deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0765
Published: 2007-02-06
Description: SQL injection vulnerability in news.php in dB Masters Curium CMS 1.03 and earlier allows remote attackers to execute arbitrary SQL commands via the c_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33111; http://secunia.com/advisories/24032; http://www.securityfocus.com/bid/22373
CVE: CVE-2007-0766
Published: 2007-02-06
Description: Stack-based buffer overflow in Remotesoft .NET Explorer 2.0.1 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long line in a .cpp file.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/34755; http://www.securityfocus.com/bid/22377; https://exchange.xforce.ibmcloud.com/vulnerabilities/32182
CVE: CVE-2007-0767
Published: 2007-02-06
Description: Cross-site scripting (XSS) vulnerability in the core in Phorum before 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34727; http://www.phorum.org/phorum5/read.php?12%2C119757; http://www.vupen.com/english/advisories/2007/0410
CVE: CVE-2007-0768
Published: 2007-02-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the (1) First Name, (2) Last Name, and (3) Nickname fields.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/31674; http://secunia.com/advisories/23928; http://www.securityfocus.com/archive/1/458225/100/0/threaded
CVE: CVE-2007-0769
Published: 2007-02-06
Description: Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: the vendor disputes this vulnerability, stating that "The characters are escaped properly.
CVSS Score: 6.8 (MEDIUM)
References: http://www.phorum.org/phorum5/read.php?12%2C119757; http://www.securityfocus.com/archive/1/458461/100/0/threaded; http://www.securityfocus.com/archive/1/458467/100/0/threaded
CVE: CVE-2007-0784
Published: 2007-02-06
Description: SQL injection vulnerability in login.asp for tPassword in the Raymond BERTHOU script collection (aka RBL - ASP) allows remote attackers to execute arbitrary SQL commands via the (1) User and (2) Password parameters.
CVSS Score: 7.5 (HIGH)
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2607; http://securityreason.com/securityalert/2225; http://www.attrition.org/pipermail/vim/2007-January/001259.html
CVE: CVE-2007-0006
Published: 2007-02-06
Description: The key serial number collision avoidance code in the key_alloc_serial function in Linux kernel 2.6.9 up to 2.6.20 allows local users to cause a denial of service (crash) via vectors that trigger a null dereference, as originally reported as "spinlock CPU recursion."
CVSS Score: 1.9 (LOW)
References: http://bugzilla.kernel.org/show_bug.cgi?id=7727; http://secunia.com/advisories/24109; http://secunia.com/advisories/24259
CVE: CVE-2007-0785
Published: 2007-02-06
Description: PHP remote file inclusion vulnerability in previewtheme.php in Flipsource Flip 2.01-final 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the inc_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35748; http://www.securityfocus.com/bid/22385; http://www.vupen.com/english/advisories/2007/0476
CVE: CVE-2007-0786
Published: 2007-02-06
Description: SQL injection vulnerability in view.php in Noname Media Photo Galerie Standard 1.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33089; http://secunia.com/advisories/24029; http://www.securityfocus.com/bid/22384
CVE: CVE-2007-0787
Published: 2007-02-06
Description: PHP remote file inclusion vulnerability in controller.php in Simple Invoices before 20070202 allows remote attackers to execute arbitrary PHP code via a URL in the (1) module or (2) view parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/31796; http://secunia.com/advisories/24040; http://www.securityfocus.com/bid/22389
CVE: CVE-2007-0788
Published: 2007-02-06
Description: Cross-site scripting (XSS) vulnerability in MediaWiki 1.9.x before 1.9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "sortable tables JavaScript."
CVSS Score: 4.3 (MEDIUM)
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-February/000059.html; http://osvdb.org/33091; http://secunia.com/advisories/24039
CVE: CVE-2007-0789
Published: 2007-02-06
Description: SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in cancel edit functions, possibly related to the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://mamboxchange.com/frs/shownotes.php?release_id=6232; http://osvdb.org/33088; http://secunia.com/advisories/24044
CVE: CVE-2007-0790
Published: 2007-02-06
Description: Heap-based buffer overflow in SmartFTP 2.0.1002 allows remote FTP servers to execute arbitrary code via a large banner.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/33086; http://secunia.com/advisories/24051; http://www.securityfocus.com/bid/22390
CVE: CVE-2007-0791
Published: 2007-02-06
Description: Cross-site scripting (XSS) vulnerability in Atom feeds in Bugzilla 2.20.3, 2.22.1, and 2.23.3, and earlier versions down to 2.20.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33090; http://secunia.com/advisories/24031; http://securityreason.com/securityalert/2222
CVE: CVE-2007-0792
Published: 2007-02-06
Description: The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35862; http://securityreason.com/securityalert/2222; http://securitytracker.com/id?1017585
CVE: CVE-2007-0793
Published: 2007-02-06
Description: PHP remote file inclusion vulnerability in inc/common.php in GlobalMegaCorp dvddb 0.6 allows remote attackers to execute arbitrary PHP code via a URL in the config parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33679; http://securityreason.com/securityalert/2221; http://www.securityfocus.com/archive/1/459149/100/0/threaded
CVE: CVE-2007-0794
Published: 2007-02-06
Description: SQL injection vulnerability in inc/common.php in GlobalMegaCorp dvddb 0.6 allows remote attackers to execute arbitrary SQL commands via the user parameter.  NOTE: this issue has been disputed by a reliable third party, who states that inc/common.php only contains function definitions
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/33670; http://www.securityfocus.com/archive/1/459151/100/0/threaded; http://www.securityfocus.com/archive/1/459180/100/0/threaded
CVE: CVE-2007-0795
Published: 2007-02-06
Description: Multiple PHP remote file inclusion vulnerabilities in Wap Portal Server 1.x allow remote attackers to execute arbitrary PHP code via a URL in the language parameter to (1) index.php and (2) admin/index.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33671; http://osvdb.org/33672; http://osvdb.org/35770
CVE: CVE-2007-0796
Published: 2007-02-06
Description: Blue Coat Systems WinProxy 6.1a and 6.0 r1c, and possibly earlier, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long HTTP CONNECT request, which triggers heap corruption.
CVSS Score: 7.5 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=471; http://osvdb.org/33097; http://secunia.com/advisories/24049
CVE: CVE-2007-0797
Published: 2007-02-06
Description: PHP remote file inclusion vulnerability in theme/settings.php in bluevirus-design SMA-DB 0.3.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pfad_z parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33096; http://secunia.com/advisories/24035; http://www.securityfocus.com/bid/22391
CVE: CVE-2007-0798
Published: 2007-02-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) login.asp; and allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters to (2) badword.asp, (3) polls.asp, and (4) users.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33641; http://osvdb.org/33642; http://osvdb.org/33643
CVE: CVE-2007-0799
Published: 2007-02-06
Description: SQL injection vulnerability in badword.asp in Ublog Reload 1.0.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33640; http://www.hackerscenter.com/archive/view.asp?id=27270; http://www.securityfocus.com/archive/1/459027/100/0/threaded
CVE: CVE-2006-1167
Published: 2007-02-06
Description: SGI ProPack 3 SP6 kernel displays the frame buffer contents of the last session after a reboot, which might allow local users to obtain sensitive information.
CVSS Score: 1.2 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20060402-01-U; http://secunia.com/advisories/19607; http://www.osvdb.org/24571
CVE: CVE-2006-6969
Published: 2007-02-07
Description: Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html; http://fisheye.codehaus.org/changelog/jetty/?cs=1274; http://osvdb.org/33108
CVE: CVE-2006-6970
Published: 2007-02-07
Description: Opera 9.10 Final allows remote attackers to bypass the Fraud Protection mechanism by adding certain characters to the end of a domain name, as demonstrated by the "." and "/" characters, which is not caught by the blacklist filter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://kaneda.bohater.net/security/20061220-opera_9.10_final_bypass_fraud_protection.php; http://osvdb.org/34927; http://www.securityfocus.com/archive/1/459265/100/0/threaded
CVE: CVE-2006-6971
Published: 2007-02-07
Description: Mozilla Firefox 2.0, possibly only when running on Windows, allows remote attackers to bypass the Phishing Protection mechanism by representing an IP address in (1) dotted-hex, (2) dotted-octal, (3) single decimal integer, (4) single hex integer, or (5) single octal integer format, which is not captured by the blacklist filter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://sla.ckers.org/forum/read.php?13%2C2253; https://bugzilla.mozilla.org/show_bug.cgi?id=356355; http://sla.ckers.org/forum/read.php?13%2C2253
CVE: CVE-2007-0800
Published: 2007-02-07
Description: Cross-zone vulnerability in Mozilla Firefox 1.5.0.9 considers blocked popups to have an internal zone origin, which allows user-assisted remote attackers to cross zone restrictions and read arbitrary file:// URIs by convincing a user to show a blocked popup.
CVSS Score: 4.3 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2713
CVE: CVE-2007-0801
Published: 2007-02-07
Description: The nsExternalAppHandler::SetUpTempFile function in Mozilla Firefox 1.5.0.9 creates temporary files with predictable filenames based on creation time, which allows remote attackers to execute arbitrary web script or HTML via a crafted XMLHttpRequest.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/24393; http://secunia.com/advisories/24437; http://security.gentoo.org/glsa/glsa-200703-04.xml
CVE: CVE-2007-0802
Published: 2007-02-07
Description: Mozilla Firefox 2.0.0.1 allows remote attackers to bypass the Phishing Protection mechanism by adding certain characters to the end of the domain name, as demonstrated by the "." and "/" characters, which is not caught by the Phishing List blacklist filter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-04/0516.html; http://kaneda.bohater.net/security/20070111-firefox_2.0.0.1_bypass_phishing_protection.php; http://osvdb.org/33705
CVE: CVE-2007-0803
Published: 2007-02-07
Description: Multiple buffer overflows in STLport before 5.0.3 allow remote attackers to execute arbitrary code via unspecified vectors relating to (1) "print floats" and (2) a missing null termination in the "rope constructor."
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://osvdb.org/33106; http://osvdb.org/33107; http://secunia.com/advisories/24024
CVE: CVE-2007-0804
Published: 2007-02-07
Description: Directory traversal vulnerability in admin/subpages.php in GGCMS 1.1.0 RC1 and earlier allows remote attackers to inject arbitrary PHP code into arbitrary files via ".." sequences in the subpageName parameter, as demonstrated by injecting PHP code into a template file.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35849; http://www.securityfocus.com/bid/22412; http://www.vupen.com/english/advisories/2007/0492
CVE: CVE-2007-0805
Published: 2007-02-07
Description: The ps (/usr/ucb/ps) command on HP Tru64 UNIX 5.1 1885 allows local users to obtain sensitive information, including environment variables of arbitrary processes, via the "auxewww" argument, a similar issue to CVE-1999-1587.
CVSS Score: 2.1 (LOW)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00817515; http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052227.html; http://osvdb.org/33113
CVE: CVE-2007-0806
Published: 2007-02-07
Description: Les News 2.2 allows remote attackers to bypass authentication and gain administrative access via a direct request for adminews/index_fr.php3, and possibly the adminews index documents for other localizations.
CVSS Score: 7.5 (HIGH)
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2622; http://osvdb.org/33686; http://securityreason.com/securityalert/2226
CVE: CVE-2007-0807
Published: 2007-02-07
Description: Cross-site scripting (XSS) vulnerability in info.php in flashChat 4.7.8 allows remote attackers to inject arbitrary web script or HTML via a channel title (aka room name) that is not properly handled by the "who's online" feature.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24071; http://securityreason.com/securityalert/2228; http://www.securityfocus.com/archive/1/459160/100/0/threaded
CVE: CVE-2007-0808
Published: 2007-02-07
Description: PHP remote file inclusion vulnerability in Mina Ajans Script allows remote attackers to execute arbitrary PHP code via a URL in the syf parameter to an unspecified PHP script.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33687; http://www.securityfocus.com/archive/1/459191/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/32243
CVE: CVE-2007-0809
Published: 2007-02-07
Description: PHP remote file inclusion vulnerability in includes/class_template.php in Categories hierarchy (aka CH or mod-CH) 2.1.2 in ptirhiikmods allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-February/001285.html; http://osvdb.org/33722; http://www.securityfocus.com/bid/22400
CVE: CVE-2007-0810
Published: 2007-02-07
Description: PHP remote file inclusion vulnerability in MVCnPHP/BaseView.php in GeekLog 2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the glConf[path_libraries] parameter.  NOTE: this might be a vulnerability in MVCnPHP rather than a vulnerability in GeekLog.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35749; http://www.securityfocus.com/bid/22386; https://exchange.xforce.ibmcloud.com/vulnerabilities/32205
CVE: CVE-2007-0811
Published: 2007-02-07
Description: Microsoft Internet Explorer 6.0 SP1 on Windows 2000, and 6.0 SP2 on Windows XP, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an HTML document containing a certain JavaScript for loop with an empty loop body, possibly involving getElementById.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37636; http://www.powerhacker.net/exploit/IE_NULL_CRASH.html; http://www.securityfocus.com/bid/22408
CVE: CVE-2007-0812
Published: 2007-02-07
Description: SQL injection vulnerability in pms.php in Woltlab Burning Board (wBB) Lite 1.0.2pl3e and earlier allows remote authenticated users to execute arbitrary SQL commands via the pmid[0] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32034; http://secunia.com/advisories/24027; http://www.securityfocus.com/bid/22415
CVE: CVE-2007-0813
Published: 2007-02-07
Description: Cross-site scripting (XSS) vulnerability in Home production MySearchEngine allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2621; http://osvdb.org/33653; http://www.securityfocus.com/archive/1/459145/100/0/threaded
CVE: CVE-2007-0814
Published: 2007-02-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Adrenalin's ASP Chat allow remote attackers to inject arbitrary web script or HTML (1) via the psuedo (pseudo) field or (2) during chat.
CVSS Score: 4.3 (MEDIUM)
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2620; http://osvdb.org/33654; http://securityreason.com/securityalert/2233
CVE: CVE-2007-0815
Published: 2007-02-07
Description: Cross-site scripting (XSS) vulnerability in images_archive.asp in Uapplication Uphotogallery 1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the s parameter.  NOTE: the thumbnails.asp vector is already covered by CVE-2006-3023.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33243; http://securityreason.com/securityalert/2227; http://www.securityfocus.com/archive/1/459187/100/0/threaded
CVE: CVE-2007-0816
Published: 2007-02-07
Description: The RPC Server service (catirpc.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 SP2 and earlier allows remote attackers to cause a denial of service (service crash) via a crafted TADDR2UADDR that triggers a null pointer dereference in catirpc.dll, possibly related to null credentials or verifier fields.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32989; http://secunia.com/advisories/24009; http://secunia.com/advisories/24512
CVE: CVE-2007-0817
Published: 2007-02-07
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion web server allows remote attackers to inject arbitrary HTML or web script via the User-Agent HTTP header, which is not sanitized before being displayed in an error page.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/32120; http://secunia.com/advisories/24115; http://www.adobe.com/support/security/bulletins/apsb07-04.html
CVE: CVE-2007-0818
Published: 2007-02-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-0396.  Reason: This candidate is a duplicate of CVE-2007-0396.  Notes: All CVE users should reference CVE-2007-0396 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-6972
Published: 2007-02-07
Description: SQL injection in torrents.php in BtitTracker 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) by and (2) order parameters.  NOTE: it is not clear whether this issue is exploitable.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2006-June/000894.html; http://pridels0.blogspot.com/2006/06/btittracker-sql-injection-vuln.html; http://secunia.com/advisories/20753
CVE: CVE-2006-6973
Published: 2007-02-07
Description: Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote attackers to (1) reinstall the application via a direct request for install/index.php; (2) delete the database via a do=delete_database QUERY_STRING to a renamed copy of install/index.php; or access the administration system, after guessing a filename, via a direct request for a file in (3) admin/ or (4) tech/.
CVSS Score: 7.5 (HIGH)
References: http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt; http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt
CVE: CVE-2006-6974
Published: 2007-02-07
Description: Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) list files in the includes/ directory; obtain the SQL username and password via a direct request for (2) config.php and (3) config.php.bak in includes/; read files in (4) email/, (5) admin/graphs/, (6) includes/javascript/, and (7) certain other includes/ directories via direct requests; and download SQL database data via direct requests for (8) data.sql, (9) install.sql, (10) settings.sql, and possibly other files in install/v2data/.
CVSS Score: 7.5 (HIGH)
References: http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt; http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt
CVE: CVE-2007-0820
Published: 2007-02-07
Description: Multiple PHP remote file inclusion vulnerabilities in Cedric CLAIRE PortailPhp 2 allow remote attackers to execute arbitrary PHP code via a URL in the chemin parameter to (1) mod_news/index.php, (2) mod_news/goodies.php, or (3) mod_search/index.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35756; http://osvdb.org/35757; http://osvdb.org/35758
CVE: CVE-2007-0821
Published: 2007-02-07
Description: Multiple directory traversal vulnerabilities in Cedric CLAIRE PortailPhp 2 allow remote attackers to read arbitrary files via a .. (dot dot) in the chemin parameter to (1) mod_news/index.php or (2) mod_news/goodies.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/35850; http://osvdb.org/35851; http://www.securityfocus.com/bid/22381
CVE: CVE-2007-0822
Published: 2007-02-07
Description: umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents.
CVSS Score: 1.9 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0012.html; http://gotfault.wordpress.com/2007/01/18/umount-bug/; http://osvdb.org/33652