[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0960.

[Assistant] uConfig agent in Compex NetPassage WPE54G router allows remote attackers to cause a denial of service (unresposiveness) via crafted datagrams to UDP port 7778.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0960?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0960?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0961 mean in the context of cybersecurity?

[Assistant] CVE-2006-0961


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0961.

[Assistant] SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id parameter.  NOTE: this product has also been referred to as "Cilem News," although that does not appear to be the proper name.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0961?

[Assistant]
20060224 Advisory: CilemNews System <= 1.1 Remote SQL Injection Vulnerability

20060224 Advisory: CilemNews System <= 1.1 Remote SQL


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0961?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0962 mean in the context of cybersecurity?

[Assistant] CVE-2006-0962


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0962.

[Assistant] SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0962?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0962?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0963 mean in the context of cybersecurity?

[Assistant] CVE-2006-0963


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0963.

[Assistant] Multiple buffer overflows in STLport 5.0.2 might allow local users to execute arbitrary code via (1) long locale environment variables to a strcpy function call in c_locale_glibc2.c and (2) long arguments to unspecified functions in num_put_float.cpp.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0963?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0963?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0964 mean in the context of cybersecurity?

[Assistant] CVE-2006-0964


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0964.

[Assistant] Client Firewall in NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass firewall program execution rules by replacing an allowed program with an arbitrary program.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0964?

[Assistant]
20060301 NCP VPN/PKI Client - various Bugs

20060301 NCP VPN/PKI Client - various Bugs


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0964?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0965 mean in the context of cybersecurity?

[Assistant] CVE-2006-0965


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0965.

[Assistant] NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass security protections and configure privileged options via a long argument to ncpmon.exe, which provides access to alternate privileged menus, possibly due to a buffer overflow.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0965?

[Assistant]
20060301 NCP VPN/PKI Client - various Bugs

20060301 NCP VPN/PKI Client - various Bugs


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0965?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0966 mean in the context of cybersecurity?

[Assistant] CVE-2006-0966


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0966.

[Assistant] NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to cause a denial of service (CPU consumption) via a large number of arguments to ncprwsnt.exe, possibly due to a buffer overflow.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0966?

[Assistant]
20060301 NCP VPN/PKI Client - various Bugs

20060301 NCP VPN/PKI Client - various Bugs


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0966?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0967 mean in the context of cybersecurity?

[Assistant] CVE-2006-0967


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0967.

[Assistant] NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to cause a denial of service (memory usage and cpu utilization) via a flood of arbitrary UDP datagrams to ports 0 to 65000. NOTE: this issue was reported as a buffer overflow, but that term usually does not apply in flooding attacks.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0967?

[Assistant]
20060301 NCP VPN/PKI Client - various Bugs

20060301 NCP VPN/PKI Client - various Bugs


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0967?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0968 mean in the context of cybersecurity?

[Assistant] CVE-2006-0968


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0968.

[Assistant] The ncprwsnt service in NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to execute arbitrary code by modifying the connect.bat script, which is automatically executed by the service after a connection is established.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0968?

[Assistant]
20060301 NCP VPN/PKI Client - various Bugs

20060301 NCP VPN/PKI Client - various Bugs


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0968?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0969 mean in the context of cybersecurity?

[Assistant] CVE-2006-0969


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0969.

[Assistant] PHP remote file inclusion vulnerability in index.php in Top sites de PixelArtKingdom allows remote attackers to include and execute arbitrary files via the page parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0969?

[Assistant] 20060227 PixelArtKingdom TopSites Remote Command Exucetion


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0969?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0970 mean in the context of cybersecurity?

[Assistant] CVE-2006-0970


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0970.

[Assistant] PHP remote file inclusion vulnerability in index.php in one or more ActiveCampaign products, possibly SupportTrio, allows remote attackers to include and execute arbitrary files via the page parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0970?

[Assistant] 20060227 Knowledgebases Remote Command Exucetion


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0970?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0971 mean in the context of cybersecurity?

[Assistant] CVE-2006-0971


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0971.

[Assistant] Directory traversal vulnerability in Lionel Reyero DirectContact 0.3b allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0971?

[Assistant]
20060312 directory traversal Fixed in DirectContact 0.3c

20060227 directory traversal in DirectContact 0.3b

20060227 directory traversal in DirectContact 0.3b


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0971?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0972 mean in the context of cybersecurity?

[Assistant] CVE-2006-0972


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0972.

[Assistant] SQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers to execute arbitrary SQL commands via the page parameter.  NOTE: the category vector is already covered by CVE-2005-3846.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0972?

[Assistant] 20060226 2 SQL Injection in Fantastic News


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0972?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0973 mean in the context of cybersecurity?

[Assistant] CVE-2006-0973


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0973.

[Assistant] SQL injection vulnerability in topics.php in Appalachian State University phpWebSite 0.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0973?

[Assistant]
20060523 sql injection in phpWebSite 0.8.3

20060412 phpWebSite 0.10.? (topics.php) Remote SQL Injection Exploit


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0973?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0974 mean in the context of cybersecurity?

[Assistant] CVE-2006-0974


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0974.

[Assistant] Cross-site scripting (XSS) vulnerability in failure.asp in Battleaxe bttlxeForum 2.0 allows remote attackers to inject arbitrary web script or HTML via the err_txt parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0974?

[Assistant] 20060226 bttlxeForum 2.* XSS Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0974?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0975 mean in the context of cybersecurity?

[Assistant] CVE-2006-0975


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0975.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0975?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0975?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0976 mean in the context of cybersecurity?

[Assistant] CVE-2006-0976


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0976.

[Assistant] Directory traversal vulnerability in scan_lang_insert.php in Boris Herbiniere-Seve SPiD 1.3.1 allows remote attackers to read arbitrary files via the lang parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0976?

[Assistant] 20060225 NSA Group Security Advisory NSAG-¹201-25.02.2006 Vulnerability SPiD v1.3.1


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0976?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0977 mean in the context of cybersecurity?

[Assistant] CVE-2006-0977


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0977.

[Assistant] Craig Morrison Mail Transport System Professional (aka MTS Pro) acts as an open relay when configured to relay all mail through an external SMTP server, which allows remote attackers to relay mail by connecting to the MTS Pro server, then sending a MAIL FROM that specifies a domain that is local to the server.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0977?

[Assistant] 20060225 Mail Transport System Professional--Open Relay Hole


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0977?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0978 mean in the context of cybersecurity?

[Assistant] CVE-2006-0978


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0978.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in the View Headers (aka viewheaders) functionality in ArGoSoft Mail Server Pro 1.8.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the Subject header, (2) the From header, and (3) certain other unspecified headers.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0978?

[Assistant] 20060227 Secunia Research: ArGoSoft Mail Server Pro viewheaders ScriptInsertion


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0978?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0979 mean in the context of cybersecurity?

[Assistant] CVE-2006-0979


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0979.

[Assistant] Unspecified vulnerability in the local weblog publisher in Nidelven IT Issue Dealer before 0.9.96 has unknown impact and attack vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0979?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0979?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0980 mean in the context of cybersecurity?

[Assistant] CVE-2006-0980


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0980.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in Jay Eckles CGI Calendar 2.7 allow remote attackers to inject arbitrary web script or HTML via the year parameter in (1) index.cgi and (2) viewday.cgi.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0980?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0980?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0981 mean in the context of cybersecurity?

[Assistant] CVE-2006-0981


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0981.

[Assistant] Directory traversal vulnerability in e-merge WinAce 2.6 and earlier allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0981?

[Assistant] 20060224 WinAce Archiver v2.6 Directory traversal


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0981?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0982 mean in the context of cybersecurity?

[Assistant] CVE-2006-0982


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0982.

[Assistant] The on-access scanner for McAfee Virex 7.7 for Macintosh, in some circumstances, might not activate when malicious content is accessed from the web browser, and might not prevent the content from being saved, which allows remote attackers to bypass virus protection, as demonstrated using the EICAR test file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0982?

[Assistant] 20060228 Virex on-access scanning unreliable


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0982?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0983 mean in the context of cybersecurity?

[Assistant] CVE-2006-0983


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0983.

[Assistant] Cross-site scripting (XSS) vulnerability in index.php in QwikiWiki 1.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0983?

[Assistant] 20060228 QwikiWiki v1.4 XSS Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0983?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0984 mean in the context of cybersecurity?

[Assistant] CVE-2006-0984


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0984.

[Assistant] Cross-site scripting (XSS) vulnerability in inc_header.php in EJ3 TOPo 2.2.178 allows remote attackers to inject arbitrary web script or HTML via the gTopNombre parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0984?

[Assistant] 20060228 EJ3 TOPo - Cross Site Scripting Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0984?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0985 mean in the context of cybersecurity?

[Assistant] CVE-2006-0985


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0985.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) website, and (3) comment parameters.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0985?

[Assistant]
20060227 WordPress 2.0.1 Multiple Vulnerabilities

20060302 Re: FW: WordPress 2.0.1 Multiple Vulnerabilities

20060228 FW: WordPress 2.0.1 Multiple Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0985?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0986 mean in the context of cybersecurity?

[Assistant] CVE-2006-0986


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0986.

[Assistant] WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) template-loader.php, (3) rss-functions.php, (4) locale.php, (5) wp-db.php, and (6) kses.php in the wp-includes/ directory; and (7) edit-form-advanced.php, (8) admin-functions.php, (9) edit-link-form.php, (10) edit-page-form.php, (11) admin-footer.php, and (12) menu.php in the wp-admin directory; and possibly (13) list directory contents of the wp-includes directory.  NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors are already covered by CVE-2005-4463.  The menu-header.php vector is already covered by CVE-2005-2110.  Other vectors might be covered by CVE-2005-1688.  NOTE: if the typical installation of WordPress does not list any site-specific files to wp-includes, then vector [13] is not an exposure.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0986?

[Assistant]
20060227 WordPress 2.0.1 Multiple Vulnerabilities

20060302 Re: FW: WordPress 2.0.1 Multiple Vulnerabilities

20060228 FW: WordPress 2.0.1 Multiple Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0986?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0987 mean in the context of cybersecurity?

[Assistant] CVE-2006-0987


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0987.

[Assistant] The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0987?

[Assistant] 20060228 recursive DNS servers DDoS as a growing DDoS problem


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0987?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0988 mean in the context of cybersecurity?

[Assistant] CVE-2006-0988


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0988.

[Assistant] The default configuration of the DNS Server service on Windows Server 2003 and Windows 2000, and the Microsoft DNS Server service on Windows NT 4.0, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0988?

[Assistant] 20060228 recursive DNS servers DDoS as a growing DDoS problem


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0988?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0989 mean in the context of cybersecurity?

[Assistant] CVE-2006-0989


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0989.

[Assistant] Stack-based buffer overflow in the volume manager daemon (vmd) in Veritas NetBackup Enterprise Server 5.0 through 6.0 and DataCenter and BusinesServer 4.5FP and 4.5MP allows attackers to execute arbitrary code via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0989?

[Assistant] 20060327 ZDI-06-005: Symantec VERITAS NetBackup Volume Manager Buffer Overflow


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0989?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0990 mean in the context of cybersecurity?

[Assistant] CVE-2006-0990


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0990.

[Assistant] Stack-based buffer overflow in the NetBackup Catalog daemon (bpdbm) in Veritas NetBackup Enterprise Server 5.0 through 6.0 and DataCenter and BusinesServer 4.5FP and 4.5MP allows attackers to execute arbitrary code via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0990?

[Assistant]
20060327 SYM06-006, Veritas NetBackup: Multiple Overflow Vulnerabilities in NetBackup Daemons

20060327 ZDI-06-006: Symantec VERITAS NetBackup Database Manager Buffer Overflow


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0990?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0991 mean in the context of cybersecurity?

[Assistant] CVE-2006-0991


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0991.

[Assistant] Buffer overflow in the NetBackup Sharepoint Services server daemon (bpspsserver) on NetBackup 6.0 for Windows allows remote attackers to execute arbitrary code via crafted "Request Service" packets to the vnetd service (TCP port 13724).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0991?

[Assistant] 20060327 TSRT-06-01: Symantec VERITAS NetBackup vnetd Buffer Overflow Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0991?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0992 mean in the context of cybersecurity?

[Assistant] CVE-2006-0992


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0992.

[Assistant] Stack-based buffer overflow in Novell GroupWise Messenger before 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept-Language value without a comma or semicolon.  NOTE: due to a typo, the original ZDI advisory accidentally referenced CVE-2006-0092.  This is the correct identifier.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0992?

[Assistant] 20060413 ZDI-06-008: Novell GroupWise Messenger Accept-Language Buffer Overflow


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0992?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0993 mean in the context of cybersecurity?

[Assistant] CVE-2006-0993


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0993.

[Assistant] The web management interface in 3Com TippingPoint SMS Server before 2.2.1.4478 does not restrict access to certain directories, which might allow remote attackers to obtain potentially sensitive information such as configuration settings.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0993?

[Assistant] 20060509 ZDI-06-013: 3Com TippingPoint SMS Server Information Disclosure Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0993?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0994 mean in the context of cybersecurity?

[Assistant] CVE-2006-0994


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0994.

[Assistant] Multiple Sophos Anti-Virus products, including Anti-Virus for Windows 5.x before 5.2.1 and 4.x before 4.05, when cabinet file inspection is enabled, allows remote attackers to execute arbitrary code via a CAB file with "invalid folder count values," which leads to heap corruption.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0994?

[Assistant]
20060508 ZDI-06-012: Sophos Anti-Virus CAB Unpacking Code Execution Vulnerability

20060508 ZDI-06-012: Sophos Anti-Virus CAB Unpacking Code Execution Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0994?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0995 mean in the context of cybersecurity?

[Assistant] CVE-2006-0995


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0995.

[Assistant] EMC Dantz Retrospect 7 backup client 7.0.107, and other versions before 7.0.109, and 6.5 before 6.5.138 allows remote attackers to cause a denial of service (client termination and loss of backup service) via a malformed packet to TCP port 497, which triggers an assert error.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0995?

[Assistant] 20060302 EMC Dantz Retrospect 7 Backup client DoS Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0995?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0996 mean in the context of cybersecurity?

[Assistant] CVE-2006-0996


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0996.

[Assistant] Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0996?

[Assistant]
20060408 phpinfo() Cross Site Scripting PHP 5.1.2 and 4.4.2

[php-cvs] 20060330 cvs: php-src /ext/standard info.c


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0996?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0997 mean in the context of cybersecurity?

[Assistant] CVE-2006-0997


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0997.

[Assistant] The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) permits encryption with a NULL key, which results in cleartext communication that allows remote attackers to read an SSL protected session by sniffing network traffic.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0997?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0997?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0998 mean in the context of cybersecurity?

[Assistant] CVE-2006-0998


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0998.

[Assistant] The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) sometimes selects a weak cipher instead of an available stronger cipher, which makes it easier for remote attackers to sniff and decrypt an SSL protected session.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0998?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0998?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-0999 mean in the context of cybersecurity?

[Assistant] CVE-2006-0999


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-0999.

[Assistant] The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) allows a client to force the server to use weak encryption by stating that a weak cipher is required for client compatibility, which might allow remote attackers to decrypt contents of an SSL protected session.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-0999?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-0999?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1000 mean in the context of cybersecurity?

[Assistant] CVE-2006-1000


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1000.

[Assistant] Multiple SQL injection vulnerabilities in Pentacle In-Out Board 3.0 and earlier allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) newsid parameter to newsdetailsview.asp and (2) password parameter to login.asp.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1000?

[Assistant]
20060225 Advisory: Pentacle In-Out Board <= 6.03 (login.asp) Authencation ByPass Vulnerability

20060225 Advisory: Pentacle In-Out Board <= 6.03 (newsdetailsview.aspnewsid) Remote SQL Injection Vulnerability

20060225 Advisory: Pentacle In-Out Board <= 6.03 (newsdetailsview.asp newsid) Remote SQL Injection Vulnerability

20060225 Advisory: Pentacle In-Out Board <= 6.03 (login.asp) AuthencationByPass Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1000?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1001 mean in the context of cybersecurity?

[Assistant] CVE-2006-1001


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1001.

[Assistant] SQL injection vulnerability in the board module in LanSuite LanParty Intranet System 2.0.6 and 2.1.0 beta allows remote attackers to execute arbitrary SQL commands via the fid parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1001?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1001?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1002 mean in the context of cybersecurity?

[Assistant] CVE-2006-1002


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1002.

[Assistant] NETGEAR WGT624 Wireless DSL router has a default account of super_username "Gearguy" and super_passwd "Geardog", which allows remote attackers to modify the configuration.  NOTE: followup posts have suggested that this might not occur with all WGT624 routers.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1002?

[Assistant]
20060226 NETGEAR WGT624 ? Wireless DSL router default user name/password vulnerability

20071220 Re: Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability

20060227 Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability

20060413 Re: Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1002?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1003 mean in the context of cybersecurity?

[Assistant] CVE-2006-1003


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1003.

[Assistant] The backup configuration option in NETGEAR WGT624 Wireless Firewall Router stores sensitive information in cleartext, which allows remote attackers to obtain passwords and gain privileges.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1003?

[Assistant] 20060227 NETGEAR WGT624 ? Wireless DSL Firewall/Router vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1003?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1004 mean in the context of cybersecurity?

[Assistant] CVE-2006-1004


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1004.

[Assistant] Cross-site scripting (XSS) vulnerability in agencyprofile.asp in Parodia 6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the AG_ID parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1004?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1004?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1005 mean in the context of cybersecurity?

[Assistant] CVE-2006-1005


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1005.

[Assistant] agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AG_ID parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1005?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1005?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1006 mean in the context of cybersecurity?

[Assistant] CVE-2006-1006


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1006.

[Assistant] Multiple SQL injection vulnerabilities in sendcard.php in sendcard before 3.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified parameters.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1006?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1006?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1007 mean in the context of cybersecurity?

[Assistant] CVE-2006-1007


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1007.

[Assistant] Multiple SQL injection vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) dir and (2) page_id parameter to index.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1007?

[Assistant] 20060309 n8cms 1.1 & 1.2 version Sql İnjection And XSS


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1007?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1008 mean in the context of cybersecurity?

[Assistant] CVE-2006-1008


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1008.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) dir and (2) page_id parameter to (a) index.php and (3) userid parameter to (b) mailto.php.  NOTE: it is possible that issues 1 and 2 are resultant from SQL injection.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1008?

[Assistant] 20060309 n8cms 1.1 & 1.2 version Sql İnjection And XSS


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1008?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1009 mean in the context of cybersecurity?

[Assistant] CVE-2006-1009


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1009.

[Assistant] M4 Project enigma-suite before 0.73.3 (Windows) has a default password of "nominal" for the "enigma-client" account, which allows local users to gain access.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1009?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1009?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1010 mean in the context of cybersecurity?

[Assistant] CVE-2006-1010


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1010.

[Assistant] Buffer overflow in socket/request.c in CrossFire before 1.9.0, when oldsocketmode is enabled, allows remote attackers to cause a denial of service (segmentation fault) and possibly execute code by sending the server a large request.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1010?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1010?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1011 mean in the context of cybersecurity?

[Assistant] CVE-2006-1011


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1011.

[Assistant] LetterMerger 1.2 stores user information in Access database files with insecure permissions, which allows local users to obtain sensitive information.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1011?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1011?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1012 mean in the context of cybersecurity?

[Assistant] CVE-2006-1012


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1012.

[Assistant] SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an HTTP header for a comment.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1012?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1012?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1013 mean in the context of cybersecurity?

[Assistant] CVE-2006-1013


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1013.

[Assistant] PHP remote file include vulnerability in index.php in SMartBlog (aka SMBlog) 1.2 allows remote attackers to include and execute arbitrary PHP files via (1) the pg parameter and (2) a query string without a parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1013?

[Assistant] 20060301 SMBlog Remote Command Exucetion


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1013?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1014 mean in the context of cybersecurity?

[Assistant] CVE-2006-1014


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1014.

[Assistant] Argument injection vulnerability in certain PHP 4.x and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mb_send_mail function, allows context-dependent attackers to read and create arbitrary files by providing extra -C and -X arguments to sendmail.  NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1014?

[Assistant] 20060228 (PHP) mb_send_mail security bypass


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1014?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1015 mean in the context of cybersecurity?

[Assistant] CVE-2006-1015


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1015.

[Assistant] Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mail function, allows remote attackers to read and create arbitrary files via the sendmail -C and -X arguments.  NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1015?

[Assistant] 20060301 Re: (PHP) mb_send_mail security bypass


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1015?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1016 mean in the context of cybersecurity?

[Assistant] CVE-2006-1016


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1016.

[Assistant] Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1016?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1016?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1017 mean in the context of cybersecurity?

[Assistant] CVE-2006-1017


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1017.

[Assistant] The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the (1) safe_mode or (2) open_basedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imap_open function, allow remote attackers to obtain access to an IMAP stream data structure and conduct unauthorized IMAP actions.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1017?

[Assistant] 20060228 (PHP) imap functions bypass safemode and open_basedir restrictions


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1017?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1018 mean in the context of cybersecurity?

[Assistant] CVE-2006-1018


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1018.

[Assistant] SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1018?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1018?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1019 mean in the context of cybersecurity?

[Assistant] CVE-2006-1019


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1019.

[Assistant] Cross-site scripting (XSS) vulnerability in fce.php in UKiBoard 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a BBCode url tag when using the show_post function.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information, some of which reference a source URL that appears to be for an unrelated issue.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1019?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1019?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1020 mean in the context of cybersecurity?

[Assistant] CVE-2006-1020


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1020.

[Assistant] SQL injection vulnerability in forumlib.php in Johnny_Vegas Vegas Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1020?

[Assistant] 20060313 [eVuln] Vegas Forum SQL Injection Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1020?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1021 mean in the context of cybersecurity?

[Assistant] CVE-2006-1021


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1021.

[Assistant] Cross-site scripting (XSS) vulnerability in sol_menu.php in PeHePe Uyelik Sistemi (aka PeHePe MemberShip Management System) 3 allows remote attackers to inject arbitrary web script or HTML via the kuladi parameter ($kul_adi variable).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1021?

[Assistant] 20060228 PEHEPE Membership Management System Multiple Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1021?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1022 mean in the context of cybersecurity?

[Assistant] CVE-2006-1022


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1022.

[Assistant] PHP remote file include vulnerability in sol_menu.php in PeHePe Uyelik Sistemi (aka PeHePe MemberShip Management System) 3 allows remote attackers to include and execute arbitrary PHP code via a URL in the uye_klasor parameter, along with a misafir[] parameter that is set to UYE_SEVIYE.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1022?

[Assistant] 20060228 PEHEPE Membership Management System Multiple Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1022?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1023 mean in the context of cybersecurity?

[Assistant] CVE-2006-1023


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1023.

[Assistant] Directory traversal vulnerability in HP System Management Homepage (SMH) 2.0.0 through 2.1.4 on Windows allows remote attackers to access certain files via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1023?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1023?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1024 mean in the context of cybersecurity?

[Assistant] CVE-2006-1024


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1024.

[Assistant] SQL injection vulnerability in MgrLogin.asp in Addsoft StoreBot 2005 Professional allows remote attackers to execute arbitrary SQL commands via the Pwd parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1024?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1024?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1025 mean in the context of cybersecurity?

[Assistant] CVE-2006-1025


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1025.

[Assistant] Cross-site scripting (XSS) vulnerability in manage.asp in Addsoft StoreBot 2002 Standard allows remote attackers to inject arbitrary web script or HTML via the ShipMethod parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1025?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1025?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1026 mean in the context of cybersecurity?

[Assistant] CVE-2006-1026


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1026.

[Assistant] JFacets before 0.2 allows remote attackers to gain privileges as any account via a GET request with a modified account profileID.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1026?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1026?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1027 mean in the context of cybersecurity?

[Assistant] CVE-2006-1027


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1027.

[Assistant] feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via a "/" (slash) in the feed parameter to index.php, which reveals the path in an error message.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1027?

[Assistant] 20060302 JOOMLA CMS 1.0.7 DoS & path disclosing


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1027?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1028 mean in the context of cybersecurity?

[Assistant] CVE-2006-1028


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1028.

[Assistant] feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to cause a denial of service (stressed file cache) by creating many files via filenames in the feed parameter to index.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1028?

[Assistant] 20060302 JOOMLA CMS 1.0.7 DoS & path disclosing


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1028?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1029 mean in the context of cybersecurity?

[Assistant] CVE-2006-1029


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1029.

[Assistant] The cross-site scripting (XSS) countermeasures in class.inputfilter.php in Joomla! 1.0.7 allow remote attackers to cause a denial of service via a crafted mosmsg parameter to index.php with a malformed sequence of multiple tags, as demonstrated using "<<>AAA<><>", possibly due to nested or empty tags.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1029?

[Assistant] 20060302 JOOMLA CMS 1.0.7 DoS & path disclosing


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1029?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1030 mean in the context of cybersecurity?

[Assistant] CVE-2006-1030


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1030.

[Assistant] Unspecified vulnerability in mod_templatechooser in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via an unspecified attack vector that reveals the path.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1030?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1030?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1031 mean in the context of cybersecurity?

[Assistant] CVE-2006-1031


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1031.

[Assistant] config/config_inc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SG_HOME parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1031?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1031?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1032 mean in the context of cybersecurity?

[Assistant] CVE-2006-1032


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1032.

[Assistant] Eval injection vulnerability in the decode function in rpc_decoder.php for phpRPC 0.7 and earlier, as used by runcms, exoops, and possibly other programs, allows remote attackers to execute arbitrary PHP code via the base64 tag.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1032?

[Assistant] 20060226 phpRPC Library Remote Code Execution


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1032?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1033 mean in the context of cybersecurity?

[Assistant] CVE-2006-1033


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1033.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) uname, (2) error, (3) profile or (4) the username filed parameter to the (a) Your_Account module, (5) catid, (6) sid, (7) Story Text or (8) Extended text text fields in the (b) News module, (9) month, (10) year or (11) sa parameter to the (c) Stories_Archive module, (12) show, (13) cid, (14) ratetype, or (15) orderby parameter to the (d) Web_Links module, (16) op, or (17) pollid parameter to the (e) Surveys module, (18) c parameter to the (f) Downloads module, (19) meta, or (20) album parameter to the (g) coppermine module, or the search box in the (21) Search, (22) Stories_Archive, (23) Downloads, and (24) Topics module.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1033?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1033?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1034 mean in the context of cybersecurity?

[Assistant] CVE-2006-1034


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1034.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in Woltlab Burning Board (wBB) allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to galerie_index.php and possibly (2) galerie_onfly.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. The second vector might not be XSS.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1034?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1034?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1035 mean in the context of cybersecurity?

[Assistant] CVE-2006-1035


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1035.

[Assistant] Unspecified vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to access diagnostics tests via unknown attack vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1035?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1035?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1036 mean in the context of cybersecurity?

[Assistant] CVE-2006-1036


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1036.

[Assistant] Multiple unspecified vulnerabilities in the Oracle Diagnostics module 2.2 and earlier have unknown impact and attack vectors, related to "permissions."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1036?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1036?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1037 mean in the context of cybersecurity?

[Assistant] CVE-2006-1037


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1037.

[Assistant] SQL injection vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1037?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1037?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1038 mean in the context of cybersecurity?

[Assistant] CVE-2006-1038


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1038.

[Assistant] Buffer overflow in SecureCRT 5.0.4 and earlier and SecureFX 3.0.4 and earlier allows remote attackers to have an unknown impact when a Unicode string is converted to a "narrow" string.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1038?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1038?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1039 mean in the context of cybersecurity?

[Assistant] CVE-2006-1039


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1039.

[Assistant] SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1039?

[Assistant] 20060301 SAP Web Application Server http request url parsing vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1039?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1040 mean in the context of cybersecurity?

[Assistant] CVE-2006-1040


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1040.

[Assistant] Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in sendmsg.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1040?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1040?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1041 mean in the context of cybersecurity?

[Assistant] CVE-2006-1041


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1041.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in Gregarius 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) rss_query parameter to search.php or (2) tag parameter to tags.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1041?

[Assistant] 20060303 Gregarius 0.5.2 XSS and SQL Injection Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1041?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1042 mean in the context of cybersecurity?

[Assistant] CVE-2006-1042


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1042.

[Assistant] Multiple SQL injection vulnerabilities in Gregarius 0.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) folder parameter to feed.php or (2) rss_query parameter to search.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1042?

[Assistant] 20060303 Gregarius 0.5.2 XSS and SQL Injection Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1042?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1043 mean in the context of cybersecurity?

[Assistant] CVE-2006-1043


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1043.

[Assistant] Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attackers to execute arbitrary code via a long DataProject field in a (1) Visual Studio Database Project File (.dbp) or (2) Visual Studio Solution (.sln).


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1043?

[Assistant]
20060304 Visual Studio 6.0 Buffer Overflow Vulnerability

20060305 Microsoft Visual Studio 6.0 Sp6 Malformed .dbp File BoF Exploit


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1043?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1044 mean in the context of cybersecurity?

[Assistant] CVE-2006-1044


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1044.

[Assistant] Multiple buffer overflows in LISTSERV 14.3 and 14.4, including LISTSERV Lite and HPO, with the web archive interface enabled, allow remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI.  NOTE: technical details will be released after the grace period has ended on 20060603.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1044?

[Assistant] 20060304 Critical Risk Vulnerability in L-Soft Listserv


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1044?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1045 mean in the context of cybersecurity?

[Assistant] CVE-2006-1045


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1045.

[Assistant] The HTML rendering engine in Mozilla Thunderbird 1.5, when "Block loading of remote images in mail messages" is enabled, does not properly block external images from inline HTML attachments, which could allow remote attackers to obtain sensitive information, such as application version or IP address, when the user reads the email and the external image is accessed.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1045?

[Assistant] 20060228 Mozilla Thunderbird : Multiple Information Disclosure Vulnerabilities


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1045?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1046 mean in the context of cybersecurity?

[Assistant] CVE-2006-1046


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1046.

[Assistant] server.cpp in Monopd 0.9.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a string containing a large number of characters that are escaped when Monopd produces XML output.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1046?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1046?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1047 mean in the context of cybersecurity?

[Assistant] CVE-2006-1047


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1047.

[Assistant] Unspecified vulnerability in the "Remember Me login functionality" in Joomla! 1.0.7 and earlier has unknown impact and attack vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1047?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1047?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1048 mean in the context of cybersecurity?

[Assistant] CVE-2006-1048


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1048.

[Assistant] Joomla! 1.0.7 and earlier allows attackers to bypass intended access restrictions and gain certain privileges via certain attack vectors related to the (1) Weblink, (2) Polls, (3) Newsfeeds, (4) Weblinks, (5) Content, (6) Content Section, (7) Content Category, (8) Contact items, or (9) Contact Search, (10) Content Search, (11) Newsfeed Search, or (12) Weblink Search.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1048?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1048?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1049 mean in the context of cybersecurity?

[Assistant] CVE-2006-1049


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1049.

[Assistant] Multiple SQL injection vulnerabilities in the Admin functionality in Joomla! 1.0.7 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via unknown attack vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1049?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1049?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1050 mean in the context of cybersecurity?

[Assistant] CVE-2006-1050


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1050.

[Assistant] Kwik-Pay Payroll 4.2.20, and possibly other versions, stores the KwikPay.mdb database file with insecure permissions, which allows local users to obtain sensitive information such as employment and payment data.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: the vendor has disputed this vulnerability, stating that "The kwikpay.mdb file supplied with kwikpay is a template for the database structure of user databases created by kwikpay and to store a demonstration payroll. It does not contain any sensitive user information.  When a user payroll database is opened, the encryption of the database is checked and if the database is not encrypted, the user is prompted to encrypt the database, but the choice is the customers.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1050?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1050?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1051 mean in the context of cybersecurity?

[Assistant] CVE-2006-1051


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1051.

[Assistant] SQL injection vulnerability in Akarru Social BookMarking Engine before 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter to akarru.lib/users.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1051?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1051?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1052 mean in the context of cybersecurity?

[Assistant] CVE-2006-1052


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1052.

[Assistant] The selinux_ptrace logic in hooks.c in SELinux for Linux 2.6.6 allows local users with ptrace permissions to change the tracer SID to an SID of another process.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1052?

[Assistant]
[git-commits-head] 20060311 [PATCH] selinux: tracer SID fix

[selinux] 20060313 [SECURITY] SELinux ptrace bug (CVE-2006-1052)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1052?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1053 mean in the context of cybersecurity?

[Assistant] CVE-2006-1053


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1053.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1053?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1053?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1054 mean in the context of cybersecurity?

[Assistant] CVE-2006-1054


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1054.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1054?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1054?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1055 mean in the context of cybersecurity?

[Assistant] CVE-2006-1055


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1055.

[Assistant] The fill_write_buffer function in sysfs/file.c in Linux kernel 2.6.12 up to versions before 2.6.17-rc1 does not zero terminate a buffer when a length of PAGE_SIZE or more is requested, which might allow local users to cause a denial of service (crash) by causing an out-of-bounds read.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1055?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1055?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1056 mean in the context of cybersecurity?

[Assistant] CVE-2006-1056


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1056.

[Assistant] The Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and 8th generation AuthenticAMD processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one process to determine portions of the state of floating point instructions of other processes, which can be leveraged to obtain sensitive information such as cryptographic keys. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1056?

[Assistant]
20061113 VMSA-2006-0009 - VMware ESX Server 3.0.0 AMD fxsave/restore issue

20060419 FreeBSD Security Advisory FreeBSD-SA-06:14.fpu

20061113 VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 4

20061113 VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 2

20061113 VMSA-2006-0005 - VMware ESX Server 2.5.4 Upgrade Patch 1


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1056?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1057 mean in the context of cybersecurity?

[Assistant] CVE-2006-1057


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1057.

[Assistant] Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1057?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1057?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1058 mean in the context of cybersecurity?

[Assistant] CVE-2006-1058


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1058.

[Assistant] BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1058?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1058?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1059 mean in the context of cybersecurity?

[Assistant] CVE-2006-1059


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1059.

[Assistant] The winbindd daemon in Samba 3.0.21 to 3.0.21c writes the machine trust account password in cleartext in log files, which allows local users to obtain the password and spoof the server in the domain.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1059?

[Assistant] 20060330 [SECURITY] Samba 3.0.21-3.0.21c: Exposure of machine account credentials in winbindd log files


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1059?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1060 mean in the context of cybersecurity?

[Assistant] CVE-2006-1060


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1060.

[Assistant] Heap-based buffer overflow in zgv before 5.8 and xzgv before 0.8 might allow user-assisted attackers to execute arbitrary code via a JPEG image with more than 3 output components, such as a CMYK or YCCK color space, which causes less memory to be allocated than required.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1060?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1060?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1061 mean in the context of cybersecurity?

[Assistant] CVE-2006-1061


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1061.

[Assistant] Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2006-1061?

[Assistant] 20060320 [SSAG#001] :: cURL tftp:// URL Buffer Overflow


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2006-1061?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2006-1062 mean in the context of cybersecurity?

[Assistant] CVE-2006-1062


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2006-1062.

[Assistant] Unspecified vulnerability in lurker.cgi for Lurker 2.0 and earlier allows attackers to read arbitrary files via unknown vectors.