Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2007-2679 State: PUBLISHED Published: 2007-05-15T00:00:00Z Last Updated: 2024-09-16T17:42:48.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP file inclusion vulnerability in index.php in Ivan Peevski gallery 0.3 in Simple PHP Scripts (sphp) allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the file_exists function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.attrition.org/pipermail/vim/2007-April/001536.html - http://
st Notes: - CVE Program Container: References: - http://www.attrition.org/pipermail/vim/2007-April/001536.html - http://secunia.com/advisories/24912 - http://www.securityfocus.com/bid/23534
CVE ID: CVE-2007-2680 State: PUBLISHED Published: 2007-05-15T00:00:00 Last Updated: 2024-08-07T13:49:57.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the management interface in Canon Network Camera Server VB100 and VB101 with firmware 3.0 R69 and earlier, and VB150 with firmware 1.1 R39 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2007/1461 - http://jvn.jp/jp/JVN%2306735665/ - http://secunia.com/advisories/24940 - http://www.securityfocus.com/bid/23560 - http://cweb.canon
jp/jp/JVN%2306735665/ - http://secunia.com/advisories/24940 - http://www.securityfocus.com/bid/23560 - http://cweb.canon.jp/drv-upd/webview/notification.html - http://osvdb.org/35019
CVE ID: CVE-2007-2681 State: PUBLISHED Published: 2007-05-15T00:00:00 Last Updated: 2024-08-07T13:49:57.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the core_subdir parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/33687 - http://securityreason.com/securityalert/2697 - http://www.securityfocus.com/archive/1/465733/100/0/threaded
CVE ID: CVE-2007-2682 State: PUBLISHED Published: 2007-05-18T18:00:00 Last Updated: 2024-08-07T13:49:57.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installer for Adobe Version Cue CS3 Server on Apple Mac OS X, as used in Adobe Creative Suite 3 (CS3), does not re-enable the personal firewall after completing the product installation, which allows remote attackers to bypass intended firewall rules. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/34342 - http://www.adobe.com/support/security/bulletins/apsb07-11.html - http://osvdb.org/35868 - http://www.securityfocus.com/bid/24027 - http://securitytrac
ecurity/bulletins/apsb07-11.html - http://osvdb.org/35868 - http://www.securityfocus.com/bid/24027 - http://securitytracker.com/id?1018075 - http://secunia.com/advisories/25291 - http://www.vupen.com/english/advisories/2007/1850
CVE ID: CVE-2007-2683 State: PUBLISHED Published: 2007-05-15T21:00:00 Last Updated: 2024-08-07T13:49:57.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias expansion. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/25529 - http://www.securitytracker.com/id?1018066 - http://www.trustix.org/errata/2007/0024/ - http://secunia.com/advisories/26415 - http://dev.mutt.org/trac/ticket/2885 - http://secunia.com/advisories/25408 - http://osvdb.org/34973 - https://bugzilla.redhat.com/bug
tt.org/trac/ticket/2885 - http://secunia.com/advisories/25408 - http://osvdb.org/34973 - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239890 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10543 - http://secunia.com/advisories/25546 - http://secunia.com/advisories/25515 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34441 - http://www.mandriva.com/security/advisories?name=MDKSA-2007:113 - http://www.redhat.com/support/errata/RHSA-2007-0386.html - http://www.securityfocus.com/bid/24192 - https://issues.rpath.com/browse/RPL-1391
CVE ID: CVE-2007-2684 State: PUBLISHED Published: 2007-05-21T20:00:00 Last Updated: 2024-08-07T13:49:57.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jetbox CMS 2.1 allows remote attackers to obtain sensitive information via (1) a direct request to (a) main_page.php, (b) open_tree.php, and (c) outputs.php; (2) a malformed view parameter to index.php, as demonstrated with an SQL injection manipulation; or (3) the id[] parameter to admin/cms/opentree.php, which reveals the installation path in the resulting error message. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/34789 - http://osvdb.org/34790 - http://www.netvigilance.com/advisory0027
ram Container: References: - http://osvdb.org/34789 - http://osvdb.org/34790 - http://www.netvigilance.com/advisory0027 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34385 - http://osvdb.org/34788 - http://marc.info/?l=full-disclosure&m=117974375029054&w=2 - http://www.securityfocus.com/archive/1/469222/100/0/threaded - http://osvdb.org/34787 - http://www.osvdb.org/34783
CVE ID: CVE-2007-2685 State: PUBLISHED Published: 2007-05-21T20:00:00 Last Updated: 2024-08-07T13:49:57.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in index.php in Jetbox CMS 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) view or (2) login parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/24077 - http://www.securityfocus.com/archive/1/469223/100/0/threaded - http://marc.info/?l=full-disclosure&m=117974433216496&w=2 - http://www.netvigilance.com/advisory0028 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34387 - http://www.osvdb.org/34784
CVE ID: CVE-2007-2686 State: PUBLISHED Published: 2007-05-22T19:00:00 Last Updated: 2024-08-07T13:49:57.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter in a sendpwd task. Additional Analyst Notes: - CVE Program Container: References: - http://www.netvigilance.com/advisory0029 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34415 - http://www.osvdb.org/34791 - http://www.securityfocus.com/archive/1/469233/100/0/threaded - http://www.securityfocus.com/bid/24095 - http://marc.info/?l=full-disclosure&m=11798193810113
/1/469233/100/0/threaded - http://www.securityfocus.com/bid/24095 - http://marc.info/?l=full-disclosure&m=117981938101135&w=2
CVE ID: CVE-2007-2687 State: PUBLISHED Published: 2007-05-24T01:29:00 Last Updated: 2024-08-07T13:49:57.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan before 9.0.718.1 allows remote attackers to execute arbitrary code via a long command. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/34457 - http://www.securityfocus.com/archive/1/469347/100/0/threaded - http://secunia.com/secunia_research/2007-54/advisory/ - http://www.vupen.com/english/advisories/2007/1917 - http://www.securityfocus.com/bid/24112 -
search/2007-54/advisory/ - http://www.vupen.com/english/advisories/2007/1917 - http://www.securityfocus.com/bid/24112 - http://osvdb.org/36580 - http://secunia.com/advisories/25136
CVE ID: CVE-2007-2688 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Cisco Intrusion Prevention System (IPS) and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5465 - http://www.osvdb.org/35336 - http://www.kb.cert.org/vuls/id/739224 - http://www.vupen.com/english/advisories/2007/1803 - http://www.se
db.org/35336 - http://www.kb.cert.org/vuls/id/739224 - http://www.vupen.com/english/advisories/2007/1803 - http://www.securitytracker.com/id?1018053 - http://www.gamasec.net/english/gs07-01.html - http://secunia.com/advisories/25285 - http://www.securitytracker.com/id?1018054 - http://www.securityfocus.com/bid/23980 - http://www.cisco.com/en/US/products/products_security_response09186a008083f82e.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/34277 - http://www.securityfocus.com/archive/1/468633/100/0/threaded
CVE ID: CVE-2007-2689 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Check Point Web Intelligence does not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/739224 - http://www.securitytracker.com/id?1018067 - http://www.gamasec.net/english/gs07-01.html - http://www.securityfocus.com/archive/1/468633/100/0/threaded
CVE ID: CVE-2007-2690 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple IBM ISS Proventia Series products, including the A, G, and M series, do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/739224 - http://www.securitytracker.com/id?1018068 - http://www.gamasec.net/english/gs07-01.html - http://www.securityfocus.com/archive/1/468633/100/0/threaded
CVE ID: CVE-2007-2691 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.mysql.com/bug.php?id=27515 - http://secunia.com/advisories/27823 - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html - http://www.redhat.com/support/errata/RHSA-2007-0894.html - http://secunia.com/advisories/26073 - http://www.securityfocus.com/bid/3
redhat.com/support/errata/RHSA-2007-0894.html - http://secunia.com/advisories/26073 - http://www.securityfocus.com/bid/31681 - http://www.securitytracker.com/id?1018069 - http://secunia.com/advisories/31226 - http://lists.mysql.com/announce/470 - http://www.vupen.com/english/advisories/2007/1804 - http://www.redhat.com/support/errata/RHSA-2008-0768.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/34347 - http://secunia.com/advisories/25946 - http://www.securityfocus.com/archive/1/473874/100/0/threaded - http://www.securityfocus.com/bid/24016 - http://secunia.com/advisories/25301 - http://www.debian.org/security/2007/dsa-1413 - http://osvdb.org/34766 - https://issues.rpath.com/brow
advisories/25301 - http://www.debian.org/security/2007/dsa-1413 - http://osvdb.org/34766 - https://issues.rpath.com/browse/RPL-1536 - http://secunia.com/advisories/32222 - https://usn.ubuntu.com/528-1/ - http://www.mandriva.com/security/advisories?name=MDKSA-2007:139 - http://secunia.com/advisories/30351 - http://secunia.com/advisories/27155 - http://secunia.com/advisories/26430 - http://www.vupen.com/english/advisories/2008/2780 - http://secunia.com/advisories/28838 - http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html - http://www.redhat.com/support/errata/RHSA-2008-0364.html - http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html - http://support.
/errata/RHSA-2008-0364.html - http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html - http://support.apple.com/kb/HT3216 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9559
CVE ID: CVE-2007-2692 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/27823 - http://secunia.com/advisories/29443 - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html - http://www.redhat.com/support/errata/RHSA-2007-0894.html - http://secunia.com/advisories/2
man/5.1/en/news-5-1-18.html - http://www.redhat.com/support/errata/RHSA-2007-0894.html - http://secunia.com/advisories/26073 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:028 - http://lists.mysql.com/announce/470 - http://www.vupen.com/english/advisories/2007/1804 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9166 - http://www.securityfocus.com/archive/1/473874/100/0/threaded - http://www.securitytracker.com/id?1018070 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34348 - http://secunia.com/advisories/25301 - http://www.debian.org/security/2007/dsa-1413 - https://issues.rpath.com/browse/RPL-1536 - http://secunia.com/advisori
- http://www.debian.org/security/2007/dsa-1413 - https://issues.rpath.com/browse/RPL-1536 - http://secunia.com/advisories/28637 - http://secunia.com/advisories/30351 - http://bugs.mysql.com/bug.php?id=27337 - http://secunia.com/advisories/26430 - http://secunia.com/advisories/28838 - http://www.ubuntu.com/usn/usn-588-1 - http://osvdb.org/34765 - http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html - http://www.redhat.com/support/errata/RHSA-2008-0364.html - http://www.securityfocus.com/bid/24011
CVE ID: CVE-2007-2693 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to obtain sensitive information from partitioned tables via an ALTER TABLE statement. Additional Analyst Notes: - CVE Program Container: References: - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html - http://www.securitytracker.com/id?1018071 - http://www.vupen.com/english/advisories/2007/1804 - http://bugs.mysql.com/bug.php?id=23675 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34349 - http://secunia.com/advisories/25301 - http://
hp?id=23675 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34349 - http://secunia.com/advisories/25301 - http://www.securityfocus.com/bid/24008
CVE ID: CVE-2007-2694 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/36075 - http://secunia.com/advisories/25284 - http://dev2dev.bea.com/pub/advisory/232 - http://www.vupen.com/english/advisories/2007/1815
CVE ID: CVE-2007-2695 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/274 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34282 - http://securitytracker.com/id?1018057 -
pub/advisory/274 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34282 - http://securitytracker.com/id?1018057 - http://secunia.com/advisories/25284 - http://secunia.com/advisories/29041 - http://osvdb.org/36074 - http://dev2dev.bea.com/pub/advisory/227 - http://www.vupen.com/english/advisories/2008/0612/references - http://www.vupen.com/english/advisories/2007/1815
CVE ID: CVE-2007-2696 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1018057 - http://secunia.com/advisories/25284 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34284 - http://dev2dev.bea.com/pub/advisory/228 - http://osvdb.org/36073 - http://www.v
rce.ibmcloud.com/vulnerabilities/34284 - http://dev2dev.bea.com/pub/advisory/228 - http://osvdb.org/36073 - http://www.vupen.com/english/advisories/2007/1815
CVE ID: CVE-2007-2697 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/229 - http://securitytracker.com/id?1018057 -
CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/229 - http://securitytracker.com/id?1018057 - http://secunia.com/advisories/25284 - http://www.vupen.com/english/advisories/2007/1815 - http://osvdb.org/36072 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34291
CVE ID: CVE-2007-2698 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/36071 - http://securitytracker.com/id?1018057 - http://www.vupen.com/english/advisories/2007/1815 - http://dev2dev.bea.com/pub/advisory/230 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34286
CVE ID: CVE-2007-2699 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/231 - http://osvdb.org/36069 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34289 - http://securitytracker.com/id?1018057 - http://secunia.com/advisories/25284 - http://www.vupen.com/english/
ties/34289 - http://securitytracker.com/id?1018057 - http://secunia.com/advisories/25284 - http://www.vupen.com/english/advisories/2007/1815 - http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html
CVE ID: CVE-2007-2700 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/233 - http://securitytracker.com/id?1018057 - http://secunia.com/advisories/25284 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34288 - http://osvdb.o
8057 - http://secunia.com/advisories/25284 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34288 - http://osvdb.org/36068 - http://www.vupen.com/english/advisories/2007/1815
CVE ID: CVE-2007-2701 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected queue." Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/234 - http://securitytracker.com/id?1018057 - http://secunia.com/advisories/25284 - https://exchange.xforce.ibmcloud.com/vulnerab
p://securitytracker.com/id?1018057 - http://secunia.com/advisories/25284 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34287 - http://www.vupen.com/english/advisories/2007/1815 - http://osvdb.org/36067
CVE ID: CVE-2007-2702 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the rich text editor. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/34283 - http://secunia.com/advisories/25284 - http://osvdb.org/36066 - http://dev2dev.bea.com/pub/advisory/235 - http://www.securitytracker.com/id?1018060 - http://www.vupen.com/engli
36066 - http://dev2dev.bea.com/pub/advisory/235 - http://www.securitytracker.com/id?1018060 - http://www.vupen.com/english/advisories/2007/1815
CVE ID: CVE-2007-2703 State: PUBLISHED Published: 2007-05-16T01:00:00 Last Updated: 2024-08-07T13:49:57.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description, which might allow remote authenticated users to access privileged resources. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/36065 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34285 - http://secunia.com/advisories/25284 - http://dev2dev.bea.com/pub/advisory/236 - http://www.securitytracker.com/id?1018060 - http://www.vupen.com/english/advisories/2007/1815