Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2007-1829
Multiple unspecified vulnerabilities in web-app.net WebAPP have unknown impact and attack vectors, described as "[having] other [security] issues too, not as bad as letting users take over your admin account, but bad too."
Affected Products: n/a
References: [{'name': '35213', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35213'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.net/cgi-bin/index.cgi?action=forum&board=public_security&op=display&num=10380'}]
CVE State: PUBLISHED
Explain CVE-2007-1830
Unspecified vulnerability in the Username Hijacking Patch 20070312 for web-app.org WebAPP 0.9.9.6 allows remote attackers to obtain administrative access via unknown vectors, related to "something overlooked in the original that was still overlooked in the patch", and possibly related to copying files to the user-lib and the "XSS and cookies exploit."
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.web-app.net/cgi-bin/index.cgi?action=viewnews&id=20'}, {'name': '35212', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35212'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=259'}]
CVE State: PUBLISHED
Explain CVE-2007-1831
web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to open files and write "wrong data" via a crafted QUERY_STRING.
Affected Products: n/a
References: [{'name': 'ADV-2007-0720', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0720'}, {'name': '20070322 WebAPP Audit', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-March/001455.html'}, {'name': '24227', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24227'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=252'}, {'name': '45395', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/45395'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=254'}]
CVE State: PUBLISHED
Explain CVE-2007-1832
web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to upload certain files (1) via a crafted filename or (2) by "using percent encoding in forms."
Affected Products: n/a
References: [{'name': 'ADV-2007-0720', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/0720'}, {'name': '20070322 WebAPP Audit', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2007-March/001455.html'}, {'name': '24227', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24227'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=252'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=254'}]
CVE State: PUBLISHED
Explain CVE-2007-1833
The Skinny Call Control Protocol (SCCP) implementation in Cisco Unified CallManager (CUCM) 3.3 before 3.3(5)SR2a, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3)SR1, and 5.0 before 5.0(4a)SU1 allows remote attackers to cause a denial of service (loss of voice services) by sending crafted packets to the (1) SCCP (2000/tcp) or (2) SCCPS (2443/tcp) port.
Affected Products: n/a
References: [{'name': '1017826', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017826'}, {'name': 'cisco-callmanager-sccp-dos(33295)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33295'}, {'name': '24665', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24665'}, {'name': 'ADV-2007-1144', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1144'}, {'name': '20070328 Multiple Cisco Unified CallManager and Presence Server Denial of Service Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/warp/public/707/cisco-sa-20070328-voip.shtml'}, {'name': '23181', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23181'}]
CVE State: PUBLISHED
Explain CVE-2007-1834
Cisco Unified CallManager (CUCM) 5.0 before 5.0(4a)SU1 and Cisco Unified Presence Server (CUPS) 1.0 before 1.0(3) allow remote attackers to cause a denial of service (loss of voice services) via a flood of ICMP echo requests, aka bug ID CSCsf12698.
Affected Products: n/a
References: [{'name': '1017826', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1017826'}, {'name': 'ADV-2007-1144', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1144'}, {'name': '20070328 Multiple Cisco Unified CallManager and Presence Server Denial of Service Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/warp/public/707/cisco-sa-20070328-voip.shtml'}, {'name': 'cisco-callmanager-presence-icmp-dos(33299)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33299'}, {'name': '23181', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23181'}, {'name': '24690', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24690'}]
CVE State: PUBLISHED
Explain CVE-2007-1835
PHP 4 before 4.4.5 and PHP 5 before 5.2.1, when using an empty session save path (session.save_path), uses the TMPDIR default after checking the restrictions, which allows local users to bypass open_basedir restrictions.
Affected Products: n/a
References: [{'name': 'ADV-2007-1991', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1991'}, {'name': 'SSRT071423', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506'}, {'name': 'HPSBTU02232', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137'}, {'name': 'SSRT071429', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.php-security.org/MOPB/MOPB-36-2007.html'}, {'name': 'ADV-2007-2374', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/2374'}, {'name': 'php-sessionsavepath-restriction-bypass(33550)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33550'}, {'name': '25423', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25423'}, {'name': 'HPSBMA02215', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506'}, {'name': '25850', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25850'}, {'name': '23183', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23183'}]
CVE State: PUBLISHED
Explain CVE-2007-1836
The command line administration interface in Data Domain OS before 4.0.3.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in certain arguments to various commands, as demonstrated by the interface argument to the (1) ifconfig and (2) ping commands.
Affected Products: n/a
References: [{'name': '23182', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23182'}, {'name': '24666', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24666'}, {'name': '34537', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34537'}, {'name': '2516', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2516'}, {'name': '20070328 Arbitrary Command Execution in DataDomain Administrator Interface', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464085/100/0/threaded'}, {'name': 'datadomain-admininterface-command-execution(33291)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33291'}]
CVE State: PUBLISHED
Explain CVE-2007-1837
Multiple PHP remote file inclusion vulnerabilities in MangoBery CMS 0.5.5 allow remote attackers to execute arbitrary PHP code via a URL in the Site_Path parameter to (1) boxes/quotes.php or (2) templates/mangobery/footer.sample.php.
Affected Products: n/a
References: [{'name': '3598', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3598'}, {'name': 'mangoberycms-quotes-file-include(33290)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33290'}, {'name': 'ADV-2007-1147', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1147'}, {'name': '24686', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24686'}, {'name': '23187', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23187'}, {'name': '34510', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34510'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mangobery.svn.sourceforge.net/viewvc/mangobery?view=rev&revision=70'}, {'name': '34509', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34509'}]
CVE State: PUBLISHED
Explain CVE-2007-1838
SQL injection vulnerability in view.php in the Friendfinder 3.3 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '3597', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3597'}, {'name': '20070329 Xoops Module Friendfinder <= 3.3 (view.php id) BLIND SQL Injection Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464153/100/0/threaded'}, {'name': '23184', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23184'}, {'name': 'ADV-2007-1146', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1146'}, {'name': 'xoops-friendfinder-view-sql-injection(33292)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33292'}]
CVE State: PUBLISHED
Explain CVE-2007-1839
Multiple PHP remote file inclusion vulnerabilities in CodeBB 1.1b3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) pass_code.php or (2) lang_select.
Affected Products: n/a
References: [{'name': 'codebb-passcode-file-include(33293)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33293'}, {'name': '23185', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23185'}, {'name': '35423', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35423'}, {'name': '3599', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3599'}, {'name': 'ADV-2007-1148', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1148'}, {'name': '35422', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35422'}]
CVE State: PUBLISHED
Explain CVE-2007-1840
lib/modules.inc in LDAP Account Manager (LAM) before 1.3.0 does not escape HTML special characters in LDAP data, which allows remote attackers to have an unknown impact, probably cross-site scripting (XSS).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://lam.cvs.sourceforge.net/lam/lam/lib/modules.inc?r1=1.173&r2=1.174'}, {'name': 'DSA-1287', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.us.debian.org/security/2007/dsa-1287'}, {'name': 'ADV-2007-1149', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1149'}, {'name': '25157', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25157'}, {'name': '23190', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23190'}, {'name': 'lam-htmlchar-xss(33307)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33307'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lam.sourceforge.net/changelog/index.htm'}, {'name': '24687', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24687'}]
CVE State: PUBLISHED
Explain CVE-2007-1841
The isakmp_info_recv function in src/racoon/isakmp_inf.c in racoon in Ipsec-tools before 0.6.7 allows remote attackers to cause a denial of service (tunnel crash) via crafted (1) DELETE (ISAKMP_NPTYPE_D) and (2) NOTIFY (ISAKMP_NPTYPE_N) messages.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:10504', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10504'}, {'name': 'GLSA-200705-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200705-09.xml'}, {'name': '23394', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23394'}, {'name': 'ADV-2007-1310', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1310'}, {'name': '25322', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25322'}, {'name': 'USN-450-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-450-1'}, {'name': '24826', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24826'}, {'name': 'MDKSA-2007:084', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:084'}, {'name': 'ipsectools-isakmpinforecv-dos(33541)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33541'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=499192&group_id=74601'}, {'name': '24815', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24815'}, {'name': '1018086', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1018086'}, {'name': '[Ipsec-tools-devel] 20070406 Ipsec-tools 0.6.7 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://sourceforge.net/mailarchive/message.php?msg_name=20070406123739.GA1546%40zen.inc'}, {'name': '25560', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25560'}, {'name': 'SUSE-SR:2007:008', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_8_sr.html'}, {'name': '24833', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24833'}, {'name': 'DSA-1299', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2007/dsa-1299'}, {'name': 'RHSA-2007:0342', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2007-0342.html'}, {'name': '25072', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25072'}, {'name': '25142', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25142'}]
CVE State: PUBLISHED
Explain CVE-2007-1842
Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the table parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, a related issue to CVE-2006-2019.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://kldp.net/plugins/scmcvs/cvsweb.php/jsboard-2/login.php.diff?r1=1.8%3Br2=1.9%3Bcvsroot=jsboard'}, {'name': '3614', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3614'}, {'name': '37365', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37365'}, {'name': 'jsboard-login-file-include(33338)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33338'}, {'name': '23223', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23223'}, {'name': 'ADV-2007-1182', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1182'}]
CVE State: PUBLISHED
Explain CVE-2007-1843
PHP remote file inclusion vulnerability in gmapfactory/params.php in MapLab 2.2.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the gszAppPath parameter.
Affected Products: n/a
References: [{'name': 'ADV-2007-1203', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1203'}, {'name': '20070402 Maplab <= 2.2.1 (gszAppPath) Remote File Inclusion Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464462/100/0/threaded'}, {'name': '20070402 Re: Maplab <= 2.2.1 (gszAppPath) Remote File InclusionVulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464490/100/0/threaded'}, {'name': '3638', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3638'}, {'name': '34620', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34620'}, {'name': '23249', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23249'}, {'name': 'maplab-params-file-include(33360)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33360'}, {'name': '20070402 Re: Maplab <= 2.2.1 (gszAppPath) Remote File Inclusion Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464503/100/0/threaded'}, {'name': '24715', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24715'}]
CVE State: PUBLISHED
Explain CVE-2007-1844
Multiple PHP remote file inclusion vulnerabilities in Aardvark Topsites PHP 5 allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) button/settings_sql.php, (2) settings_sql.php, and (3) sources/misc/new_day.php.
Affected Products: n/a
References: [{'name': '35224', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35224'}, {'name': 'aardvark-settingssql-newday-file-include(33342)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33342'}, {'name': '35223', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35223'}, {'name': '35225', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35225'}, {'name': '2515', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2515'}, {'name': '20070331 Remot File Include In Aardvark Topsites PHP 5', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464351/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1845
SQL injection vulnerability in show_event.php in the Expanded Calendar (calendar_panel) 2.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the m_month parameter.
Affected Products: n/a
References: [{'name': '2514', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2514'}, {'name': "20070331 PHP-Fusion 'Calendar_Panel' Module show_event.PHP (m_month) SQL Injection Exploit And PoC", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464348/100/0/threaded'}, {'name': 'phpfusion-showevent-sql-injection(33336)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33336'}, {'name': '36310', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/36310'}, {'name': '24718', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24718'}, {'name': '23225', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23225'}, {'name': 'ADV-2007-1191', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1191'}]
CVE State: PUBLISHED
Explain CVE-2007-1846
SQL injection vulnerability in index.php in the MyAds 2.04jp and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter, different vectors than CVE-2006-3341.
Affected Products: n/a
References: [{'name': '23212', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23212'}, {'name': '3603', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3603'}, {'name': '37372', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37372'}, {'name': 'xoops-myads-index-sql-injection(33334)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33334'}]
CVE State: PUBLISHED
Explain CVE-2007-1847
SQL injection vulnerability in viewcat.php in the Repository module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Affected Products: n/a
References: [{'name': 'xoops-viewcatphp-sql-injection(33344)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33344'}, {'name': '37373', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/37373'}, {'name': '3612', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3612'}, {'name': '23221', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23221'}]
CVE State: PUBLISHED
Explain CVE-2007-1848
Cross-site scripting (XSS) vulnerability in admin/classes/ui.dta.php in Drake CMS allows remote attackers to inject arbitrary web script or HTML via the desc[][title] field.  NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports valid until the first official release of Drake CMS."
Affected Products: n/a
References: [{'name': 'drakecms-uidta-xss(33332)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33332'}, {'name': '23216', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23216'}, {'name': '20070330 DrakeCMS multiple vulerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464272/100/0/threaded'}, {'name': '2522', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2522'}]
CVE State: PUBLISHED
Explain CVE-2007-1849
Directory traversal vulnerability in 404.php in Drake CMS allows remote attackers to include and execute arbitrary local arbitrary files via a .. (dot dot) in the d_private parameter.  NOTE: some of these details are obtained from third party information.  NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports valid until the first official release of Drake CMS."
Affected Products: n/a
References: [{'name': '23215', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23215'}, {'name': 'drakecms-dprivate-file-include(33331)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33331'}, {'name': '20070330 DrakeCMS multiple vulerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464272'}]
CVE State: PUBLISHED
Explain CVE-2007-1850
Directory traversal vulnerability in classes/captcha/captcha.jpg.php in Drake CMS allows remote attackers to read arbitrary files or list arbitrary directories, and obtain the installation path, via a .. (dot dot) in the d_private parameter.  NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports valid until the first official release of Drake CMS."
Affected Products: n/a
References: [{'name': 'drakecms-dprivate-directory-traversal(33333)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33333'}, {'name': '20070330 DrakeCMS multiple vulerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464272/100/0/threaded'}, {'name': '2522', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2522'}]
CVE State: PUBLISHED
Explain CVE-2007-1851
Multiple directory traversal vulnerabilities in Really Simple PHP and Ajax (RSPA) 2007-03-23 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the __class parameter to (1) Controller_v4.php or (2) Controller_v5.php.
Affected Products: n/a
References: [{'name': '24671', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24671'}, {'name': 'rspa-class-file-include(33357)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33357'}, {'name': 'ADV-2007-1190', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1190'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugtraq.ir/articles/advisory/RSPA_File_Inclusion/6'}, {'name': '3641', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3641'}]
CVE State: PUBLISHED
Explain CVE-2007-1852
Multiple PHP remote file inclusion vulnerabilities in 2BGal 3.1.1 allow remote attackers to execute arbitrary PHP code via a URL in the lang_filename parameter to (1) index.php or (2) backupdb.inc.php in admin/, or other unspecified files, different vectors than CVE-2006-5505. NOTE: this issue has been disputed by CVE, since the lang_filename variable is defined before it is used
Affected Products: n/a
References: [{'name': '2517', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2517'}, {'name': '2bgal-langfilename-file-include(33375)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33375'}, {'name': '20070427 FALSE -> 2bgal RFI', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2007-April/001565.html'}, {'name': '20070331 2BGal 3.1.1 <= (admin/index.php) Remote File Include Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464458/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1853
Unspecified vulnerability in Hitachi JP1/HiCommand DeviceManager, Global Link Availability Manager, Replication Monitor, Tiered Storage Manager, and Tuning Manager allows local users to obtain authentication information via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.hitachi-support.com/security_e/vuls_e/HS07-007_e/index-e.html'}, {'name': 'hitachi-hicommand-information-disclosure(33328)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33328'}, {'name': '34590', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34590'}, {'name': 'ADV-2007-1169', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1169'}, {'name': '23210', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23210'}, {'name': '24684', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24684'}]
CVE State: PUBLISHED
Explain CVE-2007-1854
Unspecified vulnerability in Hitachi Cosminexus Component Container 07-00 through 07-00-10, and 07-10 through 07-10-03, as used in uCosminexus Application Server Enterprise and Standard; uCosminexus Service Platform; uCosminexus Developer Standard and Professional; uCosminexus Service Architect; Electronic Form Workflow Standard Set, Professional Library Set, and Developer Client Set; and uCosminexus ERP Integrator, does not properly manage session information, which has an unspecified impact related to "unintended other requests."
Affected Products: n/a
References: [{'name': 'ADV-2007-1170', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1170'}, {'name': '23213', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23213'}, {'name': '34768', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34768'}, {'name': '24683', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24683'}, {'name': 'hitachi-container-information-disclosure(33318)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33318'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.hitachi-support.com/security_e/vuls_e/HS07-006_e/index-e.html'}]
CVE State: PUBLISHED
Explain CVE-2007-1855
Multiple PHP remote file inclusion vulnerabilities in smarty/smarty_class.php in Shop-Script FREE allow remote attackers to execute arbitrary PHP code via a URL in the (1) _smarty_compile_path, (2) smarty_compile_path, (3) get_plugin_filepath, (4) smarty_dir, and (5) filename parameters.  NOTE: this issue might be related to CVE-2006-7105.
Affected Products: n/a
References: [{'name': '2520', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2520'}, {'name': '35222', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35222'}, {'name': 'shopscriptfree-smarty-file-include(33339)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33339'}, {'name': '20070331 Remot File Include In Shop-SCRIPT FREE', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/464350/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2007-1856
Vixie Cron before 4.1-r10 on Gentoo Linux is installed with insecure permissions, which allows local users to cause a denial of service (cron failure) by creating hard links, which results in a failed st_nlink check in database.c.
Affected Products: n/a
References: [{'name': '20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html'}, {'name': '27886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/27886'}, {'name': 'ADV-2007-3229', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/3229'}, {'name': 'SUSE-SR:2007:007', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_007_suse.html'}, {'name': '1018081', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1018081'}, {'name': '24995', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24995'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2007-261.htm'}, {'name': 'GLSA-200704-11', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200704-11.xml'}, {'name': '25321', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25321'}, {'name': 'oval:org.mitre.oval:def:11463', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11463'}, {'name': '25723', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25723'}, {'name': 'MDKSA-2007:234', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:234'}, {'name': '26909', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/26909'}, {'name': '23520', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23520'}, {'name': '27706', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/27706'}, {'name': 'RHSA-2007:0345', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2007-0345.html'}, {'name': '24905', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24905'}]
CVE State: PUBLISHED
Explain CVE-2007-1859
XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication.
Affected Products: n/a
References: [{'name': '25610', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25610'}, {'name': '25119', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25119'}, {'name': '25105', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25105'}, {'name': '25065', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25065'}, {'name': '25116', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25116'}, {'name': 'oval:org.mitre.oval:def:11459', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11459'}, {'name': '25225', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25225'}, {'name': 'MDKSA-2007:097', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2007:097'}, {'name': 'SUSE-SR:2007:009', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_9_sr.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-1293'}, {'name': '35531', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/35531'}, {'name': '23783', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23783'}, {'name': 'xscreensaver-getpwuid-authentication-bypass(34054)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/34054'}, {'name': 'RHSA-2007:0322', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2007-0322.html'}, {'name': '25118', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25118'}, {'name': '1017996', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017996'}, {'name': 'USN-474-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-474-1'}, {'name': 'GLSA-200705-14', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200705-14.xml'}]
CVE State: PUBLISHED
Explain CVE-2007-1865
The ipv6_getsockopt_sticky function in the kernel in Red Hat Enterprise Linux (RHEL) Beta 5.1.0 allows local users to obtain sensitive information (kernel memory contents) via a negative value of the len parameter.  NOTE: this issue has been disputed in a bug comment, stating that "len is ignored when copying header info to the user's buffer.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=232045'}, {'name': '45909', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/45909'}]
CVE State: PUBLISHED
Explain CVE-2007-1866
Stack-based buffer overflow in the dns_decode_reverse_name function in dns_decode.c in dproxy-nexgen allows remote attackers to execute arbitrary code by sending a crafted packet to port 53/udp, a different issue than CVE-2007-1465.
Affected Products: n/a
References: [{'name': '20070331 dproxy-nexgen remote', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053289.html'}, {'name': '2518', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2518'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dproxy.cvs.sourceforge.net/dproxy/dproxy-nexgen/dns_decode.c?revision=1.10&view=markup'}, {'name': 'dproxy-dnsdecode-bo(33753)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33753'}, {'name': 'ADV-2007-1194', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1194'}, {'name': '20070331 Re: dproxy-nexgen remote', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053302.html'}, {'name': '24688', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24688'}]
CVE State: PUBLISHED
Explain CVE-2007-1867
Buffer overflow in IrfanView 3.99 allows remote attackers to execute arbitrary code via a crafted animated cursor (ANI) file.
Affected Products: n/a
References: [{'name': 'irfanview-ani-bo(33386)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33386'}, {'name': '3648', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3648'}, {'name': '24725', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24725'}, {'name': 'ADV-2007-1210', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1210'}, {'name': '23262', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23262'}]
CVE State: PUBLISHED
Explain CVE-2007-1868
The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly handle multipart/form-data in HTTP POST requests, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via crafted POST requests to port 8080/tcp or 443/tcp.
Affected Products: n/a
References: [{'name': 'ADV-2007-1199', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1199'}, {'name': '20070331 IBM Tivoli Provisioning Manager for OS Deployment Multiple Vulnerabilities', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=498'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg24015347'}, {'name': '23264', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23264'}, {'name': '24717', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24717'}, {'name': 'tivoli-post-code-execution(33384)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33384'}, {'name': '1017840', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1017840'}]
CVE State: PUBLISHED
Explain CVE-2007-1869
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
Affected Products: n/a
References: [{'name': '25613', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25613'}, {'name': 'GLSA-200705-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200705-07.xml'}, {'name': 'ADV-2007-1399', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1399'}, {'name': '24947', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24947'}, {'name': 'SUSE-SR:2007:007', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_007_suse.html'}, {'name': 'lighttpd-rnrn-dos(33671)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33671'}, {'name': '24995', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24995'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-1218'}, {'name': 'DSA-1303', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2007/dsa-1303'}, {'name': '23515', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23515'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt'}, {'name': '20070420 FLEA-2007-0011-1: lighttpd', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/466464/30/6900/threaded'}, {'name': '25166', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25166'}, {'name': '24886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24886'}]
CVE State: PUBLISHED
Explain CVE-2007-1870
lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference.
Affected Products: n/a
References: [{'name': '25613', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25613'}, {'name': 'GLSA-200705-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200705-07.xml'}, {'name': 'ADV-2007-1399', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1399'}, {'name': '24947', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24947'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt'}, {'name': 'SUSE-SR:2007:007', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2007_007_suse.html'}, {'name': '24995', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24995'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-1218'}, {'name': 'DSA-1303', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2007/dsa-1303'}, {'name': 'lighttpd-mtime-dos(33678)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33678'}, {'name': '23515', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23515'}, {'name': '20070420 FLEA-2007-0011-1: lighttpd', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/466464/30/6900/threaded'}, {'name': '25166', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/25166'}, {'name': '24886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24886'}]
CVE State: PUBLISHED
Explain CVE-2007-1871
Cross-site scripting (XSS) vulnerability in chcounter 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the login_name parameter to /stats/.
Affected Products: n/a
References: [{'name': '2569', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2569'}, {'name': '20070411 CVE-2007-1871: Cross site scripting in chcounter 3.1.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/465486/100/0/threaded'}, {'name': '24879', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24879'}, {'name': '23462', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23462'}, {'name': 'ADV-2007-1371', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1371'}, {'name': '34910', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34910'}, {'tags': ['x_refsource_MISC'], 'url': 'http://int21.de/cve/CVE-2007-1871-chcounter.txt'}]
CVE State: PUBLISHED
Explain CVE-2007-1872
Cross-site scripting (XSS) vulnerability in toendaCMS 1.5.3 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search id.
Affected Products: n/a
References: [{'name': '34898', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34898'}, {'name': '2568', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/2568'}, {'name': '24869', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24869'}, {'name': 'ADV-2007-1372', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1372'}, {'name': 'toendacms-search-xss(33622)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33622'}, {'name': '20070411 CVE-2007-1872: Cross site scripting in toendaCMS 1.5.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/465487/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://int21.de/cve/CVE-2007-1872-toendacms.txt'}, {'name': '23453', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23453'}]
CVE State: PUBLISHED
Explain CVE-2007-1873
Cross-site scripting (XSS) vulnerability in Mephisto 0.7.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter to the search script.
Affected Products: n/a
References: [{'name': '24870', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24870'}, {'name': '20070411 Cross site scripting in mephisto 0.7.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/465484/100/0/threaded'}, {'name': '23141', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/23141'}, {'name': '34911', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/34911'}, {'name': 'mephisto-search-xss(33620)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33620'}, {'name': 'ADV-2007-1373', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2007/1373'}, {'name': '20070412 Re: Cross site scripting in mephisto 0.7.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/465548/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://int21.de/cve/CVE-2007-1873-mephisto.txt'}, {'name': 'mephisto-search-function-xss(33484)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/33484'}]
CVE State: PUBLISHED