Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2006-7196 State: PUBLISHED Published: 2007-05-09T22:00:00 Last Updated: 2024-08-07T20:57:40.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1. Additional Analyst Notes: - CVE Program Container: References: - http://tomcat.apache.org/security-4.html - http://osvdb.org/34888 - http://secunia.com/advisories/2
ainer: References: - http://tomcat.apache.org/security-4.html - http://osvdb.org/34888 - http://secunia.com/advisories/29242 - http://www.securityfocus.com/archive/1/500412/100/0/threaded - http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html - http://secunia.com/advisories/33668 - http://www.securityfocus.com/archive/1/500396/100/0/threaded - http://www.securityfocus.com/bid/25531 - http://www.vupen.com/english/advisories/2007/1729 - http://www.vupen.com/english/advisories/2009/0233 - http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm - http://www.securityfocus.com/archive/1/478491/100/0/threaded - http://tomcat.apache.org/security-5.html - http://www.redhat.
://www.securityfocus.com/archive/1/478491/100/0/threaded - http://tomcat.apache.org/security-5.html - http://www.redhat.com/support/errata/RHSA-2008-0261.html - http://www.securityfocus.com/archive/1/478609/100/0/threaded - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540 - https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995
57c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2006-7197 State: PUBLISHED Published: 2007-04-25T20:00:00 Last Updated: 2024-08-07T20:57:39.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28477 - http://issues.apache.org/bugzilla/show_bug.cgi?id=38859 - http://www.redhat.com/support/errata/RHSA-2008-0261.html - https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8c
rt/errata/RHSA-2008-0261.html - https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/
91182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2006-7198 State: PUBLISHED Published: 2007-04-30T22:00:00 Last Updated: 2024-08-07T20:57:40.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in IBM WebSphere Application Server (WAS) before 5.1.1.14, and WAS for z/OS 601 before 6.0.2.13, has unknown impact and attack vectors, related to a "Potential security exposure," aka PK26123. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/33949 - http://secunia.com/advisories/25045 - http://www-1.ibm.com/support/docview.wss?uid=swg1PK29435 - http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006879 - http://www-1.ibm.com/sup
docview.wss?uid=swg1PK29435 - http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006879 - http://www-1.ibm.com/support/search.wss?rs=0&q=PK26123&apar=only - http://www.vupen.com/english/advisories/2007/1553 - http://securitytracker.com/id?1017976
CVE ID: CVE-2006-7199 State: PUBLISHED Published: 2007-04-30T23:00:00Z Last Updated: 2024-09-16T19:01:50.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC RSA Security SiteKey allows remote attackers to display the correct image via a man-in-the-middle (MITM) attack in which an attacker-controlled server proxies authentication data to and from a legitimate SiteKey server. NOTE: the vendor disputes the severity of the issue, stating that it is easier to monitor this attack than "attacks against static web pages." Additional Analyst Notes: - CVE Program Container: References: - http://www.cr-labs.com/publications/WhySiteKey-20060824.pdf - http://www.cr-labs.com/publications/S
ainer: References: - http://www.cr-labs.com/publications/WhySiteKey-20060824.pdf - http://www.cr-labs.com/publications/SiteKey-20060718.pdf - http://www.networkworld.com/newsletters/sec/2007/0402sec2.html
CVE ID: CVE-2006-7200 State: PUBLISHED Published: 2007-04-30T23:00:00Z Last Updated: 2024-09-16T22:03:12.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC RSA Security SiteKey issues challenge-bypass tokens that persist forever without a cancellation interface for end users, which makes it easier for attackers to bypass one stage of authentication by stealing and replaying a token. Additional Analyst Notes: - CVE Program Container: References: - http://www.cr-labs.com/publications/WhySiteKey-20060824.pdf - http://www.cr-labs.com/publications/SiteKey-20060718.pdf
CVE ID: CVE-2006-7201 State: PUBLISHED Published: 2007-04-30T23:00:00Z Last Updated: 2024-09-16T18:54:19.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC RSA Security SiteKey does not set the secure qualifier on the SiteKey Flash token (aka the PassMark Flash shared object), which might allow remote attackers to obtain the token via HTTP. Additional Analyst Notes: - CVE Program Container: References: - http://www.cr-labs.com/publications/WhySiteKey-20060824.pdf - http://www.cr-labs.com/publications/SiteKey-20060718.pdf
CVE ID: CVE-2006-7202 State: PUBLISHED Published: 2007-05-09T18:00:00 Last Updated: 2024-08-07T20:57:40.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dofreePDF function in includes/pdf.php in Mambo 4.6.1 does not properly check access rights for database content, which allows remote attackers to read certain content via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/25039 - http://www.securityfocus.com/bid/23787 - http://www.tracker.mambo-foundation.org/?do=details&task_id=170
CVE ID: CVE-2006-7203 State: PUBLISHED Published: 2007-05-14T17:00:00 Last Updated: 2024-08-07T20:57:40.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: The compat_sys_mount function in fs/compat.c in Linux kernel 2.6.20 and earlier allows local users to cause a denial of service (NULL pointer dereference and oops) by mounting a smbfs file system in compatibility mode ("mount -t smbfs"). Additional Analyst Notes: - CVE Program Container: References: - http://www.novell.com/linux/security/advisories/2007_43_kernel.html - http://secunia.com/advisories/26289 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff_plain%3Bh=822191a2fa1584a29c3224ab328507a
ttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff_plain%3Bh=822191a2fa1584a29c3224ab328507adcaeac1ab - http://secunia.com/advisories/25838 - http://www.mandriva.com/security/advisories?name=MDKSA-2007:171 - http://www.debian.org/security/2008/dsa-1504 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10941 - http://secunia.com/advisories/25683 - http://secunia.com/advisories/26620 - http://www.ubuntu.com/usn/usn-489-1 - http://www.mandriva.com/security/advisories?name=MDKSA-2007:196 - http://secunia.com/advisories/25961 - http://support.avaya.com/elmodocs2/security/ASA-2007-287.htm - http://www.vupen.com/english/advisories/2
isories/25961 - http://support.avaya.com/elmodocs2/security/ASA-2007-287.htm - http://www.vupen.com/english/advisories/2007/2209 - http://secunia.com/advisories/29058 - http://secunia.com/advisories/25682 - https://rhn.redhat.com/errata/RHSA-2007-0376.html - http://www.ubuntu.com/usn/usn-486-1 - http://www.novell.com/linux/security/advisories/2007_35_kernel.html - http://secunia.com/advisories/25700 - http://secunia.com/advisories/26139 - http://rhn.redhat.com/errata/RHSA-2007-0488.html - http://secunia.com/advisories/26133
CVE ID: CVE-2006-7204 State: PUBLISHED Published: 2007-05-22T19:00:00 Last Updated: 2024-08-07T20:57:41.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: The imap_body function in PHP before 4.4.4 does not implement safemode or open_basedir checks, which allows local users to read arbitrary files or list arbitrary directory contents. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/28005 - http://secunia.com/advisories/21546 - http://us2.php.net/ChangeLog-4.php#4.4.4 - http://bugs.php.net/bug.php?id=37265
CVE ID: CVE-2006-7205 State: PUBLISHED Published: 2007-05-24T01:29:00Z Last Updated: 2024-09-17T02:36:45.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: The array_fill function in ext/standard/array.c in PHP 4.4.2 and 5.1.2 allows context-dependent attackers to cause a denial of service (memory consumption) via a large num value. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1015979 - http://www.infigo.hr/hr/in_focus/advisories/INFIGO-2006-04-02 - http://www.osvdb.org/24945
CVE ID: CVE-2006-7206 State: PUBLISHED Published: 2007-06-22T00:00:00 Last Updated: 2024-08-07T20:57:40.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating a ADODB.Recordset object and making a series of calls to the NextRecordset method with a long string argument, which causes an "invalid memory access" in the SysFreeString function, a different issue than CVE-2006-3510 and CVE-2006-3899. Additional Analyst Notes: - CVE Program Container: References: - http://browserfun.blogspot.com/2006/07/mobb-29-adodbrecordset-nextrecordset.html - http://www.osvdb.org/2753
ferences: - http://browserfun.blogspot.com/2006/07/mobb-29-adodbrecordset-nextrecordset.html - http://www.osvdb.org/27532 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28066 - http://www.securityfocus.com/bid/19227
CVE ID: CVE-2006-7207 State: PUBLISHED Published: 2007-06-22T18:00:00Z Last Updated: 2024-09-16T18:24:42.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in ageet AGEphone before 1.4.0 might allow remote attackers to have an unknown impact via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.ageet.com/us/agephone/help/index.htm#vers
CVE ID: CVE-2006-7208 State: PUBLISHED Published: 2007-06-26T23:00:00 Last Updated: 2024-08-07T20:57:40.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in download.php in the Adam van Dongen Forum (com_forum) component (aka phpBB component) 1.2.4RC3 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/45364 - http://securityreason.com/securityalert/2836 - http://www.securityfocus.com/archive/1/472005/100/0/threaded - https://www.exploit-db.com/exploits/1995
CVE ID: CVE-2006-7209 State: PUBLISHED Published: 2007-06-27T00:00:00 Last Updated: 2024-08-07T20:57:40.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in phpTrafficA before 1.2beta2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to keywords results in the (1) main, (2) daily, (3) weekly, (4) monthly, (5) new trends, (6) individual page, and (7) search engine statistics. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/39973 - http://soft.zoneo.net/phpTrafficA/news.php
CVE ID: CVE-2006-7210 State: PUBLISHED Published: 2007-06-27T17:00:00 Last Updated: 2024-08-07T20:57:40.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a PNG image with crafted (1) Width and (2) Height values in the IHDR block. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/2204 - http://www.securityfocus.com/bid/19520 - https://www.exploit-db.com/exploits/2210 - https://www.exploit-db.com/exploits/2194 - http://www.xsec.org/index.php?module=Releases&act=view&type=1&id=6
CVE ID: CVE-2006-7211 State: PUBLISHED Published: 2007-06-29T18:00:00 Last Updated: 2024-08-07T20:57:40.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: fb_lock_mgr in Firebird 1.5 uses weak permissions (0666) for the semaphore array, which allows local users to cause a denial of service (blocked query processing) by locking semaphores. Additional Analyst Notes: - CVE Program Container: References: - http://www.firebirdsql.org/rlsnotes/Firebird-2.0-ReleaseNotes.pdf - http://www.securityfocus.com/bid/28474 - http://secunia.com/advisories/29501 - http://www.debian.org/security/2008/dsa-1529
CVE ID: CVE-2006-7212 State: PUBLISHED Published: 2007-06-29T18:00:00 Last Updated: 2024-08-07T20:57:40.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in Firebird 1.5, one of which affects WNET, have unknown impact and attack vectors. NOTE: this issue might overlap CVE-2006-1240. Additional Analyst Notes: - CVE Program Container: References: - http://www.firebirdsql.org/rlsnotes/Firebird-2.0-ReleaseNotes.pdf - http://www.securityfocus.com/bid/28474 - http://secunia.com/advisories/29501 - http://www.debian.org/security/2008/dsa-1529
CVE ID: CVE-2006-7213 State: PUBLISHED Published: 2007-06-29T18:00:00 Last Updated: 2024-08-07T20:57:40.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firebird 1.5 allows remote authenticated users without SYSDBA and owner permissions to overwrite a database by creating a database. Additional Analyst Notes: - CVE Program Container: References: - http://www.firebirdsql.org/rlsnotes/Firebird-2.0-ReleaseNotes.pdf - http://www.securityfocus.com/bid/28474 - http://secunia.com/advisories/29501 - http://www.debian.org/security/2008/dsa-1529
CVE ID: CVE-2006-7214 State: PUBLISHED Published: 2007-06-29T18:00:00 Last Updated: 2024-08-07T20:57:40.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Firebird 1.5 allow remote attackers to (1) cause a denial of service (application crash) by sending many remote protocol versions; and (2) cause a denial of service (connection drop) via certain network traffic, as demonstrated by Nessus vulnerability scanning. Additional Analyst Notes: - CVE Program Container: References: - http://www.firebirdsql.org/rlsnotes/Firebird-2.0-ReleaseNotes.pdf - http://www.securityfocus.com/bid/28474 - http://secunia.com/advisories/29501 - http://www.debian.
2.0-ReleaseNotes.pdf - http://www.securityfocus.com/bid/28474 - http://secunia.com/advisories/29501 - http://www.debian.org/security/2008/dsa-1529
CVE ID: CVE-2006-7215 State: PUBLISHED Published: 2007-07-03T21:00:00Z Last Updated: 2024-09-17T00:41:57.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Intel Core 2 Extreme processor X6800 and Core 2 Duo desktop processor E6000 and E4000 incorrectly set the memory page Access (A) bit for a page in certain circumstances involving proximity of the code segment limit to the end of a code page, which has unknown impact and attack vectors on certain operating systems other than OpenBSD, aka AI90. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=openbsd-misc&m=118296441702631&w=2 - http://www.securityfocus.com/bid/24702 - http://www.geek.com
- http://marc.info/?l=openbsd-misc&m=118296441702631&w=2 - http://www.securityfocus.com/bid/24702 - http://www.geek.com/images/geeknews/2006Jan/core_duo_errata__2006_01_21__full.gif - http://www.matasano.com/log/894/theo-de-raadt-intel-core-2-bugs-assuredly-exploitable-from-userland/ - http://download.intel.com/design/processor/specupdt/31327914.pdf - http://seclists.org/fulldisclosure/2007/Jun/0605.html
CVE ID: CVE-2006-7216 State: PUBLISHED Published: 2007-07-05T20:00:00Z Last Updated: 2024-09-16T23:46:46.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does not enforce privilege requirements at execution time, which allows remote authenticated users to lock arbitrary tables. Additional Analyst Notes: - CVE Program Container: References: - http://issues.apache.org/jira/browse/DERBY-1708 - http://db.apache.org/derby/releases/release-10.2.1.6.html
CVE ID: CVE-2006-7217 State: PUBLISHED Published: 2007-07-05T20:00:00 Last Updated: 2024-08-07T20:57:41.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode. Additional Analyst Notes: - CVE Program Container: References: - http://www.novell.com/linux/security/advisories/suse_security_summary_report.html - http://db.apache.org/derby/releases/release-10.2.1.6.html - http://issues.apache.org/jira/browse/DERBY-1858 - http://secunia.com/advisories/28636
CVE ID: CVE-2006-7218 State: PUBLISHED Published: 2007-07-06T19:00:00Z Last Updated: 2024-09-16T20:43:19.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: eZ publish before 3.8.1 does not properly enforce permissions for "content edit Language" when there are four or more languages, which allows remote authenticated users to perform translations into languages that are not listed in a Module Function Limitation policy. Additional Analyst Notes: - CVE Program Container: References: - http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_0_to_3_8_1 - http://ez.no/download/ez_publish/changelogs/ez_publish_3_9/changelog_3_8_0_to_3_9_0 - http://issues.ez.no/8539
CVE ID: CVE-2006-7219 State: PUBLISHED Published: 2007-07-06T19:00:00Z Last Updated: 2024-09-16T22:03:07.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: eZ publish before 3.8.5 does not properly enforce permissions for editing in a specific language, which allows remote authenticated users to create a draft in an unauthorized language by editing an archived version of an object, and then using Manage Versions to copy this version to a new draft. Additional Analyst Notes: - CVE Program Container: References: - http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_4_to_3_8_5 - http://issues.ez.no/8795 - http://ez.no/download/ez_publish/changelogs/ez_publish_3
blish_3_8/changelog_3_8_4_to_3_8_5 - http://issues.ez.no/8795 - http://ez.no/download/ez_publish/changelogs/ez_publish_3_9/changelog_3_8_0_to_3_9_0
CVE ID: CVE-2006-7220 State: PUBLISHED Published: 2007-07-10T00:00:00Z Last Updated: 2024-09-17T03:12:22.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in SAP SAPLPD and SAPSPRINT allows remote attackers to cause a denial of service (application crash) via a certain print job request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/19756
CVE ID: CVE-2006-7221 State: PUBLISHED Published: 2007-07-25T17:00:00.000Z Last Updated: 2025-04-03T15:03:55.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple off-by-one errors in fsplib.c in fsplib before 0.8 allow attackers to cause a denial of service via unspecified vectors involving the (1) name and (2) d_name entry attributes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.novell.com/show_bug.cgi?id=150399 - http://fsp.cvs.sourceforge.net/fsp/fsplib/ChangeLog?revision=1.17&view=markup
CVE ID: CVE-2006-7222 State: PUBLISHED Published: 2007-08-28T01:00:00 Last Updated: 2024-08-07T20:57:40.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the CFLICStream::_deltachunk function in FLICSource.cpp in Media Player Classic (MPC) 6.4.9.0 allows user-assisted remote attackers to execute arbitrary code via a crafted FLI file. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/26591 - http://www.team509.com/modules.php?name=News&file=article&sid=38 - http://www.securityfocus.com/bid/25437 - https://exchange.xforce.ibmcloud.com/vulnerabilities/36242
CVE ID: CVE-2006-7223 State: PUBLISHED Published: 2007-09-14T00:00:00Z Last Updated: 2024-09-16T19:45:40.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document. Additional Analyst Notes: - CVE Program Container: References: - http://jira.xwiki.org/jira/browse/XWIKI-366
CVE ID: CVE-2006-7224 State: REJECTED Published: 2007-11-08T20:00:00 Last Updated: 2007-11-16T10:00:00 Description: No description available.
CVE ID: CVE-2006-7225 State: PUBLISHED Published: 2007-12-03T20:00:00 Last Updated: 2024-08-07T20:57:40.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to cause a denial of service (error or crash) via a regular expression that involves a "malformed POSIX character class", as demonstrated via an invalid character after a [[ sequence. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10985 - http://www.securityfocus.com/bid/26725 - http://www.mandriva.com/security/advisories?name=MD
.mitre.oval%3Adef%3A10985 - http://www.securityfocus.com/bid/26725 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:030 - http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html - http://secunia.com/advisories/28658 - http://support.avaya.com/elmodocs2/security/ASA-2007-505.htm - https://bugzilla.redhat.com/show_bug.cgi?id=384761 - http://www.redhat.com/support/errata/RHSA-2007-1068.html - http://www.redhat.com/support/errata/RHSA-2007-1059.html - http://secunia.com/advisories/28041 - http://www.pcre.org/changelog.txt