Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2007-1594
The handle_response function in chan_sip.c in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP Response code 0 in a SIP packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://svn.digium.com/view/asterisk/trunk/channels/chan_sip.c?r1=58907&r2=59038'}, {'name': '23093', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23093'}, {'name': 'ADV-2007-1077', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1077'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.digium.com/view.php?id=9313'}, {'name': '1017809', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017809'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.asterisk.org/node/48338'}, {'name': 'SUSE-SA:2007:034', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_34_asterisk.html'}, {'name': '20070321 Two new DoS Vulnerabilities in Asterisk Fixed', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463434/100/0/threaded'}, {'name': '24579', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24579'}, {'name': 'GLSA-200704-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200704-01.xml'}, {'name': '25582', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25582'}, {'name': '24719', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24719'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sineapps.com/news.php?rssid=1707'}, {'name': '[VOIPSEC] 20070319 Asterisk SDP DOS vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://voipsa.org/pipermail/voipsec_voipsa.org/2007-March/002275.html'}]
CVE State: PUBLISHED
Explain CVE-2007-1595
The Asterisk Extension Language (AEL) in pbx/pbx_ael.c in Asterisk does not properly generate extensions, which allows remote attackers to execute arbitrary extensions and have an unknown impact by specifying an invalid extension in a certain form.
Affected Products: n/a
References: [{'name': '23155', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23155'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.digium.com/view/asterisk?rev=59073&view=rev'}, {'name': 'SUSE-SA:2007:034', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_34_asterisk.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.digium.com/view.php?id=9316'}, {'name': '25582', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25582'}, {'name': '24694', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24694'}, {'name': 'ADV-2007-1123', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1123'}]
CVE State: PUBLISHED
Explain CVE-2007-1596
Multiple PHP remote file inclusion vulnerabilities in the NFN Address Book (com_nfn_addressbook) 0.4 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) components/com_nfn_addressbook/nfnaddressbook.php or (2) administrator/components/com_nfn_addressbook/nfnaddressbook.php.
Affected Products: n/a
References: [{'name': '43554', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/43554'}, {'name': 'ADV-2007-1073', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1073'}, {'name': 'nfnaddressbook-nfnaddressbook-file-include(33133)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33133'}, {'name': '43553', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/43553'}, {'name': '23092', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23092'}, {'name': '3539', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3539'}]
CVE State: PUBLISHED
Explain CVE-2007-1597
Unclassified NewsBoard 1.6.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain (1) the board log via a direct request for logs/board-YYYY-MM-DD.log, (2) the mail and private message (PM) log via a direct request for logs/email-YY-MM-DD-HH-MM-SS.log, (3) the SQL error message log via a direct request for logs/error-YY-MM.log, and (4) the IP log via a direct request for logs/ip.log.
Affected Products: n/a
References: [{'name': '35201', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35201'}, {'name': 'unb-log-information-disclosure(33150)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33150'}, {'name': '20070319 Unclassified NewsBoard 1.6.3 multiples logs disclosure', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463186/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1598
Stack-based buffer overflow in InterVations FileCOPA FTP Server 1.01 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by filecopa.tar by Immunity.  NOTE: some of these details are obtained from third party information.  NOTE: As of 20070322, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes.
Affected Products: n/a
References: [{'name': '23056', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23056'}, {'name': 'filecopa-unspecified-bo(33462)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33462'}, {'name': '43559', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/43559'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.immunitysec.com/partners-index.shtml'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.immunityinc.com/downloads/immpartners/filecopa.tar'}]
CVE State: PUBLISHED
Explain CVE-2007-1599
wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive information via the redirect_to parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.metaeye.org/advisories/40'}, {'name': '30960', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30960'}, {'name': '20070320 Advisory - Redirection Vulnerability in wp-login.php.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463291/100/0/threaded'}, {'name': 'DSA-1601', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1601'}]
CVE State: PUBLISHED
Explain CVE-2007-1600
PHP remote file inclusion vulnerability in module.php in Digital Eye Gallery 1.1 Beta (aka 0.1.1b) allows remote attackers to execute arbitrary PHP code via a URL in the menu parameter.
Affected Products: n/a
References: [{'name': '37241', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37241'}, {'name': '23083', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23083'}, {'name': 'digital-eye-module-file-include(33115)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33115'}, {'name': '3533', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3533'}, {'name': 'ADV-2007-1070', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1070'}]
CVE State: PUBLISHED
Explain CVE-2007-1601
Directory traversal vulnerability in check_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the order parameter.  NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows opening files
Affected Products: n/a
References: [{'name': '20070313 Re: Weekly Drawing Contest <= (check_vote.php) Remote File Disclosure Vuln', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/462702/100/100/threaded'}, {'name': '2453', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2453'}, {'name': '35148', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35148'}, {'name': '20070313 Weekly Drawing Contest <= (check_vote.php) Remote File Disclosure Vuln', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/462663/100/100/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1602
SQL injection vulnerability in check_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to execute arbitrary SQL commands via the order parameter.
Affected Products: n/a
References: [{'name': '20070313 Re: Weekly Drawing Contest <= (check_vote.php) Remote File Disclosure Vuln', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/462702/100/100/threaded'}, {'name': '2453', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2453'}]
CVE State: PUBLISHED
Explain CVE-2007-1603
admin/contest.php in Weekly Drawing Contest 0.0.1 allows remote attackers to bypass authentication, and insert new contest information into a database, via a direct POST request.
Affected Products: n/a
References: [{'name': '20070313 Re: Weekly Drawing Contest <= (check_vote.php) Remote File Disclosure Vuln', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/462702/100/100/threaded'}, {'name': '2453', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2453'}]
CVE State: PUBLISHED
Explain CVE-2007-1604
Multiple unrestricted file upload vulnerabilities in w-Agora (Web-Agora) allow remote attackers to upload and execute arbitrary PHP code (1) via a forum message with an attached file, which is stored under forums/hello/hello/notes/ or (2) by using browse_avatar.php to upload a file with a double extension, as demonstrated by .php.jpg.
Affected Products: n/a
References: [{'name': '20070320 w-agora [multiples file upload,xss,full path disclosure,error sql]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463286/100/0/threaded'}, {'name': 'wagora-browseavatar-file-upload(33173)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33173'}, {'name': '23055', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23055'}, {'name': '2462', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2462'}, {'name': '34384', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34384'}, {'name': '24605', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24605'}, {'name': '34383', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34383'}]
CVE State: PUBLISHED
Explain CVE-2007-1605
w-Agora (Web-Agora) allows remote attackers to obtain sensitive information via a request to rss.php with an invalid (1) site or (2) bn parameter, (3) a certain value of the site[] parameter, or (4) an empty value of the bn[] parameter; a request to index.php with a certain value of the (5) site[] or (6) sort[] parameter; (7) a request to profile.php with an empty value of the site[] parameter; or a request to search.php with (8) an empty value of the bn[] parameter or a certain value of the (9) pattern[] or (10) search_date[] parameter, which reveal the path in various error messages, probably related to variable type inconsistencies.  NOTE: the bn[] parameter to index.php is already covered by CVE-2007-0606.1.
Affected Products: n/a
References: [{'name': '34381', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34381'}, {'name': '34382', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34382'}, {'name': '20070320 w-agora [multiples file upload,xss,full path disclosure,error sql]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463286/100/0/threaded'}, {'name': 'wagora-multiple-path-disclosure(33174)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33174'}, {'name': '2462', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2462'}, {'name': '34380', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34380'}, {'name': '24605', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24605'}, {'name': '23057', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23057'}]
CVE State: PUBLISHED
Explain CVE-2007-1606
Multiple cross-site scripting (XSS) vulnerabilities in w-Agora (Web-Agora) allow remote attackers to inject arbitrary web script or HTML via (1) the showuser parameter to profile.php, the (2) search_forum or (3) search_user parameter to search.php, or (4) the userid parameter to change_password.php.
Affected Products: n/a
References: [{'name': '34379', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34379'}, {'name': '20070320 w-agora [multiples file upload,xss,full path disclosure,error sql]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463286/100/0/threaded'}, {'name': 'wagora-multiple-xss(33175)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33175'}, {'name': '34378', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34378'}, {'name': '2462', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2462'}, {'name': '34377', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34377'}, {'name': '24605', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24605'}, {'name': '23057', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23057'}]
CVE State: PUBLISHED
Explain CVE-2007-1607
search.php in w-Agora (Web-Agora) allows remote attackers to obtain potentially sensitive information via a ' (quote) value followed by certain SQL sequences in the (1) search_forum or (2) search_user parameter, which force a SQL error.
Affected Products: n/a
References: [{'name': 'wagora-search-sql-injection(33177)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33177'}, {'name': '20070320 w-agora [multiples file upload,xss,full path disclosure,error sql]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463286/100/0/threaded'}, {'name': '2462', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2462'}, {'name': '24605', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24605'}, {'name': '23057', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23057'}, {'name': '34376', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34376'}]
CVE State: PUBLISHED
Explain CVE-2007-1608
CRLF injection vulnerability in IBM WebSphere Application Server (WAS) before 6.0.2.19 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a single CRLF sequence in a context that is not a valid multi-line header.
Affected Products: n/a
References: [{'name': '34484', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34484'}, {'name': 'PK39732', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1PK39732'}, {'name': 'ADV-2007-1062', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1062'}, {'name': '23086', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23086'}, {'name': 'websphere-unspecified-response-splitting(33123)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33123'}, {'name': '24552', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24552'}, {'name': '1017806', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017806'}]
CVE State: PUBLISHED
Explain CVE-2007-1609
Cross-site scripting (XSS) vulnerability in servlet/Spy in Dynamic Monitoring Services (DMS) in Oracle Application Server (OAS) 10g 10.1.2.0.0 allows remote attackers to inject arbitrary web script or HTML via the table parameter.  NOTE: This may be related to CVE-2002-0563.
Affected Products: n/a
References: [{'name': '2474', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2474'}, {'name': '20080905 Re: Oracle 10g Dynamic Monitoring Services XSS /servlet/Spy', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/496045/100/0/threaded'}, {'name': '33521', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/33521'}, {'name': 'ADV-2007-1078', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1078'}, {'name': '24554', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24554'}, {'name': 'oracle-dynamicmonitoring-xss(33146)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33146'}, {'name': '23102', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23102'}, {'name': '20070320 Oracle 10g Dynamic Monitoring Services XSS /servlet/Spy', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463285/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1610
Cross-site scripting (XSS) vulnerability in the RSS reader in Glue Software NewsGlue before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via a feed.
Affected Products: n/a
References: [{'name': 'newsglue-rss-feed-xss(33166)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33166'}, {'name': 'ADV-2007-1074', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1074'}, {'name': '23094', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23094'}, {'name': '34408', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34408'}, {'name': 'JVN#64227086', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/jp/JVN%2364227086/index.html'}, {'name': '24603', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24603'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gluesoft.co.jp/NewsGlue/Update.aspx'}]
CVE State: PUBLISHED
Explain CVE-2007-1611
Cross-site scripting (XSS) vulnerability in the RSS reader in a certain SOURCENEXT product, probably IKANARI JIJYOU 1.0.0 and 1.0.1, allows remote attackers to inject arbitrary web script or HTML via the title of an article in a feed.
Affected Products: n/a
References: [{'name': 'ikanarijijyou-rss-feed-xss(33452)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33452'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sourcenext.info/download/jijou.html'}, {'name': 'JVN#64227086', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/jp/JVN%2364227086/index.html'}]
CVE State: PUBLISHED
Explain CVE-2007-1612
SQL injection vulnerability in index.php in Katalog Plyt Audio 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the kolumna parameter.
Affected Products: n/a
References: [{'name': '3513', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3513'}, {'name': '24539', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24539'}, {'name': '34269', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34269'}, {'name': 'katalog-index-sql-injection(33048)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33048'}, {'name': '23024', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23024'}, {'name': 'ADV-2007-1015', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1015'}]
CVE State: PUBLISHED
Explain CVE-2007-1613
Directory traversal vulnerability in view.php in MPM Chat 2.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the logi parameter.
Affected Products: n/a
References: [{'name': '3503', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3503'}, {'name': 'ADV-2007-1008', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1008'}, {'name': '34278', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34278'}, {'name': '24576', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24576'}, {'name': '23009', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23009'}]
CVE State: PUBLISHED
Explain CVE-2007-1614
Stack-based buffer overflow in the zzip_open_shared_io function in zzip/file.c in ZZIPlib Library before 0.13.49 allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long filename.
Affected Products: n/a
References: [{'name': 'ADV-2007-0998', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0998'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securitylab.ru/forum/read.php?FID=21&TID=40858&MID=326187'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=6389&release_id=494587'}, {'name': '24708', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24708'}, {'name': 'MDKSA-2007:093', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:093'}, {'name': '23013', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23013'}, {'name': '33838', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/33838'}, {'name': '24586', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24586'}, {'name': 'GLSA-200704-05', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200704-05.xml'}]
CVE State: PUBLISHED
Explain CVE-2007-1615
SQL injection vulnerability in index.php in ScriptMagix Jokes 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Affected Products: n/a
References: [{'name': 'ADV-2007-1012', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1012'}, {'name': 'scriptmagixjokes-index-sql-injection(33063)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33063'}, {'name': '24595', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24595'}, {'name': '23015', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23015'}, {'name': '3509', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3509'}]
CVE State: PUBLISHED
Explain CVE-2007-1616
SQL injection vulnerability in index.php in ScriptMagix Lyrics 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the recid parameter.
Affected Products: n/a
References: [{'name': '23019', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23019'}, {'name': '24563', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24563'}, {'name': '34283', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34283'}, {'name': '3515', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3515'}, {'name': 'ADV-2007-1016', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1016'}, {'name': 'scriptmagixlyrics-index-sql-injection(33056)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33056'}]
CVE State: PUBLISHED
Explain CVE-2007-1617
SQL injection vulnerability in index.php in ScriptMagix Recipes 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Affected Products: n/a
References: [{'name': '24594', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24594'}, {'name': '34286', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34286'}, {'name': '3510', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3510'}, {'name': 'ADV-2007-1013', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1013'}]
CVE State: PUBLISHED
Explain CVE-2007-1618
SQL injection vulnerability in index.php in ScriptMagix FAQ Builder 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Affected Products: n/a
References: [{'name': 'ADV-2007-1011', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1011'}, {'name': '3507', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3507'}, {'name': '34619', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34619'}, {'name': '24704', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24704'}]
CVE State: PUBLISHED
Explain CVE-2007-1619
SQL injection vulnerability in viewcomments.php in ScriptMagix Photo Rating 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the phid parameter.
Affected Products: n/a
References: [{'name': 'ADV-2007-1014', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1014'}, {'name': 'scriptmagixphoto-viewcomments-sql-injection(33061)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33061'}, {'name': '3511', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3511'}, {'name': '23018', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23018'}, {'name': '24698', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24698'}, {'name': '34629', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34629'}]
CVE State: PUBLISHED
Explain CVE-2007-1620
Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SESSION[SITE_PATH] parameter to (a) wind/help.php or (b) wind/about.php, or the (2) _SESSION[DRIVER] parameter to (c) db/session.php.
Affected Products: n/a
References: [{'name': '37212', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37212'}, {'name': '3501', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3501'}, {'name': '37210', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37210'}, {'name': '37211', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37211'}, {'name': 'phpdbdesigner-multiple-script-file-include(33033)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33033'}, {'name': 'ADV-2007-1007', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1007'}]
CVE State: PUBLISHED
Explain CVE-2007-1621
PHP remote file inclusion vulnerability in templates/head.php in Active PHP Bookmark Notes (APB) 0.2.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the APB_SETTINGS[template_path] parameter.  NOTE: this issue might be related to CVE-2003-1254.
Affected Products: n/a
References: [{'name': '3504', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3504'}, {'name': '23010', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23010'}, {'name': 'apbn-head-file-include(33065)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33065'}, {'name': '37226', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37226'}, {'name': 'ADV-2007-1009', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1009'}]
CVE State: PUBLISHED
Explain CVE-2007-1622
Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF.
Affected Products: n/a
References: [{'name': 'ADV-2007-1005', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1005'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.buayacorp.com/files/wordpress/wordpress-advisory.txt'}, {'name': '23027', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23027'}, {'name': '25108', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25108'}, {'name': '24567', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24567'}, {'name': 'DSA-1285', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2007/dsa-1285'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sla.ckers.org/forum/read.php?2%2C7935#msg-8006'}]
CVE State: PUBLISHED
Explain CVE-2007-1623
Multiple cross-site scripting (XSS) vulnerabilities in realGuestbook 5.01, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) bg_color_1, (2) fs_menu, (3) fc_menu, (4) ff_menu, (5) bg_color_2, (6) fs_normal, (7) fc_normal, and (8) ff_normal parameters to welcome_admin.php; and possibly unspecified other parameters and files.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '24602', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24602'}, {'name': '34341', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/34341'}]
CVE State: PUBLISHED
Explain CVE-2007-1624
Multiple SQL injection vulnerabilities in realGuestbook 5.01 allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) homepage, and (4) text parameters to save_entry.php, as reachable through add_entry.php; and possibly other unspecified parameters and files.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '24602', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24602'}, {'name': '23072', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23072'}, {'name': 'ADV-2007-1060', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1060'}, {'name': '34342', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/34342'}]
CVE State: PUBLISHED
Explain CVE-2007-1625
Cross-site scripting (XSS) vulnerability in save_entry.php in realGuestbook 5.01 allows remote attackers to inject arbitrary web script or HTML via the homepage parameter, as reachable through add_entry.php.  NOTE: the original report stated that the vulnerability was in add_entry.php, which does not receive the input data.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://trew.icenetx.net/toolz/advisory-realGuestbook_V5-en.txt'}, {'name': '24602', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24602'}, {'name': '23072', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23072'}, {'name': 'ADV-2007-1060', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1060'}, {'name': '34343', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/34343'}]
CVE State: PUBLISHED
Explain CVE-2007-1626
PHP remote file inclusion vulnerability in iframe.php in the iFrame Module for PHP-NUKE allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.
Affected Products: n/a
References: [{'name': 'iframe-iframe-file-include(33060)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33060'}, {'name': '37222', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37222'}, {'name': '3512', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3512'}, {'name': '23038', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23038'}]
CVE State: PUBLISHED
Explain CVE-2007-1628
Multiple PHP remote file inclusion vulnerabilities in Study planner (Studiewijzer) 0.15 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the SPL_CFG[dirroot] parameter to (1) service.alert.inc.php or (2) settings.ses.php in inc/; (3) db/mysql/db.inc.php; (4) integration/shortstat/configuration.php; (5) ali.class.php or (6) cat.class.php in methodology/traditional/class/; (7) cat_browse.inc.php, (8) chr_browse.inc.php, (9) chr_display.inc.php, or (10) dash_browse.inc.php in methodology/traditional/ui/inc/; (11) spl.webservice.php or (12) konfabulator/gateway_admin.php in ws/; or other unspecified files.
Affected Products: n/a
References: [{'name': 'studyplanner-multiple-scripts-file-include(33128)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33128'}, {'name': 'ADV-2007-1069', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1069'}, {'name': '20070322 [ECHO_ADV_77$2007] Study planner (Studiewijzer) <= 0.15 Remote File Inclusion Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463491/100/0/threaded'}, {'name': '23076', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23076'}, {'tags': ['x_refsource_MISC'], 'url': 'http://advisories.echo.or.id/adv/adv77-K-159-2007.txt'}, {'name': '3532', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3532'}]
CVE State: PUBLISHED
Explain CVE-2007-1629
SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Photo Gallery allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Affected Products: n/a
References: [{'name': '23077', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23077'}, {'name': 'ADV-2007-1072', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1072'}, {'name': 'active-default-sql-injection(33129)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33129'}, {'name': '3536', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3536'}, {'name': '24568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24568'}]
CVE State: PUBLISHED
Explain CVE-2007-1630
SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Link Engine allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Affected Products: n/a
References: [{'name': '3534', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3534'}, {'name': 'active-link-default-sql-injection(33111)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33111'}, {'name': 'ADV-2007-1071', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1071'}, {'name': '34364', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/34364'}, {'name': '23080', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23080'}, {'name': '24574', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24574'}]
CVE State: PUBLISHED
Explain CVE-2007-1631
PHP remote file inclusion vulnerability in signup.php in CLBOX 1.01 allows remote attackers to execute arbitrary PHP code via a URL in the header parameter.  NOTE: this issue has been disputed by a reliable third party, stating that header is defined through an include file before use
Affected Products: n/a
References: [{'name': '20070317 CLBOX <= (signup.php header) Remote File Include Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463076/100/0/threaded'}, {'name': '33503', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/33503'}, {'name': '20070319 Bogus - [CLBOX <= (signup.php header) Remote File Include Vulnerability]', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-March/001443.html'}, {'name': '2469', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2469'}]
CVE State: PUBLISHED
Explain CVE-2007-1632
Unspecified vulnerability in TYPOlight webCMS before 2.2 Build 5 has unknown impact and attack vectors related to a "major security hole."
Affected Products: n/a
References: [{'name': '24546', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24546'}, {'name': 'ADV-2007-1026', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.typolight.org/changelog.html'}, {'name': '33303', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/33303'}]
CVE State: PUBLISHED
Explain CVE-2007-1633
Directory traversal vulnerability in bbcode_ref.php in the Giorgio Ciranni Splatt Forum 4.0 RC1 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by bbcode_ref.php.
Affected Products: n/a
References: [{'name': '38599', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38599'}, {'name': 'ADV-2007-1027', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1027'}, {'name': '23035', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23035'}, {'name': '3518', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3518'}]
CVE State: PUBLISHED
Explain CVE-2007-1634
Variable extraction vulnerability in grab_globals.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote attackers to conduct SQL injection attacks via the _FILES[DB][tmp_name] parameter to print.php, which overwrites the $DB variable with dynamic variable evaluation.
Affected Products: n/a
References: [{'name': '20070323 Root cause of NPDS SQL injection is variable extraction/evaluation', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-March/001460.html'}, {'name': '24571', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24571'}, {'name': '20070318 Net Portal Dynamic System (NPDS) <= 5.10 Remote Code Execution 0day', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463176/100/0/threaded'}, {'name': '2473', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2473'}]
CVE State: PUBLISHED
Explain CVE-2007-1635
Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote authenticated users to inject arbitrary PHP code via the xtop parameter in a "ConfigSave" op to admin.php, which can later be accessed via a "Configure" op to admin.php.
Affected Products: n/a
References: [{'name': '24571', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24571'}, {'name': '20070318 Net Portal Dynamic System (NPDS) <= 5.10 Remote Code Execution 0day', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/463176/100/0/threaded'}, {'name': '2473', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2473'}, {'name': '34303', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34303'}]
CVE State: PUBLISHED
Explain CVE-2007-1636
Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the op parameter, as demonstrated by injecting PHP code into Apache log files via the URL and User-Agent HTTP header.
Affected Products: n/a
References: [{'name': 'ADV-2007-1094', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1094'}, {'name': '38601', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/38601'}, {'name': '3548', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3548'}, {'name': 'roseonlinecms-index-file-include(33185)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33185'}, {'name': '23108', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23108'}]
CVE State: PUBLISHED
Explain CVE-2007-1637
Multiple buffer overflows in the IMAILAPILib ActiveX control (IMailAPI.dll) in Ipswitch IMail Server before 2006.2 allow remote attackers to execute arbitrary code via the (1) WebConnect and (2) Connect members in the (a) IMailServer control; (3) Sync3 and (4) Init3 members in the (b) IMailLDAPService control; and the (5) SetReplyTo member in the (c) IMailUserCollection control.
Affected Products: n/a
References: [{'name': 'ADV-2007-0853', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0853'}, {'name': '24422', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24422'}, {'name': '20070307 Ipswitch IMail Server 2006 Multiple ActiveX Control Buffer Overflow Vulnerabilitie', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=487'}, {'name': '1017737', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017737'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.ipswitch.com/kb/IM-20070305-JH01.htm'}]
CVE State: PUBLISHED
Explain CVE-2007-1638
Multiple cross-site request forgery (CSRF) vulnerabilities in the check_csrftoken function in lib/lib.inc.php in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allow remote attackers to perform unauthorized actions as an arbitrary user via the (1) Projects, (2) Contacts, (3) Helpdesk, (4) Notes, (5) Search, (6) Mail, or (7) Filemanager module; the (9) summary page; or unspecified other files.
Affected Products: n/a
References: [{'name': '20070314 n.runs-SA-2007.005 - PHProjekt 5.2.0 - Cross Site Request Forgery', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/462786/100/100/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nruns.de/security_advisory_phprojekt_csrf.php'}, {'name': '35162', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35162'}, {'name': '24509', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24509'}, {'name': '2477', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2477'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phprojekt.com/index.php?name=News&file=article&sid=276'}, {'name': 'phprojekt-multiple-modules-csrf(32989)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32989'}, {'name': 'GLSA-200706-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200706-07.xml'}, {'name': '25748', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25748'}]
CVE State: PUBLISHED
Explain CVE-2007-1639
Unrestricted file upload vulnerability in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allows remote authenticated users to upload and execute arbitrary PHP code via a file with an executable extension, which is then accessed by the (1) calendar or (2) file management module, or possibly unspecified other files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.nruns.de/security_advisory_phprojekt_privilege_escalation.php'}, {'name': '20070314 n.runs-SA-2007.006 - PHProjekt 5.2.0 - Privilege escalation', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/462785/100/100/threaded'}, {'name': '22956', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/22956'}, {'name': '24509', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24509'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phprojekt.com/index.php?name=News&file=article&sid=276'}, {'name': 'phprojekt-calendarfile-file-upload(32995)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/32995'}, {'name': '2476', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2476'}, {'name': 'GLSA-200706-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200706-07.xml'}, {'name': '35163', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35163'}, {'name': '25748', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25748'}]
CVE State: PUBLISHED