Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2007-0390
Cross-site scripting (XSS) vulnerability in index.php in sabros.us 1.7 allows remote attackers to inject arbitrary web script or HTML via the tag parameter.
Affected Products: n/a
References: [{'name': '31602', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31602'}, {'name': '22115', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22115'}, {'name': '2170', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2170'}, {'name': '20070118 [x0n3-h4ck] sabros.us 1.7 XSS Exploit', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051868.html'}, {'name': '23824', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23824'}, {'name': '20070118 [x0n3-h4ck] sabros.us 1.7 XSS Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457331/100/0/threaded'}, {'name': 'sabros-index-xss(31600)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31600'}]
CVE State: PUBLISHED
Explain CVE-2007-0391
Format string vulnerability in the log creation functionality of BitDefender Client Professional Plus 8.02 allows attackers to execute arbitrary code via certain scan job settings.
Affected Products: n/a
References: [{'name': '20070119 Layered Defense Research Advisory: BitDefender Client 8.02 Format String Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457414/100/0/threaded'}, {'name': 'bitdefender-scanjob-format-string(31608)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31608'}, {'name': 'ADV-2007-0253', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0253'}, {'name': '22128', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22128'}, {'name': '20070119 Layered Defense Research Advisory: BitDefender Client 8.02 Format String Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051883.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.bitdefender.com/KB325-en--Format-string-vulnerability.html'}]
CVE State: PUBLISHED
Explain CVE-2007-0392
IBM AIX 5.3 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572.
Affected Products: n/a
References: [{'name': '20070118 Multiple OS kernel insecure handling of stdio file descriptor', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457279/100/0/threaded'}, {'name': '20070118 Re: Multiple OS kernel insecure handling of stdio file descriptor', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457315/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0393
Sun Solaris 9 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572.
Affected Products: n/a
References: [{'name': '20070118 Multiple OS kernel insecure handling of stdio file descriptor', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457279/100/0/threaded'}, {'name': '20070118 Re: Multiple OS kernel insecure handling of stdio file descriptor', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457315/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0394
HP HP-UX B11.11 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572.
Affected Products: n/a
References: [{'name': '20070118 Multiple OS kernel insecure handling of stdio file descriptor', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457279/100/0/threaded'}, {'name': '20070118 Re: Multiple OS kernel insecure handling of stdio file descriptor', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457315/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0395
PHP remote file inclusion vulnerability in libraries/grab_globals.lib.php in ComVironment 4.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.
Affected Products: n/a
References: [{'name': 'ADV-2007-0266', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0266'}, {'name': '34621', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34621'}, {'name': 'comvironment-grabglobals-file-include(31564)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31564'}, {'name': '22108', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22108'}, {'name': '3152', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3152'}]
CVE State: PUBLISHED
Explain CVE-2007-0396
Unspecified vulnerability in HP-UX B.11.23, when running IPFilter in combination with PHNE_34474, allows remote attackers to cause a denial of service (system crash) via unspecified vectors.
Affected Products: n/a
References: [{'name': '23800', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23800'}, {'name': 'ADV-2007-0234', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0234'}, {'name': '32869', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32869'}, {'name': 'HPSBUX02181', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00837319'}, {'name': '1017527', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017527'}, {'name': '22103', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22103'}, {'name': 'SSRT061289', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00837319'}, {'name': 'oval:org.mitre.oval:def:6104', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6104'}, {'name': 'hp-ipfilter-dos(31565)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31565'}]
CVE State: PUBLISHED
Explain CVE-2007-0397
The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information.
Affected Products: n/a
References: [{'name': '1017535', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017535'}, {'name': '22111', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22111'}, {'name': '32720', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32720'}, {'name': 'ADV-2007-0245', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0245'}, {'name': '1017536', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017536'}, {'name': '23836', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23836'}, {'name': 'cisco-csmars-asdm-device-spoofing(31567)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31567'}, {'name': '20070118 SSL/TLS Certificate and SSH Public Key Validation Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a00807c517f.shtml'}]
CVE State: PUBLISHED
Explain CVE-2007-0398
Multiple cross-site scripting (XSS) vulnerabilities in forum.php3 in Arnaud Guyonne (aka Arnotic) a-forum allow remote attackers to inject arbitrary web script or HTML via the (1) Sujet or (2) Pseudo field.
Affected Products: n/a
References: [{'name': '20070119 a-forum xss', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457503/100/0/threaded'}, {'name': 'aforum-unspecified-xss(31610)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31610'}, {'name': '20070122 a-forum xss - who? what? where?', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-January/001249.html'}]
CVE State: PUBLISHED
Explain CVE-2007-0399
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Simple Machines Forum (SMF) 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) recipient or (2) BCC field when selecting send in a pm action.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://aria-security.com/forum/showthread.php?p=128'}, {'name': '20070121 Re: SMF "index.php?action=pm" Cross Site-Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457627/100/0/threaded'}, {'name': '20070122 Re: Re: Re: SMF "index.php?action=pm" Cross Site-Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457761/100/200/threaded'}, {'name': '20070126 Re: Re: Re: Re: SMF "index.php?action=pm" Cross Site-Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458194/100/100/threaded'}, {'name': '20070202 Re: SMF "index.php?action=pm" Cross Site-Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458904/100/0/threaded'}, {'name': 'smf-pm-xss(31612)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31612'}, {'name': '22143', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22143'}, {'name': '2169', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2169'}, {'name': '32606', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32606'}, {'name': '20070120 SMF "index.php?action=pm" Cross Site-Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457508/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0400
Cross-site scripting (XSS) vulnerability in admin/memberlist.php in Easebay Resources Login Manager 3.0 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
Affected Products: n/a
References: [{'name': 'loginmanager-memberlist-xss(31614)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31614'}, {'name': '2167', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2167'}, {'name': '20070120 Login Manager Multiple HTML Injections', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457505/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0401
SQL injection vulnerability in admin/memberlist.php in Easebay Resources Login Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the init_row parameter.
Affected Products: n/a
References: [{'name': '2167', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2167'}, {'name': '20070120 Login Manager Multiple HTML Injections', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457505/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0402
Cross-site scripting (XSS) vulnerability in admin/edit_member.php in Easebay Resources Paypal Subscription Manager allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Affected Products: n/a
References: [{'name': '2168', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2168'}, {'name': '33559', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33559'}, {'name': '20070120 Paypal Subscription Manager Multiple HTML Injections', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457506/100/0/threaded'}, {'name': 'psm-editmember-xss(31618)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31618'}]
CVE State: PUBLISHED
Explain CVE-2007-0403
SQL injection vulnerability in admin/memberlist.php in Easebay Resources Paypal Subscription Manager allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
Affected Products: n/a
References: [{'name': '2168', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2168'}, {'name': '36103', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36103'}, {'name': '20070120 Paypal Subscription Manager Multiple HTML Injections', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457506/100/0/threaded'}, {'name': 'psm-memberlist-sql-injection(31616)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31616'}, {'name': '33560', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33560'}]
CVE State: PUBLISHED
Explain CVE-2007-0404
bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.
Affected Products: n/a
References: [{'name': 'django-po-code-execution(31627)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31627'}, {'name': '23826', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23826'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.djangoproject.com/changeset/3592'}, {'name': '22134', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22134'}]
CVE State: PUBLISHED
Explain CVE-2007-0405
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.
Affected Products: n/a
References: [{'name': 'django-request-session-hijacking(31628)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31628'}, {'name': '23826', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23826'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.djangoproject.com/changeset/3754'}, {'name': '22138', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22138'}]
CVE State: PUBLISHED
Explain CVE-2007-0406
Multiple buffer overflows in the (1) main function in (a) client.c, and the (2) server_setup and (3) server_client_connect functions in (b) server.c in gxine 0.5.9 and earlier allow local users to cause a denial of service (daemon crash) or gain privileges via a long HOME environment variable.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '38321', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38321'}, {'name': 'ADV-2007-0259', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0259'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=476891'}, {'name': 'gxine-serversetup-serverclient-bo(31604)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31604'}, {'name': '38320', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38320'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xinehq.de/index.php/news?show_category_id=1'}]
CVE State: PUBLISHED
Explain CVE-2007-0407
Cross-site scripting (XSS) vulnerability in Operation/User.pm in Plain Black WebGUI before 7.3.5 (beta) allows remote attackers to inject arbitrary web script or HTML via the username parameter during anonymous registration, a different vector than CVE-2007-0308.  NOTE: it is possible that a separate "WikiPage titles" issue was also fixed.
Affected Products: n/a
References: [{'name': '32928', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32928'}, {'name': '22114', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22114'}, {'name': 'ADV-2007-0242', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0242'}, {'name': 'webgui-username-xss(31573)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31573'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.plainblack.com/downloads/builds/7.3.5-beta/WebGUI/docs/changelog/7.x.x.txt'}, {'name': '23754', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23754'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.plainblack.com/bugs/tracker/security-update-cross-site-scripting-vulnerability'}]
CVE State: PUBLISHED
Explain CVE-2007-0408
BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an untrusted X.509 certificate.
Affected Products: n/a
References: [{'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'BEA07-135.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/202'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': '38500', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38500'}, {'name': '1017519', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017519'}]
CVE State: PUBLISHED
Explain CVE-2007-0409
BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password.
Affected Products: n/a
References: [{'name': 'BEA07-136.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/203'}, {'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': '38501', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38501'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}]
CVE State: PUBLISHED
Explain CVE-2007-0410
Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers to cause a denial of service (thread and system hang) via unspecified "sequences of events."
Affected Products: n/a
References: [{'name': 'BEA07-137.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/204'}, {'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': '38502', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38502'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}]
CVE State: PUBLISHED
Explain CVE-2007-0411
BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle (MITM) attack.
Affected Products: n/a
References: [{'name': '38503', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38503'}, {'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': 'BEA07-138.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/205'}]
CVE State: PUBLISHED
Explain CVE-2007-0412
BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files.
Affected Products: n/a
References: [{'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'BEA07-139.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/206'}, {'name': '38505', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38505'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}]
CVE State: PUBLISHED
Explain CVE-2007-0413
BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which allows local users to obtain sensitive information by reading this backup file.
Affected Products: n/a
References: [{'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'BEA07-140.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/207'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': '38504', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38504'}]
CVE State: PUBLISHED
Explain CVE-2007-0414
BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attackers to cause a denial of service (server hang) via certain requests that cause muxer threads to block when processing error pages.
Affected Products: n/a
References: [{'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'BEA07-141.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/208'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': '38506', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38506'}]
CVE State: PUBLISHED
Explain CVE-2007-0415
BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an application that is implemented through exploded jars, which allows attackers to bypass intended access restrictions.
Affected Products: n/a
References: [{'name': '38509', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38509'}, {'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': 'BEA07-142.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/209'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}]
CVE State: PUBLISHED
Explain CVE-2007-0416
The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security.
Affected Products: n/a
References: [{'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': '38510', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38510'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': 'BEA07-143.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/210'}]
CVE State: PUBLISHED
Explain CVE-2007-0417
BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity.
Affected Products: n/a
References: [{'name': '38511', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38511'}, {'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': 'BEA07-144.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/211'}]
CVE State: PUBLISHED
Explain CVE-2007-0418
BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods.
Affected Products: n/a
References: [{'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': '38512', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38512'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': 'BEA07-145.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/212'}]
CVE State: PUBLISHED
Explain CVE-2007-0419
The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage).
Affected Products: n/a
References: [{'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'BEA07-146.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/213'}, {'name': '38513', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38513'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}]
CVE State: PUBLISHED
Explain CVE-2007-0420
BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests.
Affected Products: n/a
References: [{'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': '38514', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38514'}, {'name': 'BEA07-147.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/214'}]
CVE State: PUBLISHED
Explain CVE-2007-0421
BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log.
Affected Products: n/a
References: [{'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': '32859', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32859'}, {'name': 'BEA07-148.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/215'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}]
CVE State: PUBLISHED
Explain CVE-2007-0422
BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket connections.
Affected Products: n/a
References: [{'name': '32858', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32858'}, {'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': 'BEA07-150.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/217'}]
CVE State: PUBLISHED
Explain CVE-2007-0423
BEA WebLogic Portal 9.2 does not properly handle when an administrator deletes entitlements for a role, which causes other role entitlements to be "inadvertently affected," which has an unknown impact.
Affected Products: n/a
References: [{'name': '32857', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32857'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': '1017521', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017521'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': 'BEA07-151.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/218'}]
CVE State: PUBLISHED
Explain CVE-2007-0424
Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable, hosting web server failure, or CPU consumption.
Affected Products: n/a
References: [{'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': '32856', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32856'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': 'BEA07-152.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/219'}]
CVE State: PUBLISHED
Explain CVE-2007-0425
Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to gain privileges via unspecified vectors, related to an "overflow condition," probably a buffer overflow.
Affected Products: n/a
References: [{'name': '1017525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017525'}, {'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': 'BEA07-155.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/222'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': '38515', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38515'}]
CVE State: PUBLISHED
Explain CVE-2007-0426
BEA WebLogic Portal 9.2, when running in a WebLogic Server clustered environment using WebLogic Portal entitlements, does not properly propagate entitlement policy changes if the changes are made on a managed server while the Administrative Server is unavailable, which might allow attackers to bypass intended restrictions.
Affected Products: n/a
References: [{'name': '23750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23750'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': '1017521', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017521'}, {'name': 'ADV-2007-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0213'}, {'name': '32854', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32854'}, {'name': 'BEA07-156.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/223'}, {'name': '38516', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38516'}]
CVE State: PUBLISHED
Explain CVE-2007-0427
Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a help project (.HPJ) file with a long HLP field in the OPTIONS section.
Affected Products: n/a
References: [{'name': '22135', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22135'}, {'name': '2177', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2177'}, {'name': '31899', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31899'}, {'name': '23862', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23862'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.anspi.pl/~porkythepig/visualization/hpj-x01.cpp'}, {'name': '20070119 Help project files (.HPJ) buffer overflow vulnerability in Microsoft Help Workshop', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457436/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0428
Unspecified vulnerability in the chtbl_lookup function in hash.c for WzdFTPD 8.0 and earlier allows remote attackers to cause a denial of service via a crafted FTP command, probably due to a NULL pointer dereference.
Affected Products: n/a
References: [{'name': '23852', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23852'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.s21sec.com/avisos/s21sec-033-en.txt'}, {'name': 'wzdftpd-ftp-dos(31599)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31599'}, {'name': '2171', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2171'}, {'name': 'ADV-2007-0277', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0277'}, {'name': '32941', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32941'}, {'name': '1017537', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017537'}, {'name': '20070119 WzdFTPD < 8.1 Denial of service', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051896.html'}, {'name': '20070119 WzdFTPD < 8.1 Denial of service', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457454/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0429
DivXBrowserPlugin (aka DivX Web Player) npdivx32.dll, as distributed with DivX Player 6.4.1, allows remote attackers to cause a denial of service (Internet Explorer 7 crash) by invoking the GoWindowed method for a certain instance of the ActiveX object.
Affected Products: n/a
References: [{'name': '3157', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3157'}, {'name': '37693', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37693'}, {'name': 'divx-divxbrowserplugin-dos(31601)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31601'}, {'name': '22133', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22133'}]
CVE State: PUBLISHED
Explain CVE-2007-0430
The shared_region_map_file_np function in Apple Mac OS X 10.4.8 and earlier kernel allows local users to cause a denial of service (memory corruption) via a large mappingCount value.
Affected Products: n/a
References: [{'name': '23823', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23823'}, {'name': '2178', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2178'}, {'name': '1017538', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017538'}, {'name': 'macos-sharedregionmapfilenp-dos(31645)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31645'}, {'name': '20070119 [RISE-2007001] Apple Mac OS X 10.4.x kernel shared_region_map_file_np() memory corruption vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457466/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://risesecurity.org/advisory.php?id=RISE-2007001.txt'}, {'name': 'ADV-2007-0275', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0275'}, {'name': '32942', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/32942'}]
CVE State: PUBLISHED
Explain CVE-2007-0431
AVM Fritz!Box 7050, and possibly other product models, allows remote attackers to cause a denial of service (VoIP application crash) via a zero-length UDP packet to the SIP port (port 5060).
Affected Products: n/a
References: [{'name': '20070119 DoS against AVM Fritz!Box 7050 (and others)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0387.html'}, {'name': '22130', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22130'}, {'tags': ['x_refsource_MISC'], 'url': 'http://mazzoo.de/blog/2007/01/18#FritzBox_DoS'}, {'name': '23868', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23868'}, {'name': 'ADV-2007-0272', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0272'}, {'name': '20070123 Re: DoS against AVM Fritz!Box 7050 (and others)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457829/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'ftp://ftp.avm.de/fritz.box/fritzbox.fon_wlan_7050/firmware/info.txt'}, {'name': 'fritzbox-udp-packet-dos(31633)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31633'}, {'name': '32940', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32940'}, {'name': '20070119 DoS against AVM Fritz!Box 7050 (and others)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457406/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0432
BEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy service, which might allow remote attackers to bypass authorization policies and route requests to back-end services or conduct other unauthorized activities.
Affected Products: n/a
References: [{'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': '23786', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23786'}, {'name': '32862', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32862'}, {'name': '1017523', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017523'}, {'name': 'BEA07-157.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/224'}]
CVE State: PUBLISHED
Explain CVE-2007-0433
Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows remote authenticated users to access the server even after the account has been disabled.
Affected Products: n/a
References: [{'name': 'BEA07-154.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/221'}, {'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': '23786', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23786'}, {'name': '32861', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32861'}, {'name': '1017524', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017524'}]
CVE State: PUBLISHED
Explain CVE-2007-0434
BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection.
Affected Products: n/a
References: [{'name': '22082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22082'}, {'name': 'BEA07-153.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/220'}, {'name': '23786', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23786'}, {'name': '32860', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32860'}]
CVE State: PUBLISHED
Explain CVE-2007-0435
T-Com Speedport 500V routers with firmware 1.31 allow remote attackers to bypass authentication and reconfigure the device via a LOGINKEY=TECOM cookie value.
Affected Products: n/a
References: [{'name': '20070119 Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457453/100/0/threaded'}, {'name': '32995', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32995'}, {'name': '20070122 Re: Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457656/100/0/threaded'}, {'name': '20070121 Re: Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457645/100/0/threaded'}, {'name': 'tcom-login-authentication-bypass(31621)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31621'}, {'name': '23853', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23853'}, {'name': '20070216 Re: Virginity Security Advisory 2007-001 : T-Com Speedport 500V Login bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460319/100/0/threaded'}, {'name': '22160', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22160'}]
CVE State: PUBLISHED