Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2007-1142
Cross-site scripting (XSS) vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the link_parameters parameter in (1) news.php and (2) n_layouts.php.
Affected Products: n/a
References: [{'name': '33137', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33137'}, {'name': '20070221 Magic News Plus File Inclusion And Xss Vulnerabilitis', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460902/100/0/threaded'}, {'name': '22661', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22661'}, {'name': '2334', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2334'}, {'name': '33136', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33136'}]
CVE State: PUBLISHED
Explain CVE-2007-1143
Directory traversal vulnerability in pn-menu.php in J-Web Pics Navigator 1.0 allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter.
Affected Products: n/a
References: [{'name': '2340', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2340'}, {'tags': ['x_refsource_MISC'], 'url': 'http://forums.avenir-geopolitique.net/viewtopic.php?t=2692'}, {'name': '20070222 Pics Navigator Directory Traversal Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460907/100/0/threaded'}, {'name': '33118', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33118'}, {'name': 'picsnavigator-dir-directory-traversal(32646)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32646'}]
CVE State: PUBLISHED
Explain CVE-2007-1144
Directory traversal vulnerability in jwpn-photos.php in J-Web Pics Navigator 2.0 allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter.
Affected Products: n/a
References: [{'name': '33117', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33117'}, {'name': '2340', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2340'}, {'name': '22681', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22681'}, {'tags': ['x_refsource_MISC'], 'url': 'http://forums.avenir-geopolitique.net/viewtopic.php?t=2692'}, {'name': '20070222 Pics Navigator Directory Traversal Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460907/100/0/threaded'}, {'name': 'picsnavigator-dir-directory-traversal(32646)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32646'}, {'name': '24273', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24273'}, {'name': 'ADV-2007-0711', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0711'}]
CVE State: PUBLISHED
Explain CVE-2007-1145
Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite - ESupport 3.00.13 and 3.04.10 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a (1) lostpassword or (2) register action in index.php, (3) unspecified vectors in the Submit form in a submit action in index.php, and (4) the user's name in index.php; and (5) allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the Admin and Staff Control Panel. NOTE: this might issue overlap CVE-2004-1412, CVE-2005-0487, or CVE-2005-0842.
Affected Products: n/a
References: [{'name': '2335', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2335'}, {'name': '24223', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24223'}, {'name': '22631', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22631'}, {'name': '33536', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33536'}, {'name': 'ADV-2007-0717', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0717'}, {'name': '20070219 ESupport Multiple HTML Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460591/100/0/threaded'}, {'name': '33535', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33535'}]
CVE State: PUBLISHED
Explain CVE-2007-1146
PHP remote file inclusion vulnerability in function.php in arabhost allows remote attackers to execute arbitrary PHP code via a URL in the adminfolder parameter.
Affected Products: n/a
References: [{'name': '20070227 Verified: arabhost function.php RFI', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2007-February/001396.html'}, {'name': '2339', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2339'}, {'name': '20070222 Hasadya Raed', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460933/100/0/threaded'}, {'name': '33839', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33839'}]
CVE State: PUBLISHED
Explain CVE-2007-1147
PHP remote file inclusion vulnerability in view.php in hbm allows remote attackers to execute arbitrary PHP code via a URL in the hbmpath parameter.
Affected Products: n/a
References: [{'name': '2339', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2339'}, {'name': '36878', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36878'}, {'name': '20070222 Hasadya Raed', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460933/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1148
PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter.
Affected Products: n/a
References: [{'name': '2338', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2338'}, {'name': '22675', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22675'}, {'name': '33516', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33516'}, {'name': 'ADV-2007-0716', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0716'}, {'name': '20070222 LoveCMS 1.4 multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460917/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1149
Multiple directory traversal vulnerabilities in LoveCMS 1.4 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the step parameter to install/index.php or (2) the load parameter to the top-level URI.
Affected Products: n/a
References: [{'name': '2338', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2338'}, {'name': '33517', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33517'}, {'name': '33518', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33518'}, {'name': '22675', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22675'}, {'name': 'ADV-2007-0716', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0716'}, {'name': '20070222 LoveCMS 1.4 multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460917/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1150
Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/.
Affected Products: n/a
References: [{'name': '2338', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2338'}, {'name': '33519', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33519'}, {'name': '22675', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22675'}, {'name': '20070222 LoveCMS 1.4 multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460917/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1151
Cross-site scripting (XSS) vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error.
Affected Products: n/a
References: [{'name': '2338', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2338'}, {'name': '22675', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22675'}, {'name': '33520', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33520'}, {'name': 'ADV-2007-0716', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0716'}, {'name': '20070222 LoveCMS 1.4 multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460917/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1152
Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) act or (2) pid parameter to the top-level URI (index.php), or the (3) action parameter to admin/index.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '37398', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37398'}, {'name': '33861', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33861'}, {'name': '8095', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8095'}, {'name': '22667', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22667'}]
CVE State: PUBLISHED
Explain CVE-2007-1153
Multiple PHP remote file inclusion vulnerabilities in CutePHP CuteNews 1.3.6 allow remote attackers to execute arbitrary PHP code via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: issue might overlap CVE-2004-1660 or CVE-2006-4445.
Affected Products: n/a
References: [{'name': '22674', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22674'}, {'name': '37397', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37397'}]
CVE State: PUBLISHED
Explain CVE-2007-1154
SQL injection vulnerability in webSPELL allows remote attackers to execute arbitrary SQL commands via a ws_auth cookie, a different vulnerability than CVE-2006-4782.
Affected Products: n/a
References: [{'name': 'webspell-login-sql-injection(32669)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32669'}, {'name': '2337', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2337'}, {'name': '20070222 WebSpell > 4.0 Authentication Bypass and arbitrary code execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460937/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1155
Unrestricted file upload vulnerability in webSPELL allows remote authenticated administrators to upload and execute arbitrary PHP code via the add squad feature.  NOTE: this issue may be an administrative feature, in which case this CVE may be REJECTED.
Affected Products: n/a
References: [{'name': 'webspell-addsquad-file-upload(32670)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32670'}, {'name': '2337', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2337'}, {'name': '20070222 WebSpell > 4.0 Authentication Bypass and arbitrary code execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460937/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1156
JBrowser allows remote attackers to bypass authentication and access certain administrative capabilities via a direct request for _admin/.
Affected Products: n/a
References: [{'name': '1008909', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1008909'}, {'name': '20070222 JBrowser acces to admin/config files', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460923/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://forums.avenir-geopolitique.net/viewtopic.php?t=2693'}, {'name': '20070223 JBrowser Acces to Admin Panel Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461298/100/100/threaded'}, {'name': '33141', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33141'}, {'name': '9537', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/9537'}, {'name': '2370', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2370'}]
CVE State: PUBLISHED
Explain CVE-2007-1157
Cross-site request forgery (CSRF) vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via certain MBean operations, a different vulnerability than CVE-2006-3733.
Affected Products: n/a
References: [{'name': '33142', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33142'}, {'name': 'jboss-jmxconsole-csrf(32673)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32673'}, {'name': '20070222 JBoss jmx-console CSRF', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460934/100/0/threaded'}, {'name': '20070223 Re: JBoss jmx-console CSRF', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461004/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1158
Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
Affected Products: n/a
References: [{'name': '2336', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2336'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.elfisk.dk/index.php?module=pagesetter&func=viewpub&tid=7&pid=125'}, {'name': '22733', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22733'}, {'name': '33781', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33781'}, {'name': '20070226 SEC Consult SA-20070226-0 :: File Disclosure in Pagesetter for PostNuke', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461339/100/0/threaded'}, {'name': '20070227 Re:SEC Consult SA-20070226-0 :: File Disclosure', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=117256698219502&w=2'}, {'name': 'ADV-2007-0758', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0758'}, {'name': 'pagesetter-index-directory-traversal(32695)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32695'}, {'name': '20070226 SEC Consult SA-20070226-0 :: File Disclosure in', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=117251821622820&w=2'}, {'name': '24299', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24299'}]
CVE State: PUBLISHED
Explain CVE-2007-1159
Cross-site scripting (XSS) vulnerability in modules/out.php in Pyrophobia 2.1.3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '36879', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36879'}, {'name': '22667', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22667'}]
CVE State: PUBLISHED
Explain CVE-2007-1160
webSPELL 4.0, and possibly later versions, allows remote attackers to bypass authentication via a ws_auth cookie, a different vulnerability than CVE-2006-4782.
Affected Products: n/a
References: [{'name': '2337', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2337'}, {'name': '33143', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33143'}, {'name': '20070222 WebSpell > 4.0 Authentication Bypass and arbitrary code execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460937/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1161
Cross-site scripting (XSS) vulnerability in call_entry.php in Call Center Software 0,93 allows remote attackers to inject arbitrary web script or HTML via the problem_desc parameter, as demonstrated by the ONLOAD attribute of a BODY element.
Affected Products: n/a
References: [{'name': '2333', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2333'}, {'name': '33037', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33037'}, {'name': '20070222 [TRUE] Call Center Software - Remote Xss Post Exploit -', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-February/001378.html'}, {'name': '20070221 Call Center Software - Remote Xss Post Exploit -', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460797/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1162
A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) IsFolderAvailable or (2) RootFolder property value, different vectors than CVE-2007-0371.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/data/vulnerabilities/exploits/22645.html'}, {'name': '34963', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34963'}, {'name': '22645', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22645'}, {'name': '3350', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3350'}]
CVE State: PUBLISHED
Explain CVE-2007-1163
SQL injection vulnerability in printview.php in webSPELL 4.01.02 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter, a different vector than CVE-2007-1019, CVE-2006-5388, and CVE-2006-4783.
Affected Products: n/a
References: [{'name': '33231', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33231'}, {'name': '22659', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22659'}, {'name': '24257', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24257'}, {'name': 'ADV-2007-0714', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0714'}, {'name': '3351', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3351'}]
CVE State: PUBLISHED
Explain CVE-2007-1164
Multiple PHP remote file inclusion vulnerabilities in DBImageGallery 1.2.2 allow remote attackers to execute arbitrary PHP code via a URL in the donsimg_base_path parameter to (1) attributes.php, (2) images.php, or (3) scan.php in admin/; or (4) attributes.php, (5) db_utils.php, (6) images.php, (7) utils.php, or (8) values.php in includes/.
Affected Products: n/a
References: [{'name': '34944', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34944'}, {'name': '3353', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3353'}, {'name': 'ADV-2007-0692', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0692'}, {'name': '34943', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34943'}, {'name': '34940', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34940'}, {'name': '20070305 Re: Remote File Include In DBImageGallery', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/462142/100/0/threaded'}, {'name': '34937', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34937'}, {'name': '22657', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22657'}, {'name': 'dbimagegallery-donsimg-file-include(32612)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32612'}, {'name': '20070302 Remote File Include In DBImageGallery', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/461741/100/0/threaded'}, {'name': '34942', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34942'}, {'name': '34938', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34938'}, {'name': '34939', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34939'}, {'name': '34941', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34941'}]
CVE State: PUBLISHED
Explain CVE-2007-1165
Multiple PHP remote file inclusion vulnerabilities in DBGuestbook 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the dbs_base_path parameter to (1) utils.php, (2) guestbook.php, or (3) views.php in includes/.
Affected Products: n/a
References: [{'name': '3354', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3354'}, {'name': '33493', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33493'}, {'name': 'ADV-2007-0693', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0693'}, {'name': '22658', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22658'}, {'name': '33494', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33494'}, {'name': '33495', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33495'}]
CVE State: PUBLISHED
Explain CVE-2007-1166
SQL injection vulnerability in result.php in Nabopoll 1.2 allows remote attackers to execute arbitrary SQL commands via the surv parameter.
Affected Products: n/a
References: [{'name': '33753', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33753'}, {'name': '20070222 [TRUE] Nabopoll Blind SQL Injection vulnerabilies', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2007-February/001379.html'}, {'name': '20070221 Nabopoll Blind SQL Injection vulnerabilies', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460765/100/0/threaded'}, {'name': '3355', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3355'}, {'name': '2372', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2372'}, {'name': '22649', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22649'}]
CVE State: PUBLISHED
Explain CVE-2007-1167
inc/filebrowser/browser.php in deV!L`z Clanportal (DZCP) 1.4.5 and earlier allows remote attackers to obtain MySQL data via the inc/mysql.php value of the file parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.dzcp.de/inc/tinymce_files/Downloads/dzcp_update/notes_1.4.6.txt'}, {'name': '22660', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22660'}, {'name': '24260', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24260'}, {'name': '33372', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33372'}, {'name': 'ADV-2007-0695', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0695'}, {'name': '3357', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3357'}]
CVE State: PUBLISHED
Explain CVE-2007-1168
Trend Micro ServerProtect for Linux (SPLX) 1.25, 1.3, and 2.5 before 20070216 allows remote attackers to access arbitrary web pages and reconfigure the product via HTTP requests with the splx_2376_info cookie to the web interface port (14942/tcp).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.trendmicro.com/download/product.asp?productid=20'}, {'name': 'ADV-2007-0691', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0691'}, {'name': '22662', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22662'}, {'name': '1017685', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017685'}, {'name': '24264', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24264'}, {'name': '20070221 Trend Micro ServerProtect Web Interface Authorization Bypass Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=477'}]
CVE State: PUBLISHED
Explain CVE-2007-1169
The web interface in Trend Micro ServerProtect for Linux (SPLX) 1.25, 1.3, and 2.5 before 20070216 accepts logon requests through unencrypted HTTP, which might allow remote attackers to obtain credentials by sniffing the network.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.trendmicro.com/download/product.asp?productid=20'}]
CVE State: PUBLISHED
Explain CVE-2007-1170
SimBin GTR - FIA GT Racing Game 1.5.0.0 and earlier, GT Legends 1.1.0.0 and earlier, GTR 2 1.1 and earlier, and RACE - The WTCC Game 1.0 and earlier allow remote attackers to cause a denial of service (client disconnection) via an empty UDP packet to the server port.
Affected Products: n/a
References: [{'name': '34240', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34240'}, {'name': '2369', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2369'}, {'name': '22651', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22651'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/simbinzero-adv.txt'}, {'name': '20070221 Players disconnection in Simbin racing games', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460762/100/0/threaded'}, {'name': 'ADV-2007-0696', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0696'}]
CVE State: PUBLISHED
Explain CVE-2007-1171
SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 allows remote attackers to execute arbitrary SQL commands via an admin cookie.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-53.html'}, {'name': 'nukesentinel-nsbypass-sql-injection(32582)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32582'}, {'name': '22629', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22629'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.nukescripts.net/index.php?op=NEArticle&sid=4076'}, {'name': '20070928 CVE-2007-5125 - dupe', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-September/001806.html'}, {'name': '3337', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3337'}, {'name': '2344', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2344'}, {'name': '20070928 Re: [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/480994/100/0/threaded'}, {'name': '20070220 NukeSentinel 2.5.05 (nsbypass.php) Blind SQL Injection Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460628/100/0/threaded'}, {'name': '20070925 [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/480575/100/0/threaded'}, {'name': '25805', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/25805'}, {'name': '26954', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/26954'}]
CVE State: PUBLISHED
Explain CVE-2007-1172
SQL injection vulnerability in nukesentinel.php in NukeSentinel 2.5.05, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, aka the "File Disclosure Exploit."
Affected Products: n/a
References: [{'name': '24221', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24221'}, {'name': '2341', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2341'}, {'name': '20070220 NukeSentinel 2.5.05 (nukesentinel.php) File Disclosure Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/460599/100/0/threaded'}, {'name': '3338', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3338'}, {'name': '20070314 SQL injection (x2) in NukeSentinel', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2007-March/001429.html'}]
CVE State: PUBLISHED
Explain CVE-2007-1173
Multiple buffer overflows in the CentennialIPTransferServer service (XFERWAN.EXE), as used by (1) Centennial Discovery 2006 Feature Pack 1, (2) Numara Asset Manager 8.0, and (3) Symantec Discovery 6.5, allow remote attackers to execute arbitrary code via long strings in a crafted TCP packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2007-41/advisory/'}, {'name': 'ADV-2007-1834', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1834'}, {'name': '24002', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/24002'}, {'name': 'ADV-2007-1833', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1833'}, {'name': '1018072', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1018072'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2007-42/advisory/'}, {'name': 'ADV-2007-1832', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1832'}, {'name': 'xferwan-tcp-bo(34313)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/34313'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2007-43/advisory/'}, {'name': '24090', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24090'}, {'name': '24329', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24329'}, {'name': '35076', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35076'}, {'name': '24281', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24281'}]
CVE State: PUBLISHED
Explain CVE-2007-1174
Multiple cross-site scripting (XSS) vulnerabilities in WebAPP before 20070214 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to unspecified fields in user Profiles.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '33301', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33301'}, {'name': 'ADV-2007-0605', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0605'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=251'}, {'name': 'webapporg-net-profileedit-xss(32506)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32506'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1175
Cross-site scripting (XSS) vulnerability in an admin feature in WebAPP before 20070209 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '33275', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33275'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=249'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1176
Multiple cross-site scripting (XSS) vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) Gallery Comments pages, (2) Feedback pages, (3) Search Results pages, and (4) the Statistics Log viewer.
Affected Products: n/a
References: [{'name': '33290', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33290'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '33276', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33276'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '33289', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33289'}, {'name': '33288', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33288'}, {'name': 'webapp-searchresultspages-xss(32499)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32499'}, {'name': 'webapp-statisticslogviewer-xss(32498)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32498'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}, {'name': 'webapp-gallery-feedback-xss(32526)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32526'}]
CVE State: PUBLISHED
Explain CVE-2007-1177
WebAPP before 0.9.9.5 does not properly filter certain characters in contexts related to (1) the query string, (2) Profiles, (3) the Forum Post icon field, (4) the Edit Profile, and (5) the Gallery, which has unknown impact and remote attack vectors, possibly related to cross-site scripting (XSS).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': '33277', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33277'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '33283', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33283'}, {'name': '33287', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33287'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}, {'name': '33286', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33286'}]
CVE State: PUBLISHED
Explain CVE-2007-1178
WebAPP before 0.9.9.5 does not check access in certain contexts related to (1) Calendar Administration, (2) Instant Messages Administration, and (3) the Image Uploader, which has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '33282', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33282'}, {'name': '33279', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33279'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1179
WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to (1) the Recommend feature, Email Article (2) senders and (3) recipients, (4) New User Approval, (5) Edit Profiles, (6) the Newsletter Subscription form, (7) the Recommend form, and (8) sending of articles, which has unknown impact, and remote attack vectors related to spam attacks and possibly other attacks.
Affected Products: n/a
References: [{'name': '33284', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33284'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1180
WebAPP before 0.9.9.5 does not check referrers in certain forms, which might facilitate remote cross-site request forgery (CSRF) attacks or have other unknown impact.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '33285', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33285'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1181
WebAPP before 0.9.9.5 passes (1) Unused Informations and (2) the username through Edit Profile forms, which has unknown impact and attack vectors.
Affected Products: n/a
References: [{'name': '33291', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33291'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1182
WebAPP before 0.9.9.5 allows remote Guest users to edit a Guest profile, which has unknown impact.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '33292', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33292'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1183
WebAPP before 0.9.9.5 allows remote authenticated users to spoof another user's Real Name via whitespace, which has unknown impact and attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '33293', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33293'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1184
The default configuration of WebAPP before 0.9.9.5 has a CAPTCHA setting of "no," which makes it easier for automated programs to submit false data.
Affected Products: n/a
References: [{'name': '33294', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33294'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1185
The (1) Search, (2) Edit Profile, (3) Recommend, and (4) User Approval forms in WebAPP before 0.9.9.5 use hidden inputs, which has unknown impact and remote attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '33295', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33295'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1186
WebAPP before 0.9.9.5 does not "censor" the Latest Member real name, which has unknown impact.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '33296', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33296'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1187
WebAPP before 0.9.9.5 allows remote authenticated users, without admin privileges, to obtain sensitive information via (1) the Forum Archive feature and (2) Recent Searches.
Affected Products: n/a
References: [{'name': '33281', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33281'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '33298', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33298'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1188
WebAPP before 0.9.9.5 allows remote attackers to submit Search form input that is not checked for (1) composition or (2) length, which has unknown impact, possibly related to "search form hijacking".
Affected Products: n/a
References: [{'name': '33299', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33299'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250'}, {'name': 'ADV-2007-0604', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0604'}, {'name': '24080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24080'}, {'name': '22563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22563'}]
CVE State: PUBLISHED
Explain CVE-2007-1189
Integer overflow in the envwrite function in the Alcatel-Lucent Bell Labs Plan 9 kernel allows local users to overwrite certain memory addresses with kernel memory via a large n argument, as demonstrated by (1) modifying the iseve function to gain privileges and (2) making the devpermcheck function grant unrestricted device permissions.
Affected Products: n/a
References: [{'name': '22749', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22749'}, {'name': '3383', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3383'}, {'tags': ['x_refsource_MISC'], 'url': 'http://kernelspace.us/itheft.c'}, {'name': '34956', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34956'}, {'name': '[dailydave] 20070227 Wow, free kernel zero day?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.immunitysec.com/pipermail/dailydave/2007-February/004118.html'}]
CVE State: PUBLISHED
Explain CVE-2007-1190
Unspecified vulnerability in the EmbeddedWB Web Browser ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '36205', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36205'}, {'name': '22755', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22755'}]
CVE State: PUBLISHED