deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-3752
Published: 2007-09-06
Description: Heap-based buffer overflow in Apple iTunes before 7.4 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via crafted album cover art in the covr atom of an MP4/AAC file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=306404; http://lists.apple.com/archives/security-announce/2007/Sep/msg00000.html; http://osvdb.org/38528
CVE: CVE-2007-3913
Published: 2007-09-06
Description: SQL injection vulnerability in Gforge before 3.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-89
References: http://secunia.com/advisories/26723; http://www.debian.org/security/2007/dsa-1369; http://www.securityfocus.com/bid/25585
CVE: CVE-2007-4472
Published: 2007-09-06
Description: Multiple buffer overflows in the Broderbund Expressit 3DGreetings Player ActiveX control could allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/37779; http://secunia.com/advisories/26717; http://www.kb.cert.org/vuls/id/574401
CVE: CVE-2007-4743
Published: 2007-09-06
Description: The original patch for CVE-2007-3999 in svc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and other applications that use krb5, does not correctly check the buffer length in some environments and architectures, which might allow remote attackers to conduct a buffer overflow attack.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://article.gmane.org/gmane.comp.encryption.kerberos.announce/86; http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
CVE: CVE-2007-4744
Published: 2007-09-06
Description: PHP remote file inclusion vulnerability in environment.php in AnyInventory 1.9.1 and 2.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the DIR_PREFIX parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-94
References: http://secunia.com/advisories/26696; http://www.osvdb.org/36846; http://www.securityfocus.com/bid/25550
CVE: CVE-2007-4745
Published: 2007-09-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the AkoBook 3.42 and earlier component (com_akobook) for Mambo allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) gbmail and (2) gbpage parameters in the sign function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37533; http://secunia.com/advisories/26706; http://securityreason.com/securityalert/3101
CVE: CVE-2007-4746
Published: 2007-09-06
Description: The Cisco Video Surveillance IP Gateway Encoder/Decoder (Standalone and Module) firmware 1.8.1 and earlier, Video Surveillance SP/ISP Decoder Software firmware 1.11.0 and earlier, and the Video Surveillance SP/ISP firmware 1.23.7 and earlier have default passwords for the sypixx and root user accounts, which allows remote attackers to perform administrative actions, aka CSCsj34681.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/37502; http://secunia.com/advisories/26721; http://www.cisco.com/en/US/products/products_security_advisory09186a00808b4d38.shtml
CVE: CVE-2007-4747
Published: 2007-09-06
Description: The telnet service in Cisco Video Surveillance IP Gateway Encoder/Decoder (Standalone and Module) firmware 1.8.1 and earlier, Video Surveillance SP/ISP Decoder Software firmware 1.11.0 and earlier, and the Video Surveillance SP/ISP firmware 1.23.7 and earlier does not require authentication, which allows remote attackers to perform administrative actions, aka CSCsj31729.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://osvdb.org/37503; http://secunia.com/advisories/26721; http://www.cisco.com/en/US/products/products_security_advisory09186a00808b4d38.shtml
CVE: CVE-2007-4748
Published: 2007-09-06
Description: Buffer overflow in the PowerPlayer.dll ActiveX control in PPStream 2.0.1.3829 allows remote attackers to execute arbitrary code via a long Logo parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/38421; http://www.securityfocus.com/bid/25502; https://exchange.xforce.ibmcloud.com/vulnerabilities/36394
CVE: CVE-2007-4753
Published: 2007-09-08
Description: The Thomson ST 2030 SIP phone with software 1.52.1 allows remote attackers to cause a denial of service (device hang) via (1) an empty SIP message or (2) a SIP INVITE message with a malformed To header, different vectors than CVE-2007-4553.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065458.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065478.html; http://secunia.com/advisories/26587
CVE: CVE-2007-4754
Published: 2007-09-08
Description: Format string vulnerability in the safe_bprintf function in acesrc/acebot_cmds.c in Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (daemon crash) via format string specifiers in a nickname.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/aa2k7x-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0049.html; http://osvdb.org/40507
CVE: CVE-2007-4755
Published: 2007-09-08
Description: Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (client disconnect) by sending a client_connect command in a forged packet from the server to a client.  NOTE: client IP addresses are available via product-specific queries.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/aa2k7x-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0049.html; http://osvdb.org/40508
CVE: CVE-2007-4756
Published: 2007-09-08
Description: Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via "..\" (dot dot backslash) sequences in a filename.  NOTE: the "..\" are not displayed when the user lists files.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt; http://osvdb.org/39838; http://secunia.com/advisories/26734
CVE: CVE-2007-4757
Published: 2007-09-08
Description: PHP remote file inclusion vulnerability in menu.php in phpMytourney allows remote attackers to execute arbitrary PHP code via a URL in the functions_file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/38331; http://www.securityfocus.com/bid/25579; http://www.vupen.com/english/advisories/2007/3112
CVE: CVE-2007-4758
Published: 2007-09-08
Description: Multiple buffer overflows in the image-processing APIs in Cosminexus Developer's Kit for Java in Cosminexus 4 through 7 allow remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/37857; http://secunia.com/advisories/26538; http://www.hitachi-support.com/security_e/vuls_e/HS07-028_e/index-e.html
CVE: CVE-2007-4759
Published: 2007-09-08
Description: Multiple unspecified vulnerabilities in the image-processing APIs in Cosminexus Developer's Kit for Java in Cosminexus 4 through 7 allow remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/37858; http://secunia.com/advisories/26538; http://www.hitachi-support.com/security_e/vuls_e/HS07-028_e/index-e.html
CVE: CVE-2007-4760
Published: 2007-09-08
Description: The javadoc tool in Cosminexus Developer's Kit for Java in Cosminexus 7 and 7.5 can generate HTML documents that contain cross-site scripting (XSS) vulnerabilities, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this is probably the same issue as CVE-2007-3503.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/26671; http://www.hitachi-support.com/security_e/vuls_e/HS07-027_e/index-e.html; http://www.securityfocus.com/bid/25518
CVE: CVE-2007-4761
Published: 2007-09-08
Description: Unrestricted file upload vulnerability in upload.php in Barbo91 1.1 allows remote attackers to upload and execute arbitrary code via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/45876; http://www.securityfocus.com/bid/25551; http://osvdb.org/45876
CVE: CVE-2007-4762
Published: 2007-09-08
Description: Multiple SQL injection vulnerabilities in embadmin/login.asp in E-SMARTCART 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user and (2) pass fields, different vectors than CVE-2007-0092.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://14house.blogspot.com/2007/09/e-smart-cart-sql-injection.html; http://osvdb.org/38419; http://www.securityfocus.com/archive/1/487055/100/200/threaded
CVE: CVE-2007-4763
Published: 2007-09-08
Description: PHP remote file inclusion vulnerability in dbmodules/DB_adodb.class.php in PHP Object Framework (PHPOF) 20040226 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHPOF_INCLUDE_PATH parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/38418; http://www.securityfocus.com/bid/25541; http://www.vupen.com/english/advisories/2007/3094
CVE: CVE-2007-4764
Published: 2007-09-08
Description: Directory traversal vulnerability in pawfaliki.php in Pawfaliki 0.5.1 allows remote attackers to list arbitrary files via a .. (dot dot) in the page parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/38417; http://secunia.com/advisories/26702; http://www.securityfocus.com/bid/25553
CVE: CVE-2007-3912
Published: 2007-09-10
Description: checkrestart in debian-goodies before 0.34 allows local users to gain privileges via shell metacharacters in the name of the executable file for a running process.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=440411; http://osvdb.org/40483; http://secunia.com/advisories/26675
CVE: CVE-2007-4470
Published: 2007-09-10
Description: Multiple stack-based buffer overflows in the Earth Resource Mapping NCSView ActiveX control before 3.4.0.242 in NCSView.dll, as distributed in ER Mapper ECW JPEG 2000 Plug-in before 8.1, allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/37780; http://secunia.com/advisories/26729; http://www.kb.cert.org/vuls/id/589188
CVE: CVE-2007-4512
Published: 2007-09-10
Description: Cross-site scripting (XSS) vulnerability in Sophos Anti-Virus for Windows 6.x before 6.5.8 and 7.x before 7.0.1 allows remote attackers to inject arbitrary web script or HTML via an archive with a file that matches a virus signature and has a crafted filename that is not properly handled by the print function in SavMain.exe.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37527; http://secunia.com/advisories/26714; http://securityreason.com/securityalert/3107
CVE: CVE-2007-4776
Published: 2007-09-10
Description: Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a Visual Basic project (vbp) file containing a long Reference line, related to VBP_Open and OLE. NOTE: there are limited usage scenarios under which this would be a vulnerability.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/26704; http://www.osvdb.org/36936; http://www.securityfocus.com/bid/25629
CVE: CVE-2007-4777
Published: 2007-09-10
Description: SQL injection vulnerability in Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to the archive section.  NOTE: this may be the same as CVE-2007-4778.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39070; http://osvdb.org/39071; http://osvdb.org/39072
CVE: CVE-2007-4778
Published: 2007-09-10
Description: Multiple SQL injection vulnerabilities in the content component (com_content) in Joomla! 1.5 Beta1, Beta2, and RC1 allow remote attackers to execute arbitrary SQL commands via the filter parameter in an archive action to (1) archive.php, (2) category.php, or (3) section.php in models/.  NOTE: this may be the same as CVE-2007-4777.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://downloads.securityfocus.com/vulnerabilities/exploits/25508.php; http://osvdb.org/39070; http://osvdb.org/39071
CVE: CVE-2007-4779
Published: 2007-09-10
Description: Cross-site scripting (XSS) vulnerability in Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably related to the archive section.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38416; http://securityreason.com/securityalert/3108; http://www.joomla.org/content/view/3831/1/
CVE: CVE-2007-4780
Published: 2007-09-10
Description: Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to obtain sensitive information (the full path) via unspecified vectors, probably involving direct requests to certain PHP scripts in tmpl/ directories.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/45875; http://securityreason.com/securityalert/3108; http://www.joomla.org/content/view/3831/1/
CVE: CVE-2007-4781
Published: 2007-09-10
Description: administrator/index.php in the installer component (com_installer) in Joomla! 1.5 Beta1, Beta2, and RC1 allows remote authenticated administrators to upload arbitrary files to tmp/ via the "Upload Package File" functionality, which is accessible when com_installer is the value of the option parameter.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/45888; http://www.securityfocus.com/bid/25508; https://exchange.xforce.ibmcloud.com/vulnerabilities/36424
CVE: CVE-2007-4782
Published: 2007-09-10
Description: PHP before 5.2.3 allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the pattern parameter to the glob function; or (2) a long string in the string parameter to the fnmatch function, accompanied by a pattern parameter value with undefined characteristics, as demonstrated by a "*[1]e" value.  NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html; http://osvdb.org/38686; http://secunia.com/advisories/27102
CVE: CVE-2007-4783
Published: 2007-09-10
Description: The iconv_substr function in PHP 5.2.4 and earlier allows context-dependent attackers to cause (1) a denial of service (application crash) via a long string in the charset parameter, probably also requiring a long string in the str parameter; or (2) a denial of service (temporary application hang) via a long string in the str parameter.  NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/38917; http://secunia.com/advisories/27102; http://secunia.com/advisories/27659
CVE: CVE-2007-4784
Published: 2007-09-10
Description: The setlocale function in PHP before 5.2.4 allows context-dependent attackers to cause a denial of service (application crash) via a long string in the locale parameter.  NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless this issue can be demonstrated for code execution.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html; http://osvdb.org/38687; http://secunia.com/advisories/27102
CVE: CVE-2007-4785
Published: 2007-09-10
Description: Sony Micro Vault Fingerprint Access Software, as distributed with Sony Micro Vault USM-F USB flash drives, installs a driver that hides a directory under %WINDIR%, which might allow remote attackers to bypass malware detection by placing files in this directory.
CVSS Score: 6.8 (MEDIUM)
References: http://hiltont.blogspot.com/2007/08/sony-rootkit-version-2.html; http://observed.de/?entnum=101; http://securityreason.com/securityalert/3118
CVE: CVE-2007-4786
Published: 2007-09-10
Description: Cisco Adaptive Security Appliance (ASA) running PIX 7.0 before 7.0.7.1, 7.1 before 7.1.2.61, 7.2 before 7.2.2.34, and 8.0 before 8.0.2.11, when AAA is enabled, composes %ASA-5-111008 messages from the "test aaa" command with cleartext passwords and sends them over the network to a remote syslog server or places them in a local logging buffer, which allows context-dependent attackers to obtain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: http://osvdb.org/37499; http://secunia.com/advisories/26677; http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsj72903
CVE: CVE-2007-4787
Published: 2007-09-10
Description: The virus detection engine in Sophos Anti-Virus before 2.49.0 does not properly process malformed (1) CAB, (2) LZH, and (3) RAR files with modified headers, which might allow remote attackers to bypass malware detection.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/37988; http://secunia.com/advisories/26726; http://www.securityfocus.com/bid/25574
CVE: CVE-2007-4788
Published: 2007-09-10
Description: Cisco Content Switching Modules (CSM) 4.2 before 4.2.3a, and Cisco Content Switching Module with SSL (CSM-S) 2.1 before 2.1.2a, allow remote attackers to cause a denial of service (CPU consumption or reboot) via sets of out-of-order TCP packets with unspecified characteristics, aka CSCsd27478.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/37500; http://secunia.com/advisories/26724; http://securitytracker.com/id?1018654
CVE: CVE-2007-4789
Published: 2007-09-10
Description: Cisco Content Switching Modules (CSM) 4.2 before 4.2.7, and Cisco Content Switching Module with SSL (CSM-S) 2.1 before 2.1.6, when service termination is enabled, allow remote attackers to cause a denial of service (reboot) via unspecified vectors related to high network utilization, aka CSCsh57876.
CVSS Score: 7.8 (HIGH)
CWE: CWE-16
References: http://osvdb.org/37501; http://secunia.com/advisories/26724; http://securitytracker.com/id?1018654
CVE: CVE-2007-4790
Published: 2007-09-10
Description: Stack-based buffer overflow in certain ActiveX controls in (1) FPOLE.OCX 6.0.8450.0 and (2) Foxtlib.ocx, as used in the Microsoft Visual FoxPro 6.0 fpole 1.0 Type Library; and Internet Explorer 5.01, 6 SP1 and SP2, and 7; allows remote attackers to execute arbitrary code via a long first argument to the FoxDoCmd function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://www.securityfocus.com/bid/25571; http://www.securitytracker.com/id?1019378
CVE: CVE-2007-4791
Published: 2007-09-10
Description: Buffer overflow in the swcons command in bos.rte.console in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2005-3504 and CVE-2007-0978.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://osvdb.org/40400; http://secunia.com/advisories/26715; http://www-1.ibm.com/support/docview.wss?uid=isg1IY98532
CVE: CVE-2007-4792
Published: 2007-09-10
Description: Buffer overflow in ibstat in devices.common.IBM.ib.rte in IBM AIX 5.3 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/26715; http://www-1.ibm.com/support/docview.wss?uid=isg1IY97233; http://www.securityfocus.com/bid/25557
CVE: CVE-2007-4793
Published: 2007-09-10
Description: Buffer overflow in xlplm in plm.server.rte in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://osvdb.org/40398; http://secunia.com/advisories/26715; http://www-1.ibm.com/support/docview.wss?uid=isg1IZ00997
CVE: CVE-2007-4794
Published: 2007-09-10
Description: Buffer overflow in fcstat in devices.common.IBM.fc.rte in IBM AIX 5.2 and 5.3 allows local users to gain privileges via a long input parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://osvdb.org/40397; http://secunia.com/advisories/26715; http://www-1.ibm.com/support/docview.wss?uid=isg1IY94739
CVE: CVE-2007-4795
Published: 2007-09-10
Description: Buffer overflow in mkpath in bos.rte.methods in IBM AIX 5.2 and 5.3 allows local users to gain privileges via a long ODM name.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/26715; http://www-1.ibm.com/support/docview.wss?uid=isg1IY91132; http://www-1.ibm.com/support/docview.wss?uid=isg1IY91145
CVE: CVE-2007-4796
Published: 2007-09-10
Description: Buffer overflow in uucp in bos.net.uucp in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/26715; http://www-1.ibm.com/support/docview.wss?uid=isg1IY95852; http://www-1.ibm.com/support/docview.wss?uid=isg1IY97215
CVE: CVE-2007-4797
Published: 2007-09-10
Description: Multiple buffer overflows in unspecified svprint (System V print) commands in bos.svprint.rte in IBM AIX 5.2 and 5.3 allow local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://osvdb.org/40394; http://secunia.com/advisories/26715; http://www-1.ibm.com/support/docview.wss?uid=isg1IZ02717
CVE: CVE-2007-4798
Published: 2007-09-10
Description: Unspecified vulnerability in invscout in Inventory Scout in invscout.rte in IBM AIX 5.2 and 5.3 allows local users to delete system files that have names matching the final substring of a hostname alias, as demonstrated by hostnames ending in "unix".
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/40393; http://secunia.com/advisories/26715; http://www-1.ibm.com/support/docview.wss?uid=isg1IY98506
CVE: CVE-2007-4799
Published: 2007-09-10
Description: The perfstat kernel extension in bos.perf.perfstat in AIX 5.3 does not verify privileges when processing a SET call, which allows local users to cause a denial of service (system hang or crash) via unspecified SET operations.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/40392; http://secunia.com/advisories/26715; http://www-1.ibm.com/support/docview.wss?uid=isg1IY97309
CVE: CVE-2007-4802
Published: 2007-09-11
Description: Multiple heap-based buffer overflows in GlobalLink 2.7.0.8 allow remote attackers to execute arbitrary code via (1) a long eighth argument to the SetInfo method in a certain ActiveX control in glItemCom.dll or (2) a long second argument to the SetClientInfo method in a certain ActiveX control in glitemflat.dll.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/45886; http://osvdb.org/45887; http://www.securityfocus.com/bid/25565
CVE: CVE-2007-4803
Published: 2007-09-11
Description: Buffer overflow in AtomixMP3 2.3 allows user-assisted remote attackers to execute arbitrary code via long strings in file and title fields in a .pls file, as demonstrated by the (1) File1 and (2) Title1 fields, different vectors than CVE-2006-6287 and CVE-2007-2487.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/45889; http://www.securityfocus.com/bid/25546; https://www.exploit-db.com/exploits/4364