deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0735
Published: 2007-04-24
Description: Use-after-free vulnerability in Libinfo in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors involving crafted web pages that trigger certain error conditions that are not properly reported in certain circumstances, resulting in accessing deallocated memory.
CVSS Score: 9.3 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0736
Published: 2007-04-24
Description: Integer overflow in the RPC library in Libinfo in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to execute arbitrary code via crafted requests to portmap.
CVSS Score: 9.3 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0737
Published: 2007-04-24
Description: The Login Window in Apple Mac OS X 10.3.9 through 10.4.9 does not properly check certain environment variables, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0738
Published: 2007-04-24
Description: The Login Window in Apple Mac OS X 10.4 through 10.4.9 does not display the screen saver authentication dialog in certain circumstances when waking from sleep, even though the "require a password to wake the computer from sleep" option is enabled, which allows local users to bypass authentication controls.
CVSS Score: 4.6 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0739
Published: 2007-04-24
Description: The Login Window in Apple Mac OS X 10.4 through 10.4.9 displays the software update window beneath the loginwindow authentication dialog in certain circumstances related to running scheduled tasks, which allows local users to bypass authentication controls.
CVSS Score: 4.6 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0741
Published: 2007-04-24
Description: Buffer overflow in natd in network_cmds in Apple Mac OS X 10.3.9 through 10.4.9, when Internet Sharing is enabled, allows remote attackers to execute arbitrary code via malformed RTSP packets.
CVSS Score: 7.5 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0742
Published: 2007-04-24
Description: The WebFoundation framework in Apple Mac OS X 10.3.9 and earlier allows subdomain cookies to be accessed by the parent domain, which allows remote attackers to obtain sensitive information.
CVSS Score: 7.8 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0743
Published: 2007-04-24
Description: URLMount in Apple Mac OS X 10.3.9 through 10.4.9 passes the username and password credentials for mounting filesystems on SMB servers as command line arguments to the mount_sub command, which may allow local users to obtain sensitive information by listing the process.
CVSS Score: 4.9 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0744
Published: 2007-04-24
Description: SMB in Apple Mac OS X 10.3.9 through 10.4.9 does not properly clean the environment when executing commands, which allows local users to gain privileges by setting unspecified environment variables.
CVSS Score: 7.2 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0746
Published: 2007-04-24
Description: Heap-based buffer overflow in the VideoConference framework in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to execute arbitrary code via a "crafted SIP packet when initializing an audio/video conference".
CVSS Score: 10.0 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0747
Published: 2007-04-24
Description: load_webdav in Apple Mac OS X 10.3.9 through 10.4.9 does not properly clean the environment when mounting a WebDAV filesystem, which allows local users to gain privileges by setting unspecified environment variables.
CVSS Score: 7.2 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-2178
Published: 2007-04-24
Description: Multiple unspecified vulnerabilities in Objective Development Sharity before 3.3 allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35044; http://secunia.com/advisories/24925; http://www.obdev.at/products/sharity/releasenotes.html
CVE: CVE-2007-2179
Published: 2007-04-24
Description: Multiple unspecified vulnerabilities in IXceedCompression in XceddZipLib (RaidenFTPD.dll) in RaidenFTPD 2.4 allow remote attackers to cause a denial of service (crash) via unspecified vectors involving the (1) CalculateCrc, (2) Compress, and (3) Uncompress functions, which result in a NULL pointer dereference.
CVSS Score: 7.8 (HIGH)
References: http://securityreason.com/securityalert/2606; http://www.securityfocus.com/archive/1/466319/100/0/threaded; http://www.securityfocus.com/bid/23570
CVE: CVE-2007-2180
Published: 2007-04-24
Description: Buffer overflow in Nullsoft Winamp 5.3 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted WMV file.
CVSS Score: 7.1 (HIGH)
References: http://securityreason.com/securityalert/2601; http://www.securityfocus.com/archive/1/466291/100/0/threaded; http://www.securityfocus.com/bid/23568
CVE: CVE-2007-2181
Published: 2007-04-24
Description: PHP remote file inclusion vulnerability in admin/login.php in Webinsta FM Manager 0.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter, a different product and vector than CVE-2005-0748.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35261; http://secunia.com/advisories/24958; http://www.securityfocus.com/bid/23592
CVE: CVE-2007-2182
Published: 2007-04-24
Description: Unrestricted file upload vulnerability in forum_write.php in Maran PHP Forum allows remote attackers to upload and execute arbitrary PHP files via a trailing %00 in a filename in the page parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24968; http://www.securityfocus.com/bid/23614; http://www.vupen.com/english/advisories/2007/1493
CVE: CVE-2007-2183
Published: 2007-04-24
Description: SQL injection vulnerability in index.php in PHP-Ring Webring System (aka uPHP_ring_website) 0.9 allows remote attackers to execute arbitrary SQL commands via the ring parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37558; http://www.securityfocus.com/bid/23586; https://exchange.xforce.ibmcloud.com/vulnerabilities/33804
CVE: CVE-2007-2184
Published: 2007-04-24
Description: Directory traversal vulnerability in imgsrv.php in jchit counter 1.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the acc parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/38856; http://www.securityfocus.com/bid/23585; https://exchange.xforce.ibmcloud.com/vulnerabilities/33806
CVE: CVE-2007-2185
Published: 2007-04-24
Description: Multiple PHP remote file inclusion vulnerabilities in Supasite 1.23b allow remote attackers to execute arbitrary PHP code via a URL in the supa[db_path] parameter to (1) common_functions.php, (2) admin_auth_cookies.php, (3) admin_mods.php, (4) admin_news.php, (5) admin_topics.php, (6) admin_users.php, (7) admin_utilities.php, (8) site_comment.php, or (9) site_news.php; or the supa[include_path] parameter to (10) admin_settings.php or (11) backend_site.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/38845; http://osvdb.org/38846; http://osvdb.org/38847
CVE: CVE-2007-2186
Published: 2007-04-24
Description: Foxit Reader 2.0 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/39054; http://www.securityfocus.com/bid/23576; https://exchange.xforce.ibmcloud.com/vulnerabilities/33784
CVE: CVE-2007-2187
Published: 2007-04-24
Description: Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-04/0569.html; http://osvdb.org/35583; http://www.digit-labs.org/files/exploits/extremail-v9.c
CVE: CVE-2007-2188
Published: 2007-04-24
Description: eXtremail 2.1.1 and earlier does not verify the ID field (aka transaction id) in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-04/0569.html; http://osvdb.org/35584; http://www.securityfocus.com/bid/23577
CVE: CVE-2007-2189
Published: 2007-04-24
Description: PHP remote file inclusion vulnerability in admin/admin_album_otf.php in the MX Smartor Full Album Pack (FAP) 2.0 RC1 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/23561; https://exchange.xforce.ibmcloud.com/vulnerabilities/33760; https://www.exploit-db.com/exploits/3766
CVE: CVE-2007-2190
Published: 2007-04-24
Description: PHP remote file inclusion vulnerability in admin/public/webpages.php in Eba News 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://ebascripts.com/; http://securityreason.com/securityalert/2607; http://www.securityfocus.com/archive/1/466406/100/0/threaded
CVE: CVE-2007-2191
Published: 2007-04-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by admin/modules/logfiles/asterisk-full-log.php.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053882.html; http://osvdb.org/35315; http://secunia.com/advisories/24935
CVE: CVE-2007-2192
Published: 2007-04-24
Description: Buffer overflow in Photofiltre Studio 8.1.1 allows user-assisted remote attackers to execute arbitrary code via a crafted .tif file.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35265; http://secunia.com/advisories/24981; http://www.securityfocus.com/bid/23582
CVE: CVE-2007-2193
Published: 2007-04-24
Description: Stack-based buffer overflow in the ID_X.apl plugin in ACDSee 9.0 Build 108, Pro 8.1 Build 99, and Photo Editor 4.0 Build 195 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35236; http://secunia.com/advisories/24994; http://www.acdsee.com/support/knowledgebase/article?id=2800
CVE: CVE-2007-2194
Published: 2007-04-24
Description: Stack-based buffer overflow in XnView 1.90.3 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35235; http://secunia.com/advisories/24973; http://secunia.com/advisories/26006
CVE: CVE-2007-2195
Published: 2007-04-24
Description: aMSN (aka Alvaro's Messenger) 0.96 and earlier allows remote attackers to cause a denial of service (application crash) by sending invalid data to TCP port 31337.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/39116; http://www.securityfocus.com/bid/23583; http://www.securityfocus.com/data/vulnerabilities/exploits/23583.c
CVE: CVE-2007-2196
Published: 2007-04-24
Description: PHP remote file inclusion vulnerability in jambook.php in the Jambook (com_Jambook) 1.0 beta7 module for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: this issue has been disputed by a reliable third party because the jambook.php protects against direct request
CVSS Score: 6.8 (MEDIUM)
References: http://attrition.org/pipermail/vim/2007-April/001535.html; http://securityreason.com/securityalert/2603; http://www.jxdevelopment.com/
CVE: CVE-2007-2197
Published: 2007-04-24
Description: Race condition in the NeatUpload ASP.NET component 1.2.11 through 1.2.16, 1.1.18 through 1.1.23, and trunk.379 through trunk.445 allows remote attackers to obtain other clients' HTTP responses via multiple simultaneous requests, which triggers multiple calls to HttpWorkerRequest.FlushResponse for the same HttpWorkerRequest object and causes a buffer to be reused for a different request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/25003; http://www.securityfocus.com/archive/1/466404/100/0/threaded; http://www.securityfocus.com/bid/23578
CVE: CVE-2007-2198
Published: 2007-04-24
Description: Cross-site scripting (XSS) vulnerability in LAN Management System (LMS) before 1.6.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving the OD parameter to contrib/formularz_przelewu_wplaty/druk.php.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35479; http://secunia.com/advisories/25067; http://www.lms.org.pl/
CVE: CVE-2007-2135
Published: 2007-04-24
Description: The ADI_BINARY component in the Oracle E-Business Suite allows remote attackers to download arbitrary documents from the APPS.FND_DOCUMENTS table via the ADI_DISPLAY_REPORT function, when passed a certain parameter.  NOTE: due to lack of details from Oracle, it is not clear whether this issue is related to other CVE identifiers such as CVE-2007-2126, CVE-2007-2127, or CVE-2007-2128.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/39959; http://securityreason.com/securityalert/2612; http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2007.html
CVE: CVE-2007-2138
Published: 2007-04-24
Description: Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2007-0336.html; http://secunia.com/advisories/24989; http://secunia.com/advisories/24999
CVE: CVE-2007-2170
Published: 2007-04-24
Description: The APPLSYS.FND_DM_NODES package in Oracle E-Business Suite does not check for valid sessions, which allows remote attackers to delete arbitrary nodes.  NOTE: due to lack of details from Oracle, it is not clear whether this issue is related to other CVE identifiers such as CVE-2007-2126, CVE-2007-2127, or CVE-2007-2128.
CVSS Score: 9.4 (HIGH)
References: http://osvdb.org/39958; http://securityreason.com/securityalert/2611; http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2007.html
CVE: CVE-2007-2171
Published: 2007-04-24
Description: Stack-based buffer overflow in the base64_decode function in GWINTER.exe in Novell GroupWise (GW) WebAccess before 7.0 SP2 allows remote attackers to execute arbitrary code via long base64 content in an HTTP Basic Authentication request.
CVSS Score: 10.0 (HIGH)
References: http://download.novell.com/Download?buildid=8RF83go0nZg~; http://download.novell.com/Download?buildid=O9ucpbS1bK0~; http://secunia.com/advisories/24944
CVE: CVE-2007-2199
Published: 2007-04-24
Description: PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConcept Library, as used in multiple products including (1) Joomla! 1.5.0 Beta, (2) N/X Web Content Management System (WCMS) 4.5, (3) CJG EXPLORER PRO 3.3, and (4) phpSiteBackup 0.1, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/34803; http://osvdb.org/36009; http://secunia.com/advisories/25230
CVE: CVE-2007-2200
Published: 2007-04-24
Description: Directory traversal vulnerability in navigator/navigator_ok.php in Pagode 0.5.8 allows remote attackers to read and possibly delete arbitrary files via a .. (dot dot) in the asolute parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35311; http://osvdb.org/35312; http://secunia.com/advisories/24992
CVE: CVE-2007-2201
Published: 2007-04-24
Description: Multiple PHP remote file inclusion vulnerabilities in Post Revolution 6.6 and 7.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the dir parameter to (1) common.php or (2) themes/default/preview_post_completo.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35317; http://osvdb.org/35318; http://secunia.com/advisories/24971
CVE: CVE-2007-2202
Published: 2007-04-24
Description: PHP remote file inclusion vulnerability in inc_ACVS/SOAP/Transport.php in Accueil et Conseil en Visites et Sejours Web Services (ACVSWS) PHP5 (ACVSWS_PHP5) 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the CheminInclude parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24983; http://securityreason.com/securityalert/2609; http://www.securityfocus.com/archive/1/466695/100/0/threaded
CVE: CVE-2007-2203
Published: 2007-04-24
Description: Cross-site scripting (XSS) vulnerability in Big Blue Guestbook allows remote attackers to inject arbitrary web script or HTML via the message field in the guestbook entry submission form.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35313; http://secunia.com/advisories/24997; http://www.securityfocus.com/archive/1/466693/100/0/threaded
CVE: CVE-2007-2204
Published: 2007-04-24
Description: Multiple PHP remote file inclusion vulnerabilities in GPL PHP Board (GPB) unstable-2001.11.14-1 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) db.mysql.inc.php or (2) gpb.inc.php in include/, or the (3) theme parameter to themes/ubb/login.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37539; http://osvdb.org/37540; http://osvdb.org/37541
CVE: CVE-2007-2205
Published: 2007-04-24
Description: PHP remote file inclusion vulnerability in modules/rtmessageadd.php in LAN Management System (LMS) 1.5.3, and possibly 1.5.4, allows remote attackers to execute arbitrary PHP code via a URL in the _LIB_DIR parameter, a different vector than CVE-2007-1643.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35480; http://securityreason.com/securityalert/2630; http://www.attrition.org/pipermail/vim/2007-April/001560.html
CVE: CVE-2007-2206
Published: 2007-04-24
Description: Cross-site scripting (XSS) vulnerability in contact/index.php in Ripe Website Manager 0.8.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a leading "&lt;&quot;&lt;" in the ripeformpost parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2007-04/0384.html; http://john-martinelli.com/work/ripe.txt; http://osvdb.org/35362
CVE: CVE-2007-2207
Published: 2007-04-24
Description: SQL injection vulnerability in contact/index.php in Ripe Website Manager 0.8.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ripeformpost parameter.
CVSS Score: 7.5 (HIGH)
References: http://john-martinelli.com/work/ripe.txt; http://osvdb.org/35363; http://secunia.com/advisories/24984
CVE: CVE-2007-2208
Published: 2007-04-24
Description: Multiple PHP remote file inclusion vulnerabilities in Extreme PHPBB2 3.0 Pre Final allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) functions.php or (2) functions_portal.php in includes/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35420; http://osvdb.org/35421; http://securityreason.com/securityalert/2608
CVE: CVE-2007-2209
Published: 2007-04-24
Description: Buffer overflow in igcore15d.dll 15.1.2.0 and 15.2.0.0 for AccuSoft ImageGear, as used in Corel Paint Shop Pro Photo 11.20 and possibly other products, allows user-assisted remote attackers to execute arbitrary code via a crafted .CLP file.  NOTE: some details were obtained from third party sources.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35308; http://osvdb.org/35386; http://secunia.com/advisories/25016
CVE: CVE-2007-2210
Published: 2007-04-24
Description: A certain ActiveX control in askPopStp.dll in Netsprint Ask IE Toolbar 1.1 allows remote attackers to cause a denial of service (Internet Explorer crash) via a long AddAllowed property value, related to "improper memory handling," possibly a buffer overflow.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35413; http://securityreason.com/securityalert/2604; http://www.securityfocus.com/archive/1/466022/100/100/threaded
CVE: CVE-2007-2211
Published: 2007-04-24
Description: SQL injection vulnerability in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a dayview action.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24967; http://www.securityfocus.com/bid/23612; http://www.vupen.com/english/advisories/2007/1510
CVE: CVE-2007-2212
Published: 2007-04-24
Description: Multiple SQL injection vulnerabilities in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) year or (2) month parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/33814; https://exchange.xforce.ibmcloud.com/vulnerabilities/33814
CVE: CVE-2007-2213
Published: 2007-04-24
Description: Unspecified vulnerability in the Initialize function in NetscapeFTPHandler in WS_FTP Home and Professional 2007 allows remote attackers to cause a denial of service (NULL dereference and application crash) via unspecified vectors related to "improper arguments."
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/archive/1/466576/100/0/threaded; http://www.securityfocus.com/archive/1/466647/100/0/threaded; http://www.securityfocus.com/bid/23584
CVE: CVE-2007-2214
Published: 2007-04-24
Description: Unrestricted file upload vulnerability in includes/upload_file.php in DmCMS allows remote attackers to upload arbitrary PHP scripts by placing a script's contents in both the File2 and File3 parameters, and sending a ok.php?do=act Referer.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35636; http://securityreason.com/securityalert/2605; http://www.securityfocus.com/archive/1/466704/100/0/threaded