deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0364
Published: 2007-01-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in nicecoder.com INDEXU 5.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) error_msg parameter to (a) suggest_category.php; the (2) u parameter to (b) user_detail.php; the (3) friend_name, (4) friend_email, (5) error_msg, (6) my_name, (7) my_email, and (8) id parameters to (c) tell_friend.php; the (9) error_msg, (10) email, (11) name, and (12) subject parameters to (d) sendmail.php; the (13) email, (14) error_msg, and (15) username parameters to (e) send_pwd.php; the (16) keyword parameter to (f) search.php; the (17) error_msg, (18) username, (19) password, (20) password2, and (21) email parameters to (g) register.php; the (22) url, (23) contact_name, and (24) email parameters to (h) power_search.php; the (25) path and (26) total parameters to (i) new.php; the (27) query parameter to (j) modify.php; the (28) error_msg parameter to (k) login.php; the (29) error_msg and (30) email parameters to (l) mailing_list.php; the (31) gateway parameter to (m) upgrade.php; and another unspecified vector.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/32839; http://secunia.com/advisories/23764; http://www.osvdb.org/32838
CVE: CVE-2007-0365
Published: 2007-01-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.009 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this is probably a different vulnerability than CVE-2006-5830.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32808; http://secunia.com/advisories/23732; http://sourceforge.net/project/shownotes.php?release_id=478370
CVE: CVE-2007-0019
Published: 2007-01-19
Description: Multiple heap-based buffer overflows in rumpusd in Rumpus 5.1 and earlier (1) allow remote authenticated users to execute arbitrary code via a long LIST command and other unspecified requests to the FTP service, and (2) allow remote attackers to execute arbitrary code via unspecified requests to the HTTP service.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/32689; http://osvdb.org/32692; http://projects.info-pull.com/moab/MOAB-18-01-2007.html
CVE: CVE-2007-0366
Published: 2007-01-19
Description: Untrusted search path vulnerability in Rumpus 5.1 and earlier allows local users to gain privileges via a modified PATH that points to a malicious ipfw program.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/32690; http://projects.info-pull.com/moab/MOAB-18-01-2007.html; http://secunia.com/advisories/23842
CVE: CVE-2007-0367
Published: 2007-01-19
Description: Rumpus 5.1 and earlier has weak permissions for certain files and directories under /usr/local/Rumpus, including the configuration file, which allows local users to have an unknown impact by creating, modifying, or deleting files.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/32691; http://projects.info-pull.com/moab/MOAB-18-01-2007.html; http://secunia.com/advisories/23842
CVE: CVE-2006-6945
Published: 2007-01-19
Description: SQL injection vulnerability in Virtuemart 1.0.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to (1) Itemid, (2) product_id, and category_id parameters as handled in virtuemart_parser.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://secunia.com/advisories/24058; http://virtuemart.svn.sourceforge.net/viewvc/%2Acheckout%2A/virtuemart/branches/virtuemart-1_0_0/virtuemart/CHANGELOG.php?revision=607
CVE: CVE-2007-0368
Published: 2007-01-19
Description: Stack-based buffer overflow in mbse-bbs 0.70 and earlier allows local users to execute arbitrary code via a long string in the MBSE_ROOT environment variable.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051859.html; http://www.mbse.eu/mbse/mbsebbs/index.html; http://www.securityfocus.com/bid/22112
CVE: CVE-2007-0369
Published: 2007-01-19
Description: SQL injection vulnerability in phpBP RC3 (2.204) and earlier allows remote attackers to execute arbitrary SQL commands via the comment forum.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34763; https://exchange.xforce.ibmcloud.com/vulnerabilities/31622; https://www.exploit-db.com/exploits/3153
CVE: CVE-2007-0370
Published: 2007-01-19
Description: Unrestricted file upload vulnerability in index.php in phpBP RC3 (2.204) and earlier allows remote administrators to inject arbitrary PHP code into an upload/banners/ file via a banners add operation that uploads the PHP code through an image_form parameter specifying a multiple-extension filename such as .jpg.vil.gif.php, which is stored in upload/banners/ under a different name, and executable via a direct request.  NOTE: a separate SQL injection issue could be leveraged to make this vulnerability reachable by remote unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34762; https://exchange.xforce.ibmcloud.com/vulnerabilities/31619; https://www.exploit-db.com/exploits/3153
CVE: CVE-2007-0371
Published: 2007-01-19
Description: A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long CCRP_BDc.SelectedFolder property value.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/34647; http://www.securityfocus.com/bid/22110; https://www.exploit-db.com/exploits/3155
CVE: CVE-2007-0372
Published: 2007-01-19
Description: Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via (1) the active parameter in admin/modules/modules.php; the (2) ad_class, (3) imageurl, (4) clickurl, (5) ad_code, or (6) position parameter in modules/Advertising/admin/index.php; or unspecified vectors in the (7) advertising, (8) weblinks, or (9) reviews section.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/33698; http://osvdb.org/33699
CVE: CVE-2007-0373
Published: 2007-01-19
Description: Multiple SQL injection vulnerabilities in Joomla! 1.5.0 Beta allow remote attackers to execute arbitrary SQL commands via (1) the searchword parameter in certain files; the where parameter in (2) plugins/search/content.php or (3) plugins/search/weblinks.php; the text parameter in (4) plugins/search/contacts.php, (5) plugins/search/categories.php, or (6) plugins/search/sections.php; or (7) the email parameter in database/table/user.php, which is not properly handled by the check function.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/32527; http://osvdb.org/32528
CVE: CVE-2007-0374
Published: 2007-01-19
Description: SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/32520; http://www.hackers.ir/advisories/festival.txt
CVE: CVE-2007-0375
Published: 2007-01-19
Description: Joomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for (1) plugins/user/example.php; (2) gmail.php, (3) example.php, or (4) ldap.php in plugins/authentication/; (5) modules/mod_mainmenu/menu.php; or other unspecified PHP scripts, which reveals the path in various error messages, related to a jimport function call at the beginning of each script.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/32522; http://osvdb.org/32523
CVE: CVE-2007-0376
Published: 2007-01-19
Description: Cross-site scripting (XSS) vulnerability in Virtuemart 1.0.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://secunia.com/advisories/24058; http://virtuemart.svn.sourceforge.net/viewvc/%2Acheckout%2A/virtuemart/branches/virtuemart-1_0_0/virtuemart/CHANGELOG.php?revision=607
CVE: CVE-2007-0377
Published: 2007-01-19
Description: Multiple SQL injection vulnerabilities in Xoops 2.0.16 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in kernel/group.php in core, (2) the lid parameter in class/table_broken.php in the Weblinks module, and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/33684; http://osvdb.org/33685
CVE: CVE-2007-0378
Published: 2007-01-19
Description: Multiple SQL injection vulnerabilities in DocMan 1.3 RC2 allow attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/34650; http://www.hackers.ir/advisories/festival.txt
CVE: CVE-2007-0379
Published: 2007-01-19
Description: Cross-site scripting (XSS) vulnerability in DocMan 1.3 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/34651; http://www.hackers.ir/advisories/festival.txt
CVE: CVE-2007-0380
Published: 2007-01-19
Description: DocMan 1.3 RC2 allows remote attackers to obtain sensitive information (the full path) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/34652; http://www.hackers.ir/advisories/festival.txt
CVE: CVE-2007-0381
Published: 2007-01-19
Description: Multiple SQL injection vulnerabilities in ATutor 1.5.3.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters.  NOTE: CVE analysis suggests that the vendor fixed these issues.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/34660; http://www.atutor.ca/atutor/mantis/changelog_page.php
CVE: CVE-2007-0382
Published: 2007-01-19
Description: Multiple SQL injection vulnerabilities in letterman.class.php in the Letterman 1.2.3 (com_letterman) component for Joomla! before 1.0.12 allow remote attackers to execute arbitrary SQL commands via the id parameter, related to the (1) lm_sendMail, (2) saveNewsletter, and (3) cancelNewsletter functions.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/33688; http://www.hackers.ir/advisories/festival.txt
CVE: CVE-2007-0383
Published: 2007-01-19
Description: WDaemon 9.5.4 allows remote attackers to access the /WorldClient.dll URI on TCP port 3000, which has unknown impact.  NOTE: The researcher reports that the vendor response was "this is not a security bug.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/34661; http://www.hackers.ir/advisories/festival.txt
CVE: CVE-2007-0384
Published: 2007-01-19
Description: Cross-site scripting (XSS) vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/?root=postnuke; http://osvdb.org/35473
CVE: CVE-2007-0385
Published: 2007-01-19
Description: The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via "unvalidated output" in FAQ/index.php, possibly involving an undefined id_cat variable.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/?root=postnuke; http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/FAQ/index.php?root=postnuke&r1=20350&r2=20911
CVE: CVE-2007-0386
Published: 2007-01-19
Description: Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug."
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/35471; http://www.hackers.ir/advisories/festival.txt
CVE: CVE-2007-0387
Published: 2007-01-19
Description: SQL injection vulnerability in models/category.php in the Weblinks component for Joomla! SVN 20070118 (com_weblinks) allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html; http://osvdb.org/34792; http://www.hackers.ir/advisories/festival.txt
CVE: CVE-2007-0388
Published: 2007-01-19
Description: SQL injection vulnerability in search.php in Woltlab Burning Board (wBB) 1.0.2 and earlier, and 2.3.6 and earlier in the 2.x series, allows remote attackers to execute arbitrary SQL commands via the boardids[1] and other boardids[] parameters.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33872; https://exchange.xforce.ibmcloud.com/vulnerabilities/31550; https://www.exploit-db.com/exploits/3143
CVE: CVE-2007-0389
Published: 2007-01-19
Description: Directory traversal vulnerability in ArsDigita Community System (ACS) 3.4.10 and earlier, and ArsDigita Community Education Solution (ACES) 1.1, allows remote attackers to read arbitrary files via .%252e/ (double-encoded dot dot slash) sequences in the URI.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33552; http://www.securityfocus.com/archive/1/457318/100/0/threaded; http://www.securityfocus.com/bid/22121
CVE: CVE-2007-0390
Published: 2007-01-19
Description: Cross-site scripting (XSS) vulnerability in index.php in sabros.us 1.7 allows remote attackers to inject arbitrary web script or HTML via the tag parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051868.html; http://osvdb.org/31602; http://secunia.com/advisories/23824
CVE: CVE-2007-0391
Published: 2007-01-19
Description: Format string vulnerability in the log creation functionality of BitDefender Client Professional Plus 8.02 allows attackers to execute arbitrary code via certain scan job settings.
CVSS Score: 7.2 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051883.html; http://www.bitdefender.com/KB325-en--Format-string-vulnerability.html; http://www.securityfocus.com/archive/1/457414/100/0/threaded
CVE: CVE-2007-0392
Published: 2007-01-19
Description: IBM AIX 5.3 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/archive/1/457279/100/0/threaded; http://www.securityfocus.com/archive/1/457315/100/0/threaded; http://www.securityfocus.com/archive/1/457279/100/0/threaded
CVE: CVE-2007-0393
Published: 2007-01-19
Description: Sun Solaris 9 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/archive/1/457279/100/0/threaded; http://www.securityfocus.com/archive/1/457315/100/0/threaded; http://www.securityfocus.com/archive/1/457279/100/0/threaded
CVE: CVE-2007-0394
Published: 2007-01-19
Description: HP HP-UX B11.11 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by closing file descriptor 0, 1, or 2 and then invoking a setuid program, a variant of CVE-2002-0572.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/archive/1/457279/100/0/threaded; http://www.securityfocus.com/archive/1/457315/100/0/threaded; http://www.securityfocus.com/archive/1/457279/100/0/threaded
CVE: CVE-2007-0395
Published: 2007-01-19
Description: PHP remote file inclusion vulnerability in libraries/grab_globals.lib.php in ComVironment 4.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34621; http://www.securityfocus.com/bid/22108; http://www.vupen.com/english/advisories/2007/0266
CVE: CVE-2007-0396
Published: 2007-01-19
Description: Unspecified vulnerability in HP-UX B.11.23, when running IPFilter in combination with PHNE_34474, allows remote attackers to cause a denial of service (system crash) via unspecified vectors.
CVSS Score: 7.1 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00837319; http://osvdb.org/32869; http://secunia.com/advisories/23800
CVE: CVE-2007-0397
Published: 2007-01-20
Description: The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/32720; http://secunia.com/advisories/23836; http://securitytracker.com/id?1017535
CVE: CVE-2007-0398
Published: 2007-01-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in forum.php3 in Arnaud Guyonne (aka Arnotic) a-forum allow remote attackers to inject arbitrary web script or HTML via the (1) Sujet or (2) Pseudo field.
CVSS Score: 6.8 (MEDIUM)
References: http://www.attrition.org/pipermail/vim/2007-January/001249.html; http://www.securityfocus.com/archive/1/457503/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31610
CVE: CVE-2007-0399
Published: 2007-01-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Simple Machines Forum (SMF) 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) recipient or (2) BCC field when selecting send in a pm action.
CVSS Score: 6.0 (MEDIUM)
References: http://aria-security.com/forum/showthread.php?p=128; http://osvdb.org/32606; http://securityreason.com/securityalert/2169
CVE: CVE-2007-0400
Published: 2007-01-22
Description: Cross-site scripting (XSS) vulnerability in admin/memberlist.php in Easebay Resources Login Manager 3.0 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2167; http://www.securityfocus.com/archive/1/457505/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31614
CVE: CVE-2007-0401
Published: 2007-01-22
Description: SQL injection vulnerability in admin/memberlist.php in Easebay Resources Login Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the init_row parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2167; http://www.securityfocus.com/archive/1/457505/100/0/threaded; http://securityreason.com/securityalert/2167
CVE: CVE-2007-0402
Published: 2007-01-22
Description: Cross-site scripting (XSS) vulnerability in admin/edit_member.php in Easebay Resources Paypal Subscription Manager allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33559; http://securityreason.com/securityalert/2168; http://www.securityfocus.com/archive/1/457506/100/0/threaded
CVE: CVE-2007-0403
Published: 2007-01-22
Description: SQL injection vulnerability in admin/memberlist.php in Easebay Resources Paypal Subscription Manager allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33560; http://osvdb.org/36103; http://securityreason.com/securityalert/2168
CVE: CVE-2007-0021
Published: 2007-01-23
Description: Format string vulnerability in Apple iChat 3.1.6 allows remote attackers to cause a denial of service (null pointer dereference and application crash) and possibly execute arbitrary code via format string specifiers in an aim:// URI.
CVSS Score: 7.5 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305102; http://lists.apple.com/archives/Security-announce/2007/Feb/msg00000.html; http://osvdb.org/32715
CVE: CVE-2007-0022
Published: 2007-01-23
Description: Untrusted search path vulnerability in writeconfig in Apple Mac OS X 10.4.8 allows local users to gain privileges via a modified PATH that points to a malicious launchctl program.
CVSS Score: 7.2 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://projects.info-pull.com/moab/MOAB-21-01-2007.html
CVE: CVE-2007-0404
Published: 2007-01-23
Description: bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.
CVSS Score: 7.5 (HIGH)
References: http://code.djangoproject.com/changeset/3592; http://secunia.com/advisories/23826; http://www.securityfocus.com/bid/22134
CVE: CVE-2007-0405
Published: 2007-01-23
Description: The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.
CVSS Score: 6.5 (MEDIUM)
References: http://code.djangoproject.com/changeset/3754; http://secunia.com/advisories/23826; http://www.securityfocus.com/bid/22138
CVE: CVE-2007-0406
Published: 2007-01-23
Description: Multiple buffer overflows in the (1) main function in (a) client.c, and the (2) server_setup and (3) server_client_connect functions in (b) server.c in gxine 0.5.9 and earlier allow local users to cause a denial of service (daemon crash) or gain privileges via a long HOME environment variable.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/38320; http://osvdb.org/38321; http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=476891
CVE: CVE-2007-0407
Published: 2007-01-23
Description: Cross-site scripting (XSS) vulnerability in Operation/User.pm in Plain Black WebGUI before 7.3.5 (beta) allows remote attackers to inject arbitrary web script or HTML via the username parameter during anonymous registration, a different vector than CVE-2007-0308.  NOTE: it is possible that a separate "WikiPage titles" issue was also fixed.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32928; http://secunia.com/advisories/23754; http://www.plainblack.com/bugs/tracker/security-update-cross-site-scripting-vulnerability
CVE: CVE-2007-0408
Published: 2007-01-23
Description: BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote attackers to obtain access via an untrusted X.509 certificate.
CVSS Score: 7.5 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/202; http://osvdb.org/38500; http://secunia.com/advisories/23750
CVE: CVE-2007-0409
Published: 2007-01-23
Description: BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactory MBean Properties, which allows local administrative users to read the cleartext password.
CVSS Score: 1.5 (LOW)
References: http://dev2dev.bea.com/pub/advisory/203; http://osvdb.org/38501; http://secunia.com/advisories/23750