deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-4201
Published: 2007-08-08
Description: Guidance Software EnCase 6.2 and 6.5 does not properly handle a volume with more than 25 partitions, which might allow remote attackers to prevent examination of certain data, a related issue to CVE-2007-4035.
CVSS Score: 5.0 (MEDIUM)
References: http://www.isecpartners.com/files/iSEC-Breaking_Forensics_Software-Paper.v1_1.BH2007.pdf; http://www.kb.cert.org/vuls/id/310057; http://www.securityfocus.com/archive/1/474809/100/0/threaded
CVE: CVE-2007-4202
Published: 2007-08-08
Description: Guidance Software EnCase Enterprise Edition (EEE) 6 does not properly verify the identity of the acquisition target during communication with the EnCase Servlet (EEE servlet), which might allow remote attackers to spoof the disk image.
CVSS Score: 4.3 (MEDIUM)
References: http://www.isecpartners.com/files/iSEC-Breaking_Forensics_Software-Paper.v1_1.BH2007.pdf; http://www.kb.cert.org/vuls/id/912593; http://www.securityfocus.com/archive/1/474809/100/0/threaded
CVE: CVE-2007-4203
Published: 2007-08-08
Description: Session fixation vulnerability in Mambo 4.6.2 CMS allows remote attackers to hijack web sessions by setting the Cookie parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://osvdb.org/42514; http://securityreason.com/securityalert/2970; http://www.securityfocus.com/archive/1/475241/100/0/threaded
CVE: CVE-2007-4204
Published: 2007-08-08
Description: Hitachi Groupmax Collaboration - Schedule, as used in Groupmax Collaboration Portal 07-32 through 07-32-/B, uCosminexus Collaboration Portal 06-32 through 06-32-/B, and Groupmax Collaboration Web Client - Mail/Schedule 07-32 through 07-32-/A, can assign schedule data to the wrong user under unspecified conditions, which might allow remote authenticated users to obtain sensitive information.
CVSS Score: 3.5 (LOW)
References: http://osvdb.org/46987; http://www.hitachi-support.com/security_e/vuls_e/HS07-022_e/index-e.html; http://www.vupen.com/english/advisories/2007/2723
CVE: CVE-2007-4205
Published: 2007-08-08
Description: XHA (Linux-HA) on the BlueCat Networks Adonis DNS/DHCP Appliance 5.0.2.8 allows remote attackers to cause a denial of service (heartbeat control process crash) via a UDP packet to port 694.  NOTE: this may be the same as CVE-2006-3121.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/39396; http://secunia.com/advisories/26265; http://securityreason.com/securityalert/2978
CVE: CVE-2007-4206
Published: 2007-08-08
Description: Kaspersky Anti-Spam 3.0 MP1 before Critical Fix 2 (3.0.278.4) sets incorrect permissions for application files in certain upgrade scenarios, which might allow local users to gain privileges.
CVSS Score: 4.4 (MEDIUM)
References: http://osvdb.org/37216; http://secunia.com/advisories/26312; http://www.kaspersky.com/technews?id=203038705
CVE: CVE-2007-4207
Published: 2007-08-08
Description: SQL injection vulnerability in admin_console/index.asp in Gallery In A Box allows remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password field.  NOTE: these fields might be associated with the txtUsername and txtPassword parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/36284; http://outlaw.aria-security.info/?p=13; http://secunia.com/advisories/26334
CVE: CVE-2007-4208
Published: 2007-08-08
Description: SQL injection vulnerability in default.asp in Next Gen Portfolio Manager allows remote attackers to execute arbitrary SQL commands via the (1) Users_Email or (2) Users_Password parameter in an ExecuteTheLogin action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36280; http://outlaw.aria-security.info/?p=14; http://secunia.com/advisories/26338
CVE: CVE-2007-4209
Published: 2007-08-08
Description: SQL injection vulnerability in Recherche.php in Aceboard forum allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/475469/100/0/threaded; http://www.securityfocus.com/bid/25197; https://exchange.xforce.ibmcloud.com/vulnerabilities/35793
CVE: CVE-2007-4210
Published: 2007-08-08
Description: Multiple SQL injection vulnerabilities in module.php in LANAI (la-nai) CMS 1.2.14 allow remote attackers to execute arbitrary SQL commands via (1) the mid parameter in an faqviewgroup action in the FAQ Modules, (2) the cid parameter in the EZSHOPINGCART Modules, or (3) the gid parameter in a view action in the GALLERY Modules.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36438; http://osvdb.org/37470; http://osvdb.org/37471
CVE: CVE-2007-4211
Published: 2007-08-08
Description: The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) APPEND command.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/26320; http://secunia.com/advisories/26475; http://secunia.com/advisories/30342
CVE: CVE-2007-4212
Published: 2007-08-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Search Module in PHP-Nuke allow remote attackers to inject arbitrary web script or HTML via a trailing "<" instead of a ">" in (1) the onerror attribute of an IMG element, (2) the onload attribute of an IFRAME element, or (3) redirect users to other sites via the META tag.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/42538; http://securityreason.com/securityalert/2974; http://www.securityfocus.com/archive/1/475249/100/0/threaded
CVE: CVE-2007-4224
Published: 2007-08-08
Description: KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-59
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065101.html; http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html; http://secunia.com/advisories/26351
CVE: CVE-2007-4225
Published: 2007-08-08
Description: Visual truncation vulnerability in KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar via an http URI with a large amount of whitespace in the user/password portion.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065101.html; http://secunia.com/advisories/26351; http://secunia.com/advisories/26612
CVE: CVE-2007-4226
Published: 2007-08-08
Description: Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 (Adonis DNS/DHCP appliance 5.0.2.8) allows remote authenticated administrators, with certain TFTP privileges, to create and overwrite arbitrary files via a .. (dot dot) in a pathname.  NOTE: this can be leveraged for administrative access by overwriting /etc/shadow.
CVSS Score: 7.1 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1027&w=2; http://osvdb.org/39397; http://secunia.com/advisories/26354
CVE: CVE-2007-4227
Published: 2007-08-08
Description: Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain JPG file, as demonstrated by something.jpg.  NOTE: this issue might be related to CVE-2007-3958.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2007/08/windows-extended-file-attributes-buffer.html; http://www.securityfocus.com/archive/1/475655/100/0/threaded; http://www.securityfocus.com/bid/25207
CVE: CVE-2007-4228
Published: 2007-08-08
Description: rmpvc on IBM AIX 4.3 allows local users to cause a denial of service (system crash) via long port logical name (-l) argument.
CVSS Score: 4.7 (MEDIUM)
References: http://osvdb.org/36788; http://secunia.com/advisories/26349; http://www-1.ibm.com/support/docview.wss?uid=isg1IY93393
CVE: CVE-2007-4229
Published: 2007-08-08
Description: Unspecified vulnerability in KDE Konqueror 3.5.7 and earlier allows remote attackers to cause a denial of service (failed assertion and application crash) via certain malformed HTML, as demonstrated by a document containing TEXTAREA, BUTTON, BR, BDO, PRE, FRAMESET, and A tags.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/25170.html; http://osvdb.org/42552; http://www.securityfocus.com/archive/1/475266/100/0/threaded
CVE: CVE-2007-4230
Published: 2007-08-08
Description: BellaBiblio allows remote attackers to gain administrative privileges via a bellabiblio cookie with the value "administrator." NOTE: this issue is disputed by CVE and multiple third parties because the cookie value must be an MD5 hash
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/39032; http://securityreason.com/securityalert/2991; http://www.attrition.org/pipermail/vim/2007-July/001733.html
CVE: CVE-2007-4231
Published: 2007-08-08
Description: PHP remote file inclusion vulnerability in order/login.php in IDevSpot PhpHostBot 1.06 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the svr_rootscript parameter, a different vector than CVE-2007-4094 and CVE-2006-3776.
CVSS Score: 6.8 (MEDIUM)
References: http://advisories.echo.or.id/adv/adv83-K-159-2007.txt; http://secunia.com/advisories/26356; http://www.osvdb.org/36296
CVE: CVE-2007-4232
Published: 2007-08-08
Description: PHP remote file inclusion vulnerability in admin/inc/change_action.php in Andreas Robertz PHPNews 0.93 allows remote attackers to execute arbitrary PHP code via a URL in the format_menue parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/25223; http://www.vupen.com/english/advisories/2007/2810; https://exchange.xforce.ibmcloud.com/vulnerabilities/35835
CVE: CVE-2007-4233
Published: 2007-08-08
Description: Multiple unspecified vulnerabilities in Camera Life before 2.6 allow attackers to cause a denial of service via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://fdcl.svn.sourceforge.net/viewvc/%2Acheckout%2A/fdcl/trunk/Changelog; http://sourceforge.net/forum/forum.php?forum_id=721006; http://www.securityfocus.com/bid/25220
CVE: CVE-2007-4234
Published: 2007-08-08
Description: Unspecified vulnerability in Camera Life before 2.6 allows remote attackers to download private photos via unspecified vectors associated with the names of the photos.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://fdcl.svn.sourceforge.net/viewvc/%2Acheckout%2A/fdcl/trunk/Changelog; http://secunia.com/advisories/26319; http://sourceforge.net/forum/forum.php?forum_id=721006
CVE: CVE-2007-4235
Published: 2007-08-08
Description: Multiple PHP remote file inclusion vulnerabilities in VietPHP allow remote attackers to execute arbitrary PHP code via a URL in (1) the dirpath parameter to (a) _functions.php, or (2) the language parameter to (b) admin/index.php or (c) index.php.
CVSS Score: 9.3 (HIGH)
References: http://securityreason.com/securityalert/2983; http://www.securityfocus.com/archive/1/475758/100/0/threaded; http://www.securityfocus.com/bid/25226
CVE: CVE-2007-4236
Published: 2007-08-08
Description: Buffer overflow in lpd in bos.rte.printers in AIX 5.2 and 5.3 allows local users with printq group privileges to gain root privileges.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/26219; http://securitytracker.com/id?1018467; http://www-1.ibm.com/support/docview.wss?uid=isg1IY98339
CVE: CVE-2007-4237
Published: 2007-08-08
Description: Buffer overflow in the atm subset in arp in devices.common.IBM.atm.rte in AIX 5.2 and 5.3 allows local users to gain root privileges.
CVSS Score: 6.9 (MEDIUM)
References: http://osvdb.org/36783; http://secunia.com/advisories/26219; http://securitytracker.com/id?1018463
CVE: CVE-2007-4238
Published: 2007-08-08
Description: AIX 5.2 and 5.3 install pioinit with user and group ownership of bin, which allows local users with bin or possibly printq privileges to gain root privileges by modifying pioinit.
CVSS Score: 6.9 (MEDIUM)
References: http://osvdb.org/36782; http://secunia.com/advisories/26219; http://securitytracker.com/id?1018468
CVE: CVE-2007-4239
Published: 2007-08-08
Description: Cross-site scripting (XSS) vulnerability in user/forgotPassStep2.jsp in the admin interface in C-SAM oneWallet 210_07062007;1.0 allows remote attackers to inject arbitrary web script or HTML via the loginID parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/475732/100/0/threaded; http://www.securityfocus.com/bid/25224; https://exchange.xforce.ibmcloud.com/vulnerabilities/35838
CVE: CVE-2007-4240
Published: 2007-08-08
Description: The check_logout function in class/auth.php in Help Center Live (hcl) 2.1.3a sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to delete administrative users and have other unspecified impact via certain requests to (1) admin/departments.php, (2) admin/operators.php, and other unspecified scripts.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/39400; http://secunia.com/advisories/26352; http://www.securityfocus.com/bid/25225
CVE: CVE-2007-4241
Published: 2007-08-08
Description: Buffer overflow in ldcconn in Hewlett-Packard (HP) Controller for Cisco Local Director on HP-UX 11.11i allows remote attackers to execute arbitrary code via a long string to TCP port 17781.
CVSS Score: 10.0 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=572; http://secunia.com/advisories/26373; http://securitytracker.com/id?1018524
CVE: CVE-2007-4242
Published: 2007-08-08
Description: The pop3 Proxy in Astaro Security Gateway (ASG) 7 does not perform virus scanning of attachments that exceed the maximum attachment size, and passes these attachments, which allows remote attackers to bypass this scanning via a large attachment.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/2981; http://www.hescominsoon.com/archives/773; http://www.securityfocus.com/archive/1/475642/100/0/threaded
CVE: CVE-2007-4243
Published: 2007-08-08
Description: Unspecified vulnerability in pfilter-reporter.pl in Astaro Security Gateway (ASG) 7 allows remote attackers to cause a denial of service (CPU consumption) via certain network traffic, as demonstrated by P2P and iTunes applications that download large amounts of data.
CVSS Score: 7.8 (HIGH)
References: http://astaro.org/showthread.php?p=77667; http://astaro.org/showthread.php?p=77694; http://astaro.org/showthread.php?p=78258
CVE: CVE-2007-4244
Published: 2007-08-08
Description: PHP remote file inclusion vulnerability in langset.php in J! Reactions (com_jreactions) 1.8.1 and earlier, a Joomla! component, allows remote attackers to execute arbitrary PHP code via a URL in the comPath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/2984; http://www.securityfocus.com/archive/1/475544/100/0/threaded; http://www.securityfocus.com/archive/1/477144/100/0/threaded
CVE: CVE-2007-4245
Published: 2007-08-08
Description: Cross-site scripting (XSS) vulnerability in Search.php in DiMeMa CONTENTdm (CDM) allows remote attackers to inject arbitrary web script or HTML via a search, probably related to the CISOBOX1 parameter to results.php in CDM 4.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/36437; http://secunia.com/advisories/26324; http://securityreason.com/securityalert/2980
CVE: CVE-2007-4246
Published: 2007-08-08
Description: Unspecified vulnerability, possibly a buffer overflow, in Justsystem Ichitaro 2007 and earlier allows remote attackers to execute arbitrary code via a modified document, as actively exploited in August 2007 by malware such as Tarodrop.D (Tarodrop.Q), a different vulnerability than CVE-2006-4326, CVE-2006-5424, CVE-2006-6400, and CVE-2007-1938.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/39393; http://secunia.com/advisories/26317; http://www.justsystem.co.jp/info/pd7003.html
CVE: CVE-2007-4247
Published: 2007-08-08
Description: Windows Calendar on Microsoft Windows Vista allows remote attackers to cause a denial of service (NULL dereference and persistent application crash) via a malformed ICS file.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/46801; http://securityreason.com/securityalert/3004; http://www.eleytt.com/advisories/eleytt_CALICS.pdf
CVE: CVE-2007-4248
Published: 2007-08-08
Description: The CallCmd function in toolbar_gaming.dll in the Toolbar Gaming toolbar for Internet Explorer allows remote attackers to cause a denial of service (NULL dereference and browser crash) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/46802; http://securityreason.com/securityalert/3004; http://www.securityfocus.com/archive/1/475534/100/0/threaded
CVE: CVE-2007-4249
Published: 2007-08-08
Description: The isChecked function in Toolbar.DLL in the ExportNation toolbar for Internet Explorer allows remote attackers to cause a denial of service (NULL dereference and browser crash) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/46985; http://securityreason.com/securityalert/3004; http://www.securityfocus.com/archive/1/475534/100/0/threaded
CVE: CVE-2007-4250
Published: 2007-08-08
Description: The isChecked function in Toolbar.DLL in Advanced Searchbar before 3.33 allows remote attackers to cause a denial of service (NULL dereference and browser crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/3004; http://www.attrition.org/pipermail/vim/2007-August/001756.html; http://www.securityfocus.com/archive/1/475534/100/0/threaded
CVE: CVE-2007-4251
Published: 2007-08-08
Description: OpenOffice.org (OOo) 2.2 does not properly handle files with multiple extensions, which allows user-assisted remote attackers to cause a denial of service.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/46766; http://securityreason.com/securityalert/3004; http://www.securityfocus.com/archive/1/475534/100/0/threaded
CVE: CVE-2007-4252
Published: 2007-08-08
Description: Absolute path traversal vulnerability in a certain ActiveX control in CkString.dll 1.1 and earlier in CHILKAT ASP String allows remote attackers to create or overwrite arbitrary files via a full pathname in the first argument to the SaveToFile method, a different vulnerability than CVE-2007-3633.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/40110; http://www.securityfocus.com/bid/25205; https://exchange.xforce.ibmcloud.com/vulnerabilities/35812
CVE: CVE-2007-4253
Published: 2007-08-08
Description: SQL injection vulnerability in the News module in modules.php in Envolution 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter, a different vector than CVE-2005-4263.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/39199; http://www.securityfocus.com/archive/1/475654/100/0/threaded; http://www.securityfocus.com/bid/25203
CVE: CVE-2007-4254
Published: 2007-08-08
Description: Stack-based buffer overflow in a certain ActiveX control in VDT70.DLL in Microsoft Visual Database Tools Database Designer 7.0 for Microsoft Visual Studio 6 allows remote attackers to execute arbitrary code via a long argument to the NotSafe method.  NOTE: this may overlap CVE-2007-2885 or CVE-2005-2127.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/41080; https://www.exploit-db.com/exploits/4259; http://osvdb.org/41080
CVE: CVE-2007-4255
Published: 2007-08-08
Description: Buffer overflow in the mSQL extension in PHP 5.2.3 allows context-dependent attackers to execute arbitrary code via a long first argument to the msql_connect function.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/475660/100/0/threaded; http://www.securityfocus.com/bid/25213; https://exchange.xforce.ibmcloud.com/vulnerabilities/35830
CVE: CVE-2007-4256
Published: 2007-08-08
Description: Directory traversal vulnerability in showpage.cgi in YNP Portal System 2.2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/39198; https://www.exploit-db.com/exploits/4261; http://osvdb.org/39198
CVE: CVE-2007-4257
Published: 2007-08-08
Description: Multiple buffer overflows in Live for Speed (LFS) S1 and S2 allow user-assisted remote attackers to execute arbitrary code via (1) a .spr file (single player replay file) containing a long user name or (2) a .ply file containing a long number plate string, different vectors than CVE-2007-4140.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/46768; http://osvdb.org/46769; http://www.securityfocus.com/bid/25206
CVE: CVE-2007-4258
Published: 2007-08-08
Description: SQL injection vulnerability in directory.php in Prozilla Pub Site Directory allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/25209; https://www.exploit-db.com/exploits/4265; http://www.securityfocus.com/bid/25209
CVE: CVE-2007-4259
Published: 2007-08-08
Description: EZPhotoSales 1.9.3 and earlier allows remote attackers to download arbitrary image files via (1) a direct request for a URL under OnlineViewing/galleries/ or (2) navigation of the gallery user interface with JavaScript disabled.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/26341; http://securityreason.com/securityalert/2985; http://www.airscanner.com/security/07080601_ezphotosales.htm
CVE: CVE-2007-4260
Published: 2007-08-08
Description: EZPhotoSales 1.9.3 and earlier has a default "admin" account for galleries, which allows remote attackers to access arbitrary galleries by specifying this username.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/2985; http://www.airscanner.com/security/07080601_ezphotosales.htm; http://www.informit.com/guides/content.asp?g=security&seqNum=267
CVE: CVE-2007-4261
Published: 2007-08-08
Description: EZPhotoSales 1.9.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (1) a file containing cleartext passwords via a direct request for OnlineViewing/data/galleries.txt, or (2) a file containing username hashes and password hashes via a direct request for OnlineViewing/configuration/config.dat/.  NOTE: vector 2 can be leveraged for administrative access because authentication does not require knowledge of cleartext values, but instead uses the username hash in the ConfigLogin parameter and the password hash in the ConfigPassword parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/26341; http://securityreason.com/securityalert/2985; http://www.airscanner.com/security/07080601_ezphotosales.htm
CVE: CVE-2007-4262
Published: 2007-08-08
Description: Unrestricted file upload vulnerability in EZPhotoSales 1.9.3 and earlier allows remote authenticated administrators to upload and execute arbitrary PHP code under OnlineViewing/galleries/.
CVSS Score: 8.5 (HIGH)
References: http://secunia.com/advisories/26341; http://securityreason.com/securityalert/2985; http://www.airscanner.com/security/07080601_ezphotosales.htm
CVE: CVE-2007-4263
Published: 2007-08-08
Description: Unspecified vulnerability in the server side of the Secure Copy (SCP) implementation in Cisco 12.2-based IOS allows remote authenticated users to read, write or overwrite any file on the device's filesystem via unknown vectors.
CVSS Score: 8.5 (HIGH)
References: http://osvdb.org/36694; http://secunia.com/advisories/26361; http://www.cisco.com/warp/public/707/cisco-sa-20070808-scp.shtml
CVE: CVE-2007-4264
Published: 2007-08-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kai Blankenhorn Bitfolge simple and nice index file (aka snif) 1.5.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) path and (2) download parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38701; http://pridels-team.blogspot.com/2007/08/snif-xss-vuln.html; http://www.securityfocus.com/bid/25212