Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2007-0099
Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via many nested tags in an XML document in an IFRAME, when synchronous document rendering is frequently disrupted with asynchronous events, as demonstrated using a JavaScript timer, which can trigger NULL pointer dereferences or memory corruption, aka "MSXML Memory Corruption Vulnerability."
Affected Products: n/a
References: [{'name': 'SSRT080164', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=122703006921213&w=2'}, {'name': '32627', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32627'}, {'name': '20070104 Concurrency strikes MSIE (potentially exploitable msxml3 flaws)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2007/Jan/0110.html'}, {'name': 'TA08-316A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA08-316A.html'}, {'name': '21872', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21872'}, {'tags': ['x_refsource_MISC'], 'url': 'http://isc.sans.org/diary.php?storyid=2004'}, {'name': '23655', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23655'}, {'name': 'HPSBST02386', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=122703006921213&w=2'}, {'name': '20070104 Re: Concurrency strikes MSIE (potentially exploitablemsxml3 flaws)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0113.html'}, {'name': 'ADV-2008-3111', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/3111'}, {'name': 'MS08-069', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069'}, {'name': '20070104 RE: [Full-disclosure] Concurrency strikes MSIE (potentially exploitablemsxml3 flaws)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/455986/100/0/threaded'}, {'name': '1021164', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021164'}, {'name': 'oval:org.mitre.oval:def:5793', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5793'}, {'name': '20070104 Concurrency strikes MSIE (potentially exploitable msxml3 flaws)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/455965/100/0/threaded'}, {'name': '20070104 Re: RE: [Full-disclosure] Concurrency strikes MSIE (potentially exploitablemsxml3 flaws)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456343/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0100
The Perforce client does not restrict the set of files that it overwrites upon receiving a request from the server, which allows remote attackers to overwrite arbitrary files by modifying the client config file on the server, or by operating a malicious server.
Affected Products: n/a
References: [{'name': '33369', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33369'}, {'name': '20070104 Perforce client: security hole by design', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/455977/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0101
Cross-site request forgery (CSRF) vulnerability in SPINE allows remote attackers to perform unauthorized actions as administrators via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'spine-unspecified-csrf(31283)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31283'}, {'tags': ['x_refsource_MISC'], 'url': 'http://spine.sourceforge.net/changelog.html'}, {'name': '32577', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32577'}, {'name': 'ADV-2007-0042', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0042'}, {'name': '23537', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23537'}]
CVE State: PUBLISHED
Explain CVE-2007-0102
The Adobe PDF specification 1.3, as implemented by Apple Mac OS X Preview, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.
Affected Products: n/a
References: [{'name': 'TA07-072A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA07-072A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=305214'}, {'name': 'multiple-vendor-pdf-code-execution(31364)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31364'}, {'name': '21910', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21910'}, {'name': '31221', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31221'}, {'name': '1017749', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017749'}, {'tags': ['x_refsource_MISC'], 'url': 'http://projects.info-pull.com/moab/MOAB-06-01-2007.html'}, {'name': 'ADV-2007-0930', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0930'}, {'name': '24479', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24479'}]
CVE State: PUBLISHED
Explain CVE-2007-0103
The Adobe PDF specification 1.3, as implemented by Adobe Acrobat before 8.0.0, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.
Affected Products: n/a
References: [{'name': 'TA07-072A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA07-072A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=305214'}, {'name': 'multiple-vendor-pdf-code-execution(31364)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31364'}, {'name': '21910', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21910'}, {'name': '1017749', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017749'}, {'tags': ['x_refsource_MISC'], 'url': 'http://projects.info-pull.com/moab/MOAB-06-01-2007.html'}, {'name': 'ADV-2007-0930', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0930'}, {'name': '24479', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24479'}]
CVE State: PUBLISHED
Explain CVE-2007-0105
Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted HTTP GET request.
Affected Products: n/a
References: [{'name': '23629', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23629'}, {'name': '21900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21900'}, {'name': 'cisco-acs-csadmin-bo(31323)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31323'}, {'name': 'ADV-2007-0068', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0068'}, {'name': '1017475', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017475'}, {'name': 'VU#744249', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/744249'}, {'name': '20070105 Multiple Vulnerabilities in Cisco Secure Access Control Server', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml'}, {'name': '32642', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/32642'}]
CVE State: PUBLISHED
Explain CVE-2007-0106
Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request.
Affected Products: n/a
References: [{'name': '2114', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2114'}, {'name': '20070105 Advisory 01/2007: WordPress CSRF Protection XSS Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456048/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/development/2007/01/wordpress-206/'}, {'name': '23595', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23595'}, {'name': '33397', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33397'}, {'name': 'ADV-2007-0061', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0061'}, {'name': '21893', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21893'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hardened-php.net/advisory_012007.140.html'}]
CVE State: PUBLISHED
Explain CVE-2007-0107
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.
Affected Products: n/a
References: [{'name': 'wordpress-mbstring-security-bypass(31297)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31297'}, {'name': '21907', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21907'}, {'name': '23741', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23741'}, {'name': 'OpenPKG-SA-2007.005', 'tags': ['vendor-advisory', 'x_refsource_OPENPKG'], 'url': 'http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html'}, {'name': 'GLSA-200701-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200701-10.xml'}, {'name': '31579', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31579'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wordpress.org/development/2007/01/wordpress-206/'}, {'name': '23595', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23595'}, {'name': '20070105 Advisory 02/2007: WordPress Trackback Charset Decoding SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456049/100/0/threaded'}, {'name': 'ADV-2007-0061', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0061'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hardened-php.net/advisory_022007.141.html'}, {'name': '2112', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2112'}]
CVE State: PUBLISHED
Explain CVE-2007-0108
nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/2003 does not delete user profiles during a Terminal Service or Citrix session, which allows remote authenticated users to invoke alternate user profiles.
Affected Products: n/a
References: [{'name': 'ADV-2007-0064', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0064'}, {'name': '1017471', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017471'}, {'name': '21886', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21886'}, {'name': '31358', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31358'}, {'name': 'novell-profile-security-bypass(31343)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31343'}, {'name': '23619', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23619'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974970.htm'}]
CVE State: PUBLISHED
Explain CVE-2007-0109
wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.
Affected Products: n/a
References: [{'name': '31577', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31577'}, {'name': '23621', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23621'}, {'name': 'wordpress-account-enumeration(31262)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31262'}, {'name': '23741', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23741'}, {'name': 'GLSA-200701-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200701-10.xml'}, {'name': 'ADV-2007-0062', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0062'}, {'name': '20070103 Wordpress <= 2.x dictionnary & Bruteforce attack', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/455927/100/0/threaded'}, {'name': '2113', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2113'}]
CVE State: PUBLISHED
Explain CVE-2007-0110
Cross-site scripting (XSS) vulnerability in nidp/idff/sso in Novell Access Manager Identity Server before 3.0.0-1013 allows remote attackers to inject arbitrary web script or HTML via the IssueInstant parameter, which is not properly handled in the resulting error message.
Affected Products: n/a
References: [{'name': '23654', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23654'}, {'name': '31359', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31359'}, {'name': '21921', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21921'}, {'name': 'ADV-2007-0073', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0073'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://secure-support.novell.com/KanisaPlatform/Publishing/143/3615264_f.SAL_Public.html'}, {'name': '1017483', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017483'}]
CVE State: PUBLISHED
Explain CVE-2007-0111
Buffer overflow in Resco Photo Viewer for PocketPC 4.11 and 6.01, as used in mobile devices running Windows Mobile 5.0, 2003, and 2003SE, allows remote attackers to execute arbitrary code via a crafted PNG image.
Affected Products: n/a
References: [{'name': 'ADV-2007-0072', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0072'}, {'name': '32644', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32644'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.trendmicro.com/flaw-in-3rd-party-app-weakens-windows-mobile/'}, {'name': '23658', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23658'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VName=Vulnerability+in+Resco+Photo+Viewer+6.01+Enabling+Code+Injection+and+Arbitrary+Code+Execution'}, {'name': '21920', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21920'}]
CVE State: PUBLISHED
Explain CVE-2007-0112
SQL injection vulnerability in cats.asp in createauction allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Affected Products: n/a
References: [{'name': 'createauction-cats-sql-injection(31356)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31356'}, {'name': '33406', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33406'}, {'name': '2111', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2111'}, {'name': '20070107 createauction (cats.asp) Remote SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456272/100/0/threaded'}, {'name': '21929', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21929'}]
CVE State: PUBLISHED
Explain CVE-2007-0113
Buffer overflow in Packeteer PacketShaper PacketWise 8.x allows remote authenticated users to cause a denial of service (reset or reboot) via (1) a long traffic class argument to the "class show" command or (2) a long POLICY parameter value in clastree.htm.
Affected Products: n/a
References: [{'name': '21933', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21933'}, {'name': '20070108 Packeteer PacketWise CLI overflow DoS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456267/100/0/threaded'}, {'name': '23685', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23685'}, {'name': '2110', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2110'}, {'name': 'packetshaper-argument-dos(31357)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31357'}, {'name': '31656', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31656'}, {'name': 'ADV-2007-0098', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0098'}]
CVE State: PUBLISHED
Explain CVE-2007-0114
Sun Java System Content Delivery Server 5.0 and 5.0 PU1 allows remote attackers to obtain sensitive information regarding "content details" via unspecified vectors.
Affected Products: n/a
References: [{'name': '23630', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23630'}, {'name': '21908', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21908'}, {'name': '32645', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32645'}, {'name': '102764', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-102764-1'}, {'name': 'ADV-2007-0076', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0076'}, {'name': 'sun-java-cds-info-disclosure(31345)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31345'}]
CVE State: PUBLISHED
Explain CVE-2007-0115
Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the Username to login.php, which is injected into an error message in security.log.php, which can then be accessed using viewlog.php.
Affected Products: n/a
References: [{'name': '20070108 Source verify - Coppermine Photo Gallery <= 1.4.10 code injection', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-January/001218.html'}, {'name': '33383', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33383'}, {'tags': ['x_refsource_MISC'], 'url': 'http://acid-root.new.fr/poc/19070104.txt'}, {'name': '2107', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2107'}, {'name': '20070105 Coppermine Photo Gallery <= 1.4.10 SQL Injection Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456051/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0116
Digger Solutions Intranet Open Source (IOS) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for data/intranet.mdb.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://aria-security.com/forum/showthread.php?goto=newpost&t=88'}, {'name': '33379', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33379'}, {'name': '2109', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2109'}, {'name': 'intranet-intranet-info-disclosure(31308)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31308'}, {'name': '20070105 Intranet Open Source Remote Password Disclosure "intranet.mdb"', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456047/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0117
DiskManagementTool in the DiskManagement.framework 92.29 on Mac OS X 10.4.8 does not properly validate Bill of Materials (BOM) files, which allows attackers to gain privileges via a BOM file under /Library/Receipts/, which triggers arbitrary file permission changes upon execution of a diskutil permission repair operation.
Affected Products: n/a
References: [{'name': '23653', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23653'}, {'tags': ['x_refsource_MISC'], 'url': 'http://projects.info-pull.com/moab/MOAB-05-01-2007.html'}, {'name': '21899', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21899'}, {'name': 'ADV-2007-0074', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0074'}, {'name': '31167', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31167'}]
CVE State: PUBLISHED
Explain CVE-2007-0118
Multiple absolute path traversal vulnerabilities in EditTag 1.2 allow remote attackers to read arbitrary files via an absolute pathname in the file parameter to (1) edittag.cgi, (2) edittag.pl, (3) edittag_mp.cgi, or (4) edittag_mp.pl.
Affected Products: n/a
References: [{'name': '20070105 Multiple bugs in EditTag', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456055/100/0/threaded'}, {'name': '33395', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33395'}, {'name': '33394', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33394'}, {'name': '7950', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/7950'}, {'name': '21890', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21890'}, {'name': '33396', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33396'}, {'name': '33393', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33393'}]
CVE State: PUBLISHED
Explain CVE-2007-0119
Multiple cross-site scripting (XSS) vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the plain parameter to (1) mkpw_mp.cgi, (2) mkpw.pl, or (3) mkpw.cgi.
Affected Products: n/a
References: [{'name': '20070105 Multiple bugs in EditTag', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456055/100/0/threaded'}, {'name': '33390', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33390'}, {'name': '33392', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33392'}, {'name': '7950', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/7950'}, {'name': '21891', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21891'}, {'name': '33391', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33391'}]
CVE State: PUBLISHED
Explain CVE-2007-0120
Acunetix Web Vulnerability Scanner (WVS) 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of service (application crash) via multiple HTTP requests containing invalid Content-Length values.
Affected Products: n/a
References: [{'name': '3078', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3078'}, {'name': 'acunetix-content-length-dos(31279)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31279'}, {'name': '37580', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37580'}, {'name': '21898', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21898'}]
CVE State: PUBLISHED
Explain CVE-2007-0121
Cross-site scripting (XSS) vulnerability in search.asp in RI Blog 1.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Affected Products: n/a
References: [{'name': '23657', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23657'}, {'name': 'ADV-2007-0083', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0083'}, {'name': '21880', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21880'}, {'name': '2108', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2108'}, {'name': '20070105 RI Blog 1.3 XSS Vuln.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456052/100/0/threaded'}, {'name': '31637', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31637'}, {'name': 'riblog-search-xss(31317)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31317'}]
CVE State: PUBLISHED
Explain CVE-2007-0122
Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via (1) the cat parameter to albmgr.php, and possibly (2) the gid parameter to usermgr.php; (3) the start parameter to db_ecard.php; and the albumid parameter to unspecified files, related to the (4) filename_to_title and (5) del_titles functions.
Affected Products: n/a
References: [{'name': '35853', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35853'}, {'name': '2123', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2123'}, {'name': '25846', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25846'}, {'tags': ['x_refsource_MISC'], 'url': 'http://acid-root.new.fr/poc/19070104.txt'}, {'name': '3085', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3085'}, {'name': '35854', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35854'}, {'name': '35852', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35852'}, {'name': '20070105 Coppermine Photo Gallery <= 1.4.10 SQL Injection Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456051/100/0/threaded'}, {'name': '21894', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21894'}, {'name': '35856', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35856'}, {'name': '35855', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35855'}]
CVE State: PUBLISHED
Explain CVE-2007-0123
Unrestricted file upload vulnerability in Uber Uploader 4.2 allows remote attackers to upload and execute arbitrary PHP scripts by naming them with a .phtml extension, which bypasses the .php extension check but is still executable on some server configurations.
Affected Products: n/a
References: [{'name': '2116', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2116'}, {'name': 'uber-uploader-phtml-file-upload(31303)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31303'}, {'name': '20070105 Uber Uploader 4.2 Arbitrary File Upload Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456045/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0124
Unspecified vulnerability in Drupal before 4.6.11, and 4.7 before 4.7.5, when MySQL is used, allows remote authenticated users to cause a denial of service by poisoning the page cache via unspecified vectors, which triggers erroneous 404 HTTP errors for pages that exist.
Affected Products: n/a
References: [{'name': '2115', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2115'}, {'name': '23586', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23586'}, {'name': '32131', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32131'}, {'name': 'ADV-2007-0051', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0051'}, {'name': '20070105 [DRUPAL-SA-2007-002] Drupal 4.6.11 / 4.7.5 fixes DoS issue', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456056/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/104238'}, {'name': '21895', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21895'}]
CVE State: PUBLISHED
Explain CVE-2007-0125
Kaspersky Labs Antivirus Engine 6.0 for Windows and 5.5-10 for Linux before 20070102 enter an infinite loop upon encountering an invalid NumberOfRvaAndSizes value in the Optional Windows Header of a portable executable (PE) file, which allows remote attackers to cause a denial of service (CPU consumption) by scanning a crafted PE file.
Affected Products: n/a
References: [{'name': '20070105 Kaspersky Antivirus Scan Engine PE File Denial of Service Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=459'}, {'name': 'kaspersky-antivirus-pe-dos(31315)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31315'}, {'name': '23575', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23575'}, {'name': 'ADV-2007-0067', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0067'}, {'name': '32588', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32588'}, {'name': '21901', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21901'}, {'name': '1017476', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017476'}]
CVE State: PUBLISHED
Explain CVE-2007-0126
Heap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index bytes in the Define Huffman Table (DHT) marker.
Affected Products: n/a
References: [{'name': '31574', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31574'}, {'name': '1017473', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017473'}, {'name': 'opera-jpeg-dht-bo(31305)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31305'}, {'name': '23613', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23613'}, {'name': 'ADV-2007-0060', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0060'}, {'name': '23739', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23739'}, {'name': '20070105 Opera Software Opera Web Browser JPG Image DHT Marker Heap Corruption Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457'}, {'name': 'GLSA-200701-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200701-08.xml'}, {'name': '23771', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23771'}, {'name': 'SUSE-SA:2007:009', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.suse.com/archive/suse-security-announce/2007-Jan/0009.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.opera.com/support/search/supsearch.dml?index=852'}]
CVE State: PUBLISHED
Explain CVE-2007-0127
The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.
Affected Products: n/a
References: [{'name': '31575', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31575'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.opera.com/support/search/supsearch.dml?index=851'}, {'name': '1017473', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017473'}, {'name': '23613', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23613'}, {'name': 'ADV-2007-0060', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0060'}, {'name': '23739', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23739'}, {'name': 'GLSA-200701-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200701-08.xml'}, {'name': '23771', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23771'}, {'name': 'SUSE-SA:2007:009', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.suse.com/archive/suse-security-announce/2007-Jan/0009.html'}, {'name': '20070105 Opera Software Opera Web Browser createSVGTransformFromMatrix Object Typecasting Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458'}]
CVE State: PUBLISHED
Explain CVE-2007-0128
SQL injection vulnerability in info_book.asp in Digirez 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the book_id parameter.
Affected Products: n/a
References: [{'name': 'ADV-2007-0053', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0053'}, {'name': '23606', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23606'}, {'name': '31677', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31677'}, {'name': '3081', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3081'}]
CVE State: PUBLISHED
Explain CVE-2007-0129
SQL injection vulnerability in main.asp in LocazoList 2.01a beta5 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatID parameter.
Affected Products: n/a
References: [{'name': 'locazolist-main-sql-injection(31242)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31242'}, {'name': '35813', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35813'}, {'name': 'ADV-2007-0052', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0052'}, {'name': '3073', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3073'}]
CVE State: PUBLISHED
Explain CVE-2007-0130
SQL injection vulnerability in user.php in iGeneric iG Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '21873', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21873'}, {'name': '23602', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23602'}, {'name': 'ADV-2007-0055', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0055'}, {'name': '3082', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3082'}, {'name': '20070105 IG Calendar SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456044/100/0/threaded'}, {'name': 'igcalendar-user-sql-injection(31300)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31300'}, {'name': '31678', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31678'}]
CVE State: PUBLISHED
Explain CVE-2007-0131
JAMWiki before 0.5.0 does not properly check permissions during moves of "read-only or admin-only topics," which allows remote attackers to make unauthorized changes to the wiki.
Affected Products: n/a
References: [{'name': '32581', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32581'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=171441&release_id=475663'}, {'name': '23634', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23634'}, {'name': '21879', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21879'}, {'name': 'jamwiki-permission-security-bypass(31296)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31296'}]
CVE State: PUBLISHED
Explain CVE-2007-0132
SQL injection vulnerability in compare_product.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '3083', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3083'}, {'name': '33385', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33385'}, {'name': '23604', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23604'}, {'name': '20070105 IG Shop remote code execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456043/100/0/threaded'}, {'name': 'ADV-2007-0056', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0056'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.nl/0701-exploits/igshop10-multiple.txt'}, {'name': '21874', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21874'}, {'name': 'igshop-compareproduct-sql-injection(31299)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31299'}]
CVE State: PUBLISHED
Explain CVE-2007-0133
Multiple SQL injection vulnerabilities in display_review.php in iGeneric iG Shop 1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) user_login_cookie parameter.
Affected Products: n/a
References: [{'name': '33386', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33386'}, {'name': 'ADV-2007-0056', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0056'}]
CVE State: PUBLISHED
Explain CVE-2007-0134
Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in (1) cart.php and (2) page.php.  NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1.4.
Affected Products: n/a
References: [{'name': '21875', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21875'}, {'name': '3083', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3083'}, {'name': '33388', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33388'}, {'name': '33387', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33387'}, {'name': '20070619 iG Shop 1.4 eval Inclusion Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/471722/100/0/threaded'}, {'name': '23604', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23604'}, {'name': '20070105 IG Shop remote code execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456043/100/0/threaded'}, {'name': 'ADV-2007-0056', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0056'}, {'name': 'igshop-cartpage-code-execution(31301)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31301'}, {'name': '20070618 Dup: iG Shop 1.4 (page.php) Remote Code Execution Exploit', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-June/001664.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.nl/0701-exploits/igshop10-multiple.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0135
PHP remote file inclusion vulnerability in inc/init.inc.php in Aratix 0.2.2 beta 11 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the current_path parameter.
Affected Products: n/a
References: [{'name': '20070108 Source verify of Aratix RFI', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-January/001219.html'}, {'name': '33405', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33405'}, {'name': 'aratix-init-file-include(31282)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31282'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityreason.com/exploitalert/1698'}, {'name': 'ADV-2007-0054', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0054'}, {'name': '3079', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3079'}]
CVE State: PUBLISHED
Explain CVE-2007-0136
Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11, and 4.7 before 4.7.5, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in the (1) filter and (2) system modules.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'drupal-core-unspecified-xss(31311)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31311'}, {'name': '32140', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32140'}, {'name': '20070105 [DRUPAL-SA-2007-001] Drupal 4.6.11 / 4.7.5 fixes XSS issue', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/456054/100/100/threaded'}, {'name': '32139', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32139'}, {'name': 'ADV-2007-0050', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0050'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/files/sa-2007-001/advisory.txt'}, {'name': '20070105 [DRUPAL-SA-2007-001] Drupal 4.6.11 / 4.7.5 fixes', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=116799778408115&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/104233'}]
CVE State: PUBLISHED
Explain CVE-2007-0137
Cross-site scripting (XSS) vulnerability in SimpleBoxes/SerendipityNZ Serene Bach 2.05R and earlier, and 2.08D and earlier in the 2.08 series; and (2) sb 1.13D and earlier, and 1.18R and earlier in the 1.18 series; allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://serenebach.net/log/sb209R.html'}, {'name': 'ADV-2007-0065', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0065'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://serenebach.net/log/sb119R.html'}, {'name': 'JVN#65500885', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/jp/JVN%2365500885/index.html'}, {'name': 'serene-bach-unspecified-xss(31302)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31302'}, {'name': '32580', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32580'}, {'name': '23623', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23623'}, {'name': '21884', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/21884'}, {'name': '1017470', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017470'}]
CVE State: PUBLISHED
Explain CVE-2007-0138
formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with (1) AbfrageForm or (2) EingabeForm, allows remote attackers to cause a denial of service (daemon crash) via multiple requests containing many /../ sequences in the Name parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '32546', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32546'}, {'name': 'formbankserver-formbank-dos(31216)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31216'}, {'name': '23539', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23539'}]
CVE State: PUBLISHED