Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2007-1234
Multiple cross-site scripting (XSS) vulnerabilities in sitex allow remote attackers to inject arbitrary web script or HTML via (1) the sxYear parameter to calendar.php, (2) the search parameter to search.php, (3) the linkid parameter to redirect.php, or (4) the page parameter to calendar_events.php.
Affected Products: n/a
References: [{'name': '20070223 sitex multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461305/100/0/threaded'}, {'name': '33161', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33161'}, {'name': '33158', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33158'}, {'name': '2373', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2373'}, {'name': '20070414 Re: sitex multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/465849/100/200/threaded'}, {'name': '33159', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33159'}, {'name': '33160', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33160'}]
CVE State: PUBLISHED
Explain CVE-2007-1235
Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file.
Affected Products: n/a
References: [{'name': '20070223 sitex multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461305/100/0/threaded'}, {'name': '33157', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33157'}, {'name': '2373', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2373'}]
CVE State: PUBLISHED
Explain CVE-2007-1236
sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the (1) sxMonth[] or (2) sxYear[] parameter to calendar.php, or the (3) page[] parameter to calendar_events.php, which reveals the path in various error messages.
Affected Products: n/a
References: [{'name': '33156', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33156'}, {'name': '20070223 sitex multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461305/100/0/threaded'}, {'name': '33155', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33155'}, {'name': '2373', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2373'}]
CVE State: PUBLISHED
Explain CVE-2007-1237
sitex allows remote attackers to obtain potentially sensitive information via a ' (quote) value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error.
Affected Products: n/a
References: [{'name': '20070223 sitex multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461305/100/0/threaded'}, {'name': '33154', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33154'}, {'name': '2373', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2373'}]
CVE State: PUBLISHED
Explain CVE-2007-1238
Microsoft Office 2003 allows user-assisted remote attackers to cause a denial of service (application crash) by attempting to insert a corrupted WMF file.
Affected Products: n/a
References: [{'name': '20070225 Few unreported vulnerabilities by SehaTo', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461373/100/0/threaded'}, {'name': '34489', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34489'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityvulns.com/Qdocument120.html'}]
CVE State: PUBLISHED
Explain CVE-2007-1239
Microsoft Excel 2003 does not properly parse .XLS files, which allows remote attackers to cause a denial of service (application crash) via a file with a (1) corrupted XML format or a (2) corrupted XLS format, which triggers a NULL pointer dereference.
Affected Products: n/a
References: [{'name': '20070225 Few unreported vulnerabilities by SehaTo', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461373/100/0/threaded'}, {'name': '22717', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22717'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityvulns.com/news/Microsoft/Excel/XML/DoS.html'}]
CVE State: PUBLISHED
Explain CVE-2007-1240
Multiple cross-site scripting (XSS) vulnerabilities in Docebo CMS 3.0.3 through 3.0.5 allow remote attackers to inject arbitrary web script or HTML via (1) the searchkey parameter to index.php, or the (2) sn or (3) ri parameter to modules/htmlframechat/index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '22719', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22719'}, {'name': 'Docebocms-index-xss(32842)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32842'}, {'tags': ['x_refsource_MISC'], 'url': 'http://downloads.securityfocus.com/vulnerabilities/exploits/22719.html'}, {'name': '35995', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35995'}, {'name': '35996', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35996'}]
CVE State: PUBLISHED
Explain CVE-2007-1241
Cross-site scripting (XSS) vulnerability in setup.php in Audins Audiens 3.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://downloads.securityfocus.com/vulnerabilities/exploits/22728.html'}, {'name': '35994', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35994'}, {'name': 'audins-setup-xss(32839)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32839'}, {'name': '22728', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22728'}]
CVE State: PUBLISHED
Explain CVE-2007-1242
SQL injection vulnerability in system/index.php in Audins Audiens 3.3 allows remote attackers to execute arbitrary SQL commands via the PHPSESSID cookie.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'audins-index-sql-injection(32837)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32837'}, {'name': '34631', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34631'}, {'name': '22728', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22728'}]
CVE State: PUBLISHED
Explain CVE-2007-1243
Audins Audiens 3.3 allows remote attackers to bypass authentication and perform certain privileged actions, possibly an uninstall of the product, by calling unistall.php with the values cnf=disinstalla and status=on.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '22728', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22728'}, {'name': '33792', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33792'}, {'name': '24254', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24254'}, {'name': 'audins-unistall-authentication-bypass(32707)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32707'}]
CVE State: PUBLISHED
Explain CVE-2007-1244
Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php.  NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.
Affected Products: n/a
References: [{'name': 'wordpress-post-csrf(32703)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32703'}, {'name': '20070226 WordPress AdminPanel CSRF/XSS - 0day', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0583.html'}, {'name': '20070226 WordPress AdminPanel CSRF/XSS - 0day', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461351/100/0/threaded'}, {'name': '22735', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22735'}, {'name': '24566', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24566'}, {'name': '33787', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33787'}, {'name': 'GLSA-200703-23', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml'}, {'name': '33788', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33788'}]
CVE State: PUBLISHED
Explain CVE-2007-1245
IrfanView 3.99 allows remote attackers to cause a denial of service (application crash) via a malformed WMF file.
Affected Products: n/a
References: [{'name': '20070225 Few unreported vulnerabilities by SehaTo', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461373/100/0/threaded'}, {'name': '34487', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34487'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityvulns.com/news/IrfanView/WMF/DoS.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityvulns.com/Qdocument120.html'}]
CVE State: PUBLISHED
Explain CVE-2007-1247
Multiple PHP remote file inclusion vulnerabilities in aWeb Labs aWebNews 1.5 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_news parameter to (1) listing.php or (2) visview.php.
Affected Products: n/a
References: [{'name': '33824', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33824'}, {'name': '20070301 aWebNews V 1.1', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461684/100/0/threaded'}, {'name': '33825', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33825'}, {'name': 'ADV-2007-0808', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0808'}, {'name': '20070301 aWebNews v 1.1=>RFI', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461680/100/0/threaded'}, {'name': '22781', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22781'}, {'name': 'awebnews-pathtonews-file-include(32770)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32770'}, {'name': '24351', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24351'}, {'name': '2365', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2365'}]
CVE State: PUBLISHED
Explain CVE-2007-1248
Multiple cross-site scripting (XSS) vulnerabilities in built2go News Manager Blog 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) uid, and (3) nid parameters to (a) news.php, and the nid parameter to (b) rating.php.
Affected Products: n/a
References: [{'name': '24334', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24334'}, {'name': '22783', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22783'}, {'name': 'newsmanagerblog-news-rating-xss(32772)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32772'}, {'name': '2343', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2343'}, {'name': '20070301 Built2Go v.1.0 => ( news.php & rating.php ) Cross Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461672/100/0/threaded'}, {'name': 'ADV-2007-0818', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0818'}]
CVE State: PUBLISHED
Explain CVE-2007-1249
MoveSortedContentAction in C1 Financial Services Contelligent 9.1.4 does not check "the additional environment security configuration," which allows remote attackers with write permissions to reorder components.
Affected Products: n/a
References: [{'name': 'contelligent-sortedcontent-security-bypass(32775)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32775'}, {'name': '22785', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22785'}, {'name': 'ADV-2007-0814', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0814'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.contelligent.com/contell/cms/c1web/contelligent/site/contelligent/changelog.html?fromRelease=9.1.4'}, {'name': '24364', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24364'}, {'name': '33497', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33497'}]
CVE State: PUBLISHED
Explain CVE-2007-1250
SQL injection vulnerability in section/default.asp in ANGEL Learning Management Suite (LMS) 7.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '20070301 [Fwd: Re: Angel LMS 7.1 - Remote SQL Injection]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461811/100/0/threaded'}, {'name': 'angellms-default-sql-injection(32756)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32756'}, {'name': '33846', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33846'}, {'name': '20070301 Angel LMS 7.1 - Remote SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461638/100/0/threaded'}, {'name': '20070301 Re: Angel LMS 7.1 - Remote SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461673/100/0/threaded'}, {'name': 'ADV-2007-0807', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0807'}, {'name': '22768', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22768'}, {'name': '3390', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3390'}, {'name': '24368', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24368'}]
CVE State: PUBLISHED
Explain CVE-2007-1251
Format string vulnerability in the new_warning function in ntserv/warning.c for Netrek Vanilla Server 2.12.0, when EVENTLOG is enabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the message handling.
Affected Products: n/a
References: [{'name': '24357', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24357'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=490561'}, {'name': '22786', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22786'}, {'name': 'vanilla-vsprintf-format-string(32777)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32777'}, {'name': 'ADV-2007-0815', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0815'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/netrekfs-adv.txt'}, {'name': '20070302 Limited format string in Netrek 2.12.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461755/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1252
Buffer overflow in Symantec Mail Security for SMTP 5.0 before Patch 175 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted headers in an e-mail message.  NOTE: some information was obtained from third party sources.
Affected Products: n/a
References: [{'name': 'symantec-email-headers-code-execution(32781)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32781'}, {'name': '22782', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22782'}, {'name': 'ADV-2007-0799', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0799'}, {'name': '1017716', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017716'}, {'tags': ['x_refsource_MISC'], 'url': 'ftp://ftp.symantec.com/public/english_us_canada/products/symantec_mail_security/5.0_smtp/updates/release_notes_p175.txt'}, {'name': '33840', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33840'}, {'name': '24371', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24371'}, {'name': 'VU#875633', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/875633'}]
CVE State: PUBLISHED
Explain CVE-2007-1253
Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h, as used in (b) Blender before 2.43, allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted (1) KML or (2) KMZ file.
Affected Products: n/a
References: [{'name': '24233', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24233'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2007-39/advisory/'}, {'name': '22770', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22770'}, {'name': '24991', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24991'}, {'name': 'blender-kml-kmz-command-execution(32778)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32778'}, {'name': 'ADV-2007-0798', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0798'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2007-40/advisory/'}, {'name': '24232', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24232'}, {'name': 'GLSA-200704-19', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200704-19.xml'}, {'name': '33836', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33836'}, {'name': '1017714', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017714'}]
CVE State: PUBLISHED
Explain CVE-2007-1254
SQL injection vulnerability in part.userprofile.php in Connectix Boards 0.7 and earlier allows remote authenticated users to execute arbitrary SQL commands and obtain privileges via the p_skin parameter to index.php.
Affected Products: n/a
References: [{'name': '24255', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24255'}, {'name': '2364', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2364'}, {'name': '20070221 Connectix Boards <= 0.7 (p_skin) Multiple Vulnerabilities Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460947/100/0/threaded'}, {'name': '33537', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33537'}, {'name': '3352', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3352'}]
CVE State: PUBLISHED
Explain CVE-2007-1255
Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to execute arbitrary PHP code by uploading a crafted GIF smiley image with a .php extension via the uploadimage parameter to admin.php, which can be later accessed via a direct request for the file in smileys/.  NOTE: this can be leveraged with a separate SQL injection issue for remote unauthenticated attacks.
Affected Products: n/a
References: [{'name': '24255', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24255'}, {'name': '2364', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2364'}, {'name': '33538', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33538'}, {'name': '20070221 Connectix Boards <= 0.7 (p_skin) Multiple Vulnerabilities Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460947/100/0/threaded'}, {'name': '3352', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3352'}]
CVE State: PUBLISHED
Explain CVE-2007-1256
Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites, by repeatedly setting document.location in the onunload attribute when linking to another website, a variant of CVE-2007-1092.
Affected Products: n/a
References: [{'name': '20070227 RE: [Full-disclosure] Firefox onUnload + document.write() memory corruption vulnerability (MSIE7 null ptr)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=117259225402112&w=2'}, {'name': '20070227 Re: [Full-disclosure] Firefox onUnload + document.write() memory corruption vulnerability (MSIE7 null ptr)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=117258301222007&w=2'}, {'name': '20070227 Re: [Full-disclosure] Firefox onUnload + document.write() memory corruption vulnerability (MSIE7 null ptr)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461437/100/0/threaded'}, {'name': '35913', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35913'}]
CVE State: PUBLISHED
Explain CVE-2007-1257
The Network Analysis Module (NAM) in Cisco Catalyst Series 6000, 6500, and 7600 allows remote attackers to execute arbitrary commands via certain SNMP packets that are spoofed from the NAM's own IP address.
Affected Products: n/a
References: [{'name': '20070228 Cisco Catalyst 6000, 6500 Series and Cisco 7600 Series NAM (Network Analysis Module) Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/warp/public/707/cisco-sa-20070228-nam.shtml'}, {'name': 'VU#472412', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/472412'}, {'name': 'ADV-2007-0783', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0783'}, {'name': '24344', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24344'}, {'name': '22751', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22751'}, {'name': '33066', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33066'}, {'name': 'oval:org.mitre.oval:def:5188', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5188'}, {'name': 'cisco-catalyst-nam-unauthorized-access(32750)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32750'}, {'name': '1017710', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017710'}]
CVE State: PUBLISHED
Explain CVE-2007-1258
Unspecified vulnerability in Cisco IOS 12.2SXA, SXB, SXD, and SXF; and the MSFC2, MSFC2a and MSFC3 running in Hybrid Mode on Cisco Catalyst 6000, 6500 and Cisco 7600 series systems; allows remote attackers on a local network segment to cause a denial of service (software reload) via a certain MPLS packet.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:5869', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5869'}, {'name': '33067', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33067'}, {'name': 'ADV-2007-0782', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0782'}, {'name': '24348', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24348'}, {'name': 'cisco-catalyst-mpls-dos(32748)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32748'}, {'name': '20070228 Cisco Catalyst 6000, 6500 and Cisco 7600 Series MPLS Packet Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/warp/public/707/cisco-sa-20070228-mpls.shtml'}, {'name': '1017709', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017709'}]
CVE State: PUBLISHED
Explain CVE-2007-1259
Multiple unspecified vulnerabilities in WebAPP before 0.9.9.6 have unknown impact and attack vectors.
Affected Products: n/a
References: [{'name': 'ADV-2007-0720', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0720'}, {'name': '24227', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24227'}, {'name': '33272', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33272'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=252'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=254'}]
CVE State: PUBLISHED
Explain CVE-2007-1260
Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via a long string in the Content-Length HTTP header.
Affected Products: n/a
References: [{'name': '33834', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33834'}, {'name': '22788', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22788'}, {'name': '24346', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24346'}, {'name': 'webmod-contentlength-bo(32755)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32755'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cybermind.user.stfunoob.com/w48crash/'}, {'name': '3395', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3395'}]
CVE State: PUBLISHED
Explain CVE-2007-1261
Unspecified vulnerability in the reports system in OpenBiblio before 0.6.0 allows attackers to gain privileges via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=50071&release_id=488061'}, {'name': '35998', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35998'}, {'name': 'ADV-2007-0790', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0790'}, {'name': 'openbiblio-reports-privilege-escalation(32758)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32758'}]
CVE State: PUBLISHED
Explain CVE-2007-1264
Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Affected Products: n/a
References: [{'name': '[gnupg-users] 20070306 [Announce] Multiple Messages Problem in GnuPG and GPGME', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html'}, {'name': '22758', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22758'}, {'name': '24416', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24416'}, {'name': '2353', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2353'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/30/7710/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/?action=item&id=1687'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/100/0/threaded'}, {'name': '1017727', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017727'}, {'name': 'ADV-2007-0835', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0835'}]
CVE State: PUBLISHED
Explain CVE-2007-1265
KMail 1.9.5 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents KMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Affected Products: n/a
References: [{'name': '[gnupg-users] 20070306 [Announce] Multiple Messages Problem in GnuPG and GPGME', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html'}, {'name': '2353', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2353'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/30/7710/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/?action=item&id=1687'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/100/0/threaded'}, {'name': '24413', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24413'}, {'name': '22759', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22759'}, {'name': '1017727', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017727'}, {'name': 'ADV-2007-0835', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0835'}]
CVE State: PUBLISHED
Explain CVE-2007-1266
Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Affected Products: n/a
References: [{'name': '[gnupg-users] 20070306 [Announce] Multiple Messages Problem in GnuPG and GPGME', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html'}, {'name': '2353', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2353'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/30/7710/threaded'}, {'name': '22760', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22760'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/?action=item&id=1687'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/100/0/threaded'}, {'name': '24412', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24412'}, {'name': '1017727', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017727'}, {'name': 'ADV-2007-0835', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0835'}]
CVE State: PUBLISHED
Explain CVE-2007-1267
Sylpheed 2.2.7 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Sylpheed from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Affected Products: n/a
References: [{'name': '[gnupg-users] 20070306 [Announce] Multiple Messages Problem in GnuPG and GPGME', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html'}, {'name': '2353', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2353'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/30/7710/threaded'}, {'name': '22777', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22777'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/?action=item&id=1687'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/100/0/threaded'}, {'name': '24414', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24414'}, {'name': '1017727', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017727'}, {'name': 'ADV-2007-0835', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0835'}]
CVE State: PUBLISHED
Explain CVE-2007-1268
Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Affected Products: n/a
References: [{'name': '[gnupg-users] 20070306 [Announce] Multiple Messages Problem in GnuPG and GPGME', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html'}, {'name': '24415', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24415'}, {'name': '2353', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2353'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/30/7710/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/?action=item&id=1687'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/100/0/threaded'}, {'name': '22778', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22778'}, {'name': '1017727', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017727'}, {'name': 'ADV-2007-0835', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0835'}]
CVE State: PUBLISHED
Explain CVE-2007-1269
GNUMail 1.1.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents GNUMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Affected Products: n/a
References: [{'name': '[gnupg-users] 20070306 [Announce] Multiple Messages Problem in GnuPG and GPGME', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html'}, {'name': '2353', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2353'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/30/7710/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/?action=item&id=1687'}, {'name': '20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461958/100/0/threaded'}, {'name': '24417', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24417'}, {'name': '1017727', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017727'}, {'name': '22779', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22779'}, {'name': 'ADV-2007-0835', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0835'}]
CVE State: PUBLISHED
Explain CVE-2007-1270
Double free vulnerability in VMware ESX Server 3.0.0 and 3.0.1 allows attackers to cause a denial of service (crash), obtain sensitive information, or possibly execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': '1017875', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017875'}, {'name': '20070404 VMSA-2007-0003 VMware ESX 3.0.1 and 3.0.0 server security updates', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464745/100/0/threaded'}, {'name': 'ADV-2007-1267', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1267'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/support/vi3/doc/esx-6431040-patch.html'}, {'name': '24788', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24788'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/support/vi3/doc/esx-5754280-patch.html'}, {'name': 'oval:org.mitre.oval:def:5463', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5463'}, {'name': '35268', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35268'}, {'name': '23323', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23323'}, {'name': '2524', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2524'}]
CVE State: PUBLISHED
Explain CVE-2007-1271
Buffer overflow in VMware ESX Server 3.0.0 and 3.0.1 might allow attackers to gain privileges or cause a denial of service (application crash) via unspecified vectors.
Affected Products: n/a
References: [{'name': '1017875', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017875'}, {'name': '23322', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23322'}, {'name': '20070404 VMSA-2007-0003 VMware ESX 3.0.1 and 3.0.0 server security updates', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464745/100/0/threaded'}, {'name': 'ADV-2007-1267', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1267'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/support/vi3/doc/esx-6431040-patch.html'}, {'name': '24788', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24788'}, {'name': 'oval:org.mitre.oval:def:5552', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5552'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/support/vi3/doc/esx-5754280-patch.html'}, {'name': '2524', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2524'}]
CVE State: PUBLISHED
Explain CVE-2007-1273
Integer overflow in the ktruser function in NetBSD-current before 20061022, NetBSD 3 and 3-0 before 20061024, and NetBSD 2 before 20070209, when the kernel is built with the COMPAT_FREEBSD or COMPAT_DARWIN option, allows local users to cause a denial of service and possibly gain privileges.
Affected Products: n/a
References: [{'name': '22878', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22878'}, {'name': '35453', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35453'}, {'name': 'NetBSD-SA2007-001', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-001.txt.asc'}]
CVE State: PUBLISHED
Explain CVE-2007-1276
Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.webmin.com/security.html'}, {'name': '33832', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33832'}, {'name': '24321', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24321'}, {'name': 'ADV-2007-0780', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0780'}, {'name': '1017711', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017711'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.webmin.com/changes-1.330.html'}, {'name': 'webmin-chooser-xss(32725)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32725'}]
CVE State: PUBLISHED
Explain CVE-2007-1277
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
Affected Products: n/a
References: [{'name': '20070303 WordPress source code compromised to enable remote code execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461794/100/0/threaded'}, {'name': 'VU#214480', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/214480'}, {'name': 'wordpress-theme-command-execution(32807)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32807'}, {'name': 'wordpress-feed-code-execution(32804)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32804'}, {'name': '22797', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22797'}, {'name': 'ADV-2007-0812', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0812'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/development/2007/03/upgrade-212/'}, {'name': 'VU#641456', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/641456'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html'}, {'name': '24374', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24374'}]
CVE State: PUBLISHED
Explain CVE-2007-1278
Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root.
Affected Products: n/a
References: [{'name': '1017752', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017752'}, {'name': '34039', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34039'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb07-07.html'}, {'name': '24488', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24488'}, {'name': 'ADV-2007-0932', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0932'}, {'name': 'coldfusion-jrun-iisconnector-dos(32994)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32994'}, {'name': '22958', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22958'}]
CVE State: PUBLISHED
Explain CVE-2007-1279
Unspecified vulnerability in the installer for Adobe Bridge 1.0.3 update for Apple OS X, when patching with desktop management tools, allows local users to gain privileges via unspecified vectors during installation of the update by a different user who has administrative privileges.
Affected Products: n/a
References: [{'name': '34896', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/34896'}, {'name': '24854', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24854'}, {'name': 'ADV-2007-1342', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1342'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb07-09.html'}, {'name': 'bridge-unspecified-privilege-escalation(33570)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33570'}, {'name': '23404', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23404'}, {'name': '1017900', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017900'}]
CVE State: PUBLISHED