rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-1849 
Multiple SQL injection vulnerabilities in members_only/index.cgi in xFlow 5.46.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) position and (2) id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1850 
Multiple cross-site scripting (XSS) vulnerabilities in xFlow 5.46.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) level, (2) position, (3) id, and (4) action parameters to members_only/index.cgi, and the (5) page parameter to customer_area/index.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1851 
xFlow 5.46.11 and earlier allows remote attackers to determine the installation path of the application via the (1) action parameter to members_only/index.cgi and (2) page parameter customer_area/index.cgi, probably due to invalid values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1852 
SQL injection vulnerability in category.php in Article Publisher Pro 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1853 
Multiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execute arbitrary SQL commands via the (1) id parameter in (a) user.php, or (2) where and (3) order parameters to (b) admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1854 
Multiple cross-site scripting (XSS) vulnerabilities in BluePay Manager 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML during a login action via the (1) Account Name and (2) Username field.  NOTE: the vendor has disputed this vulnerability, saying that "it does not exist currently in the Bluepay 2.0 product," and older versions might not have been affected either.  As of 20060512, CVE has not formally investigated this dispute
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1855 
choose_new_parent in Linux kernel before 2.6.11.12 includes certain debugging code, which allows local users to cause a denial of service (panic) by causing certain circumstances involving termination of a parent process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-18T19:00:00.000Z
CVE-2006-1856 
Certain modifications to the Linux kernel 2.6.16 and earlier do not add the appropriate Linux Security Modules (LSM) file_permission hooks to the (1) readv and (2) writev functions, which might allow attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-19T23:00:00.000Z
CVE-2006-1857 
Buffer overflow in SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malformed HB-ACK chunk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T16:00:00.000Z
CVE-2006-1858 
SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a chunk length that is inconsistent with the actual length of provided parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T16:00:00.000Z
CVE-2006-1859 
Memory leak in __setlease in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (memory consumption) via unspecified actions related to an "uninitialised return value," aka "slab leak."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T01:00:00.000Z
CVE-2006-1860 
lease_init in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (fcntl_setlease lockup) via actions that cause lease_init to free a lock that might not have been allocated on the stack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T01:00:00.000Z
CVE-2006-1861 
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c.  NOTE: item 4 was originally identified by CVE-2006-2493.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-1862 
The virtual memory implementation in Linux kernel 2.6.x allows local users to cause a denial of service (panic) by running lsof a large number of times in a way that produces a heavy system load.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T17:00:00.000Z
CVE-2006-1863 
Directory traversal vulnerability in CIFS in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences, a similar vulnerability to CVE-2006-1864.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T22:00:00.000Z
CVE-2006-1864 
Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences, a similar vulnerability to CVE-2006-1863.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-26T18:00:00.000Z
CVE-2006-1865 
Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper applications while indexing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-21T23:00:00.000Z
CVE-2006-1866 
Multiple unspecified vulnerabilities in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and other versions have unknown impact and attack vectors in the (1) Advanced Replication component, as identified by Vuln# DB01, and (2) Oracle Spatial component, as identified by Vuln# DB10.  NOTE: details are unavailable from Oracle, but as of 20060421, they have not publicly disputed a claim by a reliable independent researcher that states that DB01 is an unknown issue in the DBMS_REPUTIL package, and DB10 is SQL injection in the INSERT_CATALOG, UPDATE_CATALOG, and DELETE_CATALOG functions of the SDO_CATALOG package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1867 
Unspecified vulnerability in Oracle Database Server 9.2.0.6 has unknown impact and attack vectors in the Advanced Replication component, aka Vuln# DB02.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1868 
Buffer overflow in the Advanced Replication component in Oracle Database Server 10.1.0.4 allows database users to execute arbitrary code via the VERIFY_LOG procedure of the DBMS_SNAPSHOT_UTL package, aka Vuln# DB03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1869 
Unspecified vulnerability in Oracle Database Server 8.1.7.4 and 9.0.1.5 has unknown impact and attack vectors in the Dictionary component, aka Vuln# DB04.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1870 
Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 has unknown impact and attack vectors in the Export component, aka Vuln# DB05.  NOTE: details are unavailable from Oracle, but as of 20060427, they have not publicly commented on whether DB05 is the same issue as CVE-2006-2081.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1871 
SQL injection vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.5 allows remote attackers to execute arbitrary SQL commands via the DELETE_FROM_TABLE function in the DBMS_LOGMNR_SESSION (Log Miner) package, aka Vuln# DB06.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1872 
Unspecified vulnerability in Oracle Database Server 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors in the Oracle Enterprise Manager Intelligent Agent component, aka Vuln# DB07.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1873 
Unspecified vulnerability in Oracle Database Server 9.2.0.7, 10.1.0.4, and 10.2.0.1 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB08.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1874 
Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, and 9.2.0.6 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB09.  NOTE: Oracle has not disputed reliable claims that this issue is SQL injection in MDSYS.PRVT_IDX using the (1) EXECUTE_INSERT, (2) EXECUTE_DELETE, (3) EXECUTE_UPDATE, (4) EXECUTE UPDATE, and (5) CRT_DUMMY functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1875 
Unspecified vulnerability in Oracle Database Server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB11.  NOTE: Oracle has not disputed reliable researcher claims that this issue is SQL injection in MDSYS.SDO_LRS_TRIG_INS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1876 
Unspecified vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.4 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB12.  NOTE: details are unavailable from Oracle, but as of 20060421, they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the (1) GEN_RID_RANGE_BY_AREA and (2) GEN_RID_RANGE functions in the MDSYS.SDO_PRIDX package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1877 
Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, and 9.2.0.7 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB13.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1878 
Cross-site scripting (XSS) vulnerability in index.php in phpFaber TopSites allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1879 
Multiple unspecified vulnerabilities in the Email Server component in Oracle Collaboration Suite 9.0.4.2, 10.1.1, 10.1.2.0, and 10.1.2.1 have unknown impact and attack vectors, aka Vuln# (1) OCS01, (2) OCS02, (3) OCS03, and (4) OCS04.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1880 
Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, as identified by Vuln# (1) APPS01 in the (a) Application Install component; (2) APPS09 in the (b) Oracle Diagnostics Interfaces component; (3) APPS10 in the (c) Oracle General Ledger component; (4) APPS12 and (5) APPS13 in the (d) Oracle Receivables component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1881 
Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9 has unknown impact and attack vectors.  component, aka Vuln# APPS02.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1882 
Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10 have unknown impact and attack vectors, as identified by Vuln# (1) APPS03 in (a) iProcurement; (2) APPS04 in (b) Oracle Application Object Library; (3) APPS06, (4) APPS07, and (5) APPS08 in (c) Oracle Applications Technology Stack; and (6) APPS11 in (d) Oracle Order Capture.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1883 
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite and Applications 11.5.10CU1 has unknown impact and attack vectors, aka Vuln# APPS05.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1884 
Unspecified vulnerability in the Oracle Thesaurus Management System component in Oracle E-Business Suite and OPA 4.5.2 Applications has unknown impact and attack vectors, aka Vuln# OPA01.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1885 
Multiple unspecified vulnerabilities in the Reporting Framework component in Oracle Enterprise Manager 9.0.1.5 and 9.2.0.7 have unknown impact and attack vectors, aka Vuln# (1) EM01 and (2) EM02.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1886 
Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise 8.46.12 and 8.47.04 has unknown impact and attack vectors, aka Vuln# PSE01.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1887 
Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Security Server 8.95.J1 has unknown impact and attack vectors, aka Vuln# JDE01.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1888 
phpGraphy 0.9.11 and earlier allows remote attackers to bypass authentication and gain administrator privileges via a direct request to index.php with the editwelcome parameter set to 1, which can then be used to modify the main page to inject arbitrary HTML and web script.  NOTE: XSS attacks are resultant from this issue, since normal functionality allows the admin to modify pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1889 
Cross-site scripting (XSS) vulnerability in the search action handler in index.php in Nils Asmussen (aka SCRIPTSOLUTION) Boardsolution 1.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the "Search for" item (keyword parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1890 
Multiple PHP remote file inclusion vulnerabilities in myWebland myEvent 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter in (1) event.php and (2) initialize.php.  NOTE: vector 2 was later reported to affect 1.4 as well.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1891 
Cross-site scripting (XSS) vulnerability in Martin Scheffler betaboard 0.1 allows remote attackers to inject arbitrary web script or HTML via a user's profile, possibly using the FormVal_profile parameter.  NOTE: it is not clear whether this is a distributable product or a site-specific vulnerability.  If it is site-specific, then it should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1892 
avast! 4 Linux Home Edition 1.0.5 allows local users to modify permissions of arbitrary files via a symlink attack on the /tmp/_avast4_ temporary directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1893 
Cross-site scripting (XSS) vulnerability in print.php in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1894 
Cross-site scripting (XSS) vulnerability in RevoBoard 1.8, as derived from PunBB, allows remote attackers to inject arbitrary web script or HTML via a substitution cipher of the email tag, which is transformed when the application's e-mail address obfuscator reverses the transformation.  NOTE: it is not clear whether this is a site-specific issue; however, the claimed codebase relationship with PunBB might be relevant.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1895 
Direct static code injection vulnerability in includes/template.php in phpBB allows remote authenticated users with write access to execute arbitrary PHP code by modifying a template in a way that (1) bypasses a loose ".*" regular expression to match BEGIN and END statements in overall_header.tpl, or (2) is used in an eval statement by includes/bbcode.php for bbcode.tpl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1896 
Unspecified vulnerability in phpBB allows remote authenticated users with Administration Panel access to execute arbitrary PHP code via crafted Font Colour 3 ($theme[fontcolor3] variable) and/or signature values, possibly involving the highlight functionality.  NOTE: the original report does not clarify whether this issue is static code injection, eval injection, or another type of vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1897 
Webplus (aka talentsoft) Web+Shop 5.3.6, when Redirect URL for "Script Not Found" Error is not configured, allows remote attackers to obtain sensitive information via a quote (') or possibly other invalid value in the storeid parameter in store.wml in webplus.exe, which reveals the path in a "Script Not Found" error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1898 
Multiple cross-site scripting (XSS) vulnerabilities in Ralph Capper Tiny PHP Forum (TPF) 3.6 allow remote attackers to inject arbitrary web script or HTML via (1) the uname parameter in a view action in profile.php and (2) a login name.  NOTE: the "Access to hash password" issue is already covered by CVE-2006-0103.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1899 
Multiple cross-site scripting (XSS) vulnerabilities in dev Neuron Blog 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) website parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1900 
Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers to execute arbitrary code via a long value in (1) the COMPACT attribute of the COLGROUP element, (2) the ROWS attribute of the TEXTAREA element, and (3) the COLOR attribute of the LEGEND element; and via other unspecified attack vectors consisting of "dozens of possible snippets."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1901 
Mozilla Camino 1.0 and earlier allow remote attackers to cause a denial of service (null dereference and application crash or hang) via HTML with certain improperly nested elements.  NOTE: this might be the same issue as CVE-2006-1724.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1902 
fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR, which might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.NOTE: the vendor states that the essence of the issue is "not correctly interpreting an offset to a pointer as a signed value."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1903 
Multiple cross-site scripting (XSS) vulnerabilities in UserLand Manila allow remote attackers to inject arbitrary web script or HTML (1) via the referer parameter in sendMail, and via attributes of (2) the A element and certain other HTML elements in web pages edited with the editInBrowser module.  NOTE: the msgReader$1 mode attack vector is already covered by CVE-2006-1769.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1904 
Cross-site scripting (XSS) vulnerability in index.php in AnimeGenesis Gallery allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1905 
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1906 
Cross-site scripting (XSS) vulnerability in index.php in jjgan852 phpLister 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T10:00:00.000Z
CVE-2006-1907 
Multiple SQL injection vulnerabilities in myEvent 1.x allow remote attackers to inject arbitrary SQL commands via the event_id parameter to (1) addevent.php or (2) del.php or (3) event_desc parameter to addevent.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1908 
Cross-site scripting vulnerability in addevent.php in myEvent 1.x allows remote attackers to inject arbitrary web script or HTML via the event_desc parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1909 
Directory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a .//./ (modified dot dot slash) in the file parameter, which causes a regular expression to collapse the sequences into standard "../" sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z
CVE-2006-1910 
config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later executed.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-20T18:00:00.000Z