Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
//www.redhat.com/archives/fedora-package-announce/2008-July/msg00250.html - http://secunia.com/advisories/30941 - http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html - http://jira.codehaus.org/browse/JETTY-452 - http://www.kb.cert.org/vuls/id/237888 - http://secunia.com/advisories/35143 - http://secunia.com/advisories/27925 - http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
CVE ID: CVE-2007-5614 State: PUBLISHED Published: 2007-12-05T11:00:00 Last Updated: 2024-08-07T15:39:13.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00227.html - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00250.html - http://secunia.com/advisories/30941 - http://www.kb.cert.org/vuls/id/438616 - http://www.securityfocus.com/bid/26
html - http://secunia.com/advisories/30941 - http://www.kb.cert.org/vuls/id/438616 - http://www.securityfocus.com/bid/26695 - http://secunia.com/advisories/35143 - http://secunia.com/advisories/27925 - http://osvdb.org/42496 - http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
CVE ID: CVE-2007-5615 State: PUBLISHED Published: 2007-12-05T11:00:00 Last Updated: 2024-08-07T15:39:13.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/42495 - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00227.html - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00250.html - http://secunia.com/advisories/30941 - http://lists.opensuse.org/opensuse-security-announce
nce/2008-July/msg00250.html - http://secunia.com/advisories/30941 - http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html - http://www.kb.cert.org/vuls/id/212984 - http://secunia.com/advisories/35143 - http://secunia.com/advisories/27925 - http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt - http://www.securityfocus.com/bid/26696
CVE ID: CVE-2007-5616 State: PUBLISHED Published: 2008-01-09T21:00:00 Last Updated: 2024-08-07T15:39:13.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: ssh-signer in SSH Tectia Client and Server 5.x before 5.2.4, and 5.3.x before 5.3.6, on Unix and Linux allows local users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/27191 - http://www.vupen.com/english/advisories/2008/0078 - http://securitytracker.com/id?1019167 - http://secunia.com/advisories/28247 - http://www.kb.cert.org/vuls/id/921339 - https://exchange.xforce.ibmcloud.com/vulnerabilities/39569 - http://www.kb.cert.org/vuls/i
.kb.cert.org/vuls/id/921339 - https://exchange.xforce.ibmcloud.com/vulnerabilities/39569 - http://www.kb.cert.org/vuls/id/WDON-7AMRRF
CVE ID: CVE-2007-5617 State: PUBLISHED Published: 2007-10-21T21:00:00 Last Updated: 2024-08-07T15:39:13.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in VMware Player 1.0.x before 1.0.5 and 2.0 before 2.0.1, and Workstation 5.x before 5.5.5 and 6.x before 6.0.1, prevents it from launching, which has unspecified impact, related to untrusted virtual machine images. Additional Analyst Notes: - CVE Program Container: References: - http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html - http://security.gentoo.org/glsa/glsa-200711-23.xml - http://www.vupen.com/english/advisories/2007/3229 - http://www.vmware.com/support/player2/do
g/glsa/glsa-200711-23.xml - http://www.vupen.com/english/advisories/2007/3229 - http://www.vmware.com/support/player2/doc/releasenotes_player2.html - http://secunia.com/advisories/26890 - http://www.vmware.com/support/player/doc/releasenotes_player.html - http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html - http://secunia.com/advisories/27706 - http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html
CVE ID: CVE-2007-5618 State: PUBLISHED Published: 2007-10-21T21:00:00 Last Updated: 2024-08-07T15:39:13.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unquoted Windows search path vulnerability in the Authorization and other services in VMware Player 1.0.x before 1.0.5 and 2.0 before 2.0.1, VMware Server before 1.0.4, and Workstation 5.x before 5.5.5 and 6.x before 6.0.1 might allow local users to gain privileges via malicious programs. Additional Analyst Notes: - CVE Program Container: References: - http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html - http://www.vupen.com/english/advisories/2007/3229 - http://www.vmware.com/support/server/doc/rele
eptember/065902.html - http://www.vupen.com/english/advisories/2007/3229 - http://www.vmware.com/support/server/doc/releasenotes_server.html - http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html - http://www.vmware.com/support/player2/doc/releasenotes_player2.html - http://secunia.com/advisories/26890 - http://www.vmware.com/support/player/doc/releasenotes_player.html - http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html - http://www.securityfocus.com/bid/28289 - http://www.securityfocus.com/archive/1/489739/100/0/threaded - http://lists.vmware.com/pipermail/security-announce/2008/000008.html - http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html - http://www.vupen
il/security-announce/2008/000008.html - http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html - http://www.vupen.com/english/advisories/2008/0905/references - http://www.vmware.com/security/advisories/VMSA-2008-0005.html - http://www.securityfocus.com/bid/28276
CVE ID: CVE-2007-5619 State: PUBLISHED Published: 2007-10-21T21:00:00 Last Updated: 2024-08-07T15:39:13.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in VMware Server before 1.0.4 causes user passwords to be recorded in cleartext in server logs, which might allow local users to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/support/server/doc/releasenotes_server.html
CVE ID: CVE-2007-5620 State: PUBLISHED Published: 2007-10-22T19:00:00 Last Updated: 2024-08-07T15:39:13.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/4546 - https://exchange.xforce.ibmcloud.com/vulnerabilities/37293 - http://www.securityfocus.com/bid/26135 - http://www.vupen.com/english/advisories/2007/3570 - http://osvdb.org/44751
CVE ID: CVE-2007-5621 State: PUBLISHED Published: 2007-10-22T19:00:00 Last Updated: 2024-08-07T15:39:13.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames. Additional Analyst Notes: - CVE Program Container: References: -
2) vocabulary names, (3) term names, and (4) usernames. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/38073 - https://exchange.xforce.ibmcloud.com/vulnerabilities/37275 - http://drupal.org/node/184336 - http://secunia.com/advisories/27291
CVE ID: CVE-2007-5622 State: PUBLISHED Published: 2007-10-29T21:00:00 Last Updated: 2024-08-07T15:39:13.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double free vulnerability in the ftpprchild function in ftppr in 3proxy 0.5 through 0.5.3i allows remote attackers to cause a denial of service (daemon crash) via multiple OPEN commands to the FTP proxy. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/26180 - http://osvdb.org/41870 - http://security.gentoo.org/glsa/glsa-200711-13.xml - http://www.securityfocus.com/archive/1/482697/100/0/threaded - http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066985.html - htt
.com/archive/1/482697/100/0/threaded - http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066985.html - http://3proxy.ru/0.5.3j/Changelog.txt - http://bugs.gentoo.org/show_bug.cgi?id=196772 - https://exchange.xforce.ibmcloud.com/vulnerabilities/37401 - http://secunia.com/advisories/27353 - http://secunia.com/advisories/27607
CVE ID: CVE-2007-5623 State: PUBLISHED Published: 2007-10-23T16:00:00 Last Updated: 2024-08-07T15:39:13.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the check_snmp function in Nagios Plugins (nagios-plugins) 1.4.10 allows remote attackers to cause a denial of service (crash) via crafted snmpget replies. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/27965 - http://www.securityfocus.com/bid/26215 - http://secunia.com/advisories/27609 - https://bugzilla.redhat.com/show_bug.cgi?id=348731 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:067 - http://secunia.com/advisories/28930 - http://www.debian.
tp://www.mandriva.com/security/advisories?name=MDVSA-2008:067 - http://secunia.com/advisories/28930 - http://www.debian.org/security/2008/dsa-1495 - http://www.novell.com/linux/security/advisories/2007_25_sr.html - http://secunia.com/advisories/27496 - https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00010.html - http://secunia.com/advisories/27419 - http://www.vupen.com/english/advisories/2007/3629 - http://security.gentoo.org/glsa/glsa-200711-11.xml - http://sourceforge.net/tracker/?func=detail&atid=397597&aid=1815362&group_id=29880 - http://bugs.gentoo.org/show_bug.cgi?id=196308 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00011.html
CVE ID: CVE-2007-5624 State: PUBLISHED Published: 2007-10-23T16:00:00 Last Updated: 2024-08-07T15:39:13.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Nagios 2.x before 2.10 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html - https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00161.html - http://www.mandriva.com/security/advisories?name=MDVSA-2008:067 - https://bugzilla.redhat.com/show_bug.cgi?id=362791 - http://
/www.mandriva.com/security/advisories?name=MDVSA-2008:067 - https://bugzilla.redhat.com/show_bug.cgi?id=362791 - http://www.vupen.com/english/advisories/2007/3567 - http://secunia.com/advisories/27980 - http://www.nagios.org/development/changelog.php#2x_branch - https://exchange.xforce.ibmcloud.com/vulnerabilities/37350 - https://bugzilla.redhat.com/show_bug.cgi?id=362801 - http://www.securityfocus.com/bid/26152 - https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00125.html - http://secunia.com/advisories/27316
CVE ID: CVE-2007-5625 State: PUBLISHED Published: 2007-10-23T16:00:00 Last Updated: 2024-08-07T15:39:13.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in filename.asp in ASP Site Search SearchSimon Lite 1.0 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/27337 - http://www.securityfocus.com/archive/1/482570/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/37340 - http://osvdb.org/38069 - http://www.securityfocus.com/bid/26142 - http://securityreason.com/securityalert/3275
CVE ID: CVE-2007-5626 State: PUBLISHED Published: 2007-10-23T16:00:00 Last Updated: 2024-08-07T15:39:13.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/37336 - http://security.gentoo.org/glsa/glsa-200807-10.xml - http://bugs.bacula.org/view.php?id=990
.com/vulnerabilities/37336 - http://security.gentoo.org/glsa/glsa-200807-10.xml - http://bugs.bacula.org/view.php?id=990 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446809 - http://www.vupen.com/english/advisories/2007/3572 - http://secunia.com/advisories/27243 - http://osvdb.org/41861 - http://www.securityfocus.com/bid/26156 - http://secunia.com/advisories/31184
CVE ID: CVE-2007-5627 State: PUBLISHED Published: 2007-10-23T16:00:00 Last Updated: 2024-08-07T15:39:13.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in content/fnc-readmail3.php in SocketMail 2.2.8 allows remote attackers to execute arbitrary PHP code via a URL in the __SOCKETMAIL_ROOT parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/37344 - http://www.securityfocus.com/bid/26162 - https://www.exploit-db.com/exploits/4554
CVE ID: CVE-2007-5628 State: PUBLISHED Published: 2007-10-23T16:00:00 Last Updated: 2024-08-07T15:39:13.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in src/scripture.php in The Online Web Library Site (TOWels) 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the pageHeaderFile parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/4555 - http://www.securityfocus.com/bid/26165 - https://exchange.xforce.ibmcloud.com/vulnerabilities/37381
CVE ID: CVE-2007-5629 State: PUBLISHED Published: 2007-10-23T16:00:00 Last Updated: 2024-08-07T15:39:13.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/logon.asp in ShoppingTree CandyPress Store 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2007-2804. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/26153 - http://osvdb.org/38155 - http://secunia.com/advisories/27339 - http://www.securityfocus.c
.securityfocus.com/bid/26153 - http://osvdb.org/38155 - http://secunia.com/advisories/27339 - http://www.securityfocus.com/data/vulnerabilities/exploits/26153.html - http://securityreason.com/securityalert/3267 - https://exchange.xforce.ibmcloud.com/vulnerabilities/37391
CVE ID: CVE-2007-5630 State: PUBLISHED Published: 2007-10-23T17:00:00 Last Updated: 2024-08-07T15:39:13.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in tnews.php in BBsProcesS BBPortalS 1.5.10 through 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a tnews action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/26149 - https://exchange.xforce.ibmcloud.com/vulnerabilities/37346 - https://www.exploit-db.com/exploits/4550
CVE ID: CVE-2007-5631 State: PUBLISHED Published: 2007-10-23T17:00:00 Last Updated: 2024-08-07T15:39:13.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in PeopleAggregator 1.2pre6, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the current_blockmodule_path parameter to (1) AudiosMediaGalleryModule/AudiosMediaGalleryModule.php, (2) ImagesMediaGalleryModule/ImagesMediaGalleryModule.php, (3) MembersFacewallModule/MembersFacewallModule.php, (4) NewestGroupsModule/NewestGroupsModule.php, (5) UploadMediaModule/UploadMediaModule.php, and (6) VideosMediaGalleryModule/VideosMediaGal
ule/NewestGroupsModule.php, (5) UploadMediaModule/UploadMediaModule.php, and (6) VideosMediaGalleryModule/VideosMediaGalleryModule.php in BetaBlockModules/; and (7) the path_prefix parameter to several components. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/45496 - http://www.securityfocus.com/bid/26147 - http://www.securityfocus.com/archive/1/483571/100/0/threaded - http://osvdb.org/45495 - http://osvdb.org/45501 - http://osvdb.org/45500 - https://www.exploit-db.com/exploits/4551 - http://www.myelin.co.nz/post/2007/11/12/#200711121 - http://osvdb.org/45499 - http://osvdb.org/45497 - http://osvdb.org/45498 - https://exchange.xforce.ibmcloud.com/vulnerabi
ttp://osvdb.org/45499 - http://osvdb.org/45497 - http://osvdb.org/45498 - https://exchange.xforce.ibmcloud.com/vulnerabilities/37349
CVE ID: CVE-2007-5632 State: PUBLISHED Published: 2007-10-23T17:00:00 Last Updated: 2024-08-07T15:39:13.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in the kernel in Sun Solaris 8 through 10 allow local users to cause a denial of service (panic), related to the support for retrieval of kernel statistics, and possibly related to the sfmmu_mlspl_enter or sfmmu_mlist_enter functions. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/27306 - http://www.vupen.com/english/advisories/2007/3543 - http://secunia.com/advisories/27536 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-103064-1 -
es/2007/3543 - http://secunia.com/advisories/27536 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-103064-1 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-201339-1 - http://osvdb.org/38483 - http://support.avaya.com/elmodocs2/security/ASA-2007-452.htm - http://www.securityfocus.com/bid/26131 - http://securitytracker.com/id?1018838 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3027 - https://exchange.xforce.ibmcloud.com/vulnerabilities/37289
CVE ID: CVE-2007-5633 State: PUBLISHED Published: 2007-10-23T17:00:00 Last Updated: 2024-08-07T15:39:13.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users to read or write arbitrary MSRs, and gain privileges and load unsigned drivers, via the (1) IOCTL_RDMSR 0x9C402438 and (2) IOCTL_WRMSR 0x9C40243C IOCTLs to \Device\speedfan, as demonstrated by an IOCTL_WRMSR action on MSR_LSTAR. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/37298 - http://osvdb.org/41842 - http://www.reversemode.com/index.p
https://exchange.xforce.ibmcloud.com/vulnerabilities/37298 - http://osvdb.org/41842 - http://www.reversemode.com/index.php?option=com_content&task=view&id=42&Itemid=1 - http://www.securityfocus.com/bid/26123 - http://secunia.com/advisories/27312 - http://www.bugtrack.almico.com/view.php?id=987
CVE ID: CVE-2007-5634 State: PUBLISHED Published: 2007-10-23T17:00:00 Last Updated: 2024-08-07T15:39:13.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, does not properly check a buffer during an IOCTL 0x9c402420 call, which allows local users to cause a denial of service (machine crash) and possibly gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/37299 - http://www.bugtrack.almico.com/view.php?id=987 - http://secunia.com/advisories/27312
CVE ID: CVE-2007-5635 State: PUBLISHED Published: 2007-10-23T17:00:00 Last Updated: 2024-08-07T15:39:13.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Salford Software Support Incident Tracker (SiT!) before 3.30 have unknown impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/26151 - http://sourceforge.net/project/shownotes.php?release_id=547027 - http://secunia.com/advisories/27226
CVE ID: CVE-2007-5636 State: PUBLISHED Published: 2007-10-23T17:00:00 Last Updated: 2024-08-07T15:39:13.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Nortel UNIStim IP Softphone 2050 allows remote attackers to cause a denial of service (application abort) and possibly execute arbitrary code via a flood of invalid characters to the RTCP port (5678/udp) that triggers a Windows error message, aka "extraneous messaging." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/482476/100/0/threaded - http://secunia.com/advisories/27252 - http://securityreason.com/securityalert/3271 - http://www.csnc.ch/static
hreaded - http://secunia.com/advisories/27252 - http://securityreason.com/securityalert/3271 - http://www.csnc.ch/static/advisory/csnc/nortel_UNIStim_IP_softphone_buffer-overflow_v1.0.txt - http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=655203 - http://www.vupen.com/english/advisories/2007/3540 - http://osvdb.org/38521 - https://exchange.xforce.ibmcloud.com/vulnerabilities/37256 - http://www.securityfocus.com/bid/26118
CVE ID: CVE-2007-5637 State: PUBLISHED Published: 2007-10-23T17:00:00 Last Updated: 2024-08-07T15:39:13.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines allow remote attackers to eavesdrop on the physical environment via an Open Audio Stream message that enables "surveillance mode." NOTE: issues relating to a small ID number space can be leveraged to make this attack easier. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/37255 - http://osvdb.o
otes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/37255 - http://osvdb.org/41769 - http://secunia.com/advisories/27234 - http://www.csnc.ch/static/advisory/csnc/nortel_IP_phone_surveillance_mode_v1.0.txt - http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2007/42/022870-01.pdf - http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=654714 - http://securityreason.com/securityalert/3272 - http://www.securityfocus.com/archive/1/482478/100/0/threaded - http://www.securityfocus.com/bid/26120
CVE ID: CVE-2007-5638 State: PUBLISHED Published: 2007-10-23T17:00:00 Last Updated: 2024-08-07T15:39:13.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines, use only 65536 different values in the 32-bit ID number field of an RUDP datagram, which makes it easier for remote attackers to guess the RUDP ID and spoof messages. NOTE: this can be leveraged for an eavesdropping attack by sending many Open Audio Stream messages. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud