Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2007-0218
Microsoft Internet Explorer 5.01 and 6 allows remote attackers to execute arbitrary code by instantiating certain COM objects from Urlmon.dll, which triggers memory corruption during a call to the IObjectSafety function.
Affected Products: n/a
References: [{'name': '35348', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35348'}, {'name': '25627', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25627'}, {'name': 'SSRT071438', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/archive/1/471947/100/0/threaded'}, {'name': '1018235', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1018235'}, {'name': '24372', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/24372'}, {'name': 'ADV-2007-2153', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/2153'}, {'name': 'oval:org.mitre.oval:def:1084', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1084'}, {'name': 'webbrowser-object-code-execution(32106)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32106'}, {'name': '20070612 Microsoft License Manager and urlmon.dll COM Object Interaction Invalid Memory Access Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=542'}, {'name': 'TA07-163A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA07-163A.html'}, {'name': 'MS07-033', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033'}, {'name': 'HPSBST02231', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/archive/1/471947/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0219
Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from (1) Msb1fren.dll, (2) Htmlmm.ocx, and (3) Blnmgrps.dll as ActiveX controls, which allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2006-4697.
Affected Products: n/a
References: [{'name': 'ie-com-activex-code-execution(32427)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32427'}, {'name': '1017643', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017643'}, {'name': '31894', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/31894'}, {'name': 'VU#771788', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/771788'}, {'name': 'oval:org.mitre.oval:def:257', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A257'}, {'name': '31895', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/31895'}, {'name': 'TA07-044A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA07-044A.html'}, {'name': 'ADV-2007-0584', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0584'}, {'name': '31893', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/31893'}, {'name': '24156', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24156'}, {'name': 'MS07-016', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-016'}, {'name': '22504', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22504'}]
CVE State: PUBLISHED
Explain CVE-2007-0220
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".
Affected Products: n/a
References: [{'name': 'HPSBST02214', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/archive/1/468871/100/200/threaded'}, {'name': '1018015', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1018015'}, {'name': 'MS07-026', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026'}, {'name': 'SSRT071422', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/archive/1/468871/100/200/threaded'}, {'name': 'VU#124113', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/124113'}, {'name': '23806', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23806'}, {'name': '25183', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25183'}, {'name': 'TA07-128A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA07-128A.html'}, {'name': 'ADV-2007-1711', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1711'}, {'name': 'oval:org.mitre.oval:def:1371', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1371'}, {'name': 'exchange-utf-xss(33887)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33887'}, {'name': '34389', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/34389'}]
CVE State: PUBLISHED
Explain CVE-2007-0221
Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service (service hang) via crafted literals in an IMAP command, aka the "IMAP Literal Processing Vulnerability."
Affected Products: n/a
References: [{'name': 'HPSBST02214', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/archive/1/468871/100/200/threaded'}, {'name': '1018015', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1018015'}, {'name': 'MS07-026', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026'}, {'name': 'exchange-imap-command-dos(33890)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33890'}, {'name': 'SSRT071422', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/archive/1/468871/100/200/threaded'}, {'name': '23810', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23810'}, {'name': '25183', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25183'}, {'name': 'TA07-128A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA07-128A.html'}, {'name': 'oval:org.mitre.oval:def:2054', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2054'}, {'name': 'ADV-2007-1711', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1711'}, {'name': '20070508 Microsoft Exchange Server 2000 IMAP Literal Processing DoS Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=526'}, {'name': '34392', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/34392'}]
CVE State: PUBLISHED
Explain CVE-2007-0222
Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to read arbitrary files via unknown vectors, probably "\.." sequences in the beanId parameter.  NOTE: this is likely a duplicate of another CVE that Oracle addressed in CPU Jan 2007, but due to lack of details by Oracle, it is unclear which BugID this issue is associated with, so the other CVE cannot be determined.  Possibilities include EM02 (CVE-2007-0292) or EM05 (CVE-2007-0293).
Affected Products: n/a
References: [{'name': '20070131 Oracle 10g R2 Enterprise Manager Directory Traversal', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458657/100/0/threaded'}, {'name': '20070115 SYMSA-2007-001: Oracle Application Server 10g - Directory Traversal', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457105/100/0/threaded'}, {'name': '23794', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23794'}, {'name': '22083', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22083'}, {'name': '22027', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22027'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html'}, {'name': '1017522', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017522'}]
CVE State: PUBLISHED
Explain CVE-2007-0223
SQL injection vulnerability in shared/code/cp_functions_downloads.php in Nicola Asuni All In One Control Panel (AIOCP) before 1.3.009 allows remote attackers to execute arbitrary SQL commands via the download_category parameter.
Affected Products: n/a
References: [{'name': '23726', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23726'}, {'name': '31641', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31641'}, {'name': '22019', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22019'}, {'name': 'aiocp-cpfunctionsdownloads-sql-injection(31591)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31591'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=477845'}]
CVE State: PUBLISHED
Explain CVE-2007-0224
SQL injection vulnerability in shopgiftregsearch.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginLastname parameter.
Affected Products: n/a
References: [{'name': '32732', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32732'}, {'name': 'vpasp-shopgift-sql-injection(31447)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31447'}, {'name': '23699', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23699'}, {'name': '3115', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3115'}]
CVE State: PUBLISHED
Explain CVE-2007-0225
Cross-site scripting (XSS) vulnerability in shopcustadmin.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Affected Products: n/a
References: [{'name': 'vpasp-shopcustadmin-xss(31449)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31449'}, {'name': '32733', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32733'}, {'name': '23699', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23699'}, {'name': '3115', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3115'}]
CVE State: PUBLISHED
Explain CVE-2007-0226
SQL injection vulnerability in wbsearch.aspx in uniForum 4 and earlier allows remote attackers to execute arbitrary SQL commands via the "by User" field (aka the TXbyuser parameter).
Affected Products: n/a
References: [{'name': '21966', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21966'}, {'name': '32927', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32927'}, {'name': '3106', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3106'}, {'name': '23827', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23827'}, {'name': 'uniforum-wbsearch-sql-injection(31362)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31362'}, {'name': '20070125 uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458060/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0227
slocate 3.1 does not properly manage database entries that specify names of files in protected directories, which allows local users to obtain the names of private files.  NOTE: another researcher reports that the issue is not present in slocate 2.7.
Affected Products: n/a
References: [{'name': '33465', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33465'}, {'name': '20070112 Re: slocate leaks filenames of protected directories', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456739/100/0/threaded'}, {'name': '21989', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21989'}, {'name': '20070110 Re: slocate leaks filenames of protected directories', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456530/100/0/threaded'}, {'name': '20070110 slocate leaks filenames of protected directories', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456489/100/0/threaded'}, {'name': '20070111 Re: slocate leaks filenames of protected directories', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456593/100/0/threaded'}, {'name': '20070329 FLEA-2007-0005-1: slocate', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464220/30/7320/threaded'}, {'name': 'USN-425-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-425-1'}]
CVE State: PUBLISHED
Explain CVE-2007-0228
The DataCollector service in EIQ Networks Network Security Analyzer allows remote attackers to cause a denial of service (service crash) via a (1) &CONNECTSERVER& (2) &ADDENTRY& (3) &FIN& (4) &START& (5) &LOGPATH& (6) &FWADELTA& (7) &FWALOG& (8) &SETSYNCHRONOUS& (9) &SETPRGFILE&, or (10) &SETREPLYPORT& string to TCP port 10618, which triggers a NULL pointer dereference.
Affected Products: n/a
References: [{'name': '21994', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21994'}, {'name': '23693', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23693'}, {'name': '20070110 EIQ Networks Network Security Analyzer DoS Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0209.html'}, {'name': 'ADV-2007-0147', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0147'}, {'name': 'eiq-datacollector-dos(31428)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31428'}, {'name': '32725', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32725'}]
CVE State: PUBLISHED
Explain CVE-2007-0229
Integer overflow in the ffs_mountfs function in Mac OS X 10.4.8 and FreeBSD 6.1 allows local users to cause a denial of service (panic) and possibly gain privileges via a crafted DMG image that causes "allocation of a negative size buffer" leading to a heap-based buffer overflow, a related issue to CVE-2006-5679.  NOTE: a third party states that this issue does not cross privilege boundaries in FreeBSD because only root may mount a filesystem.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://projects.info-pull.com/moab/MOAB-10-01-2007.html'}, {'name': 'TA07-072A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA07-072A.html'}, {'name': '32684', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/32684'}, {'name': '[freebsd-security] 20070114 MOAB advisories', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.freebsd.org/pipermail/freebsd-security/2007-January/004218.html'}, {'name': 'ADV-2007-0141', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0141'}, {'name': 'APPLE-SA-2007-03-13', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=305214'}, {'name': '1017751', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017751'}, {'name': '21993', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21993'}, {'name': 'macos-ffsmountfs-bo(31409)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31409'}, {'name': '23703', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23703'}, {'tags': ['x_refsource_MISC'], 'url': 'http://applefun.blogspot.com/2007/01/moab-10-01-2007-apple-dmg-ufs.html'}, {'name': 'ADV-2007-0930', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0930'}, {'name': '24479', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24479'}]
CVE State: PUBLISHED
Explain CVE-2007-0230
PHP remote file inclusion vulnerability in install.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the install_dir parameter.  NOTE: CVE and third parties dispute this vulnerability because install_dir is defined before use
Affected Products: n/a
References: [{'name': 'cscart-install-file-include(31408)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31408'}, {'name': '31277', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31277'}, {'name': '20070109 CS-Cart 1.3.3 (install.php) Remote File Include Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456527/100/0/threaded'}, {'name': '20070110 [bogus] [ahmed_labib_hilmy at yahoo.com: CS-Cart 1.3.3 (install.php) Remote File Include Vulnerability] (fwd)', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-January/001223.html'}]
CVE State: PUBLISHED
Explain CVE-2007-0231
Cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field.
Affected Products: n/a
References: [{'name': 'ADV-2007-0142', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0142'}, {'name': '32717', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32717'}, {'tags': ['x_refsource_MISC'], 'url': 'http://golem.ph.utexas.edu/~distler/blog/archives/001102.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zackvision.com/weblog/2007/01/movabletype-security-bug.html'}, {'name': '23669', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23669'}]
CVE State: PUBLISHED
Explain CVE-2007-0232
PHP remote file inclusion vulnerability in routines/fieldValidation.php in Jshop Server 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the jssShopFileSystem parameter.
Affected Products: n/a
References: [{'name': 'jshop-fieldvalidation-file-include(31425)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31425'}, {'name': '20070110 Jshop Server 1.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456591/100/0/threaded'}, {'name': '21995', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21995'}, {'name': '33459', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33459'}, {'name': '3113', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3113'}, {'name': '2146', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2146'}]
CVE State: PUBLISHED
Explain CVE-2007-0233
wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in WordPress.
Affected Products: n/a
References: [{'name': '3109', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3109'}, {'name': '21983', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21983'}, {'name': 'wordpress-tbid-sql-injection(31385)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31385'}, {'name': '36860', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36860'}]
CVE State: PUBLISHED
Explain CVE-2007-0236
Double free vulnerability in the _ATPsndrsp function in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a denial of service (kernel panic) and possibly execute arbitrary code via a crafted AppleTalk request that triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'name': '32687', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/32687'}, {'name': 'TA07-072A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA07-072A.html'}, {'name': '1017513', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017513'}, {'name': 'APPLE-SA-2007-03-13', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://projects.info-pull.com/moab/MOAB-14-01-2007.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=305214'}, {'name': '1017751', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017751'}, {'name': '22041', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22041'}, {'name': 'ADV-2007-0191', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0191'}, {'name': '3130', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3130'}, {'name': 'ADV-2007-0930', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0930'}, {'name': '23708', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23708'}, {'name': '24479', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24479'}]
CVE State: PUBLISHED
Explain CVE-2007-0237
The ndeb-binary feature in Lookup (lookup-el) allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Affected Products: n/a
References: [{'name': 'GLSA-200712-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200712-07.xml'}, {'name': '28023', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28023'}, {'name': '1017792', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017792'}, {'name': 'DSA-1269', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2007/dsa-1269'}, {'name': '34263', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34263'}, {'name': '24590', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24590'}, {'name': '24377', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24377'}, {'name': '23026', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23026'}, {'name': 'lookup-ndebbinary-symlink(33052)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33052'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=197306'}]
CVE State: PUBLISHED
Explain CVE-2007-0240
Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request.
Affected Products: n/a
References: [{'name': 'ADV-2007-1041', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1041'}, {'name': 'DSA-1275', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2007/dsa-1275'}, {'name': '23084', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23084'}, {'name': '24017', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24017'}, {'name': 'SUSE-SR:2007:011', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.suse.com/archive/suse-security-announce/2007-May/0005.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view'}, {'name': '24713', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24713'}, {'name': '25239', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25239'}, {'name': 'zope-unspecifiedget-xss(33187)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33187'}]
CVE State: PUBLISHED
Explain CVE-2007-0244
pptpgre.c in PoPToP Point to Point Tunneling Server (pptpd) before 1.3.4 allows remote attackers to cause a denial of service (PPTP connection tear-down) via (1) GRE packets with out-of-order sequence numbers or (2) certain GRE packets that are processed using a wrong pointer and improperly dequeued.
Affected Products: n/a
References: [{'name': 'ADV-2007-1743', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1743'}, {'name': 'SUSE-SR:2007:019', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_19_sr.html'}, {'name': '1018064', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1018064'}, {'name': '23886', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=501476&group_id=44827'}, {'name': '2007-0017', 'tags': ['vendor-advisory', 'x_refsource_TRUSTIX'], 'url': 'http://www.trustix.org/errata/2007/0017/'}, {'name': '26987', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/26987'}, {'name': 'USN-459-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-459-1'}, {'name': 'SUSE-SR:2007:010', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_10_sr.html'}, {'name': '25255', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25255'}, {'name': 'USN-459-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-459-2'}, {'name': 'GLSA-200705-18', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200705-18.xml'}, {'name': '25220', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25220'}, {'name': 'DSA-1288', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2007/dsa-1288'}]
CVE State: PUBLISHED
Explain CVE-2007-0246
plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATH_INFO.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://gforge.org/scm/viewvc.php/branches/Branch_4_5/gforge/plugins/scmcvs/www/cvsweb.php?root=gforge&r1=5849&r2=6038&pathrev=6038'}, {'name': 'ADV-2007-1942', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1942'}, {'name': 'gforge-cvsweb-command-execution(34510)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/34510'}, {'name': '36526', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36526'}, {'name': 'DSA-1297', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2007/dsa-1297'}, {'name': '25395', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25395'}, {'name': '25416', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25416'}, {'name': '24141', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/24141'}]
CVE State: PUBLISHED
Explain CVE-2007-0247
squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/Versions/v2/2.6/squid-2.6.STABLE7-RELEASENOTES.html#s12'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/bugs/show_bug.cgi?id=1857'}, {'name': '23921', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23921'}, {'name': '23946', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23946'}, {'name': '22079', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22079'}, {'name': 'ADV-2007-0199', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0199'}, {'name': 'GLSA-200701-22', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200701-22.xml'}, {'name': '23810', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23810'}, {'name': 'SUSE-SA:2007:012', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_12_squid.html'}, {'name': 'MDKSA-2007:026', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:026'}, {'name': '2007-0003', 'tags': ['vendor-advisory', 'x_refsource_TRUSTIX'], 'url': 'http://www.trustix.org/errata/2007/0003/'}, {'name': 'USN-414-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-414-1'}, {'name': '23837', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23837'}, {'name': '23805', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23805'}, {'name': '23767', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23767'}, {'name': '39839', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/39839'}, {'name': 'FEDORA-2007-092', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://fedoranews.org/cms/node/2442'}, {'name': '23889', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23889'}, {'name': 'squid-multiple-dos(31523)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31523'}]
CVE State: PUBLISHED
Explain CVE-2007-0248
The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload, which triggers an infinite loop.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/Versions/v2/2.6/squid-2.6.STABLE7-RELEASENOTES.html#s12'}, {'name': '22203', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22203'}, {'name': '23921', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23921'}, {'name': '23946', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23946'}, {'name': 'ADV-2007-0199', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0199'}, {'name': 'GLSA-200701-22', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200701-22.xml'}, {'name': 'SUSE-SA:2007:012', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_12_squid.html'}, {'name': 'MDKSA-2007:026', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:026'}, {'name': 'squid-externalacl-dos(31525)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31525'}, {'name': 'USN-414-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-414-1'}, {'name': '23805', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23805'}, {'name': '23767', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23767'}, {'name': '23889', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23889'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/bugs/show_bug.cgi?id=1848'}]
CVE State: PUBLISHED
Explain CVE-2007-0249
Cross-site scripting (XSS) vulnerability in index.php in Nwom topsites 3.0 allows remote attackers to inject arbitrary web script or HTML via the o parameter.
Affected Products: n/a
References: [{'name': '33461', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33461'}, {'name': '20070111 Nwom topsites v3.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456636/100/0/threaded'}, {'name': '22012', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22012'}, {'name': '2149', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2149'}]
CVE State: PUBLISHED
Explain CVE-2007-0250
index.php in Nwom topsites 3.0 allows remote attackers to obtain potentially sensitive information via a ' (quote) character in the o parameter, which forces a SQL error.
Affected Products: n/a
References: [{'name': '33462', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33462'}, {'name': '20070111 Nwom topsites v3.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456636/100/0/threaded'}, {'name': '22012', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22012'}, {'name': '2149', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2149'}]
CVE State: PUBLISHED
Explain CVE-2007-0251
Integer underflow in the DecodeGRE function in src/decode.c in Snort 2.6.1.2 allows remote attackers to trigger dereferencing of certain memory locations via crafted GRE packets, which may cause corruption of log files or writing of sensitive information into log files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://labs.calyptix.com/advisories/CX-2007-01.txt'}, {'name': 'ADV-2007-0152', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0152'}, {'name': '32095', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32095'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.snort.org/got_source/source.html'}, {'name': '1017507', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017507'}, {'name': '33464', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33464'}, {'name': '20070111 Calyptix Security Advisory CX-2007-001 - Snort 2.6.1.2 Integer Underflow Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456598/100/0/threaded'}, {'name': '22004', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22004'}, {'name': '2165', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2165'}]
CVE State: PUBLISHED
Explain CVE-2007-0252
Unspecified vulnerability in easy-content filemanager allows remote attackers to upload or modify arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': '33463', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33463'}, {'name': '20070111 easy-content filemanager', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456622/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0253
Unspecified vulnerability in the grsecurity patch has unspecified impact and remote attack vectors, a different vulnerability than the expand_stack vulnerability from the Digital Armaments 20070110 pre-advisory.  NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function, which can, and has been, easily checked for any supposed vulnerabilities."  The developer also cites a past disclosure that was not proven
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.digitalarmaments.com/news_news.shtml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://grsecurity.net/news.php#digitalfud'}, {'tags': ['x_refsource_MISC'], 'url': 'http://forums.grsecurity.net/viewtopic.php?t=1646'}]
CVE State: PUBLISHED
Explain CVE-2007-0254
Format string vulnerability in the errors_create_window function in errors.c in xine-ui allows attackers to execute arbitrary code via unknown vectors.
Affected Products: n/a
References: [{'name': '31594', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31594'}, {'name': '23891', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23891'}, {'name': '23931', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23931'}, {'name': '22002', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22002'}, {'name': '23709', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23709'}, {'name': 'MDKSA-2007:154', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:154'}, {'name': '20070111 Xine-ui format string Vulnerabilties.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456590/100/0/threaded'}, {'name': 'GLSA-200701-18', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200701-18.xml'}, {'name': 'xineui-errorscreatewindow-format-string(31505)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31505'}, {'name': 'MDKSA-2007:027', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:027'}]
CVE State: PUBLISHED
Explain CVE-2007-0255
XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI, possibly a variant of CVE-2007-0017.
Affected Products: n/a
References: [{'name': '22252', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22252'}, {'name': '20070110 VLC Format String Vulnerability also in XINE', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456523/100/0/threaded'}, {'name': '23931', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23931'}, {'name': 'MDKSA-2007:154', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:154'}, {'name': '31666', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31666'}, {'name': 'MDKSA-2007:027', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:027'}]
CVE State: PUBLISHED
Explain CVE-2007-0256
VideoLAN VLC 0.8.6a allows remote attackers to cause a denial of service (application crash) via a crafted .wmv file.
Affected Products: n/a
References: [{'name': '22003', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22003'}, {'name': '39022', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/39022'}, {'name': 'oval:org.mitre.oval:def:14698', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14698'}, {'tags': ['x_refsource_MISC'], 'url': 'http://downloads.securityfocus.com/vulnerabilities/exploits/22003.py'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.videolan.org/Changelog/0.8.6b'}, {'name': 'vlcmediaplayer-wmv-dos(31515)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31515'}]
CVE State: PUBLISHED
Explain CVE-2007-0257
Unspecified vulnerability in the expand_stack function in grsecurity PaX allows local users to gain privileges via unspecified vectors. NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function, which can, and has been, easily checked for any supposed vulnerabilities."  The developer also cites a past disclosure that was not proven.  As of 20070120, the original researcher has released demonstration code
Affected Products: n/a
References: [{'name': '1017509', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017509'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.digitalarmaments.com/pre2007-00018659.html'}, {'name': '20070111 Digital Armaments Security Pre-Advisory 11.01.2007: Grsecurity Kernel PaX - Local root vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456626/100/0/threaded'}, {'name': '20070112 Lies? [Was: Re: Digital Armaments Security Pre-Advisory11.01.2007: Grsecurity Kernel PaX - Local root vulnerability]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456722/100/0/threaded'}, {'name': '20070309 Re: Digital Armaments Security Advisory 20.01.2007: Grsecurity Kernel PaX Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/462302/100/100/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.digitalarmaments.com/news_news.shtml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://grsecurity.net/news.php#digitalfud'}, {'name': '23713', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23713'}, {'name': '22014', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22014'}, {'tags': ['x_refsource_MISC'], 'url': 'http://forums.grsecurity.net/viewtopic.php?t=1646'}, {'name': '20070120 Digital Armaments Security Advisory 20.01.2007: Grsecurity Kernel PaX Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457509/100/0/threaded'}, {'name': 'ADV-2007-0155', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0155'}, {'name': '32727', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32727'}]
CVE State: PUBLISHED
Explain CVE-2007-0258
Cross-site scripting (XSS) vulnerability in index.php in (1) Fastilo 2.0 and (2) Open Solution Quick.Cart 2.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://14house.blogspot.com/2007/01/fastilo-open-source-shopping-cart-vuln.html'}, {'name': 'ADV-2007-0156', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0156'}, {'name': '23733', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23733'}, {'name': '32731', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32731'}, {'name': '21971', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21971'}, {'name': '23738', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23738'}, {'name': '22007', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22007'}, {'name': '32730', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32730'}, {'name': 'quickcart-p-xss(31475)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31475'}, {'name': 'ADV-2007-0157', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0157'}]
CVE State: PUBLISHED
Explain CVE-2007-0259
Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to obtain sensitive information via an invalid cat parameter to boxx/knowledgebase.asp, which reveals the path in an error message.
Affected Products: n/a
References: [{'name': 'ADV-2007-0208', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0208'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugsec.com/articles.php?Security=20'}, {'name': '33470', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33470'}, {'name': '20070111 Ezboxx multiple vulnerabilities.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456699/100/0/threaded'}, {'name': '32829', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32829'}]
CVE State: PUBLISHED