deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1138
Published: 2007-03-02
Description: Absolute path traversal vulnerability in list_main_pages.php in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to list arbitrary directories, and read arbitrary files, via an absolute pathname in the nfolder parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/33138; http://securityreason.com/securityalert/2332; http://www.securityfocus.com/archive/1/460913/100/0/threaded
CVE: CVE-2007-1139
Published: 2007-03-02
Description: Unrestricted file upload vulnerability in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to upload arbitrary scripts via a filename with a double extension.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/33139; http://securityreason.com/securityalert/2332; http://www.securityfocus.com/archive/1/460913/100/0/threaded
CVE: CVE-2007-1140
Published: 2007-03-02
Description: Directory traversal vulnerability in edit.php in pheap allows remote attackers to read and modify arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 9.4 (HIGH)
CWE: CWE-22
References: http://osvdb.org/33140; http://securityreason.com/securityalert/2354; http://www.securityfocus.com/archive/1/460920/100/0/threaded
CVE: CVE-2007-1141
Published: 2007-03-02
Description: PHP remote file inclusion vulnerability in preview.php in Magic News Plus 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the php_script_path parameter.  NOTE: This issue may overlap CVE-2006-0723.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/33135; http://securityreason.com/securityalert/2334; http://www.securityfocus.com/archive/1/460902/100/0/threaded
CVE: CVE-2007-1142
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the link_parameters parameter in (1) news.php and (2) n_layouts.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/33136; http://osvdb.org/33137; http://securityreason.com/securityalert/2334
CVE: CVE-2007-1143
Published: 2007-03-02
Description: Directory traversal vulnerability in pn-menu.php in J-Web Pics Navigator 1.0 allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2692; http://osvdb.org/33118; http://securityreason.com/securityalert/2340
CVE: CVE-2007-1144
Published: 2007-03-02
Description: Directory traversal vulnerability in jwpn-photos.php in J-Web Pics Navigator 2.0 allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2692; http://osvdb.org/33117; http://secunia.com/advisories/24273
CVE: CVE-2007-1145
Published: 2007-03-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite - ESupport 3.00.13 and 3.04.10 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a (1) lostpassword or (2) register action in index.php, (3) unspecified vectors in the Submit form in a submit action in index.php, and (4) the user's name in index.php; and (5) allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the Admin and Staff Control Panel. NOTE: this might issue overlap CVE-2004-1412, CVE-2005-0487, or CVE-2005-0842.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/33535; http://osvdb.org/33536; http://secunia.com/advisories/24223
CVE: CVE-2007-1146
Published: 2007-03-02
Description: PHP remote file inclusion vulnerability in function.php in arabhost allows remote attackers to execute arbitrary PHP code via a URL in the adminfolder parameter.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-February/001396.html; http://osvdb.org/33839; http://securityreason.com/securityalert/2339
CVE: CVE-2007-1147
Published: 2007-03-02
Description: PHP remote file inclusion vulnerability in view.php in hbm allows remote attackers to execute arbitrary PHP code via a URL in the hbmpath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/36878; http://securityreason.com/securityalert/2339; http://www.securityfocus.com/archive/1/460933/100/0/threaded
CVE: CVE-2007-1148
Published: 2007-03-02
Description: PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/33516; http://securityreason.com/securityalert/2338; http://www.securityfocus.com/archive/1/460917/100/0/threaded
CVE: CVE-2007-1149
Published: 2007-03-02
Description: Multiple directory traversal vulnerabilities in LoveCMS 1.4 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the step parameter to install/index.php or (2) the load parameter to the top-level URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/33517; http://osvdb.org/33518; http://securityreason.com/securityalert/2338
CVE: CVE-2007-1150
Published: 2007-03-02
Description: Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://osvdb.org/33519; http://securityreason.com/securityalert/2338; http://www.securityfocus.com/archive/1/460917/100/0/threaded
CVE: CVE-2007-1151
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/33520; http://securityreason.com/securityalert/2338; http://www.securityfocus.com/archive/1/460917/100/0/threaded
CVE: CVE-2007-1152
Published: 2007-03-02
Description: Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) act or (2) pid parameter to the top-level URI (index.php), or the (3) action parameter to admin/index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/37398; http://www.securityfocus.com/bid/22667; http://www.securityfocus.com/bid/33861
CVE: CVE-2007-1153
Published: 2007-03-02
Description: Multiple PHP remote file inclusion vulnerabilities in CutePHP CuteNews 1.3.6 allow remote attackers to execute arbitrary PHP code via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: issue might overlap CVE-2004-1660 or CVE-2006-4445.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/37397; http://www.securityfocus.com/bid/22674; http://osvdb.org/37397
CVE: CVE-2007-1154
Published: 2007-03-02
Description: SQL injection vulnerability in webSPELL allows remote attackers to execute arbitrary SQL commands via a ws_auth cookie, a different vulnerability than CVE-2006-4782.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/2337; http://www.securityfocus.com/archive/1/460937/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/32669
CVE: CVE-2007-1155
Published: 2007-03-02
Description: Unrestricted file upload vulnerability in webSPELL allows remote authenticated administrators to upload and execute arbitrary PHP code via the add squad feature.  NOTE: this issue may be an administrative feature, in which case this CVE may be REJECTED.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/2337; http://www.securityfocus.com/archive/1/460937/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/32670
CVE: CVE-2007-1156
Published: 2007-03-02
Description: JBrowser allows remote attackers to bypass authentication and access certain administrative capabilities via a direct request for _admin/.
CVSS Score: 7.5 (HIGH)
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2693; http://osvdb.org/33141; http://securityreason.com/securityalert/2370
CVE: CVE-2007-1157
Published: 2007-03-02
Description: Cross-site request forgery (CSRF) vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via certain MBean operations, a different vulnerability than CVE-2006-3733.
CVSS Score: 7.6 (HIGH)
CWE: CWE-352
References: http://osvdb.org/33142; http://www.securityfocus.com/archive/1/460934/100/0/threaded; http://www.securityfocus.com/archive/1/461004/100/0/threaded
CVE: CVE-2007-1158
Published: 2007-03-02
Description: Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2820&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9502&w=2; http://osvdb.org/33781
CVE: CVE-2007-1159
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in modules/out.php in Pyrophobia 2.1.3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/36879; http://www.securityfocus.com/bid/22667; http://osvdb.org/36879
CVE: CVE-2007-1160
Published: 2007-03-02
Description: webSPELL 4.0, and possibly later versions, allows remote attackers to bypass authentication via a ws_auth cookie, a different vulnerability than CVE-2006-4782.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://osvdb.org/33143; http://securityreason.com/securityalert/2337; http://www.securityfocus.com/archive/1/460937/100/0/threaded
CVE: CVE-2007-1161
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in call_entry.php in Call Center Software 0,93 allows remote attackers to inject arbitrary web script or HTML via the problem_desc parameter, as demonstrated by the ONLOAD attribute of a BODY element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/33037; http://securityreason.com/securityalert/2333; http://www.attrition.org/pipermail/vim/2007-February/001378.html
CVE: CVE-2007-1162
Published: 2007-03-02
Description: A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) IsFolderAvailable or (2) RootFolder property value, different vectors than CVE-2007-0371.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/34963; http://www.securityfocus.com/bid/22645; http://www.securityfocus.com/data/vulnerabilities/exploits/22645.html
CVE: CVE-2007-1163
Published: 2007-03-02
Description: SQL injection vulnerability in printview.php in webSPELL 4.01.02 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter, a different vector than CVE-2007-1019, CVE-2006-5388, and CVE-2006-4783.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/33231; http://secunia.com/advisories/24257; http://www.securityfocus.com/bid/22659
CVE: CVE-2007-1164
Published: 2007-03-02
Description: Multiple PHP remote file inclusion vulnerabilities in DBImageGallery 1.2.2 allow remote attackers to execute arbitrary PHP code via a URL in the donsimg_base_path parameter to (1) attributes.php, (2) images.php, or (3) scan.php in admin/; or (4) attributes.php, (5) db_utils.php, (6) images.php, (7) utils.php, or (8) values.php in includes/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/34937; http://osvdb.org/34938; http://osvdb.org/34939
CVE: CVE-2007-1165
Published: 2007-03-02
Description: Multiple PHP remote file inclusion vulnerabilities in DBGuestbook 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the dbs_base_path parameter to (1) utils.php, (2) guestbook.php, or (3) views.php in includes/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/33493; http://osvdb.org/33494; http://osvdb.org/33495
CVE: CVE-2007-1166
Published: 2007-03-02
Description: SQL injection vulnerability in result.php in Nabopoll 1.2 allows remote attackers to execute arbitrary SQL commands via the surv parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://attrition.org/pipermail/vim/2007-February/001379.html; http://osvdb.org/33753; http://securityreason.com/securityalert/2372
CVE: CVE-2007-1167
Published: 2007-03-02
Description: inc/filebrowser/browser.php in deV!L`z Clanportal (DZCP) 1.4.5 and earlier allows remote attackers to obtain MySQL data via the inc/mysql.php value of the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/33372; http://secunia.com/advisories/24260; http://www.dzcp.de/inc/tinymce_files/Downloads/dzcp_update/notes_1.4.6.txt
CVE: CVE-2007-1168
Published: 2007-03-02
Description: Trend Micro ServerProtect for Linux (SPLX) 1.25, 1.3, and 2.5 before 20070216 allows remote attackers to access arbitrary web pages and reconfigure the product via HTTP requests with the splx_2376_info cookie to the web interface port (14942/tcp).
CVSS Score: 7.5 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=477; http://secunia.com/advisories/24264; http://securitytracker.com/id?1017685
CVE: CVE-2007-1169
Published: 2007-03-02
Description: The web interface in Trend Micro ServerProtect for Linux (SPLX) 1.25, 1.3, and 2.5 before 20070216 accepts logon requests through unencrypted HTTP, which might allow remote attackers to obtain credentials by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
References: http://www.trendmicro.com/download/product.asp?productid=20; http://www.trendmicro.com/download/product.asp?productid=20
CVE: CVE-2007-1170
Published: 2007-03-02
Description: SimBin GTR - FIA GT Racing Game 1.5.0.0 and earlier, GT Legends 1.1.0.0 and earlier, GTR 2 1.1 and earlier, and RACE - The WTCC Game 1.0 and earlier allow remote attackers to cause a denial of service (client disconnection) via an empty UDP packet to the server port.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/simbinzero-adv.txt; http://osvdb.org/34240; http://securityreason.com/securityalert/2369
CVE: CVE-2007-1171
Published: 2007-03-02
Description: SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 allows remote attackers to execute arbitrary SQL commands via an admin cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/26954; http://securityreason.com/securityalert/2344; http://www.attrition.org/pipermail/vim/2007-September/001806.html
CVE: CVE-2007-1172
Published: 2007-03-02
Description: SQL injection vulnerability in nukesentinel.php in NukeSentinel 2.5.05, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, aka the "File Disclosure Exploit."
CVSS Score: 6.4 (MEDIUM)
References: http://attrition.org/pipermail/vim/2007-March/001429.html; http://secunia.com/advisories/24221; http://securityreason.com/securityalert/2341
CVE: CVE-2007-1174
Published: 2007-03-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebAPP before 20070214 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to unspecified fields in user Profiles.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33301; http://www.securityfocus.com/bid/22563; http://www.vupen.com/english/advisories/2007/0605
CVE: CVE-2007-1175
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in an admin feature in WebAPP before 20070209 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33275; http://www.securityfocus.com/bid/22563; http://www.vupen.com/english/advisories/2007/0604
CVE: CVE-2007-1176
Published: 2007-03-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) Gallery Comments pages, (2) Feedback pages, (3) Search Results pages, and (4) the Statistics Log viewer.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33276; http://osvdb.org/33288; http://osvdb.org/33289
CVE: CVE-2007-1177
Published: 2007-03-02
Description: WebAPP before 0.9.9.5 does not properly filter certain characters in contexts related to (1) the query string, (2) Profiles, (3) the Forum Post icon field, (4) the Edit Profile, and (5) the Gallery, which has unknown impact and remote attack vectors, possibly related to cross-site scripting (XSS).
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/33277; http://osvdb.org/33283; http://osvdb.org/33286
CVE: CVE-2007-1178
Published: 2007-03-02
Description: WebAPP before 0.9.9.5 does not check access in certain contexts related to (1) Calendar Administration, (2) Instant Messages Administration, and (3) the Image Uploader, which has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33279; http://osvdb.org/33282; http://secunia.com/advisories/24080
CVE: CVE-2007-1179
Published: 2007-03-02
Description: WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to (1) the Recommend feature, Email Article (2) senders and (3) recipients, (4) New User Approval, (5) Edit Profiles, (6) the Newsletter Subscription form, (7) the Recommend form, and (8) sending of articles, which has unknown impact, and remote attack vectors related to spam attacks and possibly other attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33284; http://secunia.com/advisories/24080; http://www.securityfocus.com/bid/22563
CVE: CVE-2007-1180
Published: 2007-03-02
Description: WebAPP before 0.9.9.5 does not check referrers in certain forms, which might facilitate remote cross-site request forgery (CSRF) attacks or have other unknown impact.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33285; http://secunia.com/advisories/24080; http://www.securityfocus.com/bid/22563
CVE: CVE-2007-1181
Published: 2007-03-02
Description: WebAPP before 0.9.9.5 passes (1) Unused Informations and (2) the username through Edit Profile forms, which has unknown impact and attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33291; http://secunia.com/advisories/24080; http://www.securityfocus.com/bid/22563
CVE: CVE-2007-1182
Published: 2007-03-02
Description: WebAPP before 0.9.9.5 allows remote Guest users to edit a Guest profile, which has unknown impact.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/33292; http://secunia.com/advisories/24080; http://www.securityfocus.com/bid/22563
CVE: CVE-2007-1183
Published: 2007-03-02
Description: WebAPP before 0.9.9.5 allows remote authenticated users to spoof another user's Real Name via whitespace, which has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33293; http://secunia.com/advisories/24080; http://www.securityfocus.com/bid/22563
CVE: CVE-2007-1184
Published: 2007-03-02
Description: The default configuration of WebAPP before 0.9.9.5 has a CAPTCHA setting of "no," which makes it easier for automated programs to submit false data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://osvdb.org/33294; http://secunia.com/advisories/24080; http://www.securityfocus.com/bid/22563
CVE: CVE-2007-1185
Published: 2007-03-02
Description: The (1) Search, (2) Edit Profile, (3) Recommend, and (4) User Approval forms in WebAPP before 0.9.9.5 use hidden inputs, which has unknown impact and remote attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33295; http://secunia.com/advisories/24080; http://www.securityfocus.com/bid/22563
CVE: CVE-2007-1186
Published: 2007-03-02
Description: WebAPP before 0.9.9.5 does not "censor" the Latest Member real name, which has unknown impact.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33296; http://secunia.com/advisories/24080; http://www.securityfocus.com/bid/22563
CVE: CVE-2007-1187
Published: 2007-03-02
Description: WebAPP before 0.9.9.5 allows remote authenticated users, without admin privileges, to obtain sensitive information via (1) the Forum Archive feature and (2) Recent Searches.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/33281; http://osvdb.org/33298; http://secunia.com/advisories/24080
CVE: CVE-2007-1188
Published: 2007-03-02
Description: WebAPP before 0.9.9.5 allows remote attackers to submit Search form input that is not checked for (1) composition or (2) length, which has unknown impact, possibly related to "search form hijacking".
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33299; http://secunia.com/advisories/24080; http://www.securityfocus.com/bid/22563
CVE: CVE-2007-1189
Published: 2007-03-02
Description: Integer overflow in the envwrite function in the Alcatel-Lucent Bell Labs Plan 9 kernel allows local users to overwrite certain memory addresses with kernel memory via a large n argument, as demonstrated by (1) modifying the iseve function to gain privileges and (2) making the devpermcheck function grant unrestricted device permissions.
CVSS Score: 7.2 (HIGH)
References: http://kernelspace.us/itheft.c; http://lists.immunitysec.com/pipermail/dailydave/2007-February/004118.html; http://osvdb.org/34956
CVE: CVE-2007-1190
Published: 2007-03-02
Description: Unspecified vulnerability in the EmbeddedWB Web Browser ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36205; http://www.securityfocus.com/bid/22755; http://osvdb.org/36205
CVE: CVE-2007-1191
Published: 2007-03-02
Description: The Social Bookmarks (del.icio.us) plug-in 8F in Quicksilver writes usernames and passwords in plaintext to the /Library/Logs/Console/UID/Console.log file, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052722.html; http://osvdb.org/34486; http://securityreason.com/securityalert/2368
CVE: CVE-2007-1192
Published: 2007-03-02
Description: Thomas R. Pasawicz HyperBook Guestbook 1.30 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an admin password hash via a direct request for data/gbconfiguration.dat.
CVSS Score: 5.0 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/22754.py; http://osvdb.org/33868; http://secunia.com/advisories/24392
CVE: CVE-2007-1193
Published: 2007-03-02
Description: Multiple unspecified vulnerabilities in the Login page in OrangeHRM before 20070212 have unknown impact and attack vectors.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35993; http://sourceforge.net/tracker/index.php?func=detail&aid=1656000&group_id=156477&atid=799942; http://www.securityfocus.com/bid/22756
CVE: CVE-2007-1194
Published: 2007-03-02
Description: Norman SandBox Analyzer does not use the proper range for Interrupt Descriptor Table (IDT) entries, which allows local users to determine that the local machine is an emulator, or a similar environment not based on a physical Intel processor, which allows attackers to produce malware that is more difficult to analyze.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://osvdb.org/34955; http://www.ntsecurity.nu/onmymind/2007/2007-02-27.html; http://www.securityfocus.com/archive/1/461555/100/0/threaded