deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-6449
Published: 2007-12-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-6121.  Reason: This candidate is a duplicate of CVE-2007-6121.  Notes: All CVE users should reference CVE-2007-6121 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CWE: CWE-20
CVE: CVE-2007-6450
Published: 2007-12-19
Description: The RPL dissector in Wireshark (formerly Ethereal) 0.9.8 to 0.99.6 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=199958; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html; http://secunia.com/advisories/27777
CVE: CVE-2007-6451
Published: 2007-12-19
Description: Unspecified vulnerability in the CIP dissector in Wireshark (formerly Ethereal) 0.9.14 to 0.99.6 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger allocation of large amounts of memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://bugs.gentoo.org/show_bug.cgi?id=199958; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html; http://secunia.com/advisories/27777
CVE: CVE-2007-5963
Published: 2007-12-19
Description: Unspecified vulnerability in kdebase allows local users to cause a denial of service (KDM login inaccessible, or resource consumption) via unknown vectors.
CVSS Score: 4.7 (MEDIUM)
References: http://osvdb.org/41395; http://secunia.com/advisories/28104; http://secunia.com/advisories/28181
CVE: CVE-2007-5966
Published: 2007-12-20
Description: Integer overflow in the hrtimer_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitrary code or cause a denial of service (panic) via a large relative timeout value.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.10; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00002.html; http://secunia.com/advisories/28088
CVE: CVE-2007-6281
Published: 2007-12-20
Description: Heap-based buffer overflow in Open File Manager service (ofmnt.exe) in St. Bernard Open File Manager 9.5 allows remote attackers to execute arbitrary code via a long request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0535&w=2; http://secunia.com/advisories/28131; http://www.securityfocus.com/bid/26914
CVE: CVE-2007-6452
Published: 2007-12-20
Description: Unspecified vulnerability in the benchmark reporting system in Google Web Toolkit (GWT) before 1.4.61 has unknown impact and attack vectors, possibly related to cross-site scripting (XSS).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/webtoolkit/releases/release-notes-1.4.61.html; http://secunia.com/advisories/28122; http://www.osvdb.org/39232
CVE: CVE-2007-6453
Published: 2007-12-20
Description: Directory traversal vulnerability in raidenhttpd-admin/workspace.php in RaidenHTTPD 2.0.19, when the WebAdmin function is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ulang parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://retrogod.altervista.org/rgod_raidenhttpdudo.html; http://secunia.com/advisories/28143
CVE: CVE-2007-6454
Published: 2007-12-20
Description: Heap-based buffer overflow in the handshakeHTTP function in servhs.cpp in PeerCast 0.1217 and earlier, and SVN 344 and earlier, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long SOURCE request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/peercasthof-adv.txt; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457300; http://bugs.gentoo.org/show_bug.cgi?id=202747
CVE: CVE-2007-6455
Published: 2007-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Mambo 4.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Itemid parameter in a com_frontpage option and the (2) option parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28133; http://securityreason.com/securityalert/3462; http://www.securityfocus.com/archive/1/485257/100/0/threaded
CVE: CVE-2007-6456
Published: 2007-12-20
Description: Unspecified vulnerability in OpenOffice.org code in Planamesa NeoOffice 2.2.2 before Patch 4 has unknown impact and attack vectors related to MacOS 10.3.9 .odb files.  NOTE: it is not clear whether this issue is a vulnerability.
CVSS Score: 10.0 (HIGH)
References: http://neowiki.neooffice.org/index.php/NeoOffice_Release_Notes; http://secunia.com/advisories/28093; http://www.securityfocus.com/bid/26878
CVE: CVE-2007-6457
Published: 2007-12-20
Description: Stack-based buffer overflow in the webmail feature in SurgeMail 38k4 allows remote attackers to cause a denial of service (crash) via a long Host header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://retrogod.altervista.org/rgod_surgemail_crash.html; http://secunia.com/advisories/28142; http://securityreason.com/securityalert/3464
CVE: CVE-2007-6458
Published: 2007-12-20
Description: SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded value of the admin parameter to shop/admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/43706; http://www.securityfocus.com/bid/26890; https://www.exploit-db.com/exploits/4733
CVE: CVE-2007-6459
Published: 2007-12-20
Description: Anon Proxy Server 0.100, and probably 0.101, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the host parameter to diagdns.php, and (2) the host parameter and possibly (3) the port parameter to diagconnect.php, a different vulnerability than CVE-2007-6460.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/43711; http://osvdb.org/43712; http://securityreason.com/securityalert/3463
CVE: CVE-2007-6460
Published: 2007-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Anon Proxy Server before 0.101 allow remote attackers to inject arbitrary web script or HTML via the URI, which is later displayed by (1) log.php or (2) logerror.php, a different vulnerability than CVE-2007-6459.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://anonproxyserver.svn.sourceforge.net/viewvc/anonproxyserver/trunk/anon_proxy_server/; http://anonproxyserver.svn.sourceforge.net/viewvc/anonproxyserver/trunk/anon_proxy_server/log.php?r1=284&r2=325; http://anonproxyserver.svn.sourceforge.net/viewvc/anonproxyserver/trunk/anon_proxy_server/logerror.php?r1=245&r2=325
CVE: CVE-2007-6461
Published: 2007-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrary web script or HTML via (1) the query string in an index action, related to the savesearch JavaScript function; and (2) the details parameter in a details action, related to the History tab and the getHistory JavaScript function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://flyspray.org/fsa:2; http://osvdb.org/39256; http://osvdb.org/39257
CVE: CVE-2007-6462
Published: 2007-12-20
Description: SQL injection vulnerability in fullnews.php in PHP Real Estate Classifieds allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://phprealestatescript.com/PHPREC-121707-646PM-PATCH.zip; http://secunia.com/advisories/28119; http://www.securityfocus.com/bid/26888
CVE: CVE-2007-6463
Published: 2007-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in PHP Real Estate Classifieds allow remote attackers to inject arbitrary web script or HTML via unspecified "text areas/boxes."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/43708; http://phprealestatescript.com/PHPREC-121707-646PM-PATCH.zip; http://osvdb.org/43708
CVE: CVE-2007-6464
Published: 2007-12-20
Description: Multiple PHP remote file inclusion vulnerabilities in Form tools 1.5.0b allow remote attackers to execute arbitrary PHP code via a URL in the g_root_dir parameter to (1) admin_page_open.php and (2) client_page_open.php in global/templates/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/40254; http://osvdb.org/40255; https://www.exploit-db.com/exploits/4736
CVE: CVE-2007-6465
Published: 2007-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in ganglia-web in Ganglia before 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) c and (2) h parameters to (a) web/host_gmetrics.php; the (3) G, (4) me, (5) x, (6) n, (7) v, (8) l, (9) vl, and (10) st parameters to (b) web/graph.php; and the (11) c, (12) G, (13) h, (14) r, (15) m, (16) s, (17) cr, (18) hc, (19) sh, (20) p, (21) t, (22) jr, (23) js, (24) gw, (25) z, and (26) gs parameters to (c) web/get_context.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28116; http://sourceforge.net/project/shownotes.php?release_id=562168; http://www.osvdb.org/39515
CVE: CVE-2007-6466
Published: 2007-12-20
Description: Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in a details action, (2) the cat parameter in a browse list action, or (3) the group parameter in a categories action.  NOTE: it was later reported that MOG - Web Shop (MOG-WebShop), a product based on the same code, is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://newhack.org/advisories/FreeWebShop-2.2.1.txt; http://securityreason.com/securityalert/3468; http://www.securityfocus.com/bid/26886
CVE: CVE-2007-6467
Published: 2007-12-20
Description: SQL injection vulnerability in index.php in MKPortal 1.1 RC1 allows remote attackers to execute arbitrary SQL commands via the ida parameter in a gallery foto_show action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3465; http://www.securityfocus.com/archive/1/485035/100/0/threaded; http://www.securityfocus.com/bid/26860
CVE: CVE-2007-6468
Published: 2007-12-20
Description: Buffer overflow in the HuffDecode function in hw_utils/hwrcon/huffman.c and hexenworld/Client/huffman.c in Hammer of Thyrion 1.4.2 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted huffman encoded packet.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/42641; http://secunia.com/advisories/28124; http://sourceforge.net/project/shownotes.php?release_id=562016&group_id=124987
CVE: CVE-2007-6469
Published: 2007-12-20
Description: SQL injection vulnerability in index.php in phpRPG 0.8, when magic_qutoes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4168&w=2; http://secunia.com/advisories/27968; http://www.securityfocus.com/bid/26884
CVE: CVE-2007-6470
Published: 2007-12-20
Description: phpRPG 0.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read session ID values in files under tmp/, and then hijack sessions via PHPSESSID cookies.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4168&w=2; http://secunia.com/advisories/27968; http://www.securityfocus.com/bid/26884
CVE: CVE-2007-6471
Published: 2007-12-20
Description: Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\ (dot dot backslash) in the config parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28111; http://securityreason.com/securityalert/3466; http://www.securityfocus.com/archive/1/485149/100/0/threaded
CVE: CVE-2007-5759
Published: 2007-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-6335.  Reason: This candidate is a duplicate of CVE-2007-6335.  Notes: All CVE users should reference CVE-2007-6335 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-6242
Published: 2007-12-20
Description: Unspecified vulnerability in Adobe Flash Player 9.0.48.0 and earlier might allow remote attackers to execute arbitrary code via unknown vectors, related to "input validation errors."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html; http://secunia.com/advisories/28157; http://secunia.com/advisories/28161
CVE: CVE-2007-6243
Published: 2007-12-20
Description: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html
CVE: CVE-2007-6244
Published: 2007-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://crypto.stanford.edu/advisories/CVE-2007-6244/; http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html; http://secunia.com/advisories/28157
CVE: CVE-2007-6245
Published: 2007-12-20
Description: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 allows remote attackers to modify HTTP headers for client requests and conduct HTTP Request Splitting attacks.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html; http://secunia.com/advisories/28157; http://secunia.com/advisories/28161
CVE: CVE-2007-6246
Published: 2007-12-20
Description: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memory, which might allow local users to gain privileges.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html; http://secunia.com/advisories/28157; http://secunia.com/advisories/28161
CVE: CVE-2007-6335
Published: 2007-12-20
Description: Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, which triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=307562; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=634; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2007-6336
Published: 2007-12-20
Description: Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119, CWE-189
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html
CVE: CVE-2007-6353
Published: 2007-12-20
Description: Integer overflow in exif.cpp in exiv2 library allows context-dependent attackers to execute arbitrary code via a crafted EXIF file that triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://bugs.gentoo.org/show_bug.cgi?id=202351; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html; http://secunia.com/advisories/28132
CVE: CVE-2007-5584
Published: 2007-12-20
Description: Unspecified vulnerability in Cisco Firewall Services Module (FWSM) 3.2(3) allows remote attackers to cause a denial of service (device reload) via crafted "data in the control-plane path with Layer 7 Application Inspections."
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/28175; http://www.cisco.com/en/US/products/products_security_advisory09186a008091b11d.shtml; http://www.osvdb.org/39298
CVE: CVE-2007-6351
Published: 2007-12-20
Description: libexif 0.6.16 and earlier allows context-dependent attackers to cause a denial of service (infinite recursion) via an image file with crafted EXIF tags, possibly involving the exif_loader_write function in exif_loader.c.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=202350; http://osvdb.org/42652; http://secunia.com/advisories/28076
CVE: CVE-2007-6352
Published: 2007-12-20
Description: Integer overflow in libexif 0.6.16 and earlier allows context-dependent attackers to execute arbitrary code via an image with crafted EXIF tags, possibly involving the exif_data_load_data_thumbnail function in exif-data.c.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=202350; http://osvdb.org/42653; http://secunia.com/advisories/28076
CVE: CVE-2007-6430
Published: 2007-12-20
Description: Asterisk Open Source 1.2.x before 1.2.26 and 1.4.x before 1.4.16, and Business Edition B.x.x before B.2.3.6 and C.x.x before C.1.0-beta8, when using database-based registrations ("realtime") and host-based authentication, does not check the IP address when the username is correct and there is no password, which allows remote attackers to bypass authentication using a valid username.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://downloads.digium.com/pub/security/AST-2007-027.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html; http://secunia.com/advisories/28149
CVE: CVE-2007-6472
Published: 2007-12-20
Description: Multiple SQL injection vulnerabilities in phpMyRealty (PMR) 1.0.9 allow (1) remote attackers to execute arbitrary SQL commands via the type parameter to search.php and (2) remote authenticated administrators to execute arbitrary SQL commands via the listing_updated_days parameter to admin/findlistings.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28155; http://www.osvdb.org/39267; http://www.securityfocus.com/bid/26932
CVE: CVE-2007-6473
Published: 2007-12-20
Description: Heap-based buffer overflow in Texas Imperial Software WFTPD Pro Explorer 1.0 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/28160; http://www.securityfocus.com/bid/26935; https://exchange.xforce.ibmcloud.com/vulnerabilities/39138
CVE: CVE-2007-6474
Published: 2007-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to inject arbitrary web script or HTML via the newdir parameter to index_3x.php, and unspecified other vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28164; http://www.securityfocus.com/bid/26936; https://exchange.xforce.ibmcloud.com/vulnerabilities/39125
CVE: CVE-2007-6475
Published: 2007-12-20
Description: Multiple directory traversal vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang_sel parameter to (1) updater.php and (2) thumber.php.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/26936; https://exchange.xforce.ibmcloud.com/vulnerabilities/39126; https://www.exploit-db.com/exploits/4738
CVE: CVE-2007-6476
Published: 2007-12-20
Description: GF-3XPLORER 2.4 allows remote attackers to obtain configuration information via a direct request to explorer/phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/28164; https://exchange.xforce.ibmcloud.com/vulnerabilities/39127; https://www.exploit-db.com/exploits/4738
CVE: CVE-2007-6477
Published: 2007-12-20
Description: Cross-site scripting (XSS) vulnerability in the on-line help feature in Citrix Web Interface 2.0 and earlier, and NFuse, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28150; http://support.citrix.com/article/CTX115283; http://www.securityfocus.com/bid/26933
CVE: CVE-2007-6478
Published: 2007-12-20
Description: Stack-based buffer overflow in Rosoft Media Player 4.1.7, 4.1.8, and possibly earlier versions allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long string in a .M3U file. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/28144; http://securityreason.com/securityalert/3470; http://www.osvdb.org/39501
CVE: CVE-2007-6479
Published: 2007-12-20
Description: Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php (aka the "My profile" page) in Dokeos 1.8.4 allows remote authenticated users to upload and execute arbitrary PHP files via a filename with a double extension, which can then be accessed through a URI under main/upload/users/.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28154; http://www.securityfocus.com/bid/26940; https://exchange.xforce.ibmcloud.com/vulnerabilities/39148
CVE: CVE-2007-6480
Published: 2007-12-20
Description: The Oracle database component in Sun Management Center (Sun MC) 3.6.1, 3.6, and 3.5 Update 1 has a default account, which allows remote attackers to obtain database access and execute arbitrary code.
CVSS Score: 9.4 (HIGH)
References: http://osvdb.org/39563; http://secunia.com/advisories/28151; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103152-1
CVE: CVE-2007-6481
Published: 2007-12-20
Description: Unspecified vulnerability in the Device Manager daemon (utdevmgrd) in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1 allows remote attackers to create or delete arbitrary directories via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/40845; http://secunia.com/advisories/28148; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103175-1
CVE: CVE-2007-6482
Published: 2007-12-20
Description: Unspecified vulnerability in the Device Manager daemon (utdevmgrd) in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/40846; http://secunia.com/advisories/28148; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103175-1
CVE: CVE-2007-6483
Published: 2007-12-20
Description: Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and possibly earlier versions, and Sentinel Keys Server 1.0.3 and possibly earlier versions, allows remote attackers to read arbitrary files via a .. (dot dot) in the query string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://safenet-inc.com/support/files/SPI740SecurityPatch.zip; http://secunia.com/advisories/27811; http://securityreason.com/securityalert/3471