allows remote attackers to modify internal SQL queries and cause a denial of service (inaccessible database) via the tabls parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0340.html; http://secunia.com/advisories/18902; http://www.securityfocus.com/bid/16789
CVE: CVE-2006-0836
Published: 2006-02-22
Description: Mozilla Thunderbird 1.5 allows user-assisted attackers to cause an unspecified denial of service by tricking the user into importing an LDIF file with a long field into the address book, as demonstrated by a long homePhone field.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0399.html; http://securityreason.com/securityalert/469; http://www.securityfocus.com/archive/1/425602/100/0/threaded
CVE: CVE-2006-0837
Published: 2006-02-22
Description: IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 has world-readable permissions for (1) /etc/neusecure.conf, (2) /opt/NeuSecure/etc/cms-3.0.236.buildconf, and (3) /opt/NeuSecure/bin/ns_archiver.log, which allows local users to read sensitive information such as passwords.  NOTE: IBM has privately confirmed to CVE that a fix is available for these issues.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0364.html; http://secunia.com/advisories/18922; http://securitytracker.com/id?1015642
CVE: CVE-2006-0838
Published: 2006-02-22
Description: IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 stores cleartext passwords in the (1) CMS_DBPASS, (2) CMSM_DBPASS, and (3) RPT_DBPASS fields in /etc/neusecure.conf, and in (4) /opt/NeuSecure/bin/ns_archiver.log, which allows local users to gain privileges.  NOTE: IBM has privately confirmed to CVE that a fix is available for these issues.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0364.html; http://secunia.com/advisories/18922; http://securitytracker.com/id?1015642
CVE: CVE-2006-0839
Published: 2006-02-22
Description: The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18959; http://www.securityfocus.com/archive/1/425290/100/0/threaded; http://www.securityfocus.com/bid/16705
CVE: CVE-2006-0840
Published: 2006-02-22
Description: manage_user_page.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' (quote) character, which allows remote attackers to trigger a SQL error that may be repeatedly reported to a user who makes subsequent web accesses with the MANTIS_MANAGE_COOKIE cookie.  NOTE: this issue might be the same as vector 2 in CVE-2005-4519.
CVSS Score: 5.0 (MEDIUM)
References: http://morph3us.org/advisories/20060214-mantis-100rc4.txt; http://sourceforge.net/project/showfiles.php?group_id=14963&package_id=12175&release_id=386059; http://sourceforge.net/project/shownotes.php?release_id=386059&group_id=14963
CVE: CVE-2006-0841
Published: 2006-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hide_status, (2) handler_id, (3) user_monitor, (4) reporter_id, (5) view_type, (6) show_severity, (7) show_category, (8) show_status, (9) show_resolution, (10) show_build, (11) show_profile, (12) show_priority, (13) highlight_changed, (14) relationship_type, and (15) relationship_bug parameters in (a) view_all_set.php; the (16) sort parameter in (b) manage_user_page.php; the (17) view_type parameter in (c) view_filters_page.php; and the (18) title parameter in (d) proj_doc_delete.php.  NOTE: item 17 might be subsumed by CVE-2005-4522.
CVSS Score: 4.3 (MEDIUM)
References: http://morph3us.org/advisories/20060214-mantis-100rc4.txt; http://secunia.com/advisories/21400; http://sourceforge.net/project/showfiles.php?group_id=14963&package_id=12175&release_id=386059
CVE: CVE-2006-0842
Published: 2006-02-22
Description: Cross-site scripting (XSS) vulnerability in Calacode @Mail 4.3 allows remote attackers to inject arbitrary web script or HTML via a modified javascript: string in the SRC attribute of an IMG element in an e-mail message, as demonstrated by "java&#09;script:."  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/18874; http://www.osvdb.org/23236; http://www.securityfocus.com/bid/16683
CVE: CVE-2006-0843
Published: 2006-02-22
Description: Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18923; http://securityreason.com/securityalert/522; http://www.evuln.com/vulns/82/summary.html
CVE: CVE-2006-0844
Published: 2006-02-22
Description: Leif M. Wright's Blog 3.5 does not make a password comparison when authenticating an administrator via a cookie, which allows remote attackers to bypass login authentication, probably by setting the blogAdmin cookie.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18923; http://securityreason.com/securityalert/522; http://www.evuln.com/vulns/82/summary.html
CVE: CVE-2006-0845
Published: 2006-02-22
Description: Leif M. Wright's Blog 3.5 allows remote authenticated users with administrative privileges to execute arbitrary programs, including shell commands, by configuring the sendmail path to a malicious pathname.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/18923; http://securityreason.com/securityalert/522; http://www.evuln.com/vulns/82/summary.html