deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0964
Published: 2007-02-16
Description: Cisco FWSM 3.x before 3.1(3.18), when authentication is configured to use "aaa authentication match" or "aaa authentication include", allows remote attackers to cause a denial of service (device reboot) via a malformed HTTPS request.
CVSS Score: 5.4 (MEDIUM)
References: http://secunia.com/advisories/24172; http://www.cisco.com/en/US/products/products_security_advisory09186a00807e2481.shtml; http://www.securityfocus.com/bid/22561
CVE: CVE-2007-0965
Published: 2007-02-16
Description: Cisco FWSM 3.x before 3.1(3.2), when authentication is configured to use "aaa authentication match" or "aaa authentication include", allows remote attackers to cause a denial of service (device reboot) via a long HTTP request.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24172; http://www.cisco.com/en/US/products/products_security_advisory09186a00807e2481.shtml; http://www.securityfocus.com/bid/22561
CVE: CVE-2007-0966
Published: 2007-02-16
Description: Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.11), when the HTTPS server is enabled, allows remote attackers to cause a denial of service (device reboot) via certain HTTPS traffic.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24172; http://www.cisco.com/en/US/products/products_security_advisory09186a00807e2481.shtml; http://www.securityfocus.com/bid/22561
CVE: CVE-2007-0967
Published: 2007-02-16
Description: Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.1) allows remote attackers to cause a denial of service (device reboot) via malformed SNMP requests.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24172; http://www.cisco.com/en/US/products/products_security_advisory09186a00807e2481.shtml; http://www.securityfocus.com/bid/22561
CVE: CVE-2007-0968
Published: 2007-02-16
Description: Unspecified vulnerability in Cisco Firewall Services Module (FWSM) before 2.3(4.7) and 3.x before 3.1(3.1) causes the access control entries (ACE) in an ACL to be improperly evaluated, which allows remote authenticated users to bypass intended certain ACL protections.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/24172; http://www.cisco.com/en/US/products/products_security_advisory09186a00807e2481.shtml; http://www.securityfocus.com/bid/22561
CVE: CVE-2007-0969
Published: 2007-02-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebTester 5.0.20060927 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to POST parameters to multiple files.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33202; http://secunia.com/advisories/24157; http://securityreason.com/securityalert/2261
CVE: CVE-2007-0970
Published: 2007-02-16
Description: Multiple SQL injection vulnerabilities in WebTester 5.0.20060927 and earlier allow remote attackers to execute arbitrary SQL commands via the testID parameter to directions.php, and unspecified parameters to other files that accept GET or POST input.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33203; http://osvdb.org/33204; http://secunia.com/advisories/24157
CVE: CVE-2007-0971
Published: 2007-02-16
Description: Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts.  NOTE: the attack vector might involve _SERVER.
CVSS Score: 7.5 (HIGH)
References: http://mgsdl.free.fr/advisories/12070214.txt; http://osvdb.org/33727; http://www.acid-root.new.fr/advisories/12070214.txt
CVE: CVE-2007-0972
Published: 2007-02-16
Description: Unrestricted file upload vulnerability in modules/emoticons.php in Jupiter CMS 1.1.5 allows remote attackers to upload arbitrary files by modifying the HTTP request to send an image content type, and to omit is_guest and is_user parameters.  NOTE: this issue might be related to CVE-2006-4875.
CVSS Score: 7.5 (HIGH)
References: http://mgsdl.free.fr/advisories/12070214.txt; http://osvdb.org/33728; http://www.acid-root.new.fr/advisories/12070214.txt
CVE: CVE-2007-0973
Published: 2007-02-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Jupiter CMS 1.1.5 allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header and certain other HTTP headers, which are displayed without proper sanitization when an administrator performs a Logged Guest action.
CVSS Score: 6.8 (MEDIUM)
References: http://mgsdl.free.fr/advisories/12070214.txt; http://osvdb.org/33729; http://www.acid-root.new.fr/advisories/12070214.txt
CVE: CVE-2007-0974
Published: 2007-02-16
Description: Multiple unspecified vulnerabilities in Ian Bezanson DropBox before 0.0.4 beta have unknown impact and attack vectors, possibly related to a variable extraction vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35704; http://sourceforge.net/forum/forum.php?forum_id=660819; http://www.vupen.com/english/advisories/2007/0598
CVE: CVE-2007-0975
Published: 2007-02-16
Description: Variable extraction vulnerability in Ian Bezanson Apache Stats before 0.0.3 beta allows attackers to overwrite critical variables, with unknown impact, when the extract function is used on the _REQUEST superglobal array.
CVSS Score: 5.0 (MEDIUM)
References: http://sourceforge.net/forum/forum.php?forum_id=660919; http://superb-east.dl.sourceforge.net/sourceforge/apachestats/apacheStats_0.0.3Beta.tar.bz2; http://www.vupen.com/english/advisories/2007/0598
CVE: CVE-2007-0976
Published: 2007-02-16
Description: Buffer overflow in the ActSoft DVD-Tools ActiveX control (dvdtools.ocx) allows remote attackers to execute arbitrary code via a long DVD_TOOLS.OpenDVD property value.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/33732; http://www.securityfocus.com/bid/22558; http://www.shinnai.altervista.org/moaxb/20070504/actsoft.txt
CVE: CVE-2007-0977
Published: 2007-02-16
Description: IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through Readviewentries and OpenDocument requests to the defaultview view, a different vector than CVE-2005-2428.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/35764; https://www.exploit-db.com/exploits/3302; http://osvdb.org/35764
CVE: CVE-2007-0978
Published: 2007-02-16
Description: Buffer overflow in swcons in IBM AIX 5.3 allows local users to gain privileges via long input data.
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/33200; http://secunia.com/advisories/24154; http://www-1.ibm.com/support/docview.wss?uid=isg1IY94901
CVE: CVE-2007-0979
Published: 2007-02-16
Description: Unspecified vulnerability in LifeType before 1.1.6, and 1.2 before 1.2-beta2, allows remote attackers to obtain sensitive information (file contents) via a "crafted URL."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/33210; http://secunia.com/advisories/24170; http://www.lifetype.net/blog/lifetype-development-journal/releases
CVE: CVE-2007-0980
Published: 2007-02-16
Description: Unspecified vulnerability in HP Serviceguard for Linux; packaged for SuSE SLES8 and United Linux 1.0 before SG A.11.15.07, SuSE SLES9 and SLES10 before SG A.11.16.10, and Red Hat Enterprise Linux (RHEL) before SG A.11.16.10; allows remote attackers to obtain unauthorized access via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00860750; http://osvdb.org/33201; http://secunia.com/advisories/24134
CVE: CVE-2007-0981
Published: 2007-02-16
Description: Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname (location.hostname) DOM property, due to interactions with DNS resolver code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2713
CVE: CVE-2007-0982
Published: 2007-02-16
Description: Cross-site scripting (XSS) vulnerability in error.php in TaskFreak! 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the tznMessage parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33120; http://secunia.com/advisories/24123; http://www.securityfocus.com/bid/22537
CVE: CVE-2007-0983
Published: 2007-02-16
Description: PHP remote file inclusion vulnerability in _admin/nav.php in AT Contenator 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the Root_To_Script parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://attrition.org/pipermail/vim/2007-February/001312.html; http://osvdb.org/33209; http://secunia.com/advisories/24141
CVE: CVE-2007-0984
Published: 2007-02-16
Description: SQL injection vulnerability in admin_poll.asp in PollMentor 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to pollmentorres.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/33192; http://secunia.com/advisories/24137; http://www.securityfocus.com/bid/22542
CVE: CVE-2007-0985
Published: 2007-02-16
Description: SQL injection vulnerability in nickpage.php in phpCC 4.2 beta and earlier allows remote attackers to execute arbitrary SQL commands via the npid parameter in a sign_gb action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/35129; http://www.securityfocus.com/bid/22540; http://www.vupen.com/english/advisories/2007/0602
CVE: CVE-2007-0986
Published: 2007-02-16
Description: PHP remote file inclusion vulnerability in index.php in Jupiter CMS 1.1.5, when PHP 5.0.0 or later is used, allows remote attackers to execute arbitrary PHP code via an ftp URL in the n parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://mgsdl.free.fr/advisories/12070214.txt; http://osvdb.org/33730; http://www.acid-root.new.fr/advisories/12070214.txt
CVE: CVE-2007-0987
Published: 2007-02-16
Description: Directory traversal vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot), or an absolute pathname, in the n parameter.
CVSS Score: 7.5 (HIGH)
References: http://mgsdl.free.fr/advisories/12070214.txt; http://osvdb.org/33731; http://www.acid-root.new.fr/advisories/12070214.txt
CVE: CVE-2007-0451
Published: 2007-02-16
Description: Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://fedoranews.org/cms/node/2657; http://fedoranews.org/cms/node/2659; http://osvdb.org/33207
CVE: CVE-2007-0710
Published: 2007-02-16
Description: The Bonjour functionality in iChat in Apple Mac OS X 10.3.9 allows remote attackers to cause a denial of service (persistent application crash) via unspecified vectors, possibly related to CVE-2007-0614.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://docs.info.apple.com/article.html?artnum=305102; http://lists.apple.com/archives/Security-announce/2007/Feb/msg00000.html; http://secunia.com/advisories/24198
CVE: CVE-2007-0897
Published: 2007-02-16
Description: Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://docs.info.apple.com/article.html?artnum=307562; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=475; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2007-0898
Published: 2007-02-16
Description: Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the id MIME header parameter in a multi-part message.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://docs.info.apple.com/article.html?artnum=307562; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=476; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2006-5276
Published: 2007-02-20
Description: Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor; allows remote attackers to execute arbitrary code via crafted SMB traffic.
CVSS Score: 10.0 (HIGH)
References: http://fedoranews.org/updates/FEDORA-2007-206.shtml; http://iss.net/threats/257.html; http://secunia.com/advisories/24190
CVE: CVE-2007-1006
Published: 2007-02-20
Description: Multiple format string vulnerabilities in the gm_main_window_flash_message function in Ekiga before 2.0.5 allow attackers to cause a denial of service and possibly execute arbitrary code via a crafted Q.931 SETUP packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://fedoranews.org/cms/node/2682; http://fedoranews.org/cms/node/2683; http://labs.musecurity.com/advisories/MU-200702-01.txt
CVE: CVE-2007-1008
Published: 2007-02-20
Description: Apple iTunes 7.0.2 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted XML list of radio stations, which results in memory corruption.  NOTE: iTunes retrieves the XML document from a static URL, which requires an attacker to perform DNS spoofing or man-in-the-middle attacks for exploitation.
CVSS Score: 2.6 (LOW)
References: http://osvdb.org/33742; http://securityreason.com/securityalert/2278; http://www.securityfocus.com/archive/1/460544/100/0/threaded
CVE: CVE-2007-0007
Published: 2007-02-20
Description: gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.
CVSS Score: 3.6 (LOW)
References: http://fedoranews.org/cms/node/2725; http://secunia.com/advisories/24225; http://secunia.com/advisories/24226
CVE: CVE-2007-1004
Published: 2007-02-20
Description: Mozilla Firefox might allow remote attackers to conduct spoofing and phishing attacks by writing to an about:blank tab and overlaying the location bar.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33255; http://osvdb.org/33769; http://secunia.com/advisories/24153
CVE: CVE-2007-0325
Published: 2007-02-20
Description: Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control in OfficeScanSetupINI.dll, as used in OfficeScan 7.0 before Build 1344, OfficeScan 7.3 before Build 1241, and Client / Server / Messaging Security 3.0 before Build 1197, allow remote attackers to execute arbitrary code via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034288; http://osvdb.org/33040; http://secunia.com/advisories/24193
CVE: CVE-2007-0772
Published: 2007-02-20
Description: The Linux kernel 2.6.13 and other versions before 2.6.20.1 allows remote attackers to cause a denial of service (oops) via a crafted NFSACL 2 ACCESS request that triggers a free of an incorrect pointer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://fedoranews.org/cms/node/2739; http://fedoranews.org/cms/node/2740; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.1
CVE: CVE-2007-0988
Published: 2007-02-20
Description: The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service (infinite loop) by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a negative value, as demonstrated by an "a:[PII_REDACTED]:{" argument.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=228858; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506
CVE: CVE-2007-1007
Published: 2007-02-20
Description: Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the name, which is not properly handled in a call to the gnomemeeting_log_insert function.
CVSS Score: 10.0 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=229266; http://osvdb.org/32083
CVE: CVE-2007-1010
Published: 2007-02-21
Description: Multiple PHP remote file inclusion vulnerabilities in ZebraFeeds 1.0, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the zf_path parameter to (1) aggregator.php and (2) controller.php in newsfeeds/includes/.
CVSS Score: 6.8 (MEDIUM)
References: http://cazalet.org/category/zebrafeeds; http://cazalet.org/zebrafeeds/forums/viewtopic.php?pid=358; http://osvdb.org/33205
CVE: CVE-2007-1011
Published: 2007-02-21
Description: PHP remote file inclusion vulnerability in functions_inc.php in VS-Gastebuch 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gb_pfad parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33223; http://secunia.com/advisories/24182; http://www.securityfocus.com/bid/22605
CVE: CVE-2007-1012
Published: 2007-02-21
Description: Cross-site scripting (XSS) vulnerability in faq.php in DeskPRO 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the article parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/33725; http://securityreason.com/securityalert/2267; http://www.securityfocus.com/archive/1/460200/100/0/threaded
CVE: CVE-2007-1013
Published: 2007-02-21
Description: PHP remote file inclusion vulnerability in generate.php in VirtualSystem Htaccess Passwort Generator 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the ht_pfad parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/33244; http://secunia.com/advisories/24214; http://www.securityfocus.com/bid/22598
CVE: CVE-2007-1014
Published: 2007-02-21
Description: Stack-based buffer overflow in VicFTPS before 5.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long CWD command.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/33227; http://secunia.com/advisories/24161; http://vicftps.50webs.com/
CVE: CVE-2007-1015
Published: 2007-02-21
Description: SQL injection vulnerability in HaberDetay.asp in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 10.0 (HIGH)
References: http://www.vupen.com/english/advisories/2007/0620; https://exchange.xforce.ibmcloud.com/vulnerabilities/32527; https://www.exploit-db.com/exploits/3318
CVE: CVE-2007-1016
Published: 2007-02-21
Description: SQL injection vulnerability in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via certain vectors related to the HaberDetay.asp and rss.asp components, and the id and kid parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: the combination of the HaberDetay.asp component and the id parameter is already covered by another February 2007 CVE candidate.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2007/0620; http://www.vupen.com/english/advisories/2007/0620
CVE: CVE-2007-1017
Published: 2007-02-21
Description: PHP remote file inclusion vulnerability in show_news_inc.php in VirtualSystem VS-News-System 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/33247; http://secunia.com/advisories/24220; http://www.securityfocus.com/bid/22592
CVE: CVE-2007-1018
Published: 2007-02-21
Description: PHP remote file inclusion vulnerability in tpl/header.php in VirtualSystem VS-News-System 1.2.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/33248; http://secunia.com/advisories/24220; http://osvdb.org/33248
CVE: CVE-2007-1019
Published: 2007-02-21
Description: SQL injection vulnerability in news.php in webSPELL 4.01.02, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33229; http://secunia.com/advisories/24191; http://www.securityfocus.com/bid/22541
CVE: CVE-2007-1020
Published: 2007-02-21
Description: Cross-site scripting (XSS) vulnerability in index.php in CedStat 1.31 allows remote attackers to inject arbitrary web script or HTML via the hier parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2672; http://osvdb.org/33734; http://securityreason.com/securityalert/2265
CVE: CVE-2007-1021
Published: 2007-02-21
Description: SQL injection vulnerability in inc_listnews.asp in CodeAvalanche News 1.x allows remote attackers to execute arbitrary SQL commands via the CAT_ID parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35130; http://www.securityfocus.com/bid/22582; http://www.vupen.com/english/advisories/2007/0621
CVE: CVE-2007-1022
Published: 2007-02-21
Description: SQL injection vulnerability in h_goster.asp in Turuncu Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33245; http://secunia.com/advisories/24209; http://www.securityfocus.com/bid/22591
CVE: CVE-2007-1023
Published: 2007-02-21
Description: SQL injection vulnerability in pop_profile.asp in Snitz Forums 2000 3.1 SR4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35131; http://www.securityfocus.com/bid/22593; https://exchange.xforce.ibmcloud.com/vulnerabilities/32543
CVE: CVE-2007-1024
Published: 2007-02-21
Description: PHP remote file inclusion vulnerability in include.php in Meganoide's news 1.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter.
CVSS Score: 10.0 (HIGH)
References: http://attrition.org/pipermail/vim/2007-February/001361.html; http://osvdb.org/33736; http://securityreason.com/securityalert/2266
CVE: CVE-2007-1025
Published: 2007-02-21
Description: PHP remote file inclusion vulnerability in inc/functions_inc.php in VS-Link-Partner 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gb_pfad, or possibly script_pfad, parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35132; http://www.securityfocus.com/bid/22594; http://www.vupen.com/english/advisories/2007/0651
CVE: CVE-2007-1026
Published: 2007-02-21
Description: SQL injection vulnerability in view.php in XLAtunes 0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in view mode.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/33743; http://www.securityfocus.com/archive/1/460592/100/0/threaded; http://www.securityfocus.com/archive/1/460621/100/0/threaded