rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-4257 
IBM DB2 Universal Database (UDB) before 8.1 FixPak 13 allows remote authenticated users to cause a denial of service (crash) by (1) sending the first ACCSEC command without an RDBNAM parameter during the CONNECT process, or (2) sending crafted SQLJRA packet, which results in a null dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T20:00:00.000Z
CVE-2006-4258 
Absolute path traversal vulnerability in the get functionality in Anti-Spam SMTP Proxy (ASSP) allows remote authenticated users to read arbitrary files via (1) C:\ (Windows drive letter), (2) UNC, and possibly other types of paths in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T20:00:00.000Z
CVE-2006-4259 
Cross-site scripting (XSS) vulnerability in index.php in Fotopholder 1.8 allows remote attackers to inject arbitrary web script or HTML via the path parameter.  NOTE: this might be resultant from a directory traversal vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T20:00:00.000Z
CVE-2006-4260 
Directory traversal vulnerability in index.php in Fotopholder 1.8 allows remote attackers to read arbitrary directories or files via a .. (dot dot) in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T20:00:00.000Z
CVE-2006-4262 
Multiple buffer overflows in cscope 15.5 and earlier allow user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple vectors including (1) a long pathname that is not properly handled during file list parsing, (2) long pathnames that result from path variable expansion such as tilde expansion for the HOME environment variable, and (3) a long -f (aka reffile) command line argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T10:00:00.000Z
CVE-2006-4263 
Multiple PHP remote file inclusion vulnerabilities in the Product Scroller Module and other modules in mambo-phpshop (com_phpshop) for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) mod_phpshop.php, (2) mod_phpshop_allinone.php, (3) mod_phpshop_cart.php, (4) mod_phpshop_featureprod.php, (5) mod_phpshop_latestprod.php, (6) mod_product_categories.php, (7) mod_productscroller.php, and (8) mosproductsnap.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4264 
Multiple PHP remote file inclusion vulnerabilities in the lmtg_myhomepage Component (com_lmtg_myhomepage) for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) install.lmtg_homepage.php and (2) mtg_homepage.php.  NOTE: this issue has been disputed by a third party, who states that the $mosConfig_absolute_path variable is only used within a function definition.  CVE source code analysis on 20060824 is not conclusive but tends to concur with the dispute.  In addition, it appears that the component name is actually "lmtg_myhomepage"
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4265 
Kaspersky Anti-Hacker 1.8.180, when Stealth Mode is enabled, allows remote attackers to obtain responses to ICMP (1) timestamp and (2) netmask requests, which is inconsistent with the documented behavior of Stealth Mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4266 
Symantec Norton Personal Firewall 2006 9.1.0.33, and possibly earlier, does not properly protect Norton registry keys, which allows local users to provide Trojan horse libraries to Norton by using RegSaveKey and RegRestoreKey to modify HKLM\SOFTWARE\Symantec\CCPD\SuiteOwners, as demonstrated using NISProd.dll.  NOTE: in most cases, this attack would not cross privilege boundaries, because modifying the SuiteOwners key requires administrative privileges.  However, this issue is a vulnerability because the product's functionality is intended to protect against privileged actions such as this.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4267 
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num parameter in modules/gateway/Authorize/confirmed.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4268 
Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) file, (2) x, and (3) y parameters in (a) admin/filemanager/preview.php; and the (4) email parameter in (b) admin/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4269 
PHP remote file inclusion vulnerability in admin.x-shop.php in the x-shop component (com_x-shop) 1.7 and earlier for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: this issue has been disputed by third party researchers, stating that there is no mosConfig_absolute_path parameter and no admin.x-shop.php file in the reported package
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4270 
PHP remote file inclusion vulnerability in mambelfish.class.php in the mambelfish component (com_mambelfish) 1.1 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4271 
PHP remote file inclusion vulnerability in install/upgrade_301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter.  NOTE: the vendor has disputed this vulnerability, saying "The default vBulletin requires authentication prior to the usage of the upgrade system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4272 
Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of requests to register.php.  NOTE: the vendor has disputed this vulnerability, stating "If you have the CAPTCHA enabled then the registrations wont even go through. ...  if you are talking about the flood being allowed in the first place then surely this is something that should be handled at the server level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4273 
Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 3.5.4 and 3.6.0 allows remote attackers to inject arbitrary web script or HTML by uploading an attachment with a .pdf extension that contains JavaScript, which is processed as script by Microsoft Internet Explorer 6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T21:00:00.000Z
CVE-2006-4275 
PHP remote file inclusion vulnerability in catalogshop.php in the CatalogShop component for Mambo (com_catalogshop) allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T22:00:00.000Z
CVE-2006-4276 
PHP remote file inclusion vulnerability in Tutti Nova 1.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the TNLIB_DIR parameter to novalib/class.novaEdit.mysql.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T22:00:00.000Z
CVE-2006-4277 
Multiple PHP remote file inclusion vulnerabilities in Tutti Nova 1.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the TNLIB_DIR parameter to (1) include/novalib/class.novaAdmin.mysql.php and (2) novalib/class.novaRead.mysql.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T22:00:00.000Z
CVE-2006-4278 
PHP remote file inclusion vulnerability in includes/layout/plain.footer.php in SportsPHool 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the mainnav parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T22:00:00.000Z
CVE-2006-4279 
SQL injection vulnerability in topic_post.php in XennoBB 2.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the icon_topic parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T22:00:00.000Z
CVE-2006-4280 
PHP remote file inclusion vulnerability in anjel.index.php in ANJEL (formerly MaMML) Component (com_anjel) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: this issue has been disputed by a third party, who says that $mosConfig_absolute_path is set in a configuration file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T22:00:00.000Z
CVE-2006-4281 
PHP remote file inclusion vulnerability in akocomments.php in AkoComment 1.1 module (com_akocomment) for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T22:00:00.000Z
CVE-2006-4282 
PHP remote file inclusion vulnerability in MamboLogin.php in the MamboWiki component (com_mambowiki) 0.9.6 and earlier for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the IP parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4283 
Multiple PHP remote file inclusion vulnerabilities in SOLMETRA SPAW Editor 1.0.6 and 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the spaw_dir parameter in dialogs/ scripts including (1) a.php, (2) collorpicker.php, (3) img.php, (4) img_library.php, (5) table.php, or (6) td.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4284 
SQL injection vulnerability in comments.asp in LBlog 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4285 
PHP remote file inclusion vulnerability in news.php in Fantastic News 2.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[script_path] parameter.  NOTE: it was later reported that 2.1.5 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4286 
PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: this issue has been disputed by third parties who state that contentpublisher.php protects against direct request in the most recent version.  The original researcher is known to be frequently inaccurate
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4287 
Multiple PHP remote file inclusion vulnerabilities in NES Game and NES System c108122 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) phphtmllib parameter to (a) phphtmllib/includes.php; tag_utils/ scripts including (b) divtag_utils.php, (c) form_utils.php, (d) html_utils.php, and (e) localinc.php; and widgets/ scripts including (f) FooterNav.php, (g) HTMLPageClass.php, (h) InfoTable.php, (i) localinc.php, (j) NavTable.php, and (k) TextNav.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4288 
PHP remote file inclusion vulnerability in admin.a6mambocredits.php in the a6mambocredits component (com_a6mambocredits) 2.0.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4289 
Buffer overflow in Sony VAIO Media Server 2.x, 3.x, 4.x, and 5.x before 20060626 allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4290 
Directory traversal vulnerability in Sony VAIO Media Server 2.x, 3.x, 4.x, and 5.x before 20060626 allows remote attackers to gain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4291 
PHP remote file inclusion vulnerability in handlers/email/mod.listmail.php in PHlyMail Lite 3.4.4 and earlier (Build 3.04.04) allows remote attackers to execute arbitrary PHP code via a URL in the _PM_[path][handler] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4292 
Unspecified vulnerability in Niels Provos Honeyd before 1.5b allows remote attackers to cause a denial of service (application crash) via certain Address Resolution Protocol (ARP) packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4293 
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-22T17:00:00.000Z
CVE-2006-4294 
Directory traversal vulnerability in viewfile in TWiki 4.0.0 through 4.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-09T00:00:00.000Z
CVE-2006-4295 
Cross-site scripting (XSS) vulnerability in ascan_6.asp in Panda ActiveScan 5.53.00 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T01:00:00.000Z
CVE-2006-4296 
PHP remote file inclusion vulnerability in classes/Tar.php in bigAPE-Backup component (com_babackup) for Mambo 1.1 allows remote attackers to include arbitrary files via the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T01:00:00.000Z
CVE-2006-4297 
SQL injection vulnerability in shopping_cart.php in osCommerce before 2.2 Milestone 2 060817 allows remote attackers to execute arbitrary SQL commands via id array parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T01:00:00.000Z
CVE-2006-4298 
Multiple directory traversal vulnerabilities in cache.php in osCommerce before 2.2 Milestone 2 060817 allow remote attackers to determine existence of arbitrary files and disclose the installation path via a .. (dot dot) in unspecified parameters in the (1) tep_cache_also_purchased, (2) tep_cache_manufacturers_box, and (3) tep_cache_categories_box functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T01:00:00.000Z
CVE-2006-4299 
Cross-site scripting (XSS) vulnerability in tiki-searchindex.php in TikiWiki 1.9.4 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T01:00:00.000Z
CVE-2006-4300 
SQL injection vulnerability in comments.asp in SimpleBlog 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T01:00:00.000Z
CVE-2006-4301 
Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) via a long Color attribute in multiple DirectX Media Image DirectX Transforms ActiveX COM Objects from (a) dxtmsft.dll and (b) dxtmsft3.dll, including (1) DXImageTransform.Microsoft.MaskFilter.1, (2) DXImageTransform.Microsoft.Chroma.1, and (3) DX3DTransform.Microsoft.Shapes.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T01:00:00.000Z
CVE-2006-4302 
The Java Plug-in J2SE 1.3.0_02 through 5.0 Update 5, and Java Web Start 1.0 through 1.2 and J2SE 1.4.2 through 5.0 Update 5, allows remote attackers to exploit vulnerabilities by specifying a JRE version that contain vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T01:00:00.000Z
CVE-2006-4303 
Race condition in (1) libnsl and (2) TLI/XTI API routines in Sun Solaris 10 allows remote attackers to cause a denial of service ("tight loop" and CPU consumption for listener applications) via unknown vectors related to TCP fusion (do_tcp_fusion).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T01:00:00.000Z
CVE-2006-4304 
Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1, NetBSD 2.0 through 4.0 beta before 20060823, and OpenBSD 3.8 and 3.9 before 20060902 allows remote attackers to cause a denial of service (panic), obtain sensitive information, and possibly execute arbitrary code via crafted Link Control Protocol (LCP) packets with an option length that exceeds the overall length, which triggers the overflow in (1) pppoe and (2) ippp.  NOTE: this issue was originally incorrectly reported for the ppp driver.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-24T00:00:00.000Z
CVE-2006-4305 
Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-30T01:00:00.000Z
CVE-2006-4306 
Unspecified vulnerability in Sun Solaris 8 and 9 before 20060821 allows local users to execute arbitrary commands via unspecified vectors, involving the default Role-Based Access Control (RBAC) settings in the "File System Management" profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T19:00:00.000Z
CVE-2006-4307 
Unspecified vulnerability in the format command in Sun Solaris 8 and 9 before 20060821 allows local users to modify arbitrary files via unspecified vectors involving profiles that permit running format with elevated privileges, a different issue than CVE-2006-4306 and CVE-2006-4319.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T19:00:00.000Z
CVE-2006-4308 
Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Learning System 6, Blackboard Learning and Community Portal Suite 6.2.3.23, and Blackboard Vista 4 allow remote attackers to inject arbitrary Javascript, VBScript, or HTML via (1) data, (2) vbscript, and (3) malformed javascript URIs in various HTML tags when posting to the Discussion Board.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T19:00:00.000Z
CVE-2006-4309 
VNC server on the AK-Systems Windows Terminal 1.2.5 ExVLP is not password protected, which allows remote attackers to login and view RDP or Citrix sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T19:00:00.000Z
CVE-2006-4310 
Mozilla Firefox 1.5.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FTP response, when attempting to connect with a username and password via the FTP URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T19:00:00.000Z
CVE-2006-4311 
PHP remote file inclusion vulnerability in Sonium Enterprise Adressbook 0.2 allows remote attackers to execute arbitrary PHP code via the folder parameter in multiple files in the plugins directory, as demonstrated by plugins/1_Adressbuch/delete.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T19:00:00.000Z
CVE-2006-4312 
Cisco PIX 500 Series Security Appliances and ASA 5500 Series Adaptive Security Appliances, when running 7.0(x) up to 7.0(5) and 7.1(x) up to 7.1(2.4), and Firewall Services Module (FWSM) 3.1(x) up to 3.1(1.6), causes the EXEC password, local user passwords, and the enable password to be changed to a "non-random value" under certain circumstances, which causes administrators to be locked out and might allow attackers to gain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T22:00:00.000Z
CVE-2006-4313 
Multiple unspecified vulnerabilities in Cisco VPN 3000 series concentrators before 4.1, 4.1.x up to 4.1(7)L, and 4.7.x up to 4.7(2)F allow attackers to execute the (1) CWD, (2) MKD, (3) CDUP, (4) RNFR, (5) SIZE, and (6) RMD FTP commands to modify files or create and delete directories via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T22:00:00.000Z
CVE-2006-4314 
The manager server in Symantec Enterprise Security Manager (ESM) 6 and 6.5.x allows remote attackers to cause a denial of service (hang) via a malformed ESM agent request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T22:00:00.000Z
CVE-2006-4315 
Unquoted Windows search path vulnerability in multiple SSH Tectia products, including Client/Server/Connector 5.0.0 and 5.0.1 and Client/Server before 4.4.5, and Manager 2.12 and earlier, when running on Windows, might allow local users to gain privileges via a malicious program file under "Program Files" or its subdirectories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T22:00:00.000Z
CVE-2006-4316 
SSH Tectia Management Agent 2.1.2 allows local users to gain root privileges by running a program called sshd, which is obtained from a process listing when the "Restart" action is selected from the Management server GUI, which causes the agent to locate the pathname of the user's program and restart it with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T22:00:00.000Z
CVE-2006-4317 
Cross-site scripting (XSS) vulnerability in attachment.php in WoltLab Burning Board (WBB) 2.3.5 allows remote attackers to inject arbitrary web script or HTML via a GIF image that contains URL-encoded Javascript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-24T01:00:00.000Z