Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
_item.php; the (5) new_menuname parameter in (e) admin/navigation/do_new_nav.php; and (6) area1, name, and url parameters to (f) admin/pages/do_new_page.php. NOTE: some vectors might be reachable through the url and name parameters to (g) admin/navigation/new_nav_item.php. NOTE: the original disclosure does not precisely state which vectors are associated with SQL injection versus XSS. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36180 - http://www.securityfocus.com/archive/1/477320/100/0/threaded - http://www.freshervisions.com/ripe/articles/ripe-version-0.8.10/ - http://www.securityfocus.com/bid/25406 - http://securit
tp://www.freshervisions.com/ripe/articles/ripe-version-0.8.10/ - http://www.securityfocus.com/bid/25406 - http://securityreason.com/securityalert/3058
CVE ID: CVE-2007-4523 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via one or more of the following vectors: the (1) id parameter to (a) pages/delete_page.php, (b) navigation/delete_menu.php, and (c) navigation/delete_item.php in admin/; the (2) menu_id, (3) name, (3) page_id, and (4) url parameters in (d) admin/navigation/do_new_item.php; the (5) new_menuname parameter in (e) admin/navigation/do_new_nav.php; and (6) area1, name,
/navigation/do_new_item.php; the (5) new_menuname parameter in (e) admin/navigation/do_new_nav.php; and (6) area1, name, and url parameters to (f) admin/pages/do_new_page.php, probably involving the Title or textarea field as reachable through admin/pages/new_page.php. NOTE: the original disclosure does not precisely state which vectors are associated with SQL injection versus XSS. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/38444 - http://osvdb.org/38448 - http://www.securityfocus.com/archive/1/477320/100/0/threaded - http://osvdb.org/38446 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36179 - http://www.securityfocus.com/bid/25406 - http://sec
38446 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36179 - http://www.securityfocus.com/bid/25406 - http://securityreason.com/securityalert/3058 - http://osvdb.org/38449 - http://osvdb.org/38447 - http://osvdb.org/38445
CVE ID: CVE-2007-4524 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in adisplay.php in PhPress 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36219 - http://securityreason.com/securityalert/3055 - http://www.securityfocus.com/archive/1/477426/100/0/threaded - https://www.exploit-db.com/exploits/4382 - http://osvdb.org/38351 - http://www.securityfocus.com/bid/25415
CVE ID: CVE-2007-4525 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in inc-calcul.php3 in SPIP 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in the squelette_cache parameter, a different vector than CVE-2006-1702. NOTE: this issue has been disputed by third party researchers, stating that the squelette_cache variable is initialized before use, and is only used within the scope of a function Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/25416 - http://securityreason.com/securityal
es: - CVE Program Container: References: - http://www.securityfocus.com/bid/25416 - http://securityreason.com/securityalert/3056 - http://www.securityfocus.com/archive/1/477423/100/0/threaded - http://www.securityfocus.com/archive/1/477728/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/36218
CVE ID: CVE-2007-4526 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Client Login Extension (CLE) in Novell Identity Manager before 3.5.1 20070730 stores the username and password in a local file, which allows local users to obtain sensitive information by reading this file. Additional Analyst Notes: - CVE Program Container: References: - https://secure-support.novell.com/KanisaPlatform/Publishing/177/3329402_f.SAL_Public.html - http://www.vupen.com/english/advisories/2007/2957 - http://osvdb.org/37320 - http://securitytracker.com/id?1018602 - http://www.securityfocus.com/bid/25420 - http:/
/2957 - http://osvdb.org/37320 - http://securitytracker.com/id?1018602 - http://www.securityfocus.com/bid/25420 - http://secunia.com/advisories/26555 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36215
CVE ID: CVE-2007-4527 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in phUploader.php in phphq.Net phUploader 1.2 allows remote attackers to upload and execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/25405 - http://osvdb.org/45829
CVE ID: CVE-2007-4528 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Foreign Function Interface (ffi) extension in PHP 5.0.5 does not follow safe_mode restrictions, which allows context-dependent attackers to execute arbitrary code by loading an arbitrary DLL and calling a function, as demonstrated by kernel32.dll and the WinExec function. NOTE: this issue does not cross privilege boundaries in most contexts, so perhaps it should not be included in CVE. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/4311
CVE ID: CVE-2007-4529 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebAdmin interface in TeamSpeak Server 2.0.20.1 allows remote authenticated users with the ServerAdmin flag to assign Registered users certain privileges, resulting in a privilege set that extends beyond that ServerAdmin's own servers, as demonstrated by the (1) AdminAddServer, (2) AdminDeleteServer, (3) AdminStartServer, and (4) AdminStopServer privileges; and administration of arbitrary virtual servers via a request to a .tscmd URI with a modified serverid parameter, as demonstrated by (a) add_server.tscmd, (b) ask_delet
via a request to a .tscmd URI with a modified serverid parameter, as demonstrated by (a) add_server.tscmd, (b) ask_delete_server.tscmd, (c) start_server.tscmd, and (d) stop_server.tscmd. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/477424/100/0/threaded - http://secunia.com/advisories/25242 - http://securityvulns.com/Rdocument6.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/34254 - http://archives.neohapsis.com/archives/fulldisclosure/2007-05/0165.html - http://www.securityfocus.com/bid/23935 - http://osvdb.org/36047
CVE ID: CVE-2007-4530 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in TeamSpeak Server 2.0.20.1 allow remote attackers to inject arbitrary web script or HTML via (1) the error_text parameter to error_box.html or (2) the ok_title parameter to ok_box.html. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/477424/100/0/threaded - http://www.securityfocus.com/bid/23933 - http://osvdb.org/36048 - http://secunia.com/advisories/25242 - http://securityvulns.com/Rdocument6.html - http://osvdb.org/
p://osvdb.org/36048 - http://secunia.com/advisories/25242 - http://securityvulns.com/Rdocument6.html - http://osvdb.org/36049 - http://archives.neohapsis.com/archives/fulldisclosure/2007-05/0165.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/34252
CVE ID: CVE-2007-4531 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Soldat game server 1.4.2 and earlier, and dedicated server 2.6.2 and earlier, allows remote attackers to cause a client denial of service (crash) via (1) a long string to the file transfer port or (2) a long chat message, or (3) a server denial of service (continuous beep and slowdown) via a string containing many 0x07 or other control characters to the file transfer port. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/26564 - http://www.securityfocus.com/archive/1/477624/100/0/t
ram Container: References: - http://secunia.com/advisories/26564 - http://www.securityfocus.com/archive/1/477624/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/36230 - http://www.securityfocus.com/bid/25426 - http://aluigi.org/poc/soldatdos.zip - http://aluigi.altervista.org/adv/soldatdos-adv.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/36231
CVE ID: CVE-2007-4532 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Soldat game server 1.4.2 and earlier, and dedicated server 2.6.2 and earlier, allows remote attackers to cause a denial of service (client lockout) via a series of UDP join packets from a spoofed IP address, which triggers temporary blacklisting of this IP address. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/477624/100/0/threaded - http://www.securityfocus.com/bid/25426 - http://aluigi.org/poc/soldatdos.zip - http://aluigi.altervista.org/adv/soldatdos-adv.txt - https:
yfocus.com/bid/25426 - http://aluigi.org/poc/soldatdos.zip - http://aluigi.altervista.org/adv/soldatdos-adv.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/36232
CVE ID: CVE-2007-4533 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in the Say command in sv_main.cpp in Vavoom 1.24 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a chat message, related to a call to the BroadcastPrintf function. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/26701 - http://aluigi.altervista.org/adv/vaboom2-adv.txt - https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00094.html - http://securityreason.com/securityalert/3057 - https:
om/archives/fedora-package-announce/2007-September/msg00094.html - http://securityreason.com/securityalert/3057 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36247 - https://bugzilla.redhat.com/show_bug.cgi?id=256621 - http://secunia.com/advisories/26554 - http://www.securityfocus.com/bid/25436
CVE ID: CVE-2007-4534 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the VThinker::BroadcastPrintf function in p_thinker.cpp in Vavoom 1.24 and earlier allows remote attackers to execute arbitrary code via (1) a long string in a chat message and possibly (2) a long name field. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/26701 - http://aluigi.altervista.org/adv/vaboom2-adv.txt - https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00094.html - http://securityreason.com/securityalert/3057 - https://bugzilla
s/fedora-package-announce/2007-September/msg00094.html - http://securityreason.com/securityalert/3057 - https://bugzilla.redhat.com/show_bug.cgi?id=256621 - http://secunia.com/advisories/26554 - http://www.securityfocus.com/bid/25436
CVE ID: CVE-2007-4535 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VStr::Resize function in str.cpp in Vavoom 1.24 and earlier allows remote attackers to cause a denial of service (daemon crash) via a string with a negative NewLen value within a certain UDP packet that triggers an assertion error. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/26701 - http://aluigi.altervista.org/adv/vaboom2-adv.txt - https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00094.html - http://securityreason.com/securityalert/3057 - https://
/archives/fedora-package-announce/2007-September/msg00094.html - http://securityreason.com/securityalert/3057 - https://bugzilla.redhat.com/show_bug.cgi?id=256621 - http://secunia.com/advisories/26554 - http://www.securityfocus.com/bid/25436
CVE ID: CVE-2007-4536 State: PUBLISHED Published: 2007-08-25T00:00:00 Last Updated: 2024-08-07T15:01:09.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: TorrentTrader 1.07 and earlier sets insecure permissions for files in the root directory, which allows attackers to execute arbitrary PHP code by modifying (1) disclaimer.txt, (2) sponsors.txt, and (3) banners.txt, which are used in an include call. NOTE: there might be local attack vectors that extend to other files. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/40257 - http://www.torrenttrader.org/index.php?showtopic=5843 - http://secunia.com/advisories/26679 - http://www.securityfocus.com
tp://www.torrenttrader.org/index.php?showtopic=5843 - http://secunia.com/advisories/26679 - http://www.securityfocus.com/bid/25536 - http://www.attrition.org/pipermail/vim/2007-August/001774.html
CVE ID: CVE-2007-4537 State: PUBLISHED Published: 2007-08-27T21:00:00 Last Updated: 2024-08-07T15:01:09.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the Huffman decompression algorithm implemented in Skulltag 0.97d-beta4.1 and earlier allows remote attackers to execute arbitrary code via a crafted UDP packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/25423 - http://securityreason.com/securityalert/3067 - http://secunia.com/advisories/26549 - http://www.securityfocus.com/archive/1/477635/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/36229 - http://aluigi.altervista.
archive/1/477635/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/36229 - http://aluigi.altervista.org/adv/skulltaghof-adv.txt - http://www.vupen.com/english/advisories/2007/2969
CVE ID: CVE-2007-4538 State: PUBLISHED Published: 2007-08-27T21:00:00 Last Updated: 2024-08-07T15:01:09.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: email_in.pl in Bugzilla 2.23.4 through 3.0.0 allows remote attackers to execute arbitrary commands via the -f (From address) option to the Email::Send::Sendmail function, probably involving shell metacharacters. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/37203 - http://security.gentoo.org/glsa/glsa-200709-18.xml - http://www.securityfocus.com/archive/1/477630/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/36243 - https://bugzilla.mozilla.org/show_bug.cgi?id=386860 -
ded - https://exchange.xforce.ibmcloud.com/vulnerabilities/36243 - https://bugzilla.mozilla.org/show_bug.cgi?id=386860 - http://secunia.com/advisories/26971 - http://www.vupen.com/english/advisories/2007/2977 - http://secunia.com/advisories/26584 - http://www.securitytracker.com/id?1018604 - http://www.securityfocus.com/bid/25425 - http://www.bugzilla.org/security/2.20.4/
CVE ID: CVE-2007-4539 State: PUBLISHED Published: 2007-08-27T21:00:00 Last Updated: 2024-08-07T15:01:09.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebService (XML-RPC) interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote attackers to obtain sensitive information via certain XML-RPC requests, as demonstrated by the (1) Deadline and (2) Estimated Time fields. Additional Analyst Notes: - CVE Program Container: References: - http://security.gentoo.org/glsa/glsa-200709-18.xml - http://www.securityfocus.com/archive/1/477630/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/3624
http://www.securityfocus.com/archive/1/477630/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/36244 - http://secunia.com/advisories/26971 - http://www.vupen.com/english/advisories/2007/2977 - https://bugzilla.mozilla.org/show_bug.cgi?id=382056 - http://secunia.com/advisories/26584 - http://osvdb.org/37202 - http://www.securitytracker.com/id?1018604 - http://www.securityfocus.com/bid/25425 - http://www.bugzilla.org/security/2.20.4/
CVE ID: CVE-2007-4540 State: PUBLISHED Published: 2007-08-27T21:00:00 Last Updated: 2024-08-07T15:01:09.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in download.php in Olate Download (od) 3.4.2 allow remote attackers to execute arbitrary SQL commands via the (1) HTTP_REFERER or (2) HTTP_USER_AGENT HTTP header. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/477340/100/0/threaded - http://www.securityfocus.com/bid/25410 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36214 - http://securityreason.com/securityalert/3062 - http://osvdb.org/38581 - http://myimei.com/security/2
erabilities/36214 - http://securityreason.com/securityalert/3062 - http://osvdb.org/38581 - http://myimei.com/security/2007-08-22/olate-download-342downloadphp-sql-injection.html
CVE ID: CVE-2007-4541 State: PUBLISHED Published: 2007-08-27T21:00:00 Last Updated: 2024-08-07T15:01:09.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Olate Download (od) 3.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the PHP_SELF variable in modules/core/uim.php and (2) [url] tags in a comment in modules/core/fldm.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36197 - http://www.securityfocus.com/bid/25412 - http://osvdb.org/39711 - http://www.securityfocus.com/archive/1/477337/100/0/threaded - http://osvdb.org/39710
d/25412 - http://osvdb.org/39711 - http://www.securityfocus.com/archive/1/477337/100/0/threaded - http://osvdb.org/39710 - http://myimei.com/security/2007-08-22/olate-download-342modulescoreuimphpxss.html - http://secunia.com/advisories/26565 - http://securityreason.com/securityalert/3076 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36196 - http://www.securityfocus.com/archive/1/477338/100/0/threaded - http://myimei.com/security/2007-08-22/olate-download-342modulescorefldmphpcomments-tag-url-xss.html
CVE ID: CVE-2007-4542 State: PUBLISHED Published: 2007-08-27T21:00:00 Last Updated: 2024-08-07T15:01:09.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the (1) processLine function in maptemplate.c and the (2) writeError function in mapserv.c in the mapserv CGI program. Additional Analyst Notes: - CVE Program Container: References: - http://trac.osgeo.org/mapserver/attachment/ticket/2256/ms-bug-2256-4.8.patch - http://secunia.com/advisories/29688 - http://mapserver.gis.umn.edu/download/current/HISTORY.TX
6/ms-bug-2256-4.8.patch - http://secunia.com/advisories/29688 - http://mapserver.gis.umn.edu/download/current/HISTORY.TXT/ - http://trac.osgeo.org/mapserver/ticket/2256 - http://secunia.com/advisories/26561 - http://secunia.com/advisories/26718 - https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00096.html - http://www.vupen.com/english/advisories/2007/2974 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=439346 - http://www.securityfocus.com/bid/25582 - http://www.debian.org/security/2008/dsa-1539
CVE ID: CVE-2007-4543 State: PUBLISHED Published: 2007-08-27T21:00:00 Last Updated: 2024-08-07T15:01:09.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in enter_bug.cgi in Bugzilla 2.17.1 through 2.20.4, 2.22.x before 2.22.3, and 3.x before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the buildid field in the "guided form." Additional Analyst Notes: - CVE Program Container: References: - http://security.gentoo.org/glsa/glsa-200709-18.xml - https://bugzilla.mozilla.org/show_bug.cgi?id=386942 - http://www.securityfocus.com/archive/1/477630/100/0/threaded - http://osvdb.org/37201 - http://secunia.com/advisories
- http://www.securityfocus.com/archive/1/477630/100/0/threaded - http://osvdb.org/37201 - http://secunia.com/advisories/26971 - http://www.vupen.com/english/advisories/2007/2977 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36241 - http://secunia.com/advisories/26584 - http://www.securitytracker.com/id?1018604 - http://www.securityfocus.com/bid/25425 - http://www.bugzilla.org/security/2.20.4/
CVE ID: CVE-2007-4544 State: PUBLISHED Published: 2007-08-27T23:00:00 Last Updated: 2024-08-07T15:01:09.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in wp-newblog.php in WordPress multi-user (MU) 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the weblog_id parameter (Username field). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/482006/100/0/threaded - http://securityvulns.ru/Rdocument875.html - http://websecurity.com.ua/1269/ - http://osvdb.org/38442
CVE ID: CVE-2007-4545 State: PUBLISHED Published: 2007-08-27T23:00:00 Last Updated: 2024-08-07T15:01:09.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in Unreal Commander 0.92 build 565 and 573 allow user-assisted remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a filename within a (1) ZIP or (2) RAR archive. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/26583 - http://securityreason.com/securityalert/3060 - http://www.securityfocus.com/archive/1/477432/100/0/threaded - http://www.securityfocus.com/bid/25419
CVE ID: CVE-2007-4546 State: PUBLISHED Published: 2007-08-27T23:00:00 Last Updated: 2024-08-07T15:01:09.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unreal Commander 0.92 build 565 and 573 lists the filenames from the Central Directory of a ZIP archive, but extracts to local filenames corresponding to names in Local File Header fields in this archive, which might allow remote attackers to trick a user into performing a dangerous file overwrite or creation. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/45831 - http://securityreason.com/securityalert/3060 - http://www.securityfocus.com/archive/1/477432/100/0/threaded - http://www.securityf
urityreason.com/securityalert/3060 - http://www.securityfocus.com/archive/1/477432/100/0/threaded - http://www.securityfocus.com/bid/25419