Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2007-1146 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in function.php in arabhost allows remote attackers to execute arbitrary PHP code via a URL in the adminfolder parameter. Additional Analyst Notes: - CVE Program Container: References: - http://attrition.org/pipermail/vim/2007-February/001396.html - http://securityreason.com/securityalert/2339 - http://www.securityfocus.com/archive/1/460933/100/0/threaded - http://osvdb.org/33839
CVE ID: CVE-2007-1147 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in view.php in hbm allows remote attackers to execute arbitrary PHP code via a URL in the hbmpath parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2339 - http://osvdb.org/36878 - http://www.securityfocus.com/archive/1/460933/100/0/threaded
CVE ID: CVE-2007-1148 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2338 - http://www.securityfocus.com/bid/22675 - http://osvdb.org/33516 - http://www.vupen.com/english/advisories/2007/0716 - http://www.securityfocus.com/archive/1/460917/100/0/threaded
CVE ID: CVE-2007-1149 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in LoveCMS 1.4 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the step parameter to install/index.php or (2) the load parameter to the top-level URI. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2338 - http://osvdb.org/33517 - http://osvdb.org/33518 - http://www.securityfocus.com/bid/22675 - http://www.vupen.com/english/advisories/2007/0716 - http://www.securityfocus.com/archive/1/460917/100/0/thre
bid/22675 - http://www.vupen.com/english/advisories/2007/0716 - http://www.securityfocus.com/archive/1/460917/100/0/threaded
CVE ID: CVE-2007-1150 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2338 - http://osvdb.org/33519 - http://www.securityfocus.com/bid/22675 - http://www.securityfocus.com/archive/1/460917/100/0/threaded
CVE ID: CVE-2007-1151 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2338 - http://www.securityfocus.com/bid/22675 - http://osvdb.org/33520 - http://www.vupen.com/english/advisories/2007/0716 - http://www.securityfocus.com/archive/1/460917/100/0/threaded
CVE ID: CVE-2007-1152 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) act or (2) pid parameter to the top-level URI (index.php), or the (3) action parameter to admin/index.php. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/37398 - http://www.securityfocus.com/bid/33861 - https://www.exploit-db.com/exploits/8095 - http://www.securityfocus.com/bid/226
http://www.securityfocus.com/bid/33861 - https://www.exploit-db.com/exploits/8095 - http://www.securityfocus.com/bid/22667
CVE ID: CVE-2007-1153 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in CutePHP CuteNews 1.3.6 allow remote attackers to execute arbitrary PHP code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: issue might overlap CVE-2004-1660 or CVE-2006-4445. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/22674 - http://osvdb.org/37397
CVE ID: CVE-2007-1154 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in webSPELL allows remote attackers to execute arbitrary SQL commands via a ws_auth cookie, a different vulnerability than CVE-2006-4782. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/32669 - http://securityreason.com/securityalert/2337 - http://www.securityfocus.com/archive/1/460937/100/0/threaded
CVE ID: CVE-2007-1155 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in webSPELL allows remote authenticated administrators to upload and execute arbitrary PHP code via the add squad feature. NOTE: this issue may be an administrative feature, in which case this CVE may be REJECTED. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/32670 - http://securityreason.com/securityalert/2337 - http://www.securityfocus.com/archive/1/460937/100/0/threaded
CVE ID: CVE-2007-1156 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: JBrowser allows remote attackers to bypass authentication and access certain administrative capabilities via a direct request for _admin/. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1008909 - http://www.securityfocus.com/archive/1/460923/100/0/threaded - http://forums.avenir-geopolitique.net/viewtopic.php?t=2693 - http://www.securityfocus.com/archive/1/461298/100/100/threaded - http://osvdb.org/33141 - http://www.securityfocus.com/bid/9537 - http://securityreason.com/security
8/100/100/threaded - http://osvdb.org/33141 - http://www.securityfocus.com/bid/9537 - http://securityreason.com/securityalert/2370
CVE ID: CVE-2007-1157 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T12:43:22.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via certain MBean operations, a different vulnerability than CVE-2006-3733. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/33142 - https://exchange.xforce.ibmcloud.com/vulnerabilities/32673 - http://www.securityfocus.com/archive/1/460934/100/0/threaded - http://www.securityfocus.com/archive/1/461004/100/0/threaded
CVE ID: CVE-2007-1158 State: PUBLISHED Published: 2007-02-28T00:00:00 Last Updated: 2024-08-07T12:43:22.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2336 - http://www.elfisk.dk/index.php?module=pagesetter&func=viewpub&tid=7&pid=125 - http://www.securityfocus.com/bid/22733 - http://osvdb.org/33781 - http://www.securityfocus.com/archive/1/461339/100/0/threaded - http://marc.i
us.com/bid/22733 - http://osvdb.org/33781 - http://www.securityfocus.com/archive/1/461339/100/0/threaded - http://marc.info/?l=full-disclosure&m=117256698219502&w=2 - http://www.vupen.com/english/advisories/2007/0758 - https://exchange.xforce.ibmcloud.com/vulnerabilities/32695 - http://marc.info/?l=full-disclosure&m=117251821622820&w=2 - http://secunia.com/advisories/24299
CVE ID: CVE-2007-1159 State: PUBLISHED Published: 2007-02-28T00:00:00 Last Updated: 2024-08-07T12:43:22.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in modules/out.php in Pyrophobia 2.1.3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/36879 - http://www.securityfocus.com/bid/22667
CVE ID: CVE-2007-1160 State: PUBLISHED Published: 2007-02-28T00:00:00 Last Updated: 2024-08-07T12:43:22.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: webSPELL 4.0, and possibly later versions, allows remote attackers to bypass authentication via a ws_auth cookie, a different vulnerability than CVE-2006-4782. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2337 - http://osvdb.org/33143 - http://www.securityfocus.com/archive/1/460937/100/0/threaded
CVE ID: CVE-2007-1161 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in call_entry.php in Call Center Software 0,93 allows remote attackers to inject arbitrary web script or HTML via the problem_desc parameter, as demonstrated by the ONLOAD attribute of a BODY element. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2333 - http://osvdb.org/33037 - http://www.attrition.org/pipermail/vim/2007-February/001378.html - http://www.securityfocus.com/archive/1/460797/100/0/threaded
CVE ID: CVE-2007-1162 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) IsFolderAvailable or (2) RootFolder property value, different vectors than CVE-2007-0371. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/data/vulnerabilities/exploits/22645.html - http://osvdb.org/34963 - http://www.securityfocus.com/bid/22645 - https://www.exploit-db.com/
ties/exploits/22645.html - http://osvdb.org/34963 - http://www.securityfocus.com/bid/22645 - https://www.exploit-db.com/exploits/3350
CVE ID: CVE-2007-1163 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in printview.php in webSPELL 4.01.02 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter, a different vector than CVE-2007-1019, CVE-2006-5388, and CVE-2006-4783. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/33231 - http://www.securityfocus.com/bid/22659 - http://secunia.com/advisories/24257 - http://www.vupen.com/english/advisories/2007/0714 - https://www.exploit-db.com/exploits/3351
CVE ID: CVE-2007-1164 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in DBImageGallery 1.2.2 allow remote attackers to execute arbitrary PHP code via a URL in the donsimg_base_path parameter to (1) attributes.php, (2) images.php, or (3) scan.php in admin/; or (4) attributes.php, (5) db_utils.php, (6) images.php, (7) utils.php, or (8) values.php in includes/. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/34944 - https://www.exploit-db.com/exploits/3353 - http://www.vupen.com/english/advisories/2007/0692 - http
://osvdb.org/34944 - https://www.exploit-db.com/exploits/3353 - http://www.vupen.com/english/advisories/2007/0692 - http://osvdb.org/34943 - http://osvdb.org/34940 - http://www.securityfocus.com/archive/1/462142/100/0/threaded - http://osvdb.org/34937 - http://www.securityfocus.com/bid/22657 - https://exchange.xforce.ibmcloud.com/vulnerabilities/32612 - http://www.securityfocus.com/archive/1/461741/100/0/threaded - http://osvdb.org/34942 - http://osvdb.org/34938 - http://osvdb.org/34939 - http://osvdb.org/34941
CVE ID: CVE-2007-1165 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in DBGuestbook 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the dbs_base_path parameter to (1) utils.php, (2) guestbook.php, or (3) views.php in includes/. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/3354 - http://osvdb.org/33493 - http://www.vupen.com/english/advisories/2007/0693 - http://www.securityfocus.com/bid/22658 - http://osvdb.org/33494 - http://osvdb.org/33495
CVE ID: CVE-2007-1166 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in result.php in Nabopoll 1.2 allows remote attackers to execute arbitrary SQL commands via the surv parameter. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/33753 - http://attrition.org/pipermail/vim/2007-February/001379.html - http://www.securityfocus.com/archive/1/460765/100/0/threaded - https://www.exploit-db.com/exploits/3355 - http://securityreason.com/securityalert/2372 - http://www.securityfocus.com/bid/22649
CVE ID: CVE-2007-1167 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: inc/filebrowser/browser.php in deV!L`z Clanportal (DZCP) 1.4.5 and earlier allows remote attackers to obtain MySQL data via the inc/mysql.php value of the file parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.dzcp.de/inc/tinymce_files/Downloads/dzcp_update/notes_1.4.6.txt - http://www.securityfocus.com/bid/22660 - http://secunia.com/advisories/24260 - http://osvdb.org/33372 - http://www.vupen.com/english/advisories/2007/0695 - https://www.exploit-db.com/exploits/3357
CVE ID: CVE-2007-1168 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro ServerProtect for Linux (SPLX) 1.25, 1.3, and 2.5 before 20070216 allows remote attackers to access arbitrary web pages and reconfigure the product via HTTP requests with the splx_2376_info cookie to the web interface port (14942/tcp). Additional Analyst Notes: - CVE Program Container: References: - http://www.trendmicro.com/download/product.asp?productid=20 - http://www.vupen.com/english/advisories/2007/0691 - http://www.securityfocus.com/bid/22662 - http://securitytracker.com/id?1017685 - http://secunia.com/advis
es/2007/0691 - http://www.securityfocus.com/bid/22662 - http://securitytracker.com/id?1017685 - http://secunia.com/advisories/24264 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=477
CVE ID: CVE-2007-1169 State: PUBLISHED Published: 2007-02-28T15:00:00Z Last Updated: 2024-09-17T02:27:13.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface in Trend Micro ServerProtect for Linux (SPLX) 1.25, 1.3, and 2.5 before 20070216 accepts logon requests through unencrypted HTTP, which might allow remote attackers to obtain credentials by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://www.trendmicro.com/download/product.asp?productid=20
CVE ID: CVE-2007-1170 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimBin GTR - FIA GT Racing Game 1.5.0.0 and earlier, GT Legends 1.1.0.0 and earlier, GTR 2 1.1 and earlier, and RACE - The WTCC Game 1.0 and earlier allow remote attackers to cause a denial of service (client disconnection) via an empty UDP packet to the server port. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/34240 - http://securityreason.com/securityalert/2369 - http://www.securityfocus.com/bid/22651 - http://aluigi.altervista.org/adv/simbinzero-adv.txt - http://www.securityfocus.com/arc
www.securityfocus.com/bid/22651 - http://aluigi.altervista.org/adv/simbinzero-adv.txt - http://www.securityfocus.com/archive/1/460762/100/0/threaded - http://www.vupen.com/english/advisories/2007/0696
CVE ID: CVE-2007-1171 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 allows remote attackers to execute arbitrary SQL commands via an admin cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.waraxe.us/advisory-53.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/32582 - http://www.securityfocus.com/bid/22629 - http://www.nukescripts.net/index.php?op=NEArticle&sid=4076 - http://www.attrition.org/pipermail/vim/2007-September/001806.html -
ww.nukescripts.net/index.php?op=NEArticle&sid=4076 - http://www.attrition.org/pipermail/vim/2007-September/001806.html - https://www.exploit-db.com/exploits/3337 - http://securityreason.com/securityalert/2344 - http://www.securityfocus.com/archive/1/480994/100/0/threaded - http://www.securityfocus.com/archive/1/460628/100/0/threaded - http://www.securityfocus.com/archive/1/480575/100/0/threaded - http://www.securityfocus.com/bid/25805 - http://secunia.com/advisories/26954
CVE ID: CVE-2007-1172 State: PUBLISHED Published: 2007-02-28T15:00:00 Last Updated: 2024-08-07T12:43:22.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in nukesentinel.php in NukeSentinel 2.5.05, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, aka the "File Disclosure Exploit." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/24221 - http://securityreason.com/securityalert/2341 - http://www.securityfocus.com/archive/1/460599/100/0/threaded - https://www.exploit-db.com/exploits/3338 - http://attrition.org/pipermail/vim/2007-March/001429.html
CVE ID: CVE-2007-1173 State: PUBLISHED Published: 2007-05-16T22:00:00 Last Updated: 2024-08-07T12:43:22.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in the CentennialIPTransferServer service (XFERWAN.EXE), as used by (1) Centennial Discovery 2006 Feature Pack 1, (2) Numara Asset Manager 8.0, and (3) Symantec Discovery 6.5, allow remote attackers to execute arbitrary code via long strings in a crafted TCP packet. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/secunia_research/2007-41/advisory/ - http://www.vupen.com/english/advisories/2007/1834 - http://www.securityfocus.com/bid/24002 - http://www.vupen.com/engl
- http://www.vupen.com/english/advisories/2007/1834 - http://www.securityfocus.com/bid/24002 - http://www.vupen.com/english/advisories/2007/1833 - http://www.securitytracker.com/id?1018072 - http://secunia.com/secunia_research/2007-42/advisory/ - http://www.vupen.com/english/advisories/2007/1832 - https://exchange.xforce.ibmcloud.com/vulnerabilities/34313 - http://secunia.com/secunia_research/2007-43/advisory/ - http://secunia.com/advisories/24090 - http://secunia.com/advisories/24329 - http://osvdb.org/35076 - http://secunia.com/advisories/24281
CVE ID: CVE-2007-1174 State: PUBLISHED Published: 2007-02-28T16:00:00 Last Updated: 2024-08-07T12:43:22.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in WebAPP before 20070214 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to unspecified fields in user Profiles. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/33301 - http://www.vupen.com/english/advisories/2007/0605 - http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=251 - https://exchange.xforce.ibmcloud.com/vul
s/2007/0605 - http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=251 - https://exchange.xforce.ibmcloud.com/vulnerabilities/32506 - http://www.securityfocus.com/bid/22563
CVE ID: CVE-2007-1175 State: PUBLISHED Published: 2007-02-28T16:00:00 Last Updated: 2024-08-07T12:43:22.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in an admin feature in WebAPP before 20070209 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2007/0604 - http://osvdb.org/33275 - http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=249 - http://www.securityfocus.com/bid/22563
CVE ID: CVE-2007-1176 State: PUBLISHED Published: 2007-02-28T16:00:00 Last Updated: 2024-08-07T12:43:22.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) Gallery Comments pages, (2) Feedback pages, (3) Search Results pages, and (4) the Statistics Log viewer. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/33290 - http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250 - http://www.vupen.com/english/advisories/2007/0604 - http://osvdb.org/33276 - http://secunia.c
i?action=viewnews&id=250 - http://www.vupen.com/english/advisories/2007/0604 - http://osvdb.org/33276 - http://secunia.com/advisories/24080 - http://osvdb.org/33289 - http://osvdb.org/33288 - https://exchange.xforce.ibmcloud.com/vulnerabilities/32499 - https://exchange.xforce.ibmcloud.com/vulnerabilities/32498 - http://www.securityfocus.com/bid/22563 - https://exchange.xforce.ibmcloud.com/vulnerabilities/32526
CVE ID: CVE-2007-1177 State: PUBLISHED Published: 2007-02-28T16:00:00 Last Updated: 2024-08-07T12:43:22.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAPP before 0.9.9.5 does not properly filter certain characters in contexts related to (1) the query string, (2) Profiles, (3) the Forum Post icon field, (4) the Edit Profile, and (5) the Gallery, which has unknown impact and remote attack vectors, possibly related to cross-site scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=250 - http://osvdb.org/33277 - http://www.vupen.com/english/advisories/2007/0604 - http://secunia.com/adviso