Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2007-5186 State: PUBLISHED Published: 2007-10-03T14:00:00 Last Updated: 2024-08-07T15:24:42.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute was retracted after additional analysis. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/4476 - http://sourceforge.net/project/shownotes.php?group_id=82171&release_id=543854 - http:
www.exploit-db.com/exploits/4476 - http://sourceforge.net/project/shownotes.php?group_id=82171&release_id=543854 - http://www.attrition.org/pipermail/vim/2007-October/001811.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/36903 - http://www.attrition.org/pipermail/vim/2007-October/001816.html - http://www.vupen.com/english/advisories/2007/3342 - http://secunia.com/advisories/27025 - http://www.securityfocus.com/bid/25889
CVE ID: CVE-2007-5187 State: PUBLISHED Published: 2007-10-03T14:00:00 Last Updated: 2024-08-07T15:24:41.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in infusions/calendar_events_panel/show_single.php in the Expanded Calendar 2.x module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the sel parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36904 - http://www.securityfocus.com/bid/25876 - http://osvdb.org/38593 - https://www.exploit-db.com/exploits/4475 - http://www.vupen.com/english/advisories/2007/3331
CVE ID: CVE-2007-5188 State: PUBLISHED Published: 2007-10-03T14:00:00 Last Updated: 2024-08-07T15:24:42.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the XOOPS uploader class in Xoops 2.0.17.1-RC1 and earlier allows remote attackers to upload arbitrary files via unspecified vectors related to improper upload configuration settings in class/uploader.php and class/mimetypes.inc.php, possibly an incomplete blacklist that omits the .php4 extension. Additional Analyst Notes: - CVE Program Container: References: - http://www.xoops.org/modules/news/article.php?storyid=3963 - http://secunia.com/advisories/27006 - http://sourceforge.net/project/shownotes
g/modules/news/article.php?storyid=3963 - http://secunia.com/advisories/27006 - http://sourceforge.net/project/shownotes.php?group_id=41586&release_id=543338 - http://www.vupen.com/english/advisories/2007/3315 - http://osvdb.org/41386 - http://www.securityfocus.com/bid/25878
CVE ID: CVE-2007-5189 State: PUBLISHED Published: 2007-10-03T14:00:00 Last Updated: 2024-08-07T15:24:42.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in mes_add.php in x-script GuestBook 1.3a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) icq, and (4) website parameters. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36895 - http://www.securityfocus.com/archive/1/481209/100/0/threaded - http://securityreason.com/securityalert/3186 - http://www.securityfocus.com/bid/25890 - http://www.vupe
100/0/threaded - http://securityreason.com/securityalert/3186 - http://www.securityfocus.com/bid/25890 - http://www.vupen.com/english/advisories/2007/3347
CVE ID: CVE-2007-5190 State: PUBLISHED Published: 2007-10-22T19:00:00 Last Updated: 2024-08-07T15:24:42.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Alcatel OmniVista 4760 R4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the action parameter to php-bin/Webclient.php or (2) the Langue parameter to the default URI. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3280 - http://www1.alcatel-lucent.com/psirt/statements/2007003/4760xss.htm - http://www.s21sec.com/avisos/s21sec-038-en.txt - http://www.securityfocus.com/bid/26128 - h
ements/2007003/4760xss.htm - http://www.s21sec.com/avisos/s21sec-038-en.txt - http://www.securityfocus.com/bid/26128 - http://osvdb.org/37997 - http://secunia.com/advisories/27294 - http://www.securityfocus.com/archive/1/482507/100/0/threaded - http://www.vupen.com/english/advisories/2007/3541
CVE ID: CVE-2007-5191 State: PUBLISHED Published: 2007-10-04T16:00:00 Last Updated: 2024-08-07T15:24:42.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/usn-533-1 - https://issues.rpath.com/browse/RPL-1757 - http://secunia.com/advisories/27145 - http://bugs.gentoo.org/show_bug.cgi?id=195390 - http://secunia.com/advisories/27122 - http://frontal2.mandriva.com/en/security/a
ugs.gentoo.org/show_bug.cgi?id=195390 - http://secunia.com/advisories/27122 - http://frontal2.mandriva.com/en/security/advisories?name=MDKSA-2007:198 - http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git%3Ba=commit%3Bh=ebbeb2c7ac1b00b6083905957837a271e80b187e - http://secunia.com/advisories/28349 - http://www.debian.org/security/2008/dsa-1449 - http://www.debian.org/security/2008/dsa-1450 - http://secunia.com/advisories/27104 - http://secunia.com/advisories/27283 - http://www.securityfocus.com/archive/1/485936/100/0/threaded - http://secunia.com/advisories/27354 - http://lists.vmware.com/pipermail/security-announce/2008/000002.html - http://secunia.com/advisories/28469 - http://se
- http://lists.vmware.com/pipermail/security-announce/2008/000002.html - http://secunia.com/advisories/28469 - http://security.gentoo.org/glsa/glsa-200710-18.xml - http://secunia.com/advisories/28348 - http://www.securitytracker.com/id?1018782 - https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00144.html - http://secunia.com/advisories/27687 - https://bugzilla.redhat.com/show_bug.cgi?id=320041 - http://secunia.com/advisories/28368 - http://secunia.com/advisories/27399 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10101 - http://www.securityfocus.com/bid/25973 - http://secunia.com/advisories/27188 - http://support.avaya.com/elm
ef%3A10101 - http://www.securityfocus.com/bid/25973 - http://secunia.com/advisories/27188 - http://support.avaya.com/elmodocs2/security/ASA-2008-023.htm - http://www.vupen.com/english/advisories/2007/3417 - http://www.redhat.com/support/errata/RHSA-2007-0969.html - http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html - http://www.vmware.com/security/advisories/VMSA-2008-0001.html - http://www.vupen.com/english/advisories/2008/0064 - http://www.securityfocus.com/archive/1/486859/100/0/threaded
CVE ID: CVE-2007-5193 State: PUBLISHED Published: 2007-10-04T16:00:00 Last Updated: 2024-08-07T15:24:41.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory (cfg{RCS}{WorkAreaDir}) under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=444982 - http://osvdb.org/42338
CVE ID: CVE-2007-5194 State: PUBLISHED Published: 2007-10-04T17:00:00 Last Updated: 2024-08-07T15:24:41.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Chroot server in rMake 1.0.11 creates a /dev/zero device file with read/write permissions for the rMake user and the same minor device number as /dev/port, which might allow local users to gain root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://issues.rpath.com/browse/RMK-634 - http://www.securityfocus.com/bid/25899 - http://secunia.com/advisories/27030 - https://bugs.gentoo.org/show_bug.cgi?id=194550 - http://www.securityfocus.com/archive/1/481395/100/0/threaded
CVE ID: CVE-2007-5195 State: PUBLISHED Published: 2007-10-14T18:00:00 Last Updated: 2024-08-07T15:24:41.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the SSL implementation in Groupwise client system in the novell-groupwise-client package in SUSE Linux Enterprise Desktop 10 allows remote attackers to obtain credentials via a man-in-the-middle attack, a different vulnerability than CVE-2007-5196. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/45492 - http://secunia.com/advisories/27229 - http://www.novell.com/linux/security/advisories/2007_20_sr.html
CVE ID: CVE-2007-5196 State: PUBLISHED Published: 2007-10-14T18:00:00 Last Updated: 2024-08-07T15:24:42.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the SSL implementation in Groupwise client system in the novell-groupwise-client package in SUSE Linux Enterprise Desktop 10 allows remote attackers to obtain credentials via a man-in-the-middle attack, a different vulnerability than CVE-2007-5195. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/27229 - http://www.novell.com/linux/security/advisories/2007_20_sr.html - http://osvdb.org/45491
CVE ID: CVE-2007-5197 State: PUBLISHED Published: 2007-11-02T16:00:00 Last Updated: 2024-08-07T15:24:42.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Mono.Math.BigInteger class in Mono 1.2.5.1 and earlier allows context-dependent attackers to execute arbitrary code via unspecified vectors related to Reduce in Montgomery-based Pow methods. Additional Analyst Notes: - CVE Program Container: References: - http://www.gentoo.org/security/en/glsa/glsa-200711-10.xml - https://exchange.xforce.ibmcloud.com/vulnerabilities/38248 - http://secunia.com/advisories/27493 - http://www.securityfocus.com/bid/26279 - http://bugs.gentoo.org/attachment.cgi?id=134361&actio
ia.com/advisories/27493 - http://www.securityfocus.com/bid/26279 - http://bugs.gentoo.org/attachment.cgi?id=134361&action=view - http://www.vupen.com/english/advisories/2007/3716 - http://bugs.gentoo.org/show_bug.cgi?id=197067 - http://secunia.com/advisories/27583 - http://www.securitytracker.com/id?1018892 - http://secunia.com/advisories/27937 - http://secunia.com/advisories/27511 - http://secunia.com/advisories/27639 - https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00249.html - http://www.ubuntu.com/usn/usn-553-1 - http://www.mandriva.com/security/advisories?name=MDKSA-2007:218 - https://bugzilla.redhat.com/show_bug.cgi?id=367471 - http://secunia.com/advisories/27
y/advisories?name=MDKSA-2007:218 - https://bugzilla.redhat.com/show_bug.cgi?id=367471 - http://secunia.com/advisories/27439 - http://secunia.com/advisories/27612 - http://www.debian.org/security/2007/dsa-1397 - http://www.novell.com/linux/security/advisories/2007_23_sr.html
CVE ID: CVE-2007-5198 State: PUBLISHED Published: 2007-10-04T17:00:00 Last Updated: 2024-08-07T15:24:42.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the redir function in check_http.c in Nagios Plugins before 1.4.10, when running with the -f (follow) option, allows remote web servers to execute arbitrary code via Location header responses (redirects) with a large number of leading "L" characters. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/27965 - http://www.vupen.com/english/advisories/2007/3394 - http://bugs.gentoo.org/show_bug.cgi?id=194178 - http://secunia.com/advisories/27609 - http://secunia.com/ad
/2007/3394 - http://bugs.gentoo.org/show_bug.cgi?id=194178 - http://secunia.com/advisories/27609 - http://secunia.com/advisories/27124 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:067 - http://secunia.com/advisories/28930 - http://secunia.com/advisories/29862 - http://sourceforge.net/forum/forum.php?forum_id=740172 - http://sourceforge.net/tracker/index.php?func=detail&aid=1687867&group_id=29880&atid=397597 - https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00282.html - http://www.ubuntu.com/usn/usn-532-1 - http://www.securityfocus.com/bid/25952 - http://www.debian.org/security/2008/dsa-1495 - http://www.novell.com/linux/security/advisories/2007_25_sr.ht
bid/25952 - http://www.debian.org/security/2008/dsa-1495 - http://www.novell.com/linux/security/advisories/2007_25_sr.html - http://secunia.com/advisories/27362 - http://sourceforge.net/tracker/index.php?func=detail&aid=1813346&group_id=29880&atid=397597 - http://security.gentoo.org/glsa/glsa-200711-11.xml - https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00249.html - https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00320.html
CVE ID: CVE-2007-5199 State: PUBLISHED Published: 2017-08-18T20:00:00 Last Updated: 2024-08-07T15:24:42.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: A single byte overflow in catalogue.c in X.Org libXfont 1.3.1 allows remote attackers to have unspecified impact. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=327854 - https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=5bf703700ee4a5d6eae20da07cb7a29369667aef
CVE ID: CVE-2007-5200 State: PUBLISHED Published: 2007-10-14T18:00:00 Last Updated: 2024-08-07T15:24:42.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: hugin, as used on various operating systems including SUSE openSUSE 10.2 and 10.3, allows local users to overwrite arbitrary files via a symlink attack on the hugin_debug_optim_results.txt temporary file. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/27623 - http://security.gentoo.org/glsa/glsa-200712-01.xml - https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00199.html - https://bugzilla.redhat.com/show_bug.cgi?id=362851 - http://secunia.com/advisories/27
unce/2007-November/msg00199.html - https://bugzilla.redhat.com/show_bug.cgi?id=362851 - http://secunia.com/advisories/27952 - http://secunia.com/advisories/27653 - http://secunia.com/advisories/27229 - http://www.securityfocus.com/bid/26730 - https://bugzilla.redhat.com/show_bug.cgi?id=332401 - http://www.novell.com/linux/security/advisories/2007_20_sr.html - http://osvdb.org/42224
CVE ID: CVE-2007-5201 State: PUBLISHED Published: 2007-10-04T17:00:00 Last Updated: 2024-08-07T15:24:42.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840 - http://www.securityfocus.com/bid/27771 - https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.html - https://bugzilla.redhat.com/show_bug.cgi?id=293081 - http://secunia.com/advisori
-announce/2008-February/msg00356.html - https://bugzilla.redhat.com/show_bug.cgi?id=293081 - http://secunia.com/advisories/28917 - http://duplicity.nongnu.org/CHANGELOG - http://osvdb.org/42339 - https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.html
CVE ID: CVE-2007-5207 State: PUBLISHED Published: 2007-10-04T21:00:00 Last Updated: 2024-08-07T15:24:42.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: guilt 0.27 allows local users to overwrite arbitrary files via a symlink attack on a guilt.log.[PID] temporary file. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36970 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445308 - http://osvdb.org/41534 - http://secunia.com/advisories/27076 - http://www.securityfocus.com/bid/25941
CVE ID: CVE-2007-5208 State: PUBLISHED Published: 2007-10-13T00:00:00 Last Updated: 2024-08-07T15:24:41.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail. Additional Analyst Notes: - CVE Program Container: References: - https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00200.html - http://www.vupen.com/english/advisories/2007/3479 - http://secunia.com/advisories/27271 - http://secunia.com/advisories/27202
//www.vupen.com/english/advisories/2007/3479 - http://secunia.com/advisories/27271 - http://secunia.com/advisories/27202 - http://bugs.gentoo.org/show_bug.cgi?id=195565 - https://launchpad.net/bugs/149121 - http://secunia.com/advisories/27224 - http://secunia.com/advisories/27221 - http://security.gentoo.org/glsa/glsa-200710-26.xml - https://usn.ubuntu.com/530-1/ - http://www.debian.org/security/2008/dsa-1462 - http://secunia.com/advisories/28453 - http://secunia.com/advisories/27397 - http://www.securitytracker.com/id?1018806 - http://www.securityfocus.com/bid/26054 - http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:201 - http://secunia.com/advisories/27332 - https://bugzilla.
://www.mandriva.com/en/security/advisories?name=MDKSA-2007:201 - http://secunia.com/advisories/27332 - https://bugzilla.redhat.com/show_bug.cgi?id=319921 - http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html - http://secunia.com/advisories/27232 - http://www.redhat.com/support/errata/RHSA-2007-0960.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10692 - http://qa.mandriva.com/show_bug.cgi?id=30719 - https://exchange.xforce.ibmcloud.com/vulnerabilities/37183
CVE ID: CVE-2007-5209 State: PUBLISHED Published: 2007-10-04T23:00:00 Last Updated: 2024-08-07T15:24:42.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in DriveLock.exe in CenterTools DriveLock 5.0 allows remote attackers to execute arbitrary code via a long HTTP request to TCP port 6061. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/25902 - http://secunia.com/advisories/26951 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36930 - http://osvdb.org/41391
CVE ID: CVE-2007-5210 State: PUBLISHED Published: 2007-10-04T23:00:00 Last Updated: 2024-08-07T15:24:42.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbor Networks Peakflow SP before 3.5.1 patch 14, and 3.6.x before 3.6.1 patch 5, allows remote authenticated users to bypass access restrictions and read or write unspecified data via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/25907 - http://secunia.com/advisories/27003 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36924
CVE ID: CVE-2007-5211 State: PUBLISHED Published: 2007-10-04T23:00:00 Last Updated: 2024-08-07T15:24:42.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Arbor Networks Peakflow SP 3.5.1 before patch 14, and 3.6.1 before patch 5, when scope accounts are enabled, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving GET or POST requests. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36926 - http://ww
yst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36926 - http://www.securityfocus.com/bid/25910 - http://secunia.com/advisories/27003
CVE ID: CVE-2007-5212 State: PUBLISHED Published: 2007-10-04T23:00:00 Last Updated: 2024-08-07T15:24:42.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware before 2.43 allow remote attackers to inject arbitrary web script or HTML via (1) parameters associated with saved settings, as demonstrated by the conf_SMTP_MailServer1 parameter to ServerManager.srv; or (2) the subpage parameter to wizard/first/wizard_main_first.shtml. NOTE: an attacker can leverage a CSRF vulnerability to modify saved settings. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.o
vulnerability to modify saved settings. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/38795 - http://www.procheckup.com/Vulnerability_Axis_2100_research.pdf - http://securityreason.com/securityalert/3188 - http://www.securityfocus.com/bid/25837 - http://osvdb.org/38796 - http://www.securityfocus.com/archive/1/480995/100/0/threaded
CVE ID: CVE-2007-5213 State: PUBLISHED Published: 2007-10-04T23:00:00 Last Updated: 2024-08-07T15:24:42.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to perform actions as administrators, as demonstrated by (1) an SMTP server change through the conf_SMTP_MailServer1 parameter to ServerManager.srv and (2) a hostname change through the conf_Network_HostName parameter on the Network page. Additional Analyst Notes: - CVE Program Container: References: - http://www.procheckup.com/Vulnerability_Axis_2100_research.pdf - http://osvdb.
s: - CVE Program Container: References: - http://www.procheckup.com/Vulnerability_Axis_2100_research.pdf - http://osvdb.org/39490 - http://securityreason.com/securityalert/3188 - http://www.securityfocus.com/bid/25837 - http://osvdb.org/39491 - http://www.securityfocus.com/archive/1/480995/100/0/threaded
CVE ID: CVE-2007-5214 State: PUBLISHED Published: 2007-10-04T23:00:00 Last Updated: 2024-08-07T15:24:42.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to the default URI associated with a directory, as demonstrated by (a) the root directory and (b) the view/ directory; (2) parameters associated with saved settings, as demonstrated by (c) the conf_Network_HostName parameter on the Network page and (d) the conf_Layout_OwnTitle parameter to ServerManager.srv; and (3) the query
stName parameter on the Network page and (d) the conf_Layout_OwnTitle parameter to ServerManager.srv; and (3) the query string to ServerManager.srv, which is displayed on the logs page. NOTE: an attacker can leverage a CSRF vulnerability to modify saved settings. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/39493 - http://www.procheckup.com/Vulnerability_Axis_2100_research.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/36842 - http://securityreason.com/securityalert/3188 - http://osvdb.org/39494 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36840 - http://www.securityfocus.com/bid/25837 - https://exchange.xforce.ibmcloud.com/vulnerabi
loud.com/vulnerabilities/36840 - http://www.securityfocus.com/bid/25837 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36841 - http://www.securityfocus.com/archive/1/480995/100/0/threaded - http://osvdb.org/39492 - http://osvdb.org/39495