Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2007-4847 State: PUBLISHED Published: 2007-09-12T20:00:00 Last Updated: 2024-08-07T15:08:33.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Picasa allows remote attackers to read image files stored by Picasa via unspecified vectors involving a picasa:// URI. NOTE: this information is based upon a vague pre-advisory. Additional Analyst Notes: - CVE Program Container: References: - http://xs-sniper.com/blog/2007/08/20/say-cheeeeeese/ - http://osvdb.org/40565
CVE ID: CVE-2007-4848 State: PUBLISHED Published: 2007-09-12T20:00:00 Last Updated: 2024-08-07T15:08:33.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of local files that have associated images via a res:// URI in the src property of a JavaScript Image object, as demonstrated by the URI for a bitmap image resource within a (1) .exe or (2) .dll file. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/37638 - http://xs-sniper.com/blog/2007/07/20/more-uri-stuff-ies-resouce-uri/
CVE ID: CVE-2007-4849 State: PUBLISHED Published: 2007-09-12T20:00:00 Last Updated: 2024-08-07T15:08:33.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFFS2, as used on One Laptop Per Child (OLPC) build 542 and possibly other Linux systems, when POSIX ACL support is enabled, does not properly store permissions during (1) inode creation or (2) ACL setting, which might allow local users to access restricted files or directories after a remount of a filesystem, related to "legacy modes" and an inconsistency between dentry permissions and inode permissions. Additional Analyst Notes: - CVE Program Container: References: - http://lists.infradead.org/pipermail/linux-mtd-cvs/2007-Au
itional Analyst Notes: - CVE Program Container: References: - http://lists.infradead.org/pipermail/linux-mtd-cvs/2007-August/005897.html - http://secunia.com/advisories/26978 - http://secunia.com/advisories/28706 - http://www.securityfocus.com/bid/25838 - http://git.infradead.org/?p=mtd-2.6.git%3Ba=commitdiff%3Bh=9ed437c50d89eabae763dd422579f73fdebf288d - http://dev.laptop.org/ticket/2732 - http://www.ubuntu.com/usn/usn-558-1 - http://www.ubuntu.com/usn/usn-574-1 - http://secunia.com/advisories/28170 - http://www.debian.org/security/2007/dsa-1378
CVE ID: CVE-2007-4850 State: PUBLISHED Published: 2008-01-25T00:00:00 Last Updated: 2024-08-07T15:08:33.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different vulnerability than CVE-2006-2563. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/1412 - http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html - http://www.securityfocus.com/bid/31681 - http://www.securit
ple.com/archives/security-announce//2008/Jul/msg00003.html - http://www.securityfocus.com/bid/31681 - http://www.securityfocus.com/bid/29009 - http://www.securityfocus.com/bid/27413 - http://www.vupen.com/english/advisories/2008/2268 - http://www.ubuntu.com/usn/usn-628-1 - http://www.securityfocus.com/archive/1/486856/100/0/threaded - http://securityreason.com/achievement_securityalert/51 - http://www.openwall.com/lists/oss-security/2008/05/02/2 - http://www.securityfocus.com/archive/1/492671/100/0/threaded - http://secunia.com/advisories/30411 - http://www.php.net/ChangeLog-5.php - http://www.mandriva.com/security/advisories?name=MDVSA-2009:023 - http://www.mandriva.com/security/advisories?
g-5.php - http://www.mandriva.com/security/advisories?name=MDVSA-2009:023 - http://www.mandriva.com/security/advisories?name=MDVSA-2009:022 - http://secunia.com/advisories/31200 - http://secunia.com/advisories/32222 - http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059849.html - http://securityreason.com/securityalert/3562 - http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178 - http://secunia.com/advisories/31326 - http://www.vupen.com/english/advisories/2008/2780 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42134 - https://exchange.xforce.ibmcloud.com/vulnerabilities/39852 - http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html - http://support.
d.com/vulnerabilities/39852 - http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html - http://support.apple.com/kb/HT3216 - http://cvs.php.net/viewcvs.cgi/php-src/NEWS?revision=1.2027.2.547.2.1047&view=markup - http://secunia.com/advisories/30048
CVE ID: CVE-2007-4851 State: REJECTED Published: 2007-10-08T19:00:00Z Last Updated: 2024-09-16T19:20:15.162Z Description: No description available.
CVE ID: CVE-2007-4861 State: PUBLISHED Published: 2007-10-30T21:00:00 Last Updated: 2024-08-07T15:08:33.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAXON 5.4, with display_errors enabled, allows remote attackers to obtain sensitive information via (1) a direct request for news.php, (2) an invalid use of a newsid array parameter to admin/edit-item.php, and possibly unspecified vectors related to additional scripts in (3) admin/, (4) rss/, and (5) the root directory of the installation, which reveal the path in various error messages. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/45330 - http://www.quirm.net/punbb/viewtopic.php?id=129 - h
tes: - CVE Program Container: References: - http://osvdb.org/45330 - http://www.quirm.net/punbb/viewtopic.php?id=129 - https://exchange.xforce.ibmcloud.com/vulnerabilities/38138 - http://www.securityfocus.com/archive/1/482930/100/0/threaded - http://securityreason.com/securityalert/3311 - http://osvdb.org/45332 - http://osvdb.org/45334 - http://www.netvigilance.com/advisory0053 - http://osvdb.org/45333 - http://osvdb.org/45331
CVE ID: CVE-2007-4862 State: PUBLISHED Published: 2007-10-30T21:00:00 Last Updated: 2024-08-07T15:08:33.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/menu.php in SAXON 5.4 allows remote attackers to inject arbitrary web script or HTML via the config[news_url] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/38134 - http://www.securityfocus.com/bid/26237 - http://www.quirm.net/punbb/viewtopic.php?id=129 - http://securityreason.com/securityalert/3310 - http://www.securityfocus.com/archive/1/482920/100/0/threaded - http://www.netvigilance.com/adviso
m/securityalert/3310 - http://www.securityfocus.com/archive/1/482920/100/0/threaded - http://www.netvigilance.com/advisory0054 - http://secunia.com/advisories/27444
CVE ID: CVE-2007-4863 State: PUBLISHED Published: 2007-10-30T21:00:00 Last Updated: 2024-08-07T15:08:34.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in example.php in SAXON 5.4 allows remote attackers to execute arbitrary SQL commands via the template parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/26238 - http://www.quirm.net/punbb/viewtopic.php?id=129 - http://www.securityfocus.com/archive/1/482921/100/0/threaded - http://www.netvigilance.com/advisory0055 - http://osvdb.org/38839 - https://exchange.xforce.ibmcloud.com/vulnerabilities/38136 - http://securityreason.com/securityalert/33
svdb.org/38839 - https://exchange.xforce.ibmcloud.com/vulnerabilities/38136 - http://securityreason.com/securityalert/3309
CVE ID: CVE-2007-4872 State: PUBLISHED Published: 2007-09-27T19:00:00 Last Updated: 2024-08-07T15:08:33.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpNews 2.41.03 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php; or a direct request to (2) admin/dbg_infos.php, (3) admin/heading.php, or (4) evsearch.php; which reveals the path in various error messages. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/43541 - http://forum.boesch-it.de/viewtopic.php?t=2791 - http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/066052.html - http://osvdb.org/43540 - https://exchange.xf
://lists.grok.org.uk/pipermail/full-disclosure/2007-September/066052.html - http://osvdb.org/43540 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36779 - http://www.securityfocus.com/archive/1/480588/100/0/threaded - http://securityreason.com/securityalert/3174 - http://osvdb.org/43543 - http://www.netvigilance.com/advisory0068 - http://osvdb.org/43542
CVE ID: CVE-2007-4873 State: PUBLISHED Published: 2007-09-27T19:00:00 Last Updated: 2024-08-07T15:08:33.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36778 - http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/066056.html - http://forum.boesch-it.de/viewtopic.php?t=2791 - http://securityreason.com/securityalert/3173
7-September/066056.html - http://forum.boesch-it.de/viewtopic.php?t=2791 - http://securityreason.com/securityalert/3173 - http://osvdb.org/45479 - http://www.securityfocus.com/archive/1/480601/100/0/threaded - http://www.netvigilance.com/advisory0069
CVE ID: CVE-2007-4874 State: PUBLISHED Published: 2007-09-26T20:00:00 Last Updated: 2024-08-07T15:08:33.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in SimpNews 2.41.03 allow remote attackers to inject arbitrary web script or HTML via the (1) l_username parameter to admin/layout2b.php, and the (2) backurl parameter to comment.php. Additional Analyst Notes: - CVE Program Container: References: - http://forum.boesch-it.de/viewtopic.php?t=2791 - http://securityreason.com/securityalert/3166 - http://www.securityfocus.com/bid/25809 - http://secunia.com/advisories/26965 - http://www.securityfocus.com/archive/1/480598/100/0/thre
rityfocus.com/bid/25809 - http://secunia.com/advisories/26965 - http://www.securityfocus.com/archive/1/480598/100/0/threaded - http://www.netvigilance.com/advisory0070 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36774
CVE ID: CVE-2007-4879 State: PUBLISHED Published: 2007-09-13T18:00:00 Last Updated: 2024-08-07T15:08:33.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by requesting the TLS client certificates from other domains. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/490196/100/0/threaded - http://secunia.com/advisories/29541 - http://secun
ces: - http://www.securityfocus.com/archive/1/490196/100/0/threaded - http://secunia.com/advisories/29541 - http://secunia.com/advisories/29539 - http://www.securitytracker.com/id?1019704 - http://secunia.com/advisories/30620 - http://secunia.com/advisories/29560 - http://www.debian.org/security/2008/dsa-1532 - http://secunia.com/advisories/30327 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1 - http://www.ubuntu.com/usn/usn-592-1 - http://secunia.com/advisories/29616 - http://secunia.com/advisories/29645 - http://0x90.eu/ff_tls_poc.html - http://www.vupen.com/english/advisories/2008/1793/references - http://secunia.com/advisories/29558 - http://secunia.com/advisories/295
en.com/english/advisories/2008/1793/references - http://secunia.com/advisories/29558 - http://secunia.com/advisories/29526 - http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html - http://www.us-cert.gov/cas/techalerts/TA08-087A.html - http://www.mozilla.org/security/announce/2008/mfsa2008-17.html - https://bugzilla.mozilla.org/show_bug.cgi?id=395399 - http://www.securityfocus.com/bid/28448 - http://www.debian.org/security/2008/dsa-1534 - http://secunia.com/advisories/29547 - http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml - http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128 - http://www.vupen.com/english/advisories/2008/0998/references - http://www.debian.or
com/wiki/Advisories:rPSA-2008-0128 - http://www.vupen.com/english/advisories/2008/0998/references - http://www.debian.org/security/2008/dsa-1535 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:080
CVE ID: CVE-2007-4880 State: PUBLISHED Published: 2007-09-28T00:00:00 Last Updated: 2024-08-07T15:08:33.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Client Acceptor Daemon (CAD), dsmcad.exe, in certain IBM Tivoli Storage Manager (TSM) clients 5.1 before 5.1.8.1, 5.2 before 5.2.5.2, 5.3 before 5.3.5.3, and 5.4 before 5.4.1.2 allows remote attackers to execute arbitrary code via crafted HTTP headers, aka IC52905. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/25743 - http://www-1.ibm.com/support/docview.wss?uid=swg21268775 - http://www-1.ibm.com/support/search.wss?rs=0&q=IC52905&apar=only - http://secu
com/support/docview.wss?uid=swg21268775 - http://www-1.ibm.com/support/search.wss?rs=0&q=IC52905&apar=only - http://securityreason.com/securityalert/3184 - http://www.zerodayinitiative.com/advisories/ZDI-07-054.html - http://www.vupen.com/english/advisories/2007/3228 - http://secunia.com/advisories/26883 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36700 - http://osvdb.org/38161 - http://www.securityfocus.com/archive/1/480492 - http://www.securitytracker.com/id?1018725
CVE ID: CVE-2007-4881 State: PUBLISHED Published: 2007-09-14T00:00:00 Last Updated: 2024-08-07T15:08:33.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in profile/myprofile.php in psi-labs.com social networking script (psisns), probably 1.0, allows remote attackers to execute arbitrary SQL commands via the u parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36557 - http://osvdb.org/36942 - http://www.vupen.com/english/advisories/2007/3128 - http://www.securityfocus.com/archive/1/478999/100/0/threaded - http://secunia.com/advisories/26774 - http://www.securityfocus.com/bi
ecurityfocus.com/archive/1/478999/100/0/threaded - http://secunia.com/advisories/26774 - http://www.securityfocus.com/bid/25631 - http://securityreason.com/securityalert/3131
CVE ID: CVE-2007-4882 State: PUBLISHED Published: 2007-09-14T00:00:00 Last Updated: 2024-08-07T15:08:33.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in TechExcel CustomerWise (formerly TechExcel CRM) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://arquilliere.blog.rhonealpesjob.com/index.php/post/2007/09/12/Decouverte-de-vulnerabilite-publication-et-patch - http://arquilliere.blog.rhonealpesjob.com/index.php/post/2007/09/11/Premiere-faille-publiee-de-lannee - http://osvdb.org/37083 - http://www.securityfocus.com/
com/index.php/post/2007/09/11/Premiere-faille-publiee-de-lannee - http://osvdb.org/37083 - http://www.securityfocus.com/bid/25624
CVE ID: CVE-2007-4883 State: PUBLISHED Published: 2007-09-14T00:00:00 Last Updated: 2024-08-07T15:08:33.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the BotQuery extension in MediaWiki 1.7.x and earlier before SVN 20070910 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a similar issue to CVE-2007-4828. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/37336 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html
CVE ID: CVE-2007-4884 State: PUBLISHED Published: 2007-09-14T00:00:00 Last Updated: 2024-08-07T15:08:33.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: Media Player Classic (MPC) allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0154.html - http://osvdb.org/37377
CVE ID: CVE-2007-4885 State: PUBLISHED Published: 2007-09-14T00:00:00Z Last Updated: 2024-09-16T16:43:34.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avnex AV MP3 Player allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0154.html
CVE ID: CVE-2007-4886 State: PUBLISHED Published: 2007-09-14T00:00:00 Last Updated: 2024-08-07T15:08:33.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftp, (3) ftps, or (4) ssh2.sftp URL, in the pilih parameter, for which PHP remote file inclusion is blocked only for http URLs. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/4390 - http://www.auracms.org/?pilih=news&aksi=lihat&id=117 - http://osvdb.org/40506
CVE ID: CVE-2007-4887 State: PUBLISHED Published: 2007-09-14T00:00:00 Last Updated: 2024-08-07T15:08:33.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dl function in PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in the library parameter. NOTE: there are limited usage scenarios under which this would be a vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.php.net/ChangeLog-5.php#5.2.5 - http://securityreason.com/securityalert/3133 - https://issues.rpath.com/browse/RPL-1943 - http://secunia.com/advisories/28750 - http://www.gentoo.org/security/en/glsa/glsa-
://issues.rpath.com/browse/RPL-1943 - http://secunia.com/advisories/28750 - http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml - http://www.vupen.com/english/advisories/2008/0924/references - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5767 - http://secunia.com/advisories/30040 - http://www.securityfocus.com/archive/1/478988/100/0/threaded - http://www.vupen.com/english/advisories/2008/0398 - http://www.php.net/releases/5_2_5.php - http://secunia.com/advisories/27659 - http://secunia.com/advisories/29420 - http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html - http://www.securityfocus.com/archive/1/491693/100/0/threaded -
.com/archives/security-announce/2008/Mar/msg00001.html - http://www.securityfocus.com/archive/1/491693/100/0/threaded - http://www.securityfocus.com/archive/1/478985/100/0/threaded - http://www.securityfocus.com/archive/1/491693/100/0/threaded - http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242 - http://docs.info.apple.com/article.html?artnum=307562 - http://secunia.com/advisories/27102 - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501 - http://www.securityfocus.com/bid/26403 - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501 - http://www.vupen.com/english/advisories/2007/3825
CVE ID: CVE-2007-4888 State: PUBLISHED Published: 2007-09-14T00:00:00 Last Updated: 2024-08-07T15:08:34.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribute of the doc variable. Additional Analyst Notes: - CVE Program Container: References: - http://jira.xwiki.org/jira/browse/XWIKI-726 - http://osvdb.org/40499
CVE ID: CVE-2007-4889 State: PUBLISHED Published: 2007-09-14T01:00:00 Last Updated: 2024-08-07T15:08:33.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MySQL extension in PHP 5.2.4 and earlier allows remote attackers to bypass safe_mode and open_basedir restrictions via the MySQL (1) LOAD_FILE, (2) INTO DUMPFILE, and (3) INTO OUTFILE functions, a different issue than CVE-2007-3997. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3134 - http://www.securityfocus.com/archive/1/479082/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/36555 - http://www.securityfocus.com/archive/1/479187/100/200/threa
https://exchange.xforce.ibmcloud.com/vulnerabilities/36555 - http://www.securityfocus.com/archive/1/479187/100/200/threaded - http://www.securityfocus.com/archive/1/479189/100/200/threaded
CVE ID: CVE-2007-4890 State: PUBLISHED Published: 2007-09-14T01:00:00 Last Updated: 2024-08-07T15:08:34.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute directory traversal vulnerability in a certain ActiveX control in the VB To VSI Support Library (VBTOVSI.DLL) 1.0.0.0 in Microsoft Visual Studio 6.0 allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SaveAs method. NOTE: contents can be copied from local files via the Load method. Additional Analyst Notes: - CVE Program Container: References: - http://shinnai.altervista.org/exploits/txt/TXT_qwFZc3a35RLy5AGxVBjJ.html - https://exchange.xforce.ibmcloud.com/vulnerabi
ttp://shinnai.altervista.org/exploits/txt/TXT_qwFZc3a35RLy5AGxVBjJ.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/36571 - https://www.exploit-db.com/exploits/4394 - http://secunia.com/advisories/26779 - http://www.securityfocus.com/bid/25635
CVE ID: CVE-2007-4891 State: PUBLISHED Published: 2007-09-14T01:00:00 Last Updated: 2024-08-07T15:08:33.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) SyncShell, (3) SaveAs, (4) CABDefaultURL, (5) CABFileName, and (6) CABRunFile methods, which allows remote attackers to execute arbitrary programs and have other impacts, as demonstrated using absolute pathnames in arguments to StartProcess and SyncShell. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36572 - https://www.ex
otes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36572 - https://www.exploit-db.com/exploits/4393 - http://shinnai.altervista.org/exploits/txt/TXT_AZJ5bXwXvMARqwtfe97I.html - http://osvdb.org/37106 - http://secunia.com/advisories/26779 - http://www.securityfocus.com/bid/25638
CVE ID: CVE-2007-4892 State: PUBLISHED Published: 2007-09-14T18:00:00 Last Updated: 2024-08-07T15:08:34.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in SWSoft Plesk 7.6.1, 8.1.0, 8.1.1, and 8.2.0 for Windows allow remote attackers to execute arbitrary SQL commands via a PLESKSESSID cookie to (1) login.php3 or (2) auth.php3. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/26741 - http://marc.info/?l=bugtraq&m=118960991517910&w=2 - http://www.osvdb.org/37009 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36580 - http://kb.swsoft.com/en/2159 - http://www.securityfocus.com/bid/25646