rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-6907 
Unspecified vulnerability in the Bluesoil Bluetooth stack has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-08T20:00:00.000Z
CVE-2006-6908 
Buffer overflow in the Bluetooth Stack COM Server in the Widcomm Bluetooth stack, as packaged as Widcomm Stack 3.x and earlier on Windows, Widcomm BTStackServer 1.4.2.10 and 1.3.2.7 on Windows, Widcomm Bluetooth Communication Software 1.4.1.03 on Windows, and the Bluetooth implementation in Windows Mobile or Windows CE on the HP IPAQ 2215 and 5450, allows remote attackers to cause a denial of service (service crash) and possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-08T20:00:00.000Z
CVE-2006-6909 
Stack-based buffer overflow in http.c in Karl Dahlke Edbrowse (aka Command line editor browser) 3.1.3 allows remote attackers to execute arbitrary code by operating an FTP server that sends directory listings with (1) long user names or (2) long group names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T11:00:00.000Z
CVE-2006-6910 
formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with Abfrage, allows remote attackers to cause a denial of service (daemon crash) via multiple requests containing many /../ sequences in the Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T11:00:00.000Z
CVE-2006-6911 
SQL injection vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated users to execute arbitrary SQL commands via the ordernum parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T18:00:00.000Z
CVE-2006-6912 
SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T18:00:00.000Z
CVE-2006-6913 
Unspecified vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to upload arbitrary PHP scripts via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T18:00:00.000Z
CVE-2006-6914 
Unspecified vulnerability in ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote attackers to obtain sensitive information, including passwords, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-10T00:00:00.000Z
CVE-2006-6915 
ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote authenticated users to cause a denial of service (port exhaustion) via unspecified vectors. NOTE: some details were obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-10T00:00:00.000Z
CVE-2006-6916 
Getahead Direct Web Remoting (DWR) before 1.1.3 allows attackers to cause a denial of service (infinite loop) via unknown vectors related to "crafted input."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-11T02:00:00.000Z
CVE-2006-6917 
Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup R11.5 Server before SP2 allows remote attackers to execute arbitrary code in the Tape Engine (tapeeng.exe) via a crafted RPC request with (1) opnum 38, which is not properly handled in TAPEUTIL.dll 11.5.3884.0, or (2) opnum 37, which is not properly handled in TAPEENG.dll 11.5.3884.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-11T20:00:00.000Z
CVE-2006-6918 
Unspecified vulnerability in the Admin login for Georgian discussion board (GeoBB) before 1.0 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-11T23:00:00.000Z
CVE-2006-6919 
Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with an img tag containing the script followed by an extra trailing ">", which Sage modifies to close the img element before the malicious script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-11T23:00:00.000Z
CVE-2006-6920 
Cross-site scripting (XSS) vulnerability in Nucleus before 3.24 allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly involving (1) lib/ADMIN.php and (2) lib/SKIN.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-11T23:00:00.000Z
CVE-2006-6921 
Unspecified versions of the Linux kernel allow local users to cause a denial of service (unrecoverable zombie process) via a program with certain instructions that prevent init from properly reaping a child whose parent has died.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-12T23:00:00.000Z
CVE-2006-6922 
SQL injection vulnerability in Deadlock User Management System (phpdeadlock) 0.64 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2006-6923 
SQL injection vulnerability in newsletters/edition.php in bitweaver 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the tk parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2006-6924 
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to (1) blogs/list_blogs.php, (2) fisheye/index.php, (3) wiki/orphan_pages.php, or (4) wiki/list_pages.php, which forces a SQL error.  NOTE: the fisheye/list_galleries.php vector is already covered by CVE-2005-4380.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2006-6925 
Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the message title field when submitting an article to articles/edit.php, (2) the message title field when submitting a blog post to blogs/post.php, or (3) the message description field when editing in the Sandbox in wiki/edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2006-6926 
Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors, as demonstrated by VulnDisco Pack.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2006-6927 
Multiple SQL injection vulnerabilities in Rialto 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the uname (username) and (2) pword (passwd) fields in (a) admin/default.asp; the (3) ID parameter to (b) listfull.asp or (c) printmain.asp; the (4) cat parameter to (d) listmain.asp, (e) searchoption.asp, or (f) searchmain.asp; the (5) Keyword parameter to (g) searchkey.asp; the (6) area parameter to searchmain.asp or searchoption.asp; the (7) searchin parameter to searchkey.asp; or the (8) cost1, (9) cost2, (10) acreage1, or (11) squarefeet1 parameters to searchoption.asp.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2006-6928 
Multiple cross-site scripting (XSS) vulnerabilities in Rialto 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) listmain.asp or (b) searchmain.asp, the (2) the Keyword parameter to (c) searchkey.asp, or the (3) refno parameter to (d) forminfo.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2006-6929 
Multiple cross-site scripting (XSS) vulnerabilities in Rapid Classified 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) reply.asp or (b) view_print.asp, the (2) SH1 parameter to (c) search.asp, the (3) name parameter to reply.asp, or the (4) dosearch parameter to (d) advsearch.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2006-6930 
SQL injection vulnerability in viewad.asp in Rapid Classified 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-13T02:00:00.000Z
CVE-2006-6931 
Algorithmic complexity vulnerability in Snort before 2.6.1, during predicate evaluation in rule matching for certain rules, allows remote attackers to cause a denial of service (CPU consumption and detection outage) via crafted network traffic, aka a "backtracking attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2006-6932 
Multiple SQL injection vulnerabilities in Image Gallery with Access Database allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to (a) dispimage.asp, or the (2) order or (3) page parameter to (b) default.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2006-6933 
Easy Chat Server 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download certain files via direct requests to files such as (1) ServerKey.pem and (2) AcceptIP.txt.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2006-6934 
Multiple cross-site scripting (XSS) vulnerabilities in Portix-PHP 0.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) titre or (2) auteur field in a forum post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2006-6935 
SQL injection vulnerability in the login component in Portix-PHP 0.4.2 allows remote attackers to execute arbitrary SQL commands via the username and passwd (password) fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-16T23:00:00.000Z
CVE-2006-6936 
Cross-site scripting (XSS) vulnerability in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary HTML or web script via (1) the catname parameter to displaypic.asp or (2) the search field. NOTE: vector 1 likely overlaps CVE-2006-3032.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T00:00:00.000Z
CVE-2006-6937 
SQL injection vulnerability in displaypic.asp in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary SQL commands via the sortorder parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T00:00:00.000Z
CVE-2006-6938 
Directory traversal vulnerability in includes/common.php in NitroTech 0.0.3a, as distributed before 2006, allows remote attackers to include arbitrary files via ".." sequences in the root parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T00:00:00.000Z
CVE-2006-6939 
GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T00:00:00.000Z
CVE-2006-6940 
Buffer overflow in the ParseHeader function in clsOWA.cls in POP3/SMTP to OWA (pop2owa) 1.1.3 allows remote attackers to execute arbitrary code via a long header in an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-17T11:00:00.000Z
CVE-2006-6941 
index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to obtain sensitive information via an invalid action parameter in an info operation, which discloses the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-19T00:00:00.000Z
CVE-2006-6942 
Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-19T02:00:00.000Z
CVE-2006-6943 
PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-19T02:00:00.000Z
CVE-2006-6944 
phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-19T02:00:00.000Z
CVE-2006-6945 
SQL injection vulnerability in Virtuemart 1.0.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to (1) Itemid, (2) product_id, and category_id parameters as handled in virtuemart_parser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-19T23:00:00.000Z
CVE-2006-6946 
The web server in the NEC MultiWriter 1700C allows remote attackers to modify the device configuration via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2006-6947 
The FTP server in the NEC MultiWriter 1700C allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command, a variant of CVE-1999-0017.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2006-6948 
MyODBC Japanese conversion edition 3.51.06, 2.50.29, and 2.50.25 allows remote attackers to cause a denial of service via a certain string in a response, which has unspecified impact on the MySQL database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2006-6949 
Conti FTPServer 1.0 Build 2.8 stores user passwords in cleartext in MyServerSettings.ini, which allows local users to obtain sensitive information by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2006-6950 
Directory traversal vulnerability in Conti FTPServer 1.0 Build 2.8 allows remote attackers to read arbitrary files and list arbitrary directories via a .. (dot dot) in a filename argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2006-6951 
Cross-site scripting (XSS) vulnerability in blog.php in OdysseusBlog allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2006-6952 
Computer Associates Host Intrusion Prevention System (HIPS) drivers (1) Core kmxstart.sys 6.5.4.31 and (2) Firewall kmxfw.sys 6.5.4.10 allow local users to gain privileges by using certain privileged IOCTLs to modify callback function pointers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-24T23:00:00.000Z
CVE-2006-6953 
The virtual keyboard implementation in GlobeTrotter Mobility Manager changes the color of a key as it is pressed, which allows local users to capture arbitrary keystrokes, such as for passwords, by shoulder surfing or grabbing periodic screenshots.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6954 
Flock beta 1 0.7 allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6955 
Opera allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6956 
Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6957 
PHP remote file inclusion vulnerability in addons/mod_media/body.php in Docebo 3.0.3 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[where_framework] parameter.  NOTE: this issue might be resultant from a global overwrite vulnerability. This issue is similar to CVE-2006-2576 and CVE-2006-3107, but the vectors are different.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6958 
Multiple PHP remote file inclusion vulnerabilities in phpBlueDragon 2.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter to (1) team_admin.php, (2) rss_admin.php, (3) manual_admin.php, and (4) forum_admin.php in includes/root_modules/, a different set of vectors than CVE-2006-3076.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6959 
WebRoot Spy Sweeper 4.5.9 and earlier allows local users to bypass the "Startup-Shield" security restrictions by modifying certain registry keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6960 
The Compression Sweep feature in WebRoot Spy Sweeper 4.5.9 and earlier does not handle non-ZIP archives, which allows remote attackers to bypass the malware detection via files with (1) RAR, (2) GZ, (3) TAR, (4) CAB, or (5) ACE compression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6961 
WebRoot Spy Sweeper 4.5.9 and earlier does not detect malware based on file contents, which allows remote attackers to bypass malware detection by changing a file's name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6962 
PHP remote file inclusion vulnerability in rsgallery2.html.php in the RS Gallery2 component (com_rsgallery2) 1.11.2 for Joomla! allows attackers to execute arbitrary PHP code via the mosConfig_absolute_path parameter.  NOTE: this issue may overlap CVE-2006-5047.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6963 
Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 3.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[where_lms] parameter to (1) class.module/class.definition.php and (2) modules/scorm/scorm_utils.php.  NOTE: this issue may overlap CVE-2006-2577.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6964 
MailEnable Professional before 1.78 provides a cleartext user password when an administrator edits the user's settings, which allows remote authenticated administrators to obtain sensitive information by viewing the HTML source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2006-6965 
CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the media parameter.  NOTE: this issue can be leveraged for XSS attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2006-6966 
phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a config.php file via the pictures[] parameter to index.php.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpGraphy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-04T00:00:00.000Z
CVE-2006-6968 
Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-06T02:00:00.000Z
CVE-2006-6969 
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-07T11:00:00.000Z
CVE-2006-6970 
Opera 9.10 Final allows remote attackers to bypass the Fraud Protection mechanism by adding certain characters to the end of a domain name, as demonstrated by the "." and "/" characters, which is not caught by the blacklist filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-07T11:00:00.000Z
CVE-2006-6971 
Mozilla Firefox 2.0, possibly only when running on Windows, allows remote attackers to bypass the Phishing Protection mechanism by representing an IP address in (1) dotted-hex, (2) dotted-octal, (3) single decimal integer, (4) single hex integer, or (5) single octal integer format, which is not captured by the blacklist filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-07T11:00:00.000Z
CVE-2006-6972 
SQL injection in torrents.php in BtitTracker 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) by and (2) order parameters.  NOTE: it is not clear whether this issue is exploitable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-07T20:00:00.000Z