Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2007-0517
Scriptsez Random PHP Quote 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password information via a direct request for pwd.txt.
Affected Products: n/a
References: [{'name': '32947', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32947'}, {'name': '2184', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2184'}, {'name': 'randomphpquote-pwd-information-disclosure(31696)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31696'}, {'name': '23888', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23888'}, {'name': '20070123 RANDOM PHP QUOTE 1.0 (pwd.txt) Remote Password Disclosur', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457825/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0518
Scriptsez Smart PHP Subscriber (aka subscribe) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt.
Affected Products: n/a
References: [{'name': '23886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23886'}, {'name': '2183', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2183'}, {'name': '32946', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32946'}, {'name': 'subscriber-pwd-information-disclosure(31701)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31701'}, {'name': '20070123 subscribe (pwd.txt) Remote Password Disclosur', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457852/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0519
Cross-site scripting (XSS) vulnerability in memcp.php in XMB U2U Instant Messenger allows remote authenticated users to inject arbitrary web script or HTML via the recipient field.
Affected Products: n/a
References: [{'name': '20070120 XMB "U2U Instant Messenger" Cross-Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457630/100/0/threaded'}, {'name': '2182', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2182'}, {'name': 'u2u-memcp-xss(31661)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31661'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aria-security.com/forum/showthread.php?p=129'}, {'tags': ['x_refsource_MISC'], 'url': 'https://docs.xmbforum2.com/index.php?title=Security_Issue_History'}]
CVE State: PUBLISHED
Explain CVE-2007-0520
SQL injection vulnerability in banner.php in Unique Ads (UDS) 1.x allows remote attackers to execute arbitrary SQL commands via the bid parameter.
Affected Products: n/a
References: [{'name': 'uniqueads-banner-sql-injection(31660)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31660'}, {'name': '20070121 SQL Injection in Unique Ads ( UDS )', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457667/100/0/threaded'}, {'name': '2181', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2181'}]
CVE State: PUBLISHED
Explain CVE-2007-0521
The Sony Ericsson K700i and W810i phones allow remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth, as demonstrated by ussp-push.
Affected Products: n/a
References: [{'name': '2180', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2180'}, {'name': '20070123 Re: Bluetooth DoS by obex push [readable]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457797/100/0/threaded'}, {'name': '20070123 Bluetooth DoS by obex push', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457768/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0522
The Motorola MOTORAZR V3 phone allows remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth, as demonstrated by ussp-push.
Affected Products: n/a
References: [{'name': '2180', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2180'}, {'name': '20070123 Re: Bluetooth DoS by obex push [readable]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457797/100/0/threaded'}, {'name': '20070123 Bluetooth DoS by obex push', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457768/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0523
The Nokia N70 phone allows remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth, as demonstrated by ussp-push.
Affected Products: n/a
References: [{'name': '2180', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2180'}, {'name': '20070123 Re: Bluetooth DoS by obex push [readable]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457797/100/0/threaded'}, {'name': '20070123 Bluetooth DoS by obex push', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457768/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0524
The LG Chocolate KG800 phone allows remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth, as demonstrated by ussp-push.
Affected Products: n/a
References: [{'name': '2180', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2180'}, {'name': '20070123 Re: Bluetooth DoS by obex push [readable]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457797/100/0/threaded'}, {'name': '20070123 Bluetooth DoS by obex push', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457768/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0525
Multiple buffer overflows in Nickolas Grigoriadis Mini Web server (MiniWebsvr) before 0.05 have unknown impact and attack vectors.
Affected Products: n/a
References: [{'name': '33512', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33512'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=479480&group_id=187000'}, {'name': 'ADV-2007-0294', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0294'}]
CVE State: PUBLISHED
Explain CVE-2007-0526
Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the URL (PATH_INFO) to (1) articles/edit.php, (2) articles/list.php, (3) blogs/list_blogs.php, or (4) blogs/rankings.php.
Affected Products: n/a
References: [{'name': '2186', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2186'}, {'name': '33579', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33579'}, {'name': 'bitweaver-multiple-scripts-xss(31655)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31655'}, {'name': '33578', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33578'}, {'name': '20070122 [x0n3-h4ck] bitweaver 1.3.1 XSS Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457695/100/0/threaded'}, {'name': '33580', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33580'}, {'name': '33581', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33581'}]
CVE State: PUBLISHED
Explain CVE-2007-0527
SQL injection vulnerability in the is_remembered function in class.login.php in Website Baker 2.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the REMEMBER_KEY cookie parameter. NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '23828', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23828'}, {'name': '2185', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2185'}, {'name': 'ADV-2007-0311', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0311'}, {'name': '32945', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32945'}, {'name': 'websitebaker-login-sql-injection(31692)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31692'}, {'name': '22176', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22176'}, {'name': '20070122 SQL Injection by using Cookie Poisoning for Website Baker Version 2.6.5 and before', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457684/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0528
The admin web console implemented by the Centrality Communications (aka Aredfox) PA168 chipset and firmware 1.54 and earlier, as provided by various IP phones, does not require passwords or authentication tokens when using HTTP, which allows remote attackers to connect to existing superuser sessions and obtain sensitive information (passwords and configuration data).
Affected Products: n/a
References: [{'name': '23936', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23936'}, {'name': 'ADV-2007-0346', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0346'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.procheckup.com/Vulner_PR0614.php'}, {'name': '20070123 PR06-14: IP Phones based on Centrality Communications/Aredfox PA168 chipset weak session management vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457868/100/0/threaded'}, {'name': '23919', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23919'}, {'name': '32966', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32966'}, {'name': '3189', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3189'}]
CVE State: PUBLISHED
Explain CVE-2007-0529
Cross-site scripting (XSS) vulnerability in index.html (aka the administration page) in PHP Link Directory (phpLD) 3.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted link, which is triggered when the administrator uses the "Validate Links" functionality.
Affected Products: n/a
References: [{'name': '32952', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32952'}, {'name': '20070121 PHP Link Directory XSS Vulnerability version <= 3.0.6', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457672/100/0/threaded'}, {'name': 'phpld-admin-xss(31662)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31662'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.smilehouse.com/advisory/phplinkdirectory_070121.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0530
Multiple PHP remote file inclusion vulnerabilities in Advanced Guestbook 2.4.2 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) index.php, (2) addentry.php, or (3) picture.php, a different set of vectors than CVE-2006-5804.  NOTE: this issue has been disputed by third party researchers, stating that the include_path variable is instantiated before use
Affected Products: n/a
References: [{'name': '20070123 Re: Advanced Guestbook <=- 2.4.2 (include_path) Remote File Include Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457955/100/0/threaded'}, {'name': '20070123 Advanced Guestbook <=- 2.4.2 (include_path) Remote File Include Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457870/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0531
PHP remote file inclusion vulnerability in includes/login.php in FreeWebShop 2.2.3 and 2.2.4 before 20070123 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter.
Affected Products: n/a
References: [{'name': 'freewebshop-login-file-include(31732)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31732'}, {'name': '1017549', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017549'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.freewebshop.org/?id=36'}, {'name': '23898', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23898'}, {'name': '32951', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32951'}, {'tags': ['x_refsource_MISC'], 'url': 'http://14house.blogspot.com/2007/01/freewebshoporg-remote-file-inclusion.html'}, {'name': 'ADV-2007-0319', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0319'}]
CVE State: PUBLISHED
Explain CVE-2007-0532
Tuan Do Uploader (aka php-uploader) 6 beta 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrator password hash via a direct request for userdata/user_1.txt.
Affected Products: n/a
References: [{'name': 'uploader-userdata-info-disclosure(31683)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31683'}, {'name': '20070122 Uploader <= (userdata/user_1.txt) Password Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457698/100/0/threaded'}, {'name': '2187', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2187'}]
CVE State: PUBLISHED
Explain CVE-2007-0533
The AToZed IntraWeb component 8.0 and earlier for Borland Delphi and Kylix, and IntraWeb 9.0 before build (9.0.12), allows remote attackers to cause a denial of service (thread hang or CPU consumption) via a crafted HTTP request, related to the OnBeforeDispatch function in the TIWServerController object.
Affected Products: n/a
References: [{'name': '20070124 Re: AToZed Software Intraweb Component for Borland Delphi and Kylix DoS vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457947/100/0/threaded'}, {'name': 'intraweb-component-dos(31685)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31685'}, {'name': '23902', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23902'}, {'name': '22185', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22185'}, {'name': 'ADV-2007-0355', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0355'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.atozed.com/Olaf/20070124A.en.aspx'}, {'name': '20070123 AToZed Software Intraweb Component for Borland Delphi and Kylix DoS vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457758/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.atozed.com/Olaf/20070124.en.aspx'}, {'name': '20070125 Re: AToZed Software Intraweb Component for Borland Delphi and Kylix DoS vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458121/100/0/threaded'}, {'name': '32973', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32973'}]
CVE State: PUBLISHED
Explain CVE-2007-0534
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Project issue tracking 4.7.0 through 5.x before 20070123 and (2) Project 4.6.0 through 5.x before 20070123 modules for Drupal allow remote authenticated users to inject arbitrary web script or HTML via (a) certain "fields on project nodes" or (b) "certain project-specific settings regarding issue tracking."
Affected Products: n/a
References: [{'name': 'projecttracking-unspecified-xss(31728)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31728'}, {'name': '22224', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22224'}, {'name': '32133', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32133'}, {'name': 'ADV-2007-0312', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0312'}, {'name': '23908', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23908'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/112146'}]
CVE State: PUBLISHED
Explain CVE-2007-0535
Multiple eval injection vulnerabilities in Vote! Pro 4.0, and possibly earlier, allow remote attackers to execute arbitrary code via requests to unspecified PHP scripts with the poll_id parameter, which is supplied to eval function calls, a different set of vectors than CVE-2007-0504.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'ADV-2007-0300', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0300'}, {'name': '31606', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31606'}, {'name': '23834', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23834'}]
CVE State: PUBLISHED
Explain CVE-2007-0536
The chroot helper in rMake for rPath Linux 1 does not drop supplemental groups, which causes packages to be installed with insecure permissions and might allow local users to gain privileges.
Affected Products: n/a
References: [{'name': '23922', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23922'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-987'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.rpath.com/pipermail/security-announce/2007-January/000137.html'}, {'name': 'rpath-rmake-privilege-escalation(31942)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31942'}, {'name': '32972', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32972'}]
CVE State: PUBLISHED
Explain CVE-2007-0537
The KDE HTML library (kdelibs), as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to CVE-2007-0478.
Affected Products: n/a
References: [{'name': 'RHSA-2007:0909', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2007-0909.html'}, {'name': 'MDKSA-2007:157', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:157'}, {'name': '24889', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24889'}, {'name': '23932', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23932'}, {'name': 'SUSE-SR:2007:006', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_6_sr.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kde.org/info/security/advisory-20070206-1.txt'}, {'name': '32975', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32975'}, {'name': 'GLSA-200703-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200703-10.xml'}, {'name': '20070124 Re: Safari Improperly Parses HTML Documents & BlogSpot XSS vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457924/100/0/threaded'}, {'name': 'USN-420-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-420-1'}, {'name': '27108', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/27108'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-1117'}, {'name': '24463', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24463'}, {'name': '1017591', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017591'}, {'name': '24065', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24065'}, {'name': '24013', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24013'}, {'name': 'oval:org.mitre.oval:def:10244', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10244'}, {'name': 'MDKSA-2007:031', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:031'}, {'name': 'ADV-2007-0505', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0505'}, {'name': '22428', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22428'}, {'name': '24442', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24442'}]
CVE State: PUBLISHED
Explain CVE-2007-0538
Telligent Community Server 2.1 and earlier allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to (1) a large file, which triggers a long download session without a timeout constraint; or (2) a file with a binary content type, which is downloaded even though it cannot contain usable pingback data.
Affected Products: n/a
References: [{'name': '2211', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2211'}, {'name': '33583', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33583'}, {'name': '33584', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33584'}, {'name': '20070124 Weaknesses in Pingback Design', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457996/100/0/threaded'}, {'name': '20070124 DoS against Telligent Community Server', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457999/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0539
The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a large file, which triggers a long download session without a timeout constraint.
Affected Products: n/a
References: [{'name': '20070124 Multiple Remote Vulnerabilities in Wordpress', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458003/100/0/threaded'}, {'name': '20070124 Weaknesses in Pingback Design', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457996/100/0/threaded'}, {'name': '2191', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2191'}]
CVE State: PUBLISHED
Explain CVE-2007-0540
WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a file with a binary content type, which is downloaded even though it cannot contain usable pingback data.
Affected Products: n/a
References: [{'name': '30013', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30013'}, {'name': '20070124 Multiple Remote Vulnerabilities in Wordpress', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458003/100/0/threaded'}, {'name': 'DSA-1564', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1564'}, {'name': '20070124 Weaknesses in Pingback Design', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457996/100/0/threaded'}, {'name': '2191', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2191'}]
CVE State: PUBLISHED
Explain CVE-2007-0541
WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain configurations causes a brief file excerpt to be published as a blog comment.
Affected Products: n/a
References: [{'name': '20070124 Multiple Remote Vulnerabilities in Wordpress', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458003/100/0/threaded'}, {'name': '20070124 Weaknesses in Pingback Design', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457996/100/0/threaded'}, {'name': '2191', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2191'}]
CVE State: PUBLISHED
Explain CVE-2007-0542
Cross-site scripting (XSS) vulnerability in show.php in 212cafe Guestbook 4.00 beta allows remote attackers to inject arbitrary web script or HTML via the user parameter.
Affected Products: n/a
References: [{'name': '20070121 XSS in Guestbook ( v.4.00 beta )', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457660/100/0/threaded'}, {'name': 'guestbook-show-xss(31663)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31663'}, {'name': '2190', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2190'}]
CVE State: PUBLISHED
Explain CVE-2007-0543
ZixForum 1.14 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for Zixforum.mdb.  NOTE: a followup post suggests that this issue only occurs if the administrator does not properly follow installation directions.
Affected Products: n/a
References: [{'name': '20070124 Re: ZixForum <= 1.14 (Zixforum.mdb) Remote Password Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458135/100/100/threaded'}, {'name': '2189', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2189'}, {'name': '20070124 ZixForum <= 1.14 (Zixforum.mdb) Remote Password Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457950/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0544
Cross-site scripting (XSS) vulnerability in private.php in MyBB (aka MyBulletinBoard) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949.
Affected Products: n/a
References: [{'name': 'mybb-subject-field-xss(31740)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31740'}, {'name': '32967', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32967'}, {'name': '22205', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22205'}, {'name': '23934', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23934'}, {'name': '20070124 [Aria-Security Team] MyBB Cross-Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457929/100/0/threaded'}, {'name': '28837', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28837'}]
CVE State: PUBLISHED
Explain CVE-2007-0545
Maxtricity Tagger 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for tagger.mdb.
Affected Products: n/a
References: [{'name': '2214', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2214'}, {'name': '33577', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33577'}, {'name': '20070124 Maxtricity Tagger Password Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457953/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0546
Toxiclab Shoutbox 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db.mdb.
Affected Products: n/a
References: [{'name': '20070124 Toxiclab Shoutbox Password Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457931/100/0/threaded'}, {'name': '33576', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33576'}, {'name': '2213', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2213'}]
CVE State: PUBLISHED
Explain CVE-2007-0547
Cross-site scripting (XSS) vulnerability in CGI-RESCUE WebFORM 4.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#05123538', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/jp/JVN%2305123538/index.html'}, {'name': '23913', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23913'}, {'name': 'ADV-2007-0344', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0344'}, {'name': '32964', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32964'}]
CVE State: PUBLISHED
Explain CVE-2007-0548
KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number of requests for nonexistent objects.
Affected Products: n/a
References: [{'name': '31623', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31623'}, {'name': '3182', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3182'}, {'name': 'sami-http-request-dos(31690)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31690'}, {'name': '23901', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23901'}]
CVE State: PUBLISHED
Explain CVE-2007-0549
Cross-site scripting (XSS) vulnerability in list3.php in 212cafeBoard 6.30 Beta allows remote attackers to inject arbitrary web script or HTML via the user parameter.
Affected Products: n/a
References: [{'name': '2212', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2212'}, {'name': '212cafeboard-list3-xss(31650)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31650'}, {'name': '20070121 XSS in 212cafeBoard ( Verision 0.08 & 6.30 Beta )', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457611/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0550
Cross-site scripting (XSS) vulnerability in search.php in 212cafeBoard 0.08 Beta allows remote attackers to inject arbitrary web script or HTML via keyword parameter.
Affected Products: n/a
References: [{'name': '2212', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2212'}, {'name': '20070121 XSS in 212cafeBoard ( Verision 0.08 & 6.30 Beta )', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457611/100/0/threaded'}, {'name': '212cafeboard-search-xss(31651)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31651'}]
CVE State: PUBLISHED
Explain CVE-2007-0551
Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters.
Affected Products: n/a
References: [{'name': '33572', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33572'}, {'name': '2195', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2195'}, {'name': '20070120 cmsimple 2.7 Remote File Include', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457668/100/0/threaded'}, {'name': 'cmsimple-cms-file-include(31658)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31658'}]
CVE State: PUBLISHED
Explain CVE-2007-0552
Cross-site scripting (XSS) vulnerability in install/default/error404.html in Oh no! Not another CMS (Onnac) 0.0.8.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the error_url parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://onnac.svn.sourceforge.net/viewvc/onnac/trunk/install/default/error404.html?view=log'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/forum/forum.php?forum_id=655260'}, {'name': 'ADV-2007-0347', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0347'}, {'name': '22256', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22256'}, {'name': 'onnac-error-xss(31795)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31795'}, {'name': '36811', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36811'}]
CVE State: PUBLISHED
Explain CVE-2007-0553
Multiple cross-site scripting (XSS) vulnerabilities in index.inc.php in PHProxy before 0.5 beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) data[realm] and (2) _url parameters, different vectors than CVE-2004-2604.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=479999&group_id=110693'}, {'name': 'ADV-2007-0348', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0348'}, {'name': '22255', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22255'}, {'name': '36812', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36812'}]
CVE State: PUBLISHED
Explain CVE-2007-0554
SQL injection vulnerability in print.asp in Guo Xu Guos Posting System (GPS) 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '20070125 GPS 1.2 Content Managing System (print.asp) Remote SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458061/100/0/threaded'}, {'name': 'ADV-2007-0353', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0353'}, {'name': '22232', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22232'}, {'name': '31635', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31635'}, {'name': '2209', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2209'}, {'name': 'gps-print-sql-injection(31759)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31759'}, {'name': '23929', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23929'}, {'name': '3195', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3195'}]
CVE State: PUBLISHED
Explain CVE-2007-0557
rMake before 1.0.4 drops root privileges in a way that retains the original supplemental groups, which might allow attackers to gain privileges via a crafted recipe file, a different vulnerability than CVE-2007-0536.
Affected Products: n/a
References: [{'name': '32971', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32971'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-1002'}]
CVE State: PUBLISHED
Explain CVE-2007-0558
PHP remote file inclusion vulnerability in modules/mail/main.php in Inter7 vHostAdmin 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the MODULES_DIR parameter.
Affected Products: n/a
References: [{'name': '3191', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3191'}, {'name': 'ADV-2007-0339', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0339'}, {'name': '36627', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36627'}]
CVE State: PUBLISHED
Explain CVE-2007-0559
PHP remote file inclusion vulnerability in config.php in RPW 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the sql_language parameter.
Affected Products: n/a
References: [{'name': 'ADV-2007-0342', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0342'}, {'name': '36626', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36626'}, {'name': '3185', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3185'}]
CVE State: PUBLISHED
Explain CVE-2007-0560
SQL injection vulnerability in user.asp in ASP EDGE 1.2b and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter.
Affected Products: n/a
References: [{'name': '31619', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31619'}, {'name': '3186', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3186'}, {'name': '23894', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23894'}, {'name': '22212', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22212'}, {'name': '20070125 ASP EDGE <= V1.2b (user.asp) Remote SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458058/100/100/threaded'}, {'name': 'ADV-2007-0341', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0341'}, {'name': 'aspedge-user-sql-injection(31723)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31723'}]
CVE State: PUBLISHED
Explain CVE-2007-0561
Multiple PHP remote file inclusion vulnerabilities in Xero Portal 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) admin_linkdb.php, (2) admin_forum_prune.php, (3) admin_extensions.php, (4) admin_board.php, (5) admin_attachments.php, or (6) admin_users.php in admin/.
Affected Products: n/a
References: [{'name': '31977', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31977'}, {'name': '23952', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23952'}, {'name': '31978', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31978'}, {'name': '22227', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22227'}, {'name': 'xero-multiple-scripts-file-include(31767)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31767'}, {'name': '3192', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3192'}, {'name': '31980', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31980'}, {'name': 'ADV-2007-0338', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0338'}, {'name': '31634', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31634'}, {'name': '31979', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31979'}, {'name': '31981', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31981'}, {'name': '20070125 Xero Portal v1.2 (phpbb_root_path) Remote File Include Vulnerablity', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458059/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0562
Windows Explorer (explorer.exe) 6.0.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted .avi file, which triggers the crash when the user right clicks on the file.
Affected Products: n/a
References: [{'name': '3190', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3190'}, {'name': '43307', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/43307'}]
CVE State: PUBLISHED
Explain CVE-2007-0563
Multiple cross-site scripting (XSS) vulnerabilities in Symantec Web Security (SWS) before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) error messages and (2) blocked page messages produced by SWS.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://securityresponse.symantec.com/avcenter/security/Content/2007.01.24c.html'}, {'name': 'ADV-2007-0330', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0330'}, {'name': '23896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23896'}, {'name': '32960', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32960'}, {'name': '1017558', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017558'}, {'name': 'symantec-html-xss(31750)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31750'}, {'name': '32961', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32961'}, {'name': '22184', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22184'}]
CVE State: PUBLISHED
Explain CVE-2007-0564
The license registering interface in Symantec Web Security (SWS) before 3.0.1.85 allows attackers to cause a denial of service (CPU consumption) by submitting a large file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://securityresponse.symantec.com/avcenter/security/Content/2007.01.24c.html'}, {'name': 'ADV-2007-0330', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0330'}, {'name': '23896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23896'}, {'name': '1017558', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017558'}]
CVE State: PUBLISHED
Explain CVE-2007-0565
CGI-Rescue Shopping Basket Professional 7.50 and earlier allows remote attackers to inject arbitrary operating system commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '31622', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31622'}, {'name': '23909', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23909'}, {'name': '22245', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22245'}, {'name': 'JVN#82258242', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/jp/JVN%2382258242/index.html'}]
CVE State: PUBLISHED
Explain CVE-2007-0566
SQL injection vulnerability in news_detail.asp in ASP NEWS 3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '22214', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22214'}, {'name': '20070125 ASP NEWS <= V3 (news_detail.asp) Remote SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458057/100/100/threaded'}, {'name': '33582', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33582'}, {'name': 'aspnews-newsdetail-sql-injection(31719)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31719'}, {'name': 'ADV-2007-0340', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0340'}, {'name': '3187', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3187'}]
CVE State: PUBLISHED
Explain CVE-2007-0567
Cross-site scripting (XSS) vulnerability in admin.php in Interactive-Scripts.Com PHP Membership Manager 1.5 allows remote attackers to inject arbitrary web script or HTML via the _p parameter.
Affected Products: n/a
References: [{'name': '20070126 PHP Membership Manager Cross-Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458226/100/0/threaded'}, {'name': '33601', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33601'}, {'name': 'phpmembership-admin-xss(31916)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31916'}, {'name': '22263', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22263'}]
CVE State: PUBLISHED
Explain CVE-2007-0568
PHP remote file inclusion vulnerability in system/lib/package.php in MyPHPCommander 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the gl_root parameter.
Affected Products: n/a
References: [{'name': '22257', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22257'}, {'name': '23890', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23890'}, {'name': 'ADV-2007-0385', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0385'}, {'name': '3201', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3201'}, {'name': '32055', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32055'}, {'name': 'myphpcommander-package-file-include(31906)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31906'}]
CVE State: PUBLISHED