rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-3026 
Multiple cross-site scripting (XSS) vulnerabilities in ClickGallery 5.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in gallery.asp and (2) parentcurrentpage parameter in view_gallery.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3027 
Multiple SQL injection vulnerabilities in Enthrallwebe ePhotos 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) CAT_ID parameter in (a) subphotos.asp and (b) subLevel2.asp, the (2) AL_ID parameter in (c) photo.asp, and the (3) SUB_ID parameter in (d) subLevel2.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3028 
PHP remote file inclusion vulnerability in stat_modules/users_age/module.php in Minerva 2.0.8a Build 237 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3029 
Cross-site scripting (XSS) vulnerability in default.asp in ClickTech Clickcart 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3030 
Multiple cross-site scripting (XSS) vulnerabilities in DwZone Shopping Cart 1.1.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ToCategory and (2) FromCategory parameters to (a) ProductDetailsForm.asp and (3) UserName and (4) Password parameters to (b) LogIn/VerifyUserLog.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3031 
Multiple cross-site scripting (XSS) vulnerabilities in index.asp in fipsCMS 4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) w, (2) phcat, (3) dayid, and (4) calw parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3032 
Multiple cross-site scripting (XSS) vulnerabilities in Xtreme ASP Photo Gallery 1.05 and earlier, and possibly 2.0 (trial), allow remote attackers to inject arbitrary web script or HTML via the (1) catname and (2) total parameters in (a) displaypic.asp, and the (3) catname parameter in (b) displaythumbs.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3033 
Cross-site scripting (XSS) vulnerability in MyScrapbook 3.1 allows remote attackers to inject arbitrary web script or HTML via the input box in singlepage.php when submitting scrapbook pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3034 
MyScrapbook 3.1 allows remote attackers to obtain sensitive information via a direct request to files in the txt-db-api directory such as txt-db-api/sql.php, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3035 
Multiple cross-site scripting (XSS) vulnerabilities in addwords.php in MyScrapbook 3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) comment parameters.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3036 
Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) imgdir parameter in (a) index.php, and the (2) w, (3) h, and (4) t parameters in (b) popup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3037 
Multiple cross-site scripting (XSS) vulnerabilities in publish.php in ST AdManager Lite allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) description, (3) article, (4) bio, and (5) name parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3038 
Cross-site scripting (XSS) vulnerability in index.php in Cescripts Realty Room Rent allows remote attackers to inject arbitrary web script or HTML via the sel_menu parameter.  NOTE: the vendor notified CVE on 20060823 that "All issues concerning this script and others at cescripts.com have been addressed and fixed."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3039 
Cross-site scripting (XSS) vulnerability in index.php in Cescripts Realty Home Rent allows remote attackers to inject arbitrary web script or HTML via the sel_menu parameter.  NOTE: the vendor notified CVE on 20060823 that "All issues concerning this script and others at cescripts.com have been addressed and fixed."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3040 
PHP remote file inclusion vulnerability in talkbox.php in Amr Talkbox allows remote attackers to execute arbitrary PHP code via a URL in the direct parameter.  NOTE: this issue has been disputed by CVE, since the $direct variable is set to a static value just before the include statement
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3041 
PHP remote file inclusion vulnerability in Ltwcalendar/calendar.php in Codewalkers Ltwcalendar 4.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the ltw_config[include_dir] parameter. NOTE: CVE disputes this claim, since the $ltw_config[include_dir] variable is defined as a static value in an include file before it is referenced in an include() statement
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3042 
Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][classes_root] parameter in (a) server.inc.php, and the (2) go_info[server][classes_root] parameter in (b) app.inc.php, (c) login.php, and (d) trylogin.php.  NOTE: this issue has been disputed by the vendor, who states that the original researcher "reviewed the installation tarball that is not identical with the resulting system after installtion.  The file, where the $go_info array is declared ... is created by the installer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-3043 
Cross-site scripting (XSS) vulnerability in search.cfm in CreaFrameXe (CFXe) CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the voltext_suche parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3044 
Cross-site scripting (XSS) vulnerability in LogiSphere 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected in an error page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3045 
PHP remote file inclusion vulnerability in manage_songs.php in Foing 0.7.0e and earlier allows remote attackers to execute arbitrary PHP code via a URL in the foing_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3046 
Unspecified vulnerability in the admin login feature in Subtext 1.5, in a multiblog setup, allows remote administrators of one blog to login to another blog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3047 
Cross-site scripting (XSS) vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3048 
SQL injection vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3049 
Multiple cross-site scripting (XSS) vulnerabilities in booking3.php in Mole Group Ticket Booking Script allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) address1, (3) address2, (4) county, (5) postcode, (6) email, (7) phone, or (8) mobile parameters to booking2.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3050 
Directory traversal vulnerability in detail.php in SixCMS 6.0, and other versions before 6.0.6patch2, allows remote attackers to read arbitrary files via a ..  (dot dot) sequence and trailing null (%00) byte in the template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3051 
Cross-site scripting (XSS) vulnerability in list.php in SixCMS 6.0, and other versions before 6.0.6patch2, allows remote attackers to inject arbitrary script code or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3052 
Cross-site scripting (XSS) vulnerability in Event Registration allows remote attackers to inject arbitrary web script or HTML via the (1) event_id parameter to view-event-details.php or (2) select_events parameter to event-registration.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3053 
PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter.  NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum."  CVE analysis concurs with the vendor
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3054 
Multiple SQL injection vulnerabilities in VBZooM 1.11 allow remote attackers to execute arbitrary SQL commands via the (1) sobjectID or (2) MAINID parameters to (a) show.php or (3) MainID parameter to (b) subject.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3055 
Multiple SQL injection vulnerabilities in VBZooM 1.02 allow remote attackers to execute arbitrary SQL commands via the (1) QuranID, (2) ShowByQuranID, or (3) Action parameters to meaning.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3056 
SQL injection vulnerability in language.php in VBZooM 1.01 allows remote attackers to execute arbitrary SQL commands via the Action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3057 
Unspecified vulnerability in NetworkManager daemon for DHCP (dhcdbd) allows remote attackers to cause a denial of service (crash) via certain invalid DHCP responses that trigger memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-3059 
Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors.  NOTE: this is a different vulnerability than CVE-2006-3086.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-17T01:00:00.000Z
CVE-2006-3060 
Cross-site scripting (XSS) vulnerability in P.A.I.D 2.2 allows remote attackers to inject arbitrary web script or HTML via the (1) read parameter in index.php, (2) farea parameter in faq.php, and (3) unspecified input fields on the "My Account" login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3061 
Multiple cross-site scripting (XSS) vulnerabilities in 5 Star Review allow remote attackers to inject arbitrary web script or HTML via the (1) sort parameter in index2.php, (2) item_id parameter in report.php, (3) search_term parameter (aka the "search box") in search_reviews.php, (4) the profile field in usercp/profile_edit1.php, and the (5) review field in review_form.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3062 
Cross-site scripting (XSS) vulnerability in index.php in myPHP Guestbook 2.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3063 
Multiple cross-site scripting (XSS) vulnerabilities in myPHP Guestbook 1.x through 2.0.0-r1 and before 2.0.1 RC5 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) email, (3) homepage, (4) id, (5) name, and (6) text parameters in (a) index.php, the (7) comment, (8) email, (9) homepage, (10) number, (11) name, and (12) text parameters in (b) admin/guestbook.php, and the (13) email, (14) homepage, (15) icq, (16) name, and (17) text parameters in (c) admin/edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3064 
SQL injection vulnerability in the add_hit function in include/function.inc.php in Coppermine Photo Gallery (CPG) 1.4.8, when "Keep detailed hit statistics" is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) referer and (2) user-agent HTTP headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3065 
SQL injection vulnerability in engine/shards/blog.php in blur6ex 0.3.462 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a proc_reply action in the blog shard.  NOTE: This is a similar vulnerability to CVE-2006-1763, but the affected code and versions are different.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3066 
Buffer overflow in the TCP/IP listener in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allows remote attackers to cause a denial of service (application crash) via a long MGRLVLLS message inside of an EXCSAT message when establishing a connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3067 
Multiple unspecified vulnerabilities in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allow remote attackers to cause a denial of service (application crash) via a (1) "long column list" in the (a) REPLACE INTO and (b) INSERT INTO portions of the LOAD command or a (2) large number of values in an IN clause, possibly related to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3068 
IBM DB2 Universal Database (UDB) before 8.2 FixPak 12 allows remote attackers to cause a denial of service (application crash) by sending "incorrect information ... regarding the package name/creator," which leads to a "memory overwrite."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3069 
PHP remote file inclusion vulnerability in DoubleSpeak 0.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the config[private] parameter in multiple files, as demonstrated by (1) index.php, (2) faq.php, and (3) hardware.php. NOTE: this issue has been disputed by multiple third-party researchers, who state that config[private] is initialized in an include file before being used
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3070 
write_ok.php in Zeroboard 4.1 pl8, when installed on Apache with mod_mime, allows remote attackers to bypass restrictions for uploading files with executable extensions by uploading a .htaccess file that with an AddType directive that assigns an executable module to files with assumed-safe extensions, as demonstrated by assigning the txt extension to be handled by application/x-httpd-php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3071 
Cross-site scripting (XSS) vulnerability in index.php in MP3 Search/Archive 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter, as used by the "search box", and (2) res parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3072 
M4 Macro Library in Symantec Security Information Manager before 4.0.2.29 HOTFIX 1 allows local users to execute arbitrary commands via crafted "rule definitions", which produces dangerous Java code during M4 transformation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3073 
Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA), when in WebVPN clientless mode, allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) dnserror.html and (2) connecterror.html, aka bugid CSCsd81095 (VPN3k) and CSCse48193 (ASA). NOTE: the vendor states that "WebVPN full-network-access mode" is not affected, despite the claims by the original researcher.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3074 
klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and 7.0, KAV 6.0 for Windows Workstations, and KAV 6.0 for Windows Servers does not validate certain parameters to the (1) NtCreateKey, (2) NtCreateProcess, (3) NtCreateProcessEx, (4) NtCreateSection, (5) NtCreateSymbolicLinkObject, (6) NtCreateThread, (7) NtDeleteValueKey, (8) NtLoadKey2, (9) NtOpenKey, (10) NtOpenProcess, (11) NtOpenSection, and (12) NtQueryValueKey hooked system calls, which allows local users to cause a denial of service (reboot) via an invalid parameter, as demonstrated by the ClientId parameter to NtOpenProcess.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3075 
Multiple PHP remote file inclusion vulnerabilities in PictureDis Professional 1.33 Build 234 and earlier and PictureDis Photoalbum 4.82 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to files in photoalbum/ including (1) thumstbl.php, (2) wpfiles.php, and (3) wallpapr.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3076 
PHP remote file inclusion vulnerability in software_upload/public_includes/pub_templates/vphptree/template.php in PhpBlueDragon CMS 2.9.1 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3077 
Cross-site scripting (XSS) vulnerability in guestbook.cfm in aXentGuestbook 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the startrow parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3078 
Multiple SQL injection vulnerabilities in APBoard 2.2-r3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) PHPSESSID parameter in board.php and (2) viewcatmod parameter in main.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3079 
Cross-site scripting (XSS) vulnerability in index.cfm in SSPwiz Plus 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3080 
Cross-site scripting (XSS) vulnerability in viewposts.cfm in aXentForum II and earlier allows remote attackers to inject arbitrary web script or HTML via the startrow parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T10:00:00.000Z
CVE-2006-3081 
mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) via a NULL second argument to the str_to_date function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T18:00:00.000Z
CVE-2006-3082 
parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T18:00:00.000Z
CVE-2006-3083 
The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges using attacks such as resource exhaustion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-09T10:00:00.000Z
CVE-2006-3084 
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges.  NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-09T10:00:00.000Z
CVE-2006-3085 
xt_sctp in netfilter for Linux kernel before 2.6.17.1 allows attackers to cause a denial of service (infinite loop) via an SCTP chunk with a 0 length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-23T10:00:00.000Z
CVE-2006-3086 
Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink, as demonstrated using an Excel worksheet with a long link in Unicode, aka "Hyperlink COM Object Buffer Overflow Vulnerability." NOTE: this is a different issue than CVE-2006-3059.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-19T19:00:00.000Z