deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-3761
Published: 2007-09-27
Description: Cross-site scripting (XSS) vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by causing Javascript events to be applied to a frame in another domain.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=306586; http://lists.apple.com/archives/security-announce/2007/Sep/msg00001.html; http://osvdb.org/38530
CVE: CVE-2007-4671
Published: 2007-09-27
Description: Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to "alter or access" HTTPS content via an HTTP session with a crafted web page that causes Javascript to be applied to HTTPS pages from the same domain.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://docs.info.apple.com/article.html?artnum=306586; http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/Security-announce/2007/Nov/msg00003.html
CVE: CVE-2007-4880
Published: 2007-09-28
Description: Buffer overflow in the Client Acceptor Daemon (CAD), dsmcad.exe, in certain IBM Tivoli Storage Manager (TSM) clients 5.1 before 5.1.8.1, 5.2 before 5.2.5.2, 5.3 before 5.3.5.3, and 5.4 before 5.4.1.2 allows remote attackers to execute arbitrary code via crafted HTTP headers, aka IC52905.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/38161; http://secunia.com/advisories/26883; http://securityreason.com/securityalert/3184
CVE: CVE-2007-5136
Published: 2007-09-28
Description: Cross-site scripting (XSS) vulnerability in DFD Cart 1.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/39625; http://sourceforge.net/forum/forum.php?forum_id=738710; http://www.vupen.com/english/advisories/2007/3255
CVE: CVE-2007-5137
Published: 2007-09-28
Description: Buffer overflow in the ReadImage function in generic/tkImgGIF.c in Tcl (Tcl/Tk) 8.4.13 through 8.4.15 allows remote attackers to execute arbitrary code via multi-frame interlaced GIF files in which later frames are smaller than the first.  NOTE: this issue is due to an incorrect patch for CVE-2007-5378.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=192539; http://secunia.com/advisories/26942; http://secunia.com/advisories/27086
CVE: CVE-2007-5138
Published: 2007-09-28
Description: PHP remote file inclusion vulnerability in forum/forum.php in lustig.cms BETA 2.5 allows remote attackers to execute arbitrary PHP code via a URL in the view parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/25833; https://exchange.xforce.ibmcloud.com/vulnerabilities/36830; https://www.exploit-db.com/exploits/4461
CVE: CVE-2007-5139
Published: 2007-09-28
Description: PHP remote file inclusion vulnerability in admin/include/header.php in chupix 0.2.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/25835; https://exchange.xforce.ibmcloud.com/vulnerabilities/36829; https://www.exploit-db.com/exploits/4462
CVE: CVE-2007-5140
Published: 2007-09-28
Description: PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in IntegraMOD Nederland 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/26991; http://www.securityfocus.com/bid/25832; http://www.vupen.com/english/advisories/2007/3307
CVE: CVE-2007-5141
Published: 2007-09-28
Description: SQL injection vulnerability in search.php in SiteX CMS 0.7.3 Beta allows remote attackers to execute arbitrary SQL commands via the search parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/3178; http://www.securityfocus.com/archive/1/480814/100/0/threaded; http://www.waraxe.us/advisory-55.html
CVE: CVE-2007-5142
Published: 2007-09-28
Description: Cross-site scripting (XSS) vulnerability in buscar.asp in Solidweb Novus 1.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/25828; http://www.securityfocus.com/bid/25828
CVE: CVE-2007-5143
Published: 2007-10-01
Description: F-Secure Anti-Virus for Windows Servers 7.0 64-bit edition allows local users to bypass virus scanning by using the system32 directory to store a crafted (1) archive or (2) packed executable.  NOTE: in many environments, this does not cross privilege boundaries because any process able to write to system32 could also shut off F-Secure Anti-Virus.
CVSS Score: 1.9 (LOW)
References: http://osvdb.org/41377; http://secunia.com/advisories/26948; http://www.f-secure.com/security/fsc-2007-6.shtml
CVE: CVE-2007-5144
Published: 2007-10-01
Description: Buffer overflow in the GDI engine in Windows Live Messenger, as used for Windows MSN Live 8.1, allows user-assisted remote attackers to cause a denial of service (application crash or system crash) and possibly execute arbitrary code by placing a malformed file in a new folder under the Sharing Folders path, and triggering a synchronize operation through the Windows MSN Live online service, possibly related to extended file attributes and possibly related to an incomplete fix for MS07-046, as demonstrated by a (1) .jpg, (2) .gif, (3) .wmf, (4) .doc, or (5) .ico file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lostmon.blogspot.com/2007/09/windows-live-messenger-jpg-overflow.html; http://osvdb.org/45523; http://www.securityfocus.com/bid/25795
CVE: CVE-2007-5145
Published: 2007-10-01
Description: Multiple buffer overflows in system DLL files in Microsoft Windows XP, as used by Microsoft Windows Explorer (explorer.exe) 6.00.2900.2180, Don Ho Notepad++, unspecified Adobe Macromedia applications, and other programs, allow user-assisted remote attackers to cause a denial of service (application crash) via long strings in the (1) author, (2) title, (3) subject, and (4) comment Properties fields of a file, possibly involving improper handling of extended file attributes by the (a) NtQueryInformationFile, (b) NtQueryDirectoryFile, (c) NtSetInformationFile, (d) FileAllInformation, (e) FileNameInformation, and other FILE_INFORMATION_CLASS functions in ntdll.dll and the (f) GetFileAttributesExW and (g) GetFileAttributesW functions in kernel32.dll, a related issue to CVE-2007-1347.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lostmon.blogspot.com/2007/06/buffer-overflow-in-extended-file.html; http://osvdb.org/41064; http://osvdb.org/41065
CVE: CVE-2007-5146
Published: 2007-10-01
Description: Multiple PHP remote file inclusion vulnerabilities in dedi-group Der Dirigent 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the dedi_path parameter to (1) inc.generate_code.php, (2) fnc.type_forms.php, or (3) fnc.type.php in backend/inc/, or (4) frontend.php or (5) backend.php in projekt01/cms/inc/; or (6) the this_dir parameter to backend/inc/class.filemanager.php.  NOTE: vectors 4 and 5 are disputed by CVE because PHP encounters a fatal function-call error on a direct request for the file, before reaching the include statement.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/14/rfi-02-der-dirigent/; http://osvdb.org/45535; http://osvdb.org/45536
CVE: CVE-2007-5147
Published: 2007-10-01
Description: Multiple PHP remote file inclusion vulnerabilities in Puzzle Apps CMS 2.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the MODULEDIR parameter to (1) core/modules/my/my.module.php or (2) core/modules/xml/xml.module.php; the COREROOT parameter to (3) config.loader.php, (4) platform.loader.php, (5) core.loader.php, (6) person.loader.php, or (7) module.loader.php in core/ or (8) install/steps/step_3.php; or the THISDIR parameter to (9) people.lib.php, (10) general.lib.php, (11) content.lib.php, or (12) templates.lib.php in core/modules/admin/libs/ or (13) core/modules/webstat/MEC/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/14/rfi-02-puzzle-apps-cms/; http://arfis.wordpress.com/2007/09/14/rfi-02-puzzle-apps-cms/
CVE: CVE-2007-5148
Published: 2007-10-01
Description: Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.12 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter to (1) access/logout.php or certain PHP scripts under (2) admin/, (3) dimensions/, (4) gl/, (5) inventory/, (6) manufacturing/, (7) purchasing/, (8) reporting/, (9) sales/, or (10) taxes/.  NOTE: the config.php vector is already covered by CVE-2007-4279, and the login.php and language.php vectors are already covered by CVE-2007-5117.  NOTE: this issue is disputed by CVE because path_to_root is defined before use in all of the other files reported in the original disclosure
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/14/rfi-02-frontaccounting/; http://osvdb.org/45524; http://arfis.wordpress.com/2007/09/14/rfi-02-frontaccounting/
CVE: CVE-2007-5149
Published: 2007-10-01
Description: PHP remote file inclusion vulnerability in NewsCMS/news/newstopic_inc.php in North Country Public Radio Public Media Manager (PMM) 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the indir parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/14/rfi-02-public-media-manager/; http://osvdb.org/37399; http://secunia.com/advisories/27020
CVE: CVE-2007-5150
Published: 2007-10-01
Description: SQL injection vulnerability in the is_god function in includes/nukesentinel.php in NukeSentinel 2.5.11 allows remote attackers to execute arbitrary SQL commands via base64-encoded data in an admin cookie, a different vector than CVE-2007-5125.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3181; http://www.nukescripts.net/index.php?op=NEArticle&sid=4076; http://www.securityfocus.com/archive/1/480812/100/0/threaded
CVE: CVE-2007-5151
Published: 2007-10-01
Description: SQL injection vulnerability in the abget_admin function in includes/nukesentinel.php in NukeSentinel 2.5.12 allows remote attackers to execute arbitrary SQL commands via base64-encoded data in an admin cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/26990; http://www.securityfocus.com/archive/1/480846/100/0/threaded; http://www.securityfocus.com/bid/25830
CVE: CVE-2007-5152
Published: 2007-10-01
Description: Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 9.1 container, does not demand authentication after a container restart, which allows remote attackers to perform administrative tasks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/37758; http://secunia.com/advisories/26976; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103069-1
CVE: CVE-2007-5153
Published: 2007-10-01
Description: Unspecified vulnerability in Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 8.x container, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/37757; http://secunia.com/advisories/26976; http://securitytracker.com/id?1018753
CVE: CVE-2007-5154
Published: 2007-10-01
Description: Session fixation vulnerability in Aipo and Aipo ASP 3.0.1.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-362
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/41380; http://secunia.com/advisories/27004
CVE: CVE-2007-5155
Published: 2007-10-01
Description: IceGUI.DLL in ICEOWS 4.20b invokes a function with incorrect arguments, which allows user-assisted remote attackers to execute arbitrary code via a long filename in the header of an ACE archive, which triggers a stack-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20, CWE-119
References: http://osvdb.org/41381; http://secunia.com/advisories/26973; http://vuln.sg/iceows420b-en.html
CVE: CVE-2007-5156
Published: 2007-10-01
Description: Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.
CVSS Score: 7.5 (HIGH)
References: http://dev.fckeditor.net/changeset/973; http://dev.fckeditor.net/ticket/1325; http://downloads.securityfocus.com/vulnerabilities/exploits/30677.php
CVE: CVE-2007-5157
Published: 2007-10-01
Description: PHP remote file inclusion vulnerability in phfito-post.php in Alex Kocharin PHP Fidonet Tosser (PhFiTo) 1.3.0 in phpFidoNode allows remote attackers to execute arbitrary PHP code via a URL in the SRC_PATH parameter to phfito-post.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/39643; http://www.securityfocus.com/bid/25839; http://www.vupen.com/english/advisories/2007/3313
CVE: CVE-2007-5158
Published: 2007-10-01
Description: The focus handling for the onkeydown event in Microsoft Internet Explorer 6.0 allows remote attackers to change field focus and copy keystrokes via a certain use of a JavaScript htmlFor attribute, as demonstrated by changing focus from a textarea to a file upload field, a related issue to CVE-2007-3511.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/41382; http://secunia.com/advisories/27007; http://www.0x000000.com/index.php?i=437
CVE: CVE-2007-5159
Published: 2007-10-01
Description: The ntfs-3g package before 1.913-2.fc7 in Fedora 7, and an ntfs-3g package in Ubuntu 7.10/Gutsy, assign incorrect permissions (setuid root) to mount.ntfs-3g, which allows local users with fuse group membership to read from and write to arbitrary block devices, possibly involving a file descriptor leak.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/26938; https://bugzilla.redhat.com/show_bug.cgi?id=298651; https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00163.html
CVE: CVE-2007-5160
Published: 2007-10-01
Description: Multiple PHP remote file inclusion vulnerabilities in Thierry Leriche Restaurant Management System (ReMaSys) 0.5 allow remote attackers to execute arbitrary PHP code via a URL in (1) the DIR_ROOT parameter to (a) global.php, or the (2) DIR_PAGE parameter to (b) template/fr/page.php or (c) page/fr/boxConnection.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/14/rfi-02-remasys/; http://arfis.wordpress.com/2007/09/14/rfi-02-remasys/
CVE: CVE-2007-5161
Published: 2007-10-01
Description: Cross-zone scripting vulnerability in the internal browser in i-Systems Feedreader 3.10 allows remote attackers to inject arbitrary web script or HTML via an item in a feed, as demonstrated by a WordPress blog update.  NOTE: this was originally reported as XSS.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0583&w=2; http://osvdb.org/37409; http://secunia.com/advisories/26996
CVE: CVE-2007-5162
Published: 2007-10-01
Description: The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/26985; http://secunia.com/advisories/27044; http://secunia.com/advisories/27432
CVE: CVE-2007-5163
Published: 2007-10-01
Description: PHP remote file inclusion vulnerability in includes/functions/layout.php in Nexty 1.01.A Beta allows remote attackers to execute arbitrary PHP code via a URL in the rel parameter.  NOTE: this issue is disputed by CVE because the applicable include is in a function that is not called on a direct request
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/14/rfi-02-nexty/; http://arfis.wordpress.com/2007/09/14/rfi-02-nexty/
CVE: CVE-2007-5164
Published: 2007-10-01
Description: PHP remote file inclusion vulnerability in htmls/forum/includes/topic_review.php in UniversiBO 1.3.4 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.  NOTE: this issue is disputed by CVE because the applicable include is in a function that is not called on a direct request
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/14/rfi-02-universibo/; http://osvdb.org/39639; http://arfis.wordpress.com/2007/09/14/rfi-02-universibo/
CVE: CVE-2007-5165
Published: 2007-10-01
Description: PHP remote file inclusion vulnerability in init.php in Jens Tkotz myIpacNG-stats (MINGS) 0.05 allows remote attackers to execute arbitrary PHP code via a URL in the MINGS_BASE parameter.  NOTE: this issue is disputed by CVE because MINGS_BASE is defined before use
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/14/rfi-02-myipacng-stats/; http://osvdb.org/41058; http://arfis.wordpress.com/2007/09/14/rfi-02-myipacng-stats/
CVE: CVE-2007-5166
Published: 2007-10-01
Description: Multiple PHP remote file inclusion vulnerabilities in SiteSys 1.0a allow remote attackers to execute arbitrary PHP code via a URL in the doc_root parameter to (1) inc/pagehead.inc.php or (2) inc/pageinit.inc.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/14/rfi-02-sitesys/; http://osvdb.org/40072; http://osvdb.org/40073
CVE: CVE-2007-5167
Published: 2007-10-01
Description: PHP remote file inclusion vulnerability in .systeme/fonctions.php in phpLister 0.5-pre2 allows remote attackers to execute arbitrary PHP code via a URL in the nom_rep_systeme parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/14/rfi-02-phplister/; http://arfis.wordpress.com/2007/09/14/rfi-02-phplister/
CVE: CVE-2007-5168
Published: 2007-10-01
Description: Multiple PHP remote file inclusion vulnerabilities in ClanLite 1.23.01.2005 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) modules/serveur_jeux.php or (2) conf/conf-php.php.  NOTE: vector 1 is disputed by CVE because the require_once is only reached when a certain constant has already been defined.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://arfis.wordpress.com/2007/09/13/rfi-02-clanlite/; http://osvdb.org/41055; http://osvdb.org/41056
CVE: CVE-2007-4996
Published: 2007-10-01
Description: libpurple in Pidgin before 2.2.1 does not properly handle MSN nudge messages from users who are not on the receiver's buddy list, which allows remote attackers to cause a denial of service (crash) via a nudge message that triggers an access of "an invalid memory location."
CVSS Score: 4.3 (MEDIUM)
References: http://fedoranews.org/updates/FEDORA-2007-236.shtml; http://secunia.com/advisories/27010; http://secunia.com/advisories/27088
CVE: CVE-2007-5003
Published: 2007-10-01
Description: Multiple stack-based buffer overflows in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allow remote attackers to execute arbitrary code via a long (1) username or (2) password to the rxrLogin command in rxRPC.dll, or a long (3) username argument to the GetUserInfo function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=599; http://research.eeye.com/html/advisories/published/AD20070920.html; http://secunia.com/advisories/25606
CVE: CVE-2007-5004
Published: 2007-10-01
Description: Integer overflow in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allows remote attackers to execute arbitrary code via a long username and a certain "useless" password.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://research.eeye.com/html/advisories/published/AD20070920.html; http://secunia.com/advisories/25606; http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.asp
CVE: CVE-2007-5005
Published: 2007-10-01
Description: Directory traversal vulnerability in rxRPC.dll in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allows remote attackers to upload and overwrite arbitrary files via a ..\ (dot dot backslash) sequence in the destination filename argument to sub-function 8 in the rxrReceiveFileFromServer command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://research.eeye.com/html/advisories/published/AD20070920.html; http://secunia.com/advisories/25606; http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.asp
CVE: CVE-2007-5006
Published: 2007-10-01
Description: Multiple command handlers in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 do not verify if a peer is authenticated, which allows remote attackers to add and delete users, and start client restores.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=598; http://secunia.com/advisories/25606; http://supportconnectw.ca.com/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.asp
CVE: CVE-2007-5082
Published: 2007-10-01
Description: Multiple stack-based buffer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r11.6 allow remote attackers to execute arbitrary code via unspecified CsAgent service commands with certain opcodes, related to missing validation of a length parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-07-16; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=601; http://secunia.com/advisories/26914
CVE: CVE-2007-5083
Published: 2007-10-01
Description: Multiple integer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r11.6 allow remote attackers to execute arbitrary code via unspecified CsAgent service commands that trigger a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=601; http://secunia.com/advisories/26914; http://securitytracker.com/id?1018747
CVE: CVE-2007-5084
Published: 2007-10-01
Description: Multiple SQL injection vulnerabilities in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r11.6 allow remote attackers to execute arbitrary SQL commands via CsAgent service commands with opcodes (1) 0x07, (2) 0x08, (3) 0x09, (4) 0x1E, (5) 0x32, (6) 0x36, (7) 0x40, and possibly others.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://dvlabs.tippingpoint.com/advisory/TPTI-07-17; http://secunia.com/advisories/26914; http://securitytracker.com/id?1018747
CVE: CVE-2007-5170
Published: 2007-10-01
Description: Unspecified vulnerability in the embedded service processor (SP) before 3.09 in Sun Fire X2100 M2 and X2200 M2 Embedded Lights Out Manager (ELOM) allows remote attackers to send arbitrary network traffic and use ELOM as a spam proxy.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/40832; http://secunia.com/advisories/27027; http://securitytracker.com/id?1018756