Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2007-0343
OpenBSD before 20070116 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via certain IPv6 ICMP (aka ICMP6) echo request packets.
Affected Products: n/a
References: [{'name': '1017518', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017518'}, {'name': '22087', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22087'}, {'name': '23830', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23830'}, {'name': '32935', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/32935'}, {'name': '[3.9] 018: RELIABILITY FIX: January 16, 2007', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata39.html#icmp6'}, {'name': '[4.0] 008: RELIABILITY FIX: January 16, 2007', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata.html#icmp6'}]
CVE State: PUBLISHED
Explain CVE-2007-0344
Multiple format string vulnerabilities in (1) _invitedToRoom: and (2) _invitedToDirectChat: in Colloquy 2.1 and earlier allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in the channel name of an INVITE request, related to the implementation of AlertSheet and AlertPanel in Apple AppKit.
Affected Products: n/a
References: [{'name': '22086', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22086'}, {'name': '3139', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3139'}, {'tags': ['x_refsource_MISC'], 'url': 'http://projects.info-pull.com/moab/MOAB-16-01-2007.html'}, {'name': 'ADV-2007-0238', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0238'}, {'name': '32688', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/32688'}, {'name': '23801', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23801'}]
CVE State: PUBLISHED
Explain CVE-2007-0345
The (1) Activity Monitor.app/Contents/Resources/pmTool, (2) Keychain Access.app/Contents/Resources/kcproxy, and (3) ODBC Administrator.app/Contents/Resources/iodbcadmintool programs in /Applications/Utilities/ in Mac OS X 10.4.8 have weak permissions (writable by admin group), which allows local admin users to gain root privileges by modifying a program and then performing permissions repair via diskutil.
Affected Products: n/a
References: [{'name': '32700', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/32700'}, {'name': '32701', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/32701'}, {'tags': ['x_refsource_MISC'], 'url': 'http://projects.info-pull.com/moab/MOAB-15-01-2007.html'}, {'name': '3136', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3136'}, {'name': 'macosx-applications-privilege-escalation(31530)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31530'}, {'name': '32702', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/32702'}]
CVE State: PUBLISHED
Explain CVE-2007-0346
SQL injection vulnerability in index.php in SmE FileMailer 1.21 allows remote attackers to execute arbitrary SQL commands via the us parameter.
Affected Products: n/a
References: [{'name': '32832', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32832'}, {'name': 'smefilemailer-login-sql-injection(31533)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31533'}, {'name': '20070117 Source VERIFY of SMe FileMailer 1.21 SQL injection', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-January/001244.html'}, {'name': 'ADV-2007-0221', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0221'}]
CVE State: PUBLISHED
Explain CVE-2007-0347
The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" (quote) character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a ' character in certain messages, tickets, or Wiki entries.
Affected Products: n/a
References: [{'name': 'ADV-2007-0398', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0398'}, {'name': '2192', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2192'}, {'name': '31935', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31935'}, {'name': '20070129 CVSTrac 2.0.0 Denial of Service (DoS) vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052058.html'}, {'name': '20070129 CVSTrac 2.0.0 Denial of Service (DoS) vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/458455/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cvstrac.org/cvstrac/chngview?cn=850'}, {'name': '22296', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22296'}, {'name': 'OpenPKG-SA-2007.008', 'tags': ['vendor-advisory', 'x_refsource_OPENPKG'], 'url': 'http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.008.html'}, {'name': '23940', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23940'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cvstrac.org/cvstrac/tktview?tn=683'}]
CVE State: PUBLISHED
Explain CVE-2007-0348
Stack-based buffer overflow in the IASystemInfo.dll ActiveX control in (1) InterActual Player 2.60.12.0717, (2) Roxio CinePlayer 3.2, (3) WinDVD 7.0.27.172, and possibly other products, allows remote attackers to execute arbitrary code via a long ApplicationType property.
Affected Products: n/a
References: [{'name': '23075', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23075'}, {'name': 'interactual-iasysteminfo-bo(33186)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33186'}, {'name': '34314', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34314'}, {'name': '23032', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23032'}, {'name': 'VU#922969', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/922969'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2007-37/advisory/'}, {'name': '34315', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34315'}, {'name': 'ADV-2007-1042', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1042'}, {'name': '23071', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23071'}, {'name': 'ADV-2007-1043', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1043'}, {'name': '24556', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24556'}, {'name': '20070321 Secunia Research: InterActual Player / CinePlayer IASystemInfo.dllActiveX Control Buffer Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463405/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0349
Directory traversal vulnerability in upgrade.php in nicecoder.com INDEXU 5.x allows remote attackers to include arbitrary local files via a .. (dot dot) in the gateway parameter.
Affected Products: n/a
References: [{'name': 'indexu-upgrade-file-include(31539)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31539'}, {'name': '20070116 vulnerability script indexu all versions', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457079/100/0/threaded'}, {'name': '45533', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/45533'}]
CVE State: PUBLISHED
Explain CVE-2007-0350
Multiple SQL injection vulnerabilities in (a) index.php and (b) dl.php in SmE FileMailer 1.21 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ps, (2) us, (3) f, or (4) code parameter.  NOTE: the us vector in index.php is already covered by CVE-2007-0346.
Affected Products: n/a
References: [{'name': '20070117 Source VERIFY of SMe FileMailer 1.21 SQL injection', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2007-January/001244.html'}, {'name': '20070116 [x0n3-h4ck] SmE FileMailer 1.21 Remote Sql Injextion Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2007-01/0395.html'}, {'name': 'smefilemailer-login-sql-injection(31533)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31533'}, {'name': '32833', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32833'}, {'name': 'ADV-2007-0221', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0221'}]
CVE State: PUBLISHED
Explain CVE-2007-0351
Microsoft Windows XP and Windows Server 2003 do not properly handle user logoff, which might allow local users to gain the privileges of a previous system user, possibly related to user profile unload failure. NOTE: it is not clear whether this is an issue in Windows itself, or an interaction with another product.  The issue might involve ZoneAlarm not being able to terminate processes when it cannot prompt the user.
Affected Products: n/a
References: [{'name': '20070117 Re: Windows logoff bug possible security vulnerability and exploit.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457217/100/0/threaded'}, {'name': '20070117 Windows logoff bug possible security vulnerability and exploit.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457167/100/0/threaded'}, {'name': '20070123 Re: Windows logoff bug possible security vulnerability and exploit.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457807/100/200/threaded'}, {'name': '20070211 Windows logoff bug solution possibly.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/459838/100/0/threaded'}, {'name': '20070118 Re: Windows logoff bug possible security vulnerability and exploit.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457340/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-0352
Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a crafted .cnt file composed of lines that begin with an integer followed by a space and a long string.
Affected Products: n/a
References: [{'name': '20070117 Microsoft Help Workshop .CNT contents files buffer overflow vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457210/100/0/threaded'}, {'name': 'ms-help-workshop-cnt-bo(31555)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31555'}, {'name': '1017530', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017530'}, {'name': '22100', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22100'}, {'name': '2156', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2156'}, {'name': '3149', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3149'}, {'name': '23862', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23862'}, {'name': '31898', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31898'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.anspi.pl/~porkythepig/visualization/cnt-expl1.cpp'}]
CVE State: PUBLISHED
Explain CVE-2007-0353
Cross-site scripting (XSS) vulnerability in (1) index.php and (2) login.php in myBloggie 2.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO string.
Affected Products: n/a
References: [{'name': 'mybloggie-indexlogin-xss(31554)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31554'}, {'name': '32930', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32930'}, {'name': '20070117 [x0n3-h4ck] myBloggie 2.1.5 XSS exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457206/100/0/threaded'}, {'name': '2155', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2155'}, {'name': '22097', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22097'}, {'tags': ['x_refsource_MISC'], 'url': 'http://mywebland.com/forums/showtopic.php?t=1224'}, {'name': '32929', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32929'}, {'name': '20070117 [x0n3-h4ck] myBloggie 2.1.5 XSS exploit', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0338.html'}, {'name': '1017531', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017531'}]
CVE State: PUBLISHED
Explain CVE-2007-0354
SQL injection vulnerability in email.php in MGB OpenSource Guestbook 0.5.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '31612', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/31612'}, {'name': '22094', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22094'}, {'name': 'mgb-email-sql-injection(31551)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31551'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.tv-kritik.net/mgb/index.php'}, {'name': '3141', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3141'}, {'name': '20070118 vendor ACK for MGB Guestbook issue', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-January/001246.html'}, {'name': 'ADV-2007-0232', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0232'}, {'name': '23825', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23825'}]
CVE State: PUBLISHED
Explain CVE-2007-0355
Buffer overflow in the Apple Minimal SLP v2 Service Agent (slpd) in Mac OS X 10.4.11 and earlier, including 10.4.8, allows local users, and possibly remote attackers, to gain privileges and possibly execute arbitrary code via a registration request with an invalid attr-list field.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=307430'}, {'name': '1019359', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1019359'}, {'name': '3151', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3151'}, {'name': '1017533', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017533'}, {'name': '32693', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/32693'}, {'tags': ['x_refsource_MISC'], 'url': 'http://projects.info-pull.com/moab/MOAB-17-01-2007.html'}, {'name': 'ADV-2007-0239', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0239'}, {'name': 'TA08-043B', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA08-043B.html'}, {'name': '23796', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23796'}, {'name': 'APPLE-SA-2008-02-11', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2008/Feb/msg00002.html'}, {'name': '22101', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22101'}, {'name': 'macos-slpd-bo(31562)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31562'}]
CVE State: PUBLISHED
Explain CVE-2007-0356
The Common Controls Replacement Project (CCRP) FolderTreeview (FTV) ActiveX control (ccrpftv6.ocx) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long CCRP.RootFolder property value.
Affected Products: n/a
References: [{'name': '22092', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22092'}, {'name': '3142', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3142'}, {'name': 'ie-ccrp-dos(31549)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31549'}]
CVE State: PUBLISHED
Explain CVE-2007-0357
Directory traversal vulnerability in the AVM IGD CTRL Service in Fritz!DSL 02.02.29 allows remote attackers to read arbitrary files via ..%5C (URL-encoded dot dot backslash) sequences in a URI requested from the AR7 webserver.
Affected Products: n/a
References: [{'name': 'ADV-2007-0236', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0236'}, {'name': '23774', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23774'}, {'name': '2159', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2159'}, {'name': '32866', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32866'}, {'name': 'fritz-avm-directory-traversal(31556)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31556'}, {'name': '20070117 Flaw in AVM UPNP service for windows', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051844.html'}, {'name': '22093', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22093'}]
CVE State: PUBLISHED
Explain CVE-2007-0358
Unspecified vulnerability in the FTP server implementation in HP Jetdirect firmware x.20.nn through x.24.nn allows remote attackers to cause a denial of service via unknown vectors.
Affected Products: n/a
References: [{'name': '23802', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23802'}, {'name': 'ADV-2007-0233', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0233'}, {'name': 'HPSBPI02185', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://itrc.hp.com/service/cki/docDisplay.do?docId=c00838612'}, {'name': '1017532', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017532'}, {'name': 'SSRT071290', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://itrc.hp.com/service/cki/docDisplay.do?docId=c00838612'}, {'name': '32867', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32867'}, {'name': '22105', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22105'}, {'name': 'hp-jetdirect-unspecified-dos(31589)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31589'}]
CVE State: PUBLISHED
Explain CVE-2007-0359
PHP remote file inclusion vulnerability in frontpage.php in Uberghey CMS 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the setup_folder parameter.
Affected Products: n/a
References: [{'name': '22098', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22098'}, {'name': 'ADV-2007-0230', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0230'}, {'name': 'uberghey-frontpage-file-include(31553)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31553'}, {'name': '20070118 source verify: Uberghey CMS 0.3.1 RFI', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-January/001247.html'}, {'name': '3147', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3147'}]
CVE State: PUBLISHED
Explain CVE-2007-0360
PHP remote file inclusion vulnerability in lang/index.php in Oreon 1.2.3 RC4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.
Affected Products: n/a
References: [{'name': '22107', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22107'}, {'name': 'oreon-index-file-include(31568)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31568'}, {'name': '20070211 Oreon1.2.x Series Exploit Coded', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/459811/100/0/threaded'}, {'name': '33711', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33711'}, {'name': 'ADV-2007-0229', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0229'}, {'name': '3150', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3150'}]
CVE State: PUBLISHED
Explain CVE-2007-0361
PHP remote file inclusion vulnerability in mep/frame.php in PHPMyphorum 1.5a allows remote attackers to execute arbitrary PHP code via a URL in the chem parameter.
Affected Products: n/a
References: [{'name': 'ADV-2007-0231', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0231'}, {'name': '22099', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22099'}, {'name': '3145', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3145'}, {'name': 'phpmyphorum-frame-file-include(31552)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31552'}]
CVE State: PUBLISHED
Explain CVE-2007-0362
Cross-site scripting (XSS) vulnerability in the RSS feed component in FreshReader before 1.0.07010600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to tag attributes.
Affected Products: n/a
References: [{'name': 'JVN#95249468', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/jp/JVN%2395249468/index.html'}, {'name': 'ADV-2007-0241', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0241'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://manual.freshreader.com/archives/2007/01/20070118_javasc.html'}, {'name': '23806', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23806'}, {'name': '22106', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22106'}, {'name': 'freshreader-rssfeed-xss(31566)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31566'}, {'name': '32923', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32923'}]
CVE State: PUBLISHED
Explain CVE-2007-0363
Cross-site scripting (XSS) vulnerability in admin-search.php in (1) Openads for PostgreSQL (aka phpPgAds) before 2.0.10 and (2) Openads (aka phpAdsNew) before 2.0.10 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Affected Products: n/a
References: [{'name': '23720', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23720'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=11386&release_id=479424'}, {'name': '22124', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22124'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=36679&release_id=479426'}, {'name': 'ADV-2007-0240', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0240'}, {'name': 'openads-unspecified-xss(31570)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31570'}]
CVE State: PUBLISHED
Explain CVE-2007-0365
Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.009 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this is probably a different vulnerability than CVE-2006-5830.
Affected Products: n/a
References: [{'name': 'aiocp-unspecified-xss(31486)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31486'}, {'name': '23732', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23732'}, {'name': '32808', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32808'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=478370'}, {'name': 'ADV-2007-0189', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0189'}]
CVE State: PUBLISHED
Explain CVE-2007-0366
Untrusted search path vulnerability in Rumpus 5.1 and earlier allows local users to gain privileges via a modified PATH that points to a malicious ipfw program.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://projects.info-pull.com/moab/MOAB-18-01-2007.html'}, {'name': 'rumpus-path-privilege-escalation(31597)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31597'}, {'name': '23842', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23842'}, {'name': '32690', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32690'}]
CVE State: PUBLISHED
Explain CVE-2007-0367
Rumpus 5.1 and earlier has weak permissions for certain files and directories under /usr/local/Rumpus, including the configuration file, which allows local users to have an unknown impact by creating, modifying, or deleting files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://projects.info-pull.com/moab/MOAB-18-01-2007.html'}, {'name': '32691', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32691'}, {'name': '23842', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/23842'}]
CVE State: PUBLISHED
Explain CVE-2007-0368
Stack-based buffer overflow in mbse-bbs 0.70 and earlier allows local users to execute arbitrary code via a long string in the MBSE_ROOT environment variable.
Affected Products: n/a
References: [{'name': '20070118 mbsebbs 0.70.0 & below local root exploit', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051859.html'}, {'name': 'mbsebbs-mbuseradd-bo(31639)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31639'}, {'name': '3154', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3154'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.mbse.eu/mbse/mbsebbs/index.html'}, {'name': '22112', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22112'}]
CVE State: PUBLISHED
Explain CVE-2007-0369
SQL injection vulnerability in phpBP RC3 (2.204) and earlier allows remote attackers to execute arbitrary SQL commands via the comment forum.
Affected Products: n/a
References: [{'name': '3153', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3153'}, {'name': 'phpbp-comment-sql-injection(31622)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31622'}, {'name': '34763', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34763'}]
CVE State: PUBLISHED
Explain CVE-2007-0370
Unrestricted file upload vulnerability in index.php in phpBP RC3 (2.204) and earlier allows remote administrators to inject arbitrary PHP code into an upload/banners/ file via a banners add operation that uploads the PHP code through an image_form parameter specifying a multiple-extension filename such as .jpg.vil.gif.php, which is stored in upload/banners/ under a different name, and executable via a direct request.  NOTE: a separate SQL injection issue could be leveraged to make this vulnerability reachable by remote unauthenticated attackers.
Affected Products: n/a
References: [{'name': 'phpbp-banner-file-upload(31619)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31619'}, {'name': '3153', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3153'}, {'name': '34762', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34762'}]
CVE State: PUBLISHED
Explain CVE-2007-0371
A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long CCRP_BDc.SelectedFolder property value.
Affected Products: n/a
References: [{'name': '22110', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22110'}, {'name': '3155', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3155'}, {'name': '34647', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34647'}]
CVE State: PUBLISHED
Explain CVE-2007-0372
Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via (1) the active parameter in admin/modules/modules.php; the (2) ad_class, (3) imageurl, (4) clickurl, (5) ad_code, or (6) position parameter in modules/Advertising/admin/index.php; or unspecified vectors in the (7) advertising, (8) weblinks, or (9) reviews section.
Affected Products: n/a
References: [{'name': '33699', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33699'}, {'name': '20070204 Sql injection bugs in PHP-Nuke', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/459174/100/0/threaded'}, {'name': '33698', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33698'}, {'name': '33702', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33702'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'name': '22116', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22116'}, {'name': '33701', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33701'}, {'name': '33700', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33700'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0373
Multiple SQL injection vulnerabilities in Joomla! 1.5.0 Beta allow remote attackers to execute arbitrary SQL commands via (1) the searchword parameter in certain files; the where parameter in (2) plugins/search/content.php or (3) plugins/search/weblinks.php; the text parameter in (4) plugins/search/contacts.php, (5) plugins/search/categories.php, or (6) plugins/search/sections.php; or (7) the email parameter in database/table/user.php, which is not properly handled by the check function.
Affected Products: n/a
References: [{'name': '22122', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22122'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'name': '32528', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32528'}, {'name': '32527', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32527'}, {'name': '20070204 Sql injection bugs in Joomla and Mambo', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/459203/100/0/threaded'}, {'name': '32531', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32531'}, {'name': '32529', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32529'}, {'name': '32533', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32533'}, {'name': '32530', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32530'}, {'name': '32532', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32532'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0374
SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing.
Affected Products: n/a
References: [{'name': '32520', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32520'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'name': '19734', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/19734'}, {'name': '20070204 Sql injection bugs in Joomla and Mambo', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/459203/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0375
Joomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for (1) plugins/user/example.php; (2) gmail.php, (3) example.php, or (4) ldap.php in plugins/authentication/; (5) modules/mod_mainmenu/menu.php; or other unspecified PHP scripts, which reveals the path in various error messages, related to a jimport function call at the beginning of each script.
Affected Products: n/a
References: [{'name': '32522', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32522'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'name': '32526', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32526'}, {'name': '32525', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32525'}, {'name': '20070204 Sql injection bugs in Joomla and Mambo', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/459203/100/0/threaded'}, {'name': '32523', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32523'}, {'name': '32524', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/32524'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0376
Cross-site scripting (XSS) vulnerability in Virtuemart 1.0.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://virtuemart.svn.sourceforge.net/viewvc/%2Acheckout%2A/virtuemart/branches/virtuemart-1_0_0/virtuemart/CHANGELOG.php?revision=607'}, {'name': '24058', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24058'}, {'name': '22123', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22123'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'name': '20070204 Sql injection bugs in Virtuemart and Letterman', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/459195/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0377
Multiple SQL injection vulnerabilities in Xoops 2.0.16 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in kernel/group.php in core, (2) the lid parameter in class/table_broken.php in the Weblinks module, and other unspecified vectors.
Affected Products: n/a
References: [{'name': '20070204 Sql injection bugs in Xoops 2.0.16 + Weblinks module', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/459150/100/0/threaded'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'name': '22399', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22399'}, {'name': '33684', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33684'}, {'name': '33685', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33685'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0378
Multiple SQL injection vulnerabilities in DocMan 1.3 RC2 allow attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '34650', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34650'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0379
Cross-site scripting (XSS) vulnerability in DocMan 1.3 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'name': '34651', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34651'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0380
DocMan 1.3 RC2 allows remote attackers to obtain sensitive information (the full path) via unspecified vectors.
Affected Products: n/a
References: [{'name': '34652', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34652'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0381
Multiple SQL injection vulnerabilities in ATutor 1.5.3.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters.  NOTE: CVE analysis suggests that the vendor fixed these issues.
Affected Products: n/a
References: [{'name': '34660', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34660'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.atutor.ca/atutor/mantis/changelog_page.php'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0382
Multiple SQL injection vulnerabilities in letterman.class.php in the Letterman 1.2.3 (com_letterman) component for Joomla! before 1.0.12 allow remote attackers to execute arbitrary SQL commands via the id parameter, related to the (1) lm_sendMail, (2) saveNewsletter, and (3) cancelNewsletter functions.
Affected Products: n/a
References: [{'name': '33688', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33688'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'name': '22117', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22117'}, {'name': '20070204 Sql injection bugs in Virtuemart and Letterman', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/459195/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0383
WDaemon 9.5.4 allows remote attackers to access the /WorldClient.dll URI on TCP port 3000, which has unknown impact.  NOTE: The researcher reports that the vendor response was "this is not a security bug.
Affected Products: n/a
References: [{'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'name': '34661', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34661'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0384
Cross-site scripting (XSS) vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '35473', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35473'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/?root=postnuke'}, {'name': '22119', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22119'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0385
The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via "unvalidated output" in FAQ/index.php, possibly involving an undefined id_cat variable.
Affected Products: n/a
References: [{'name': '35472', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35472'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/?root=postnuke'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/FAQ/index.php?root=postnuke&r1=20350&r2=20911'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0386
Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug."
Affected Products: n/a
References: [{'name': '35471', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35471'}, {'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0387
SQL injection vulnerability in models/category.php in the Weblinks component for Joomla! SVN 20070118 (com_weblinks) allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Affected Products: n/a
References: [{'name': '20070118 The vulnerabilities festival !', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html'}, {'name': '34792', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34792'}, {'name': '20070204 Sql injection bugs in Joomla and Mambo', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/459203/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hackers.ir/advisories/festival.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-0388
SQL injection vulnerability in search.php in Woltlab Burning Board (wBB) 1.0.2 and earlier, and 2.3.6 and earlier in the 2.x series, allows remote attackers to execute arbitrary SQL commands via the boardids[1] and other boardids[] parameters.
Affected Products: n/a
References: [{'name': '33872', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33872'}, {'name': '3143', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3143'}, {'name': 'wbb-search-sql-injection(31550)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31550'}, {'name': '3144', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3144'}]
CVE State: PUBLISHED
Explain CVE-2007-0389
Directory traversal vulnerability in ArsDigita Community System (ACS) 3.4.10 and earlier, and ArsDigita Community Education Solution (ACES) 1.1, allows remote attackers to read arbitrary files via .%252e/ (double-encoded dot dot slash) sequences in the URI.
Affected Products: n/a
References: [{'name': 'ADV-2007-0286', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0286'}, {'name': 'acs-url-directory-traversal(31613)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31613'}, {'name': '33552', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33552'}, {'name': '22121', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22121'}, {'name': '20070118 Directory Traversal in ArsDigita Community System', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/457318/100/0/threaded'}]
CVE State: PUBLISHED