deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-4767
Published: 2007-11-07
Description: Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=198976; http://docs.info.apple.com/article.html?artnum=307179; http://docs.info.apple.com/article.html?artnum=307562
CVE: CVE-2007-4768
Published: 2007-11-07
Description: Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=198976; http://docs.info.apple.com/article.html?artnum=307179; http://docs.info.apple.com/article.html?artnum=307562
CVE: CVE-2007-5116
Published: 2007-11-07
Description: Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://docs.info.apple.com/article.html?artnum=307179; http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
CVE: CVE-2007-4352
Published: 2007-11-08
Description: Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.
CVSS Score: 7.6 (HIGH)
References: http://secunia.com/advisories/26503; http://secunia.com/advisories/27260; http://secunia.com/advisories/27553
CVE: CVE-2007-5392
Published: 2007-11-08
Description: Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/26503; http://secunia.com/advisories/27260; http://secunia.com/advisories/27553
CVE: CVE-2007-5393
Published: 2007-11-08
Description: Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/26503; http://secunia.com/advisories/27260; http://secunia.com/advisories/27553
CVE: CVE-2007-5395
Published: 2007-11-08
Description: Stack-based buffer overflow in the separate_word function in tokenize.c in Link Grammar 4.1b and possibly other versions, as used in AbiWord Link Grammar 4.2.4, allows remote attackers to execute arbitrary code via a long word, as reachable through the separate_sentence function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=450695; http://bugs.gentoo.org/show_bug.cgi?id=196803; http://secunia.com/advisories/27300
CVE: CVE-2007-5581
Published: 2007-11-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in mpweb/scripts/mpx.dll in Cisco Unified MeetingPlace 5.4 and earlier and 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName and (2) LastName parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/26462; http://securitytracker.com/id?1018904; http://www.cisco.com/warp/public/707/cisco-sr-20071107-mp.shtml
CVE: CVE-2007-5889
Published: 2007-11-08
Description: Multiple PHP remote file inclusion vulnerabilities in IDMOS 1.0 Alpha (aka Phoenix) allow remote attackers to execute arbitrary PHP code via a URL in the site_absolute_path parameter to (1) admin.php, (2) menu_add.php, and (3) menu_operation.php in administrator/, different vectors than CVE-2007-5294.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/38735; http://osvdb.org/38736; http://osvdb.org/38737
CVE: CVE-2007-5890
Published: 2007-11-08
Description: Directory traversal vulnerability in index.php in easyGB 2.1.1 allows remote attackers to include arbitrary files via the DatabaseType parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/38730; http://www.securityfocus.com/bid/26335; http://osvdb.org/38730
CVE: CVE-2007-5891
Published: 2007-11-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in jsp/Login.do in ManageEngine OpManager MSP Edition and OpManager 7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) requestid, (2) fileid, (3) woMode, and (2) woID parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38437; http://secunia.com/advisories/27456; http://www.securityfocus.com/bid/26368
CVE: CVE-2007-5892
Published: 2007-11-08
Description: Stack-based buffer overflow in the pdg2.dll ActiveX control in SSReader 4.0 and earlier allow remote attackers to execute arbitrary code via a long argument to the Register method.  NOTE: some details were obtained from third party sources.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/38436; http://secunia.com/advisories/27561; http://www.dswlab.com/vir/v20071020.html
CVE: CVE-2007-5893
Published: 2007-11-08
Description: HTTPSocket.cpp in the C++ Sockets Library before 2.2.5 allows remote attackers to cause a denial of service (crash) via an HTTP request with a missing protocol version number, which triggers an exception. NOTE: some of these details were obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/42105; http://secunia.com/advisories/27535; http://www.alhem.net/Sockets/Changelog
CVE: CVE-2007-3921
Published: 2007-11-08
Description: gforge 3.1 and 4.5.14 allows local users to truncate arbitrary files via a symlink attack on temporary files.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://osvdb.org/42117; http://secunia.com/advisories/27549; http://secunia.com/advisories/27586
CVE: CVE-2007-4129
Published: 2007-11-08
Description: CoolKey 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files in the /tmp/.pk11ipc1/ directory.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://osvdb.org/40435; http://secunia.com/advisories/27591; http://www.redhat.com/support/errata/RHSA-2007-0631.html
CVE: CVE-2007-4223
Published: 2007-11-08
Description: Dbgv.sys in Microsoft Sysinternals DebugView before 4.72 provides an unspecified mechanism for copying data into kernel memory, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=621; http://secunia.com/advisories/27552; http://www.securityfocus.com/bid/26359
CVE: CVE-2006-7224
Published: 2007-11-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-7227, CVE-2005-4872, CVE-2006-7228.  Reason: this candidate was SPLIT into other identifiers in order to reflect different affected versions and distinct vendor fixes.  Notes: All CVE users should consult CVE-2006-7227, CVE-2005-4872, and CVE-2006-7228 to determine which ID is appropriate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-4517
Published: 2007-11-08
Description: Buffer overflow in the XDB.XDB_PITRIG_PKG.PITRIG_DROPMETADATA procedure in Oracle 10g R2 allows remote authenticated users to execute arbitrary code via a long (1) OWNER or (2) NAME argument.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=622; http://secunia.com/advisories/27526; http://securityreason.com/securityalert/8524
CVE: CVE-2007-5766
Published: 2007-11-08
Description: SQL injection vulnerability in okxLOV.jsp in Oracle E-Business Suite 11 and 12 allows remote attackers to execute arbitrary SQL commands via unknown vectors.  NOTE: this is probably the same issue as CVE-2007-5527 or CVE-2007-5528, but there are insufficient details to be sure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/40080; http://securityreason.com/securityalert/3344; http://www.oracle.com/technetwork/topics/security/cpuoct2007-092913.html
CVE: CVE-2007-5896
Published: 2007-11-08
Description: Mozilla Firefox 2.0.0.9 allows remote attackers to cause a denial of service (CPU consumption and crash) via an iframe with Javascript that sets the document.location to contain a leading NULL byte (\x00) and a (1) res://, (2) about:config, or (3) file:/// URI.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://osvdb.org/45296; http://www.0x000000.com/index.php?i=467&bin=111010011; http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2007-11/msg00094.html
CVE: CVE-2007-5897
Published: 2007-11-08
Description: Buffer overflow in MDSYS.SDO_CS in Oracle Database Server 8iR3, 9iR1, 9iR2 up to 9.2.0.6, and 10gR1 up to 10.1.0.4 allows remote authenticated users to cause a denial of service (crash) and execute arbitrary code via the TRANSFORM function.  NOTE: this issue might already be covered by CVE-2007-5515, CVE-2007-5509, or CVE-2007-5505, but there are insufficient details to be sure.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/40081; http://www.oracle.com/technetwork/topics/security/cpuoct2007-092913.html; http://www.securityfocus.com/archive/1/482918/100/100/threaded
CVE: CVE-2007-5904
Published: 2007-11-09
Description: Multiple buffer overflows in CIFS VFS in Linux kernel 2.6.23 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long SMB responses that trigger the overflows in the SendReceive function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git%3Ba=commitdiff%3Bh=133672efbc1085f9af990bdc145e1822ea93bcf3; http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00002.html
CVE: CVE-2007-5906
Published: 2007-11-09
Description: Xen 3.1.1 allows virtual guest system users to cause a denial of service (hypervisor crash) by using a debug register (DR7) to set certain breakpoints.
CVSS Score: 4.7 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html; http://lists.xensource.com/archives/html/xen-devel/2007-10/msg01048.html; http://secunia.com/advisories/28405
CVE: CVE-2007-5907
Published: 2007-11-09
Description: Xen 3.1.1 does not prevent modification of the CR4 TSC from applications, which allows pv guests to cause a denial of service (crash).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html; http://lists.xensource.com/archives/html/xen-devel/2007-10/msg00932.html; http://secunia.com/advisories/28405
CVE: CVE-2007-5908
Published: 2007-11-09
Description: Rejected reason: Buffer overflow in the (1) sysfs_show_available_clocksources and (2) sysfs_show_current_clocksources functions in Linux kernel 2.6.23 and earlier might allow local users to cause a denial of service or execute arbitrary code via crafted clock source names.  NOTE: follow-on analysis by Linux developers states that "There is no way for unprivileged users (or really even the root user) to add new clocksources.
CVE: CVE-2007-4570
Published: 2007-11-10
Description: Algorithmic complexity vulnerability in the MCS translation daemon in mcstrans 0.2.3 allows local users to cause a denial of service (temporary daemon outage) via a large range of compartments in sensitivity labels.
CVSS Score: 1.9 (LOW)
CWE: CWE-20
References: http://osvdb.org/39244; http://secunia.com/advisories/27589; http://www.securityfocus.com/bid/26371
CVE: CVE-2007-5396
Published: 2007-11-10
Description: Format string vulnerability in the ext_yahoo_contact_added function in yahoo.c in Miranda IM 0.7.1 allows remote attackers to execute arbitrary code via a Y7 Buddy Authorization packet with format string specifiers in the contact Yahoo!  handle (who).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://miranda.svn.sourceforge.net/viewvc/miranda/trunk/miranda/protocols/Yahoo/yahoo.c?r1=6601&r2=6699&diff_format=l; http://secunia.com/advisories/27402; http://secunia.com/secunia_research/2007-89/advisory/
CVE: CVE-2007-5909
Published: 2007-11-10
Description: Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK before 9.2.0.12, as used by ActivePDF DocConverter, IBM Lotus Notes before 7.0.3, Symantec Mail Security, and other products, allow remote attackers to execute arbitrary code via a crafted (1) AG file to kpagrdr.dll, (2) AW file to awsr.dll, (3) DLL or (4) EXE file to exesr.dll, (5) DOC file to mwsr.dll, (6) MIF file to mifsr.dll, (7) SAM file to lasr.dll, or (8) RTF file to rtfsr.dll.  NOTE: the WPD (wp6sr.dll) vector is covered by CVE-2007-5910.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27304; http://securityreason.com/securityalert/3357; http://securityresponse.symantec.com/avcenter/security/Content/2007.11.01c.html
CVE: CVE-2007-5910
Published: 2007-11-10
Description: Stack-based buffer overflow in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK before 9.2.0.12, as used by ActivePDF DocConverter, wp6sr.dll in IBM Lotus Notes 8.0 and before 7.0.3, Symantec Mail Security, and other products, allows remote attackers to execute arbitrary code via a crafted WordPerfect (WPD) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27304; http://securityreason.com/securityalert/3357; http://securityresponse.symantec.com/avcenter/security/Content/2007.11.01c.html
CVE: CVE-2007-5911
Published: 2007-11-10
Description: Multiple stack-based buffer overflows in the AxMetaStream ActiveX control in AxMetaStream.dll 3.3.2.26 in Viewpoint Media Player 3.2 allow remote attackers to execute arbitrary code via a long string argument to the (1) BroadcastKey, (2) BroadcastKeyFileURL, (3) Component, (4) ComponentClassID, (5) ComponentFileName, (6) ExtraProperty, (7) Properties, (8) RequiredVersions, (9) Source, or (10) XMLText method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/40268; http://shinnai.altervista.org/exploits/txt/TXT_dolp8rQrZmWLlINruy0o.html; http://www.securityfocus.com/bid/26356
CVE: CVE-2007-5912
Published: 2007-11-10
Description: SQL injection vulnerability in mailer.php in jPORTAL 2 allows remote attackers to execute arbitrary SQL commands via the to parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/4611; https://www.exploit-db.com/exploits/4611
CVE: CVE-2007-5913
Published: 2007-11-10
Description: dirsys/modules/auth.php in JBC Explorer 7.20 RC1 and earlier does not require authentication, which allows remote attackers to (1) delete auth.inc.php via the suppr parameter, and (2) re-create the auth.inc.php file with contents that specify a new account name and password for JBC Explorer via the login and password parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://mgsdl.free.fr/?1:33; http://osvdb.org/42069; http://secunia.com/advisories/27533
CVE: CVE-2007-5914
Published: 2007-11-10
Description: Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php.  NOTE: this can be exploited by unauthenticated remote attackers by leveraging CVE-2007-5913.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://mgsdl.free.fr/?1:33; http://osvdb.org/42070; http://secunia.com/advisories/27533
CVE: CVE-2007-5915
Published: 2007-11-10
Description: Directory traversal vulnerability in index.php in phphelpdesk 0.6.16 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the whattodo parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/3359; http://www.securityfocus.com/archive/1/483256/100/0/threaded; http://www.securityfocus.com/bid/26318
CVE: CVE-2007-5916
Published: 2007-11-10
Description: SQL injection vulnerability in the login page in phphelpdesk 0.6.16 allows remote attackers to execute arbitrary SQL commands via unspecified parameters related to the "login procedures."
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3359; http://www.securityfocus.com/archive/1/483256/100/0/threaded; http://www.securityfocus.com/bid/26319
CVE: CVE-2007-5917
Published: 2007-11-10
Description: Cross-site request forgery (CSRF) vulnerability in admin/admin_account.php in Skalinks 1.5 and earlier allows remote attackers to add arbitrary privileged accounts as administrators via the admin_name, admin_password, admin_type, and Add_admin parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/27532; http://securityreason.com/securityalert/3356; http://www.hackinginside.altervista.org/bug/skalinks_1_5_csrf.txt
CVE: CVE-2007-5918
Published: 2007-11-10
Description: Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://0x90.com.ar/Advisory/20071106.txt; http://www.securityfocus.com/archive/1/483353/100/0/threaded; http://www.securityfocus.com/bid/26358
CVE: CVE-2007-5919
Published: 2007-11-10
Description: MyWebFTP, possibly 5.3.2, stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain an MD5 password hash via a direct request for pass/pass.txt.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/27551; http://securityreason.com/securityalert/3355; http://www.securityfocus.com/archive/1/483354/100/0/threaded
CVE: CVE-2007-5920
Published: 2007-11-10
Description: index.php in Domenico Mancini PicoFlat CMS before 0.4.18 allows remote attackers to include certain files via unspecified vectors, possibly due to a directory traversal vulnerability.  NOTE: this can be leveraged to bypass authentication and upload files by including pico_insert.php or unspecified other administrative scripts.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/42106; http://picoflat.altervista.org/; http://secunia.com/advisories/27504
CVE: CVE-2007-5921
Published: 2007-11-10
Description: Unspecified vulnerability in the ioctl interface in the Solaris Volume Manager (SVM) in Sun Solaris 9 and 10 allows local users to cause a denial of service (panic) via unspecified vectors, a different vulnerability than CVE-2004-1346.
CVSS Score: 4.7 (MEDIUM)
References: http://osvdb.org/40817; http://secunia.com/advisories/27519; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103143-1
CVE: CVE-2007-5922
Published: 2007-11-10
Description: The modules/mdop.m in the Cypress 1.0k script for BitchX, as downloaded from a distribution site in November 2007, contains an externally introduced backdoor that e-mails sensitive information (hostnames, usernames, and shell history) to a fixed address.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/42073; http://secunia.com/advisories/27556; http://www.securityfocus.com/archive/1/483350/100/0/threaded
CVE: CVE-2007-5923
Published: 2007-11-10
Description: Cross-site scripting (XSS) vulnerability in forms/smpwservices.fcc in CA (formerly Computer Associates) eTrust SiteMinder Agent allows remote attackers to inject arbitrary web script or HTML via the SMAUTHREASON parameter, a different vector than CVE-2005-2204.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/483367/100/0/threaded; http://www.securityfocus.com/bid/26375; http://www.securityfocus.com/archive/1/483367/100/0/threaded
CVE: CVE-2007-5924
Published: 2007-11-10
Description: Cross-site scripting (XSS) vulnerability in the Web Server (HTTP) task in IBM Lotus Domino before 6.5.6 FP2, and 7.x before 7.0.2 FP2, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/39720; http://secunia.com/advisories/27509
CVE: CVE-2007-5925
Published: 2007-11-10
Description: The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and earlier allows remote authenticated users to cause a denial of service (database crash) via a certain CONTAINS operation on an indexed column, which triggers an assertion error.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=198988; http://bugs.mysql.com/bug.php?id=32125; http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/067350.html
CVE: CVE-2007-5926
Published: 2007-11-10
Description: OpenBase 10.0.5 and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to the (1) AsciiBackup, (2) OEMLicenseInstall, and possibly other stored procedures.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/27525; http://www.netragard.com/pdfs/research/NETRAGARD-20070313-OPENBASE.txt; http://www.securityfocus.com/bid/26347
CVE: CVE-2007-5927
Published: 2007-11-10
Description: Directory traversal vulnerability in OpenBase 10.0.5 and earlier allows remote authenticated users to create files with arbitrary contents via a .. (dot dot) in the first argument to the GlobalLog stored procedure.  NOTE: this can be leveraged to execute arbitrary code using CVE-2007-5926.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: http://secunia.com/advisories/27525; http://www.netragard.com/pdfs/research/NETRAGARD-20070313-OPENBASE.txt; http://www.securityfocus.com/bid/26347
CVE: CVE-2007-5928
Published: 2007-11-10
Description: OpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECT statement.  NOTE: this might be a buffer overflow, but it is not clear.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-119, CWE-119
References: http://www.netragard.com/pdfs/research/NETRAGARD-20070313-OPENBASE.txt; http://www.netragard.com/pdfs/research/NETRAGARD-20070313-OPENBASE.txt
CVE: CVE-2007-5929
Published: 2007-11-10
Description: Buffer overflow in OpenBase 10.0.5 and earlier might allow remote authenticated users to execute arbitrary code or cause a denial of service (daemon crash) by creating a stored procedure with a long name and invoking this procedure, which triggers heap corruption.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27525; http://www.netragard.com/pdfs/research/NETRAGARD-20070313-OPENBASE.txt; http://www.securityfocus.com/bid/26347
CVE: CVE-2007-5930
Published: 2007-11-10
Description: Cross-site scripting (XSS) vulnerability in the web interface in Cerberus FTP Server before 2.46 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38789; http://secunia.com/advisories/27569; http://www.cerberusftp.com/cerberus-releasenotes.htm#ReleaseNotes