rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-6453 
PHP remote file inclusion vulnerability in JOWAMP_ShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the link parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-10T21:00:00.000Z
CVE-2006-6454 
execInBackground.php in J-OWAMP Web Interface 2.1b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters to the (1) exe and (2) args parameters, which are used in an exec function call.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-10T21:00:00.000Z
CVE-2006-6455 
Multiple SQL injection vulnerabilities in admin/default.asp in DUware DUdirectory 3.1, and possibly DUdirectory Pro and Pro SQL 3.x, allow remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-10T21:00:00.000Z
CVE-2006-6456 
Unspecified vulnerability in Microsoft Word 2000, 2002, and 2003 and Word Viewer 2003 allows remote attackers to execute code via unspecified vectors related to malformed data structures that trigger memory corruption, a different vulnerability than CVE-2006-5994.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T17:00:00.000Z
CVE-2006-6457 
tiki-wiki_rss.php in Tikiwiki 1.9.5, 1.9.2, and possibly other versions allows remote attackers to obtain sensitive information (MySQL username and password) via an invalid (large or negative) ver parameter, which leaks the information in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T17:00:00.000Z
CVE-2006-6458 
The Trend Micro scan engine before 8.320 for Windows and before 8.150 on HP-UX and AIX, as used in Trend Micro PC Cillin - Internet Security 2006, Office Scan 7.3, and Server Protect 5.58, allows remote attackers to cause a denial of service (CPU consumption and system hang) via a malformed RAR archive with an Archive Header section with the head_size and pack_size fields set to zero, which triggers an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T17:00:00.000Z
CVE-2006-6459 
Cross-site scripting (XSS) vulnerability in toplist.php in PhpBB Toplist 1.3.7 allows remote attackers to inject arbitrary HTML or web script via the (1) Name and (2) Information fields when adding a new site (toplistnew action).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T17:00:00.000Z
CVE-2006-6460 
Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php, which leaks the path in an error message.  NOTE: this issue might be resultant from CVE-2006-2509.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T17:00:00.000Z
CVE-2006-6461 
tr1.php in Yourfreeworld Stylish Text Ads Script allows remote attackers to obtain the installation path via an invalid id parameter, which leaks the path in an error message.  NOTE: this issue might be resultant from CVE-2006-2508.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T17:00:00.000Z
CVE-2006-6462 
PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6463 
Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6464 
viewcart in Midicart accepts negative numbers in the Qty (quantity) field, which allows remote attackers to obtain a smaller total price for a shopping cart.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6465 
Directory traversal vulnerability in WBmap.php in WikyBlog 1.3.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter.  NOTE: CVE disputes this vulnerability because l is validated by ctype_alpha before use
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6466 
Multiple cross-site scripting (XSS) vulnerabilities in WBmap.php in WikyBlog 1.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) key, (2) d, (3) l, or (4) v parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: CVE disputes the l vector because l is validated by ctype_alpha before use.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6467 
Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not properly restrict access to SMB file resources, which allows remote attackers to gain unspecified file or directory access via vectors related to (1) visibility of the SMB "Homes" share and (2) SMB file system browsing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6468 
Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not check the Fully Qualified Domain Name (FQDN) during a "Validate Repository SSL Certificate" scan, which has unknown impact and attack vectors, possibly related to spoofed certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6469 
Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not block the postgres port (5432/tcp), which has unknown impact and remote attack vectors, probably related to unauthorized connections to a PostgreSQL daemon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6470 
The SNMP Agent in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 returns no error for a non-writable object, which has unknown impact and attack vectors.  NOTE: due to the vagueness of the advisory, it is not clear whether this is a vulnerability, or a bug in a security feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6471 
Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 use weak permissions for certain files, which allows unspecified file access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6472 
The httpd.conf file in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 configures port 443 to be always active, which has unknown impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6473 
Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 have unknown impact and attack vectors, related to (1) an Immediate Image Overwrite (IIO) error message at the Local User Interface (LUI) if overwrite fails, (2) an IIO failure when a Held Job is deleted, and (3) an On Demand Image Overwrite failure when the overwrite is greater than 2 Gb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-11T18:00:00.000Z
CVE-2006-6474 
Untrusted search path vulnerability in McAfee VirusScan for Linux 4510e and earlier includes the current working directory in the DT_RPATH environment variable, which allows local users to load arbitrary ELF DSO libraries and execute arbitrary code by installing malicious libraries in that directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-14T20:00:00.000Z
CVE-2006-6475 
FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode with SSL enabled, allows remote attackers to cause a denial of service (refused connections) via malformed requests, which results in a mishandled exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6476 
FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6477 
FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and configured to use only HTTP, allows local users to modify requests and responses between a client and an agent by hijacking an HTTP FRAgent daemon and conducting a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6478 
Multiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) email.php, the (2) no parameter in (b) voirannonce.php, the (3) idmembre parameter in (c) admin/admin_membre/fiche_membre.php, and the (4) idannonce parameter in (d) admin/admin_annonce/okvalannonce.php and (e) admin/admin_annonce/changeannonce.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-12T00:00:00.000Z
CVE-2006-6479 
Multiple cross-site scripting (XSS) vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the email parameter in (1) erreurinscription.php, (2) Templates/admin.dwt.php, (3) Templates/commun.dwt.php, (4) membre.dwt.php, and (5) admin/admin_config/Aide.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-12T00:00:00.000Z
CVE-2006-6480 
admin/admin_membre/fiche_membre.php in AnnonceScriptHP 2.0 allows remote attackers to obtain sensitive information via the idmembre parameter, which discloses the passwords for arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-12T00:00:00.000Z
CVE-2006-6481 
Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-12T01:00:00.000Z
CVE-2006-6482 
Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm without a host, which can reveal the server's internal IP address in an HREF tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-12T20:00:00.000Z
CVE-2006-6483 
Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte (%00) in certain HTML tags, as demonstrated using "%00script" in a tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-12T20:00:00.000Z
CVE-2006-6484 
The IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.34, Professional Edition 1.6 through 1.83, and Enterprise Edition 1.1 through 1.40 allows remote attackers to cause a denial of service (crash) via unspecified vectors that trigger a null pointer dereference, as addressed by the ME-10023 hotfix, and a different issue than CVE-2006-6423.  NOTE: some details were obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-12T20:00:00.000Z
CVE-2006-6485 
Multiple cross-site scripting (XSS) vulnerabilities in ShopSite 8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the prevlocation parameter in shopper/sc/registration.cgi and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-12T20:00:00.000Z
CVE-2006-6486 
SQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via unspecified vectors in sptrees/default.aspx, possibly involving the docId parameter.  NOTE: this issue appears to have been disputed by a third party researcher, stating that SQL injection is not possible. However, insufficient details were provided to evaluate the dispute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-12T20:00:00.000Z
CVE-2006-6487 
Cross-site scripting (XSS) vulnerability in index.php in DT Guestbook (dt_guestbook) 1.0f, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the error[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T19:00:00.000Z
CVE-2006-6488 
Stack-based buffer overflow in the DoModal function in the Dialog Wrapper Module ActiveX control (DlgWrapper.dll) before 8.4.166.0, as used by ICONICS OPC Enabled Gauge, Switch, and Vessel ActiveX, allows remote attackers to execute arbitrary code via a long (1) FileName or (2) Filter argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2006-6489 
The SISCO OSI stack, as used in SISCO MMS-EASE, ICCP Toolkit for MMS-EASE, AX-S4 MMS and AX-S4 ICCP, and possibly other control system applications, allows remote attackers to cause a denial of service (application termination and restart) via malformed packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-18T02:00:00.000Z
CVE-2006-6490 
Multiple buffer overflows in the SupportSoft (1) SmartIssue (tgctlsi.dll) and (2) ScriptRunner (tgctlsr.dll) ActiveX controls, as used by Symantec Automated Support Assistant and Norton AntiVirus, Internet Security, and System Works 2006, allows remote attackers to execute arbitrary code via a crafted HTML message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T21:00:00.000Z
CVE-2006-6493 
Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAP_AUTH_KRBV41 authentication method and long credential data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-13T00:00:00.000Z
CVE-2006-6494 
Directory traversal vulnerability in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via a .. (dot dot) sequence in the LANG environment variable that points to a locale file containing attacker-controlled format string specifiers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-13T01:00:00.000Z
CVE-2006-6495 
Stack-based buffer overflow in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via large precision padding values in a format string specifier in the format parameter of the doprf function.  NOTE: this issue normally does not cross privilege boundaries, except in cases of external introduction of malicious message files, or if it is leveraged with other vulnerabilities such as CVE-2006-6494.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-13T01:00:00.000Z
CVE-2006-6496 
The (1) VetMONNT.sys and (2) VetFDDNT.sys drivers in CA Anti-Virus 2007 8.1, Anti-Virus for Vista Beta 8.2, and CA Internet Security Suite 2007 v3.0 do not properly handle NULL buffers, which allows local users with administrative access to cause a denial of service (system crash) via certain IOCTLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-13T21:00:00.000Z
CVE-2006-6497 
Multiple unspecified vulnerabilities in the layout engine for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6498 
Multiple unspecified vulnerabilities in the JavaScript engine for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, SeaMonkey before 1.0.7, and Mozilla 1.7 and probably earlier on Solaris, allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6499 
The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins that reduce the precision.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6500 
Heap-based buffer overflow in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by setting the CSS cursor to certain images that cause an incorrect size calculation when converting to a Windows bitmap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6501 
Unspecified vulnerability in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to gain privileges and install malicious code via the watch Javascript function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6502 
Use-after-free vulnerability in the LiveConnect bridge code for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6503 
Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to bypass cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6504 
Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6505 
Multiple heap-based buffer overflows in Mozilla Thunderbird before 1.5.0.9 and SeaMonkey before 1.0.7 allow remote attackers to execute arbitrary code via (1) external message modies with long Content-Type headers or (2) long RFC2047-encoded (MIME non-ASCII) headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6506 
The "Feed Preview" feature in Mozilla Firefox 2.0 before 2.0.0.1 sends the URL of the feed when requesting favicon.ico icons, which results in a privacy leak that might allow feed viewing services to determine browsing habits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6507 
Mozilla Firefox 2.0 before 2.0.0.1 allows remote attackers to bypass Cross-Site Scripting (XSS) protection via vectors related to a Function.prototype regression error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T01:00:00.000Z
CVE-2006-6508 
Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.21 allows remote authenticated users to send unauthorized messages as an arbitrary user via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-14T00:00:00.000Z
CVE-2006-6509 
Cross-site scripting (XSS) vulnerability in the skinning feature in SiteKiosk before 6.5.150 allows local users to bypass security protections and inject arbitrary web script or HTML via an ABOUT: URI, which is displayed in the title bar of the browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-14T00:00:00.000Z
CVE-2006-6510 
An unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security protections and read arbitrary files via certain functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-14T00:00:00.000Z
CVE-2006-6511 
dadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain (1) feature, (2) editor, (3) newswire, (4) otherpress, (5) admin, (6) pbook, (7) media, or (8) mod, which are processed as PHP file types (application/x-httpd-php).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-14T00:00:00.000Z
CVE-2006-6512 
Directory traversal vulnerability in the Browse function (/browse URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to list arbitrary directories via URL encoded backslashes ("%2F") in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-14T01:00:00.000Z
CVE-2006-6513 
The CControl::Download function (/dl URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to download arbitrary file types under the root via a trailing "." (dot) in a filename in the file parameter, related to erroneous behavior of the IsWinampFile function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-14T01:00:00.000Z