{"id": "CVE-2006-6994", "bulletinFamily": "NVD", "title": "CVE-2006-6994", "description": "Unrestricted file upload vulnerability in add.asp in OzzyWork Gallery, possibly 2.0 and earlier, allows remote attackers to upload and execute arbitrary ASP files by removing the client-side security checks.", "published": "2007-02-12T11:28:00", "modified": "2017-07-29T01:29:00", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-6994", "reporter": "cve@mitre.org", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/26365", "http://secunia.com/advisories/20049", "http://www.securityfocus.com/bid/17946", "http://www.vupen.com/english/advisories/2006/1768", "http://www.osvdb.org/25427", "http://marc.info/?l=bugtraq&m=114723238307299&w=2"], "cvelist": ["CVE-2006-6994"], "type": "cve", "lastseen": "2019-05-29T18:08:35", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "fdf05b33ca95a966b9be7edad22e86ec"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvelist", "hash": "a2b73b68b36ec33be15c10457548598c"}, {"key": "cvss", "hash": "2004c9f19f804139a2bd4b20151bd451"}, {"key": "cvss2", "hash": "1dc2f667d36e0cf0a1d1984879d6264c"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "9be98121f2022e3cbc7266e74ecbbb55"}, {"key": "description", "hash": "cc7afbf0851cb2d513b34caae381bad8"}, {"key": "href", "hash": "a47d595bda4eb3dbb44bc07bed4b9757"}, {"key": "modified", "hash": "81fbf4dc6a3bd69489aeb37b6c16d22d"}, {"key": "published", "hash": "f59963fb915bb450bb8a288874f6b5a6"}, {"key": "references", "hash": "27cd585fe9d35226b805998a1902f345"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "51c80043373487b9bd9bfa56eff070b3"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "a0f636042cdd43242e2fe539da8fdab43a5b093395c71ae036b01c6a7a8566f7", "viewCount": 0, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2019-05-29T18:08:35"}, "dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:25427"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:6108"]}], "modified": "2019-05-29T18:08:35"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": [], "affectedSoftware": [{"name": "indirmax.org ozzywork_galeri", "operator": "le", "version": "2.0"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": [], "cwe": ["CWE-254"]}

{"securityvulns": [{"lastseen": "2018-08-31T11:09:21", "bulletinFamily": "software", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "modified": "2006-05-09T00:00:00", "published": "2006-05-09T00:00:00", "id": "SECURITYVULNS:VULN:6108", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:6108", "title": "Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)", "type": "securityvulns", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:22", "bulletinFamily": "software", "description": "## Vulnerability Description\nOzzyWork contains a flaw that may allow a malicious user to upload arbitray files. The issue is caused by improper file extensions checks in add.asp. It is possible that the flaw may allow an attacker to upload and execute arbitrary ASP code resulting in a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOzzyWork contains a flaw that may allow a malicious user to upload arbitray files. The issue is caused by improper file extensions checks in add.asp. It is possible that the flaw may allow an attacker to upload and execute arbitrary ASP code resulting in a loss of integrity.\n## References:\nVendor URL: http://www.indirmax.org/program.asp?id=2696\n[Secunia Advisory ID:20049](https://secuniaresearch.flexerasoftware.com/advisories/20049/)\n[Related OSVDB ID: 25426](https://vulners.com/osvdb/OSVDB:25426)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0176.html\nISS X-Force ID: 26365\nFrSIRT Advisory: ADV-2006-1768\n[CVE-2006-6994](https://vulners.com/cve/CVE-2006-6994)\nBugtraq ID: 17946\n", "modified": "2006-05-09T03:47:37", "published": "2006-05-09T03:47:37", "href": "https://vulners.com/osvdb/OSVDB:25427", "id": "OSVDB:25427", "title": "OzzyWork Galeri add.asp Arbitrary File Upload", "type": "osvdb", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}]}