rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-6133 
Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and 2005 SP1 (formerly Business Objects Crystal Reports XI Professional) allows user-assisted remote attackers to execute arbitrary code via a crafted RPT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T01:00:00.000Z
CVE-2006-6134 
Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long HREF attribute, using an unrecognized protocol, in a REF element in an ASX PlayList file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T01:00:00.000Z
CVE-2006-6135 
Multiple unspecified vulnerabilities in IBM WebSphere Application Server 6.1.0 before Fix Pack 3 (6.1.0.3) have unknown impact and attack vectors, related to (1) a "Potential security vulnerability" (PK29725) and (2) "Potential security exposure" (PK30831).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T02:00:00.000Z
CVE-2006-6136 
IBM WebSphere Application Server 6.1.0 before Fix Pack 3 (6.1.0.3) does not perform EAL4 authentication checks at the proper time during "registering of response operation," which has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T02:00:00.000Z
CVE-2006-6137 
Multiple PHP remote file inclusion vulnerabilities in Sisfo Kampus 0.8 allow remote attackers to execute arbitrary PHP code via a URL in the (1) exec parameter to index.php or (2) print parameter to print.php, which is also accessible via the print command to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T02:00:00.000Z
CVE-2006-6138 
Directory traversal vulnerability in download.php in Sisfo Kampus 0.8 allows remote attackers to list arbitrary directories via an absolute pathname in the dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T02:00:00.000Z
CVE-2006-6139 
Directory traversal vulnerability in downloadexcel.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitrary files via the fn parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T02:00:00.000Z
CVE-2006-6140 
PHP remote file inclusion vulnerability in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to execute arbitrary PHP code via a URL in the slnt parameter to (1) index.php and (2) print.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T02:00:00.000Z
CVE-2006-6141 
Buffer overflow in Tftpd32 3.01 allows remote attackers to cause a denial of service via a long GET or PUT request, which is not properly handled when the request is displayed in the title of the gauge window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T02:00:00.000Z
CVE-2006-6142 
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-05T11:00:00.000Z
CVE-2006-6143 
The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-10T00:00:00.000Z
CVE-2006-6144 
The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-10T00:00:00.000Z
CVE-2006-6145 
CRYPTOCard CRYPTO-Server before 6.4.56 stores LDAP credentials in plaintext in UninstallerData\installvariables.properties, which has insecure permissions and allows local users to obtain the credentials. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6146 
Buffer overflow in the HPDF_Page_Circle function in hpdf_page_operator.c in Takeshi Kanno Haru Free PDF Library (libharu2, aka libharu) 2.0.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via certain arguments that yield a large amount of PDF data, as demonstrated by a filled circle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6147 
Multiple SQL injection vulnerabilities in JiRos Links Manager allow remote attackers to execute arbitrary SQL commands via the (1) LinkID parameter to openlink.asp or the (2) CategoryID parameter to viewlinks.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6148 
Multiple cross-site scripting (XSS) vulnerabilities in submitlink.asp in JiRos Links Manager allow remote attackers to inject arbitrary web script or HTML via the (1) lName, (2) lURL, (3) lImage, and (4) lDescription parameters.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6149 
SQL injection vulnerability in index.asp in JiRos FAQ Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the tID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6150 
PHP remote file inclusion vulnerability in memory/OWLMemoryProperty.php in OWLLib 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the OWLLIB_ROOT parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6151 
PHP remote file inclusion vulnerability in centre.php in Messagerie Locale as of 20061127 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6152 
Multiple SQL injection vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to (a) cat.asp, or the (2) keyword, (3) order, (4) sort, (5) menuSelect, or (6) state parameter to (b) search.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6153 
Multiple cross-site scripting (XSS) vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to inject arbitrary web script or HTML via (1) catname parameter to cat.asp or the (2) minprice parameter to search.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6154 
PHP remote file inclusion vulnerability in addcode.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6155 
Multiple SQL injection vulnerabilities in addrating.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ipadd or (2) url parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6156 
Cross-site scripting (XSS) vulnerability in auth/message.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF).  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6157 
SQL injection vulnerability in index.php in ContentNow 1.39 and earlier allows remote attackers to execute arbitrary SQL commands via the pageid parameter.  NOTE: this issue can be leveraged for path disclosure with an invalid pageid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6158 
Multiple cross-site scripting (XSS) vulnerabilities in (a) PMOS Help Desk 2.4, formerly (b) InverseFlow Help Desk 2.31 and also sold as (c) Ace Helpdesk 2.31, allow remote attackers to inject arbitrary web script or HTML via the (1) id or email parameter to ticketview.php, or (2) the email parameter to ticket.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6159 
Multiple cross-site scripting (XSS) vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) message or (2) subject parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6160 
SQL injection vulnerability in details.asp in Doug Luxem Liberum Help Desk 0.97.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6161 
Multiple SQL injection vulnerabilities in Doug Luxem Liberum Help Desk 0.97.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) uid parameter to (a) inout/status.asp, (b) inout/update.asp, and (c) forgotpass.asp.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6162 
Cross-site scripting (XSS) vulnerability in tiki-edit_structures.php in TikiWiki 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the pageAlias parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-29T01:00:00.000Z
CVE-2006-6163 
Cross-site scripting (XSS) vulnerability in tiki-setup_base.php in TikiWiki before 1.9.7 allows remote attackers to inject arbitrary JavaScript via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-29T01:00:00.000Z
CVE-2006-6164 
The _dl_unsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LD_PRELOAD to loading processes, which might be leveraged to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-29T01:00:00.000Z
CVE-2006-6165 
ld.so in FreeBSD, NetBSD, and possibly other BSD distributions does not remove certain harmful environment variables, which allows local users to gain privileges by passing certain environment variables to loading processes.  NOTE: this issue has been disputed by a third party, stating that it is the responsibility of the application to properly sanitize the environment
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-29T01:00:00.000Z
CVE-2006-6166 
Cross-site scripting (XSS) vulnerability in jce.php in the JCE Admin Component in Ryan Demmer Joomla Content Editor (JCE) 1.0.4 for Joomla! (com_jce), without the 20060821 jce_patch, allows remote attackers to inject arbitrary web script or HTML via the mosConfig_live_site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-29T02:00:00.000Z
CVE-2006-6167 
Multiple PHP remote file inclusion vulnerabilities in L. Brandon Stone and Nathanial P. Hendler Active PHP Bookmarks (APB) 1.1.02 allow remote attackers to execute arbitrary PHP code via a URL in the APB_SETTINGS['apb_path'] parameter in (1) apb_common.php or (2) apb.php.  NOTE: CVE and another third party dispute this vulnerability because these PHP scripts exit if the attack vectors are present in GPC variables
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-29T02:00:00.000Z
CVE-2006-6168 
tiki-register.php in TikiWiki before 1.9.7 allows remote attackers to trigger "notification-spam" via certain vectors such as a comma-separated list of addresses in the email field, related to lack of "a minimal check on email."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-29T02:00:00.000Z
CVE-2006-6169 
Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-29T18:00:00.000Z
CVE-2006-6170 
Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-30T15:00:00.000Z
CVE-2006-6171 
ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow.  NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure.  NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-30T15:00:00.000Z
CVE-2006-6172 
Buffer overflow in the asmrp_eval function in the RealMedia RTSP stream handler (asmrp.c) for Real Media input plugin, as used in (1) xine/xine-lib, (2) MPlayer 1.0rc1 and earlier, and possibly others, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a rulebook with a large number of rulematches.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-30T15:00:00.000Z
CVE-2006-6173 
Buffer overflow in the shared_region_make_private_np function in vm/vm_unix.c in Mac OS X 10.4.6 and earlier allows local users to execute arbitrary code via (1) a small range count, which causes insufficient memory allocation, or (2) a large number of ranges in the shared_region_make_private_np_args parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-30T16:00:00.000Z
CVE-2006-6174 
Cross-site scripting (XSS) vulnerability in tDiary before 2.0.3 and 2.1.x before 2.1.4.20061126 allows remote attackers to inject arbitrary web script or HTML via the conf parameter in (1) tdiary.rb and (2) skel/conf.rhtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-30T16:00:00.000Z
CVE-2006-6175 
Directory traversal vulnerability in lib/FBView.php in Horde Kronolith H3 before 2.0.7 and 2.1.x before 2.1.4 allows remote attackers to include arbitrary files and execute PHP code via a .. (dot dot) sequence in the view parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-30T16:00:00.000Z
CVE-2006-6176 
Cross-site scripting (XSS) vulnerability in admin.php in Blogn before 1.9.4 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-30T16:00:00.000Z
CVE-2006-6177 
SQL injection vulnerability in system/core/users/users.profile.inc.php in Neocrome Seditio 1.10 and earlier allows remote authenticated users to execute arbitrary SQL commands via a double-url-encoded id parameter to users.php that begins with a valid filename, as demonstrated by "default.gif" followed by an encoded NULL and ' (apostrophe) (%2500%2527).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-30T16:00:00.000Z
CVE-2006-6178 
Buffer overflow in PCCSRV\Web_console\RemoteInstallCGI\Wizard.exe for Trend Micro OfficeScan 7.3 before build 7.3.0.1087 allows remote attackers to execute arbitrary code via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-30T23:00:00.000Z
CVE-2006-6179 
Buffer overflow in PCCSRV\Web_console\RemoteInstallCGI\CgiRemoteInstall.exe for Trend Micro OfficeScan 7.3 before build 7.3.0.1089 allows remote attackers to execute arbitrary code via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-30T23:00:00.000Z
CVE-2006-6180 
Cross-site scripting (XSS) vulnerability in articles.asp in Expinion.net iNews Publisher (iNP) 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the hl parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6181 
Multiple SQL injection vulnerabilities in default.asp in ClickTech ClickContact allow remote attackers to execute arbitrary SQL commands via the (1) AlphaSort, (2) In, and (3) orderby parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6182 
The Gabriele Teotino GNotebook 0.7.0.1 gadget for Google Desktop stores Gmail passwords in plaintext in the %SYSTEMDRIVE%\temp\Gnotebook.txt log file, which allows local users to obtain passwords by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6183 
Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long mode field (aka transporting mode) in a (1) GET or (2) PUT command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6184 
Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long filename in a (1) GET or (2) PUT command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6185 
Directory traversal vulnerability in script.php in Wabbit PHP Gallery 0.9 allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6186 
Multiple directory traversal vulnerabilities in enomphp 4.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter to (1) config.php, (2) ranklv_inside.php, (3) rankml_inside.php, and (4) admin/Restore/config.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6187 
Multiple SQL injection vulnerabilities in ClickTech Click Gallery allow remote attackers to execute arbitrary SQL commands via the (1) currentpage or (2) gallery_id parameter to (a) view_gallery.asp, the (3) image_id parameter to (b) download_image.asp, the currentpage or (5) orderby parameter to (c) gallery.asp, or the currentpage parameter to (d) view_recent.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6188 
Cross-site scripting (XSS) vulnerability in view_search.asp in ClickTech Click Gallery allows remote attackers to inject arbitrary web script or HTML via the txtKeyWord parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6189 
SQL injection vulnerability in displayCalendar.asp in ClickTech Click Blog allows remote attackers to execute arbitrary SQL commands via the date parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6190 
SQL injection vulnerability in anna.pl in Anna^ IRC Bot before 0.30 (aka caprice) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: it is possible that there are multiple issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6191 
SQL injection vulnerability in admin/edit.asp in 8pixel.net simpleblog 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6192 
Unspecified scripts in the admin directory in 8pixel.net SimpleBlog 3.0 and earlier do not properly perform authentication, which allows remote attackers to add users and perform certain other unauthorized privileged actions.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6193 
SQL injection vulnerability in edit.asp in BasicForum 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z
CVE-2006-6194 
Multiple SQL injection vulnerabilities in index.asp in Ultimate Survey Pro allow remote attackers to execute arbitrary SQL commands via the (1) cat or (2) did parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-01T00:00:00.000Z