deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-7215
Published: 2007-07-03
Description: The Intel Core 2 Extreme processor X6800 and Core 2 Duo desktop processor E6000 and E4000 incorrectly set the memory page Access (A) bit for a page in certain circumstances involving proximity of the code segment limit to the end of a code page, which has unknown impact and attack vectors on certain operating systems other than OpenBSD, aka AI90.
CVSS Score: 2.1 (LOW)
References: http://download.intel.com/design/processor/specupdt/31327914.pdf; http://marc.info/?l=openbsd-misc&m=[PII_REDACTED]2631&w=2; http://seclists.org/fulldisclosure/2007/Jun/0605.html
CVE: CVE-2007-3508
Published: 2007-07-03
Description: Integer overflow in the process_envvars function in elf/rtld.c in glibc before 2.5-rc4 might allow local users to execute arbitrary code via a large LD_HWCAP_MASK environment variable value.  NOTE: the glibc maintainers state that they do not believe that this issue is exploitable for code execution
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=183844; http://osvdb.org/37901; http://secunia.com/advisories/25864
CVE: CVE-2007-3548
Published: 2007-07-03
Description: Stack-based buffer overflow in W3Filer 2.1.3 allows remote FTP servers to cause a denial of service (application hang or crash) and possibly execute arbitrary code by sending a large banner to a client that is sending a file.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/45745; http://www.securityfocus.com/bid/24709; https://exchange.xforce.ibmcloud.com/vulnerabilities/35184
CVE: CVE-2007-3549
Published: 2007-07-03
Description: SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38936; http://www.securityfocus.com/bid/24711; https://exchange.xforce.ibmcloud.com/vulnerabilities/35176
CVE: CVE-2007-3550
Published: 2007-07-03
Description: Microsoft Internet Explorer 6.0 and 7.0 allows remote attackers to fill Zones with arbitrary domains using certain metacharacters such as wildcards via JavaScript, which results in a denial of service (website suppression and resource consumption), aka "Internet Explorer Zone Domain Specification Dos and Page Suppressing".  NOTE: this issue has been disputed by a third party, who states that the zone settings cannot be manipulated
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064326.html; http://osvdb.org/45814; http://securityreason.com/securityalert/2855
CVE: CVE-2007-3551
Published: 2007-07-03
Description: Buffer overflow in bbs100 before 3.2 allows remote attackers to cause a denial of service (crash) by attempting to login as the Guest user when another Guest user is already logged in, possibly related to the state_login_prompt function in state_login.c.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/37805; http://secunia.com/advisories/25924; http://www.ka.sara.nl/home/walter//bbs100/ChangeLog.txt
CVE: CVE-2007-3552
Published: 2007-07-03
Description: Multiple unspecified vulnerabilities in bbs100 before 3.2 allow remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving certain v*printf and shift_StringIO functions.  NOTE: some details were obtained from third party information.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/37806; http://osvdb.org/37807; http://secunia.com/advisories/25924
CVE: CVE-2007-3553
Published: 2007-07-03
Description: Cross-site scripting (XSS) vulnerability in Rapid Install Web Server in Oracle Application Server 11i allows remote attackers to inject arbitrary web script or HTML via a URL to the "Secondary Login Page", as demonstrated using (1) pls/ and (2) pls/MSBEP004/.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37058; http://secunia.com/advisories/25919; http://www.securityfocus.com/bid/24697
CVE: CVE-2007-2949
Published: 2007-07-04
Description: Integer overflow in the seek_to_and_unpack_pixeldata function in the psd.c plugin in Gimp 2.2.15 allows remote attackers to execute arbitrary code via a crafted PSD file that contains a large (1) width or (2) height value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-190
References: http://issues.foresightlinux.org/browse/FL-457; http://osvdb.org/37804; http://secunia.com/advisories/25677
CVE: CVE-2007-3554
Published: 2007-07-04
Description: Stack-based buffer overflow in the HPSDDX Class (SDD) ActiveX control in sdd.dll in HP Instant Support - Driver Check before 1.5.0.3 allows remote attackers to execute arbitrary code via a long argument to the queryHub function.
CVSS Score: 7.6 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01077597; http://osvdb.org/37832; http://secunia.com/advisories/25918
CVE: CVE-2007-3555
Published: 2007-07-04
Description: Cross-site scripting (XSS) vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004-1424.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/25929; http://securityreason.com/securityalert/2857; http://securityvulns.ru/Rdocument391.html
CVE: CVE-2007-3556
Published: 2007-07-04
Description: Liesbeth base CMS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an include file containing account credentials via a direct request for config.inc.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/45744; http://securityreason.com/securityalert/2857; http://securityvulns.ru/Rdocument392.html
CVE: CVE-2007-3557
Published: 2007-07-04
Description: SQL injection vulnerability in admin/login.php in Wheatblog (wB) 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the login parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37063; http://secunia.com/advisories/25903; http://securityreason.com/securityalert/2856
CVE: CVE-2007-3558
Published: 2007-07-04
Description: SQL injection vulnerability in Coppermine Photo Gallery (CPG) before 1.4.11 allows remote attackers to execute arbitrary SQL commands via an album password cookie to an unspecified component.
CVSS Score: 7.5 (HIGH)
References: http://coppermine-gallery.net/forum/index.php?topic=44845.0; http://secunia.com/advisories/25846; http://www.securityfocus.com/bid/24710
CVE: CVE-2007-3559
Published: 2007-07-04
Description: Cross-site scripting (XSS) vulnerability in infusions/shoutbox_panel/shoutbox_panel.php in PHP-Fusion 6.01.10 and 6.01.9, when guest posts are enabled, allows remote authenticated users to inject arbitrary web script or HTML via the URI, related to the FUSION_QUERY constant.
CVSS Score: 3.5 (LOW)
References: http://osvdb.org/36342; http://secunia.com/advisories/25907; http://www.securityfocus.com/bid/24733
CVE: CVE-2007-3560
Published: 2007-07-04
Description: Multiple unspecified vulnerabilities in Esqlanelapse before 2.6 have unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37793; http://secunia.com/advisories/25791; http://sourceforge.net/project/shownotes.php?group_id=118575&release_id=519061
CVE: CVE-2007-3561
Published: 2007-07-04
Description: Cross-site scripting (XSS) vulnerability in ara.asp in Efendy Blog 1.0 allows remote attackers to inject arbitrary web script or HTML via the ara parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36341; http://secunia.com/advisories/25917; http://www.securityfocus.com/bid/24738
CVE: CVE-2007-3562
Published: 2007-07-04
Description: SQL injection vulnerability in videos.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36353; http://osvdb.org/39719; http://secunia.com/advisories/25928
CVE: CVE-2007-3563
Published: 2007-07-04
Description: SQL injection vulnerability in includes/view_page.php in AV Arcade 2.1b allows remote attackers to execute arbitrary SQL commands via the id parameter in a view_page action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/36354; http://secunia.com/advisories/25927; http://www.securityfocus.com/archive/1/472663/100/0/threaded
CVE: CVE-2007-3011
Published: 2007-07-05
Description: The DBAsciiAccess CGI Script in the web interface in Fujitsu-Siemens Computers ServerView before 4.50.09 allows remote attackers to execute arbitrary commands via shell metacharacters in the Servername subparameter of the ParameterList parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37835; http://secunia.com/advisories/25944; http://securityreason.com/securityalert/2858
CVE: CVE-2007-3012
Published: 2007-07-05
Description: The web interface in Fujitsu-Siemens Computers PRIMERGY BX300 Switch Blade allows remote attackers to obtain sensitive information by canceling the authentication dialog when accessing a sub-page, which still displays the form field contents of the sub-page, as demonstrated using (1) config/ip_management.htm and (2) config/snmp_config.htm.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/37837; http://secunia.com/advisories/25943; http://www.redteam-pentesting.de/advisories/rt-sa-2007-003.php
CVE: CVE-2007-3567
Published: 2007-07-05
Description: MySQLDumper 1.21b through 1.23 REV227 uses a "Limit GET" statement in the .htaccess authentication mechanism, which allows remote attackers to bypass authentication requirements via HTTP POST requests.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2007-08/0052.html; http://osvdb.org/42460; http://securityreason.com/securityalert/2859
CVE: CVE-2007-3568
Published: 2007-07-05
Description: The _LoadBMP function in imlib 1.9.15 and earlier allows context-dependent attackers to cause a denial of service (infinite loop) via a BMP image with a Bits Per Page (BPP) value of 0.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/39016; http://www.securiteam.com/unixfocus/5WP030UM0W.html; http://www.securityfocus.com/bid/24750
CVE: CVE-2007-3569
Published: 2007-07-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Oliver Library Management System allow remote attackers to inject arbitrary web script or HTML via the (1) updateform and (2) displayform parameter to (a) gateway/gateway.exe; the (3) TERMS, (4) database, (5) srchad, (6) SuggestedSearch, and (7) searchform parameters to the (b) "Basic Search page"; and (8) username parameter when (c) logging on.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/055355.html; http://osvdb.org/37059; http://osvdb.org/37060
CVE: CVE-2007-3570
Published: 2007-07-05
Description: The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 (RC1) allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request.
CVSS Score: 7.5 (HIGH)
References: http://www.novell.com/documentation/novellaccessmanager/readme/accessmanager_readme.html#ban5hsz; http://www.vupen.com/english/advisories/2007/2390; http://www.vupen.com/english/advisories/2007/3075
CVE: CVE-2007-3571
Published: 2007-07-05
Description: The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/45742; http://www.vupen.com/english/advisories/2007/2388; https://exchange.xforce.ibmcloud.com/vulnerabilities/35365
CVE: CVE-2006-7216
Published: 2007-07-05
Description: Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does not enforce privilege requirements at execution time, which allows remote authenticated users to lock arbitrary tables.
CVSS Score: 4.0 (MEDIUM)
References: http://db.apache.org/derby/releases/release-10.2.1.6.html; http://issues.apache.org/jira/browse/DERBY-1708; http://db.apache.org/derby/releases/release-10.2.1.6.html
CVE: CVE-2006-7217
Published: 2007-07-05
Description: Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
CVSS Score: 4.0 (MEDIUM)
References: http://db.apache.org/derby/releases/release-10.2.1.6.html; http://issues.apache.org/jira/browse/DERBY-1858; http://secunia.com/advisories/28636
CVE: CVE-2007-3572
Published: 2007-07-05
Description: Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the param parameter, as demonstrated by URL encoded "`" (backtick) characters (%60 sequences).
CVSS Score: 9.3 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0020.html; http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0092.html; http://osvdb.org/37808
CVE: CVE-2007-3573
Published: 2007-07-05
Description: Multiple SQL injection vulnerabilities in akocomment allow remote attackers to execute arbitrary SQL commands via the (1) acparentid or (2) acitemid parameter to an unspecified component, different vectors than CVE-2006-1421.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/38914; http://securityreason.com/securityalert/2860; http://www.securityfocus.com/archive/1/472652/100/0/threaded
CVE: CVE-2007-3574
Published: 2007-07-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in setup.cgi on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.00.06 firmware allow remote attackers to inject arbitrary web script or HTML via the (1) c4_trap_ip_, (2) devname, (3) snmp_getcomm, or (4) snmp_setcomm parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/40877; http://osvdb.org/40878; http://secunia.com/advisories/27738/
CVE: CVE-2007-3575
Published: 2007-07-05
Description: SQL injection vulnerability in includes/functions in FreeDomain.co.nr Clone allows remote attackers to execute arbitrary SQL commands via the logindomain parameter to members.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/45741; http://securityreason.com/securityalert/2862; http://www.securityfocus.com/archive/1/472656/100/0/threaded
CVE: CVE-2007-3576
Published: 2007-07-05
Description: Microsoft Internet Explorer 6 executes web script from URIs of arbitrary scheme names ending with the "script" character sequence, using the (1) vbscript: handler for scheme names with 7 through 9 characters, and the (2) javascript: handler for scheme names with 10 or more characters, which might allow remote attackers to bypass certain XSS protection schemes.  NOTE: other researchers dispute the significance of this issue, stating "this only works when typed in the address bar.
CVSS Score: 4.3 (MEDIUM)
References: http://groups.google.com/group/php-ids/browse_thread/thread/3ec15f69d6b3dba0; http://ha.ckers.org/blog/20070702/ie60-protocol-guessing/; http://osvdb.org/45813
CVE: CVE-2007-3577
Published: 2007-07-05
Description: PHPIDS before 20070703 does not properly handle use of the substr method in (1) document.location.search and (2) document.referrer; (3) certain use of document.location.hash; (4) certain "window[eval" and similar expressions; (5) certain Function expressions; (6) certain '=' expressions, as demonstrated by a 'whatever="something"' sequence; and (7) certain "with" expressions, which allows remote attackers to inject arbitrary web script.
CVSS Score: 4.3 (MEDIUM)
References: http://groups.google.com/group/php-ids/browse_thread/thread/3ec15f69d6b3dba0; http://osvdb.org/45759; http://sla.ckers.org/forum/read.php?2%2C13209%2C13218
CVE: CVE-2007-3578
Published: 2007-07-05
Description: PHPIDS before 20070703 does not properly handle (1) arithmetic expressions and (2) unclosed comments, which allows remote attackers to inject arbitrary web script.
CVSS Score: 4.3 (MEDIUM)
References: http://groups.google.com/group/php-ids/browse_thread/thread/3ec15f69d6b3dba0; http://osvdb.org/45757; http://osvdb.org/45758
CVE: CVE-2007-3579
Published: 2007-07-05
Description: PHPIDS before 20070703 does not properly handle setting the .text property of a SCRIPT element before its attachment to the DOM, which allows remote attackers to inject arbitrary web script.
CVSS Score: 4.3 (MEDIUM)
References: http://groups.google.com/group/php-ids/browse_thread/thread/3ec15f69d6b3dba0; http://osvdb.org/45756; http://sla.ckers.org/forum/read.php?2%2C13209%2C13218
CVE: CVE-2007-3580
Published: 2007-07-05
Description: PHPIDS does not properly handle certain code containing newlines, as demonstrated by a try/catch block within a loop, which allows user-assisted remote attackers to inject arbitrary web script.
CVSS Score: 4.3 (MEDIUM)
References: http://groups.google.com/group/php-ids/browse_thread/thread/3ec15f69d6b3dba0; http://osvdb.org/45755; http://sla.ckers.org/forum/read.php?2%2C13209%2C13218
CVE: CVE-2007-3581
Published: 2007-07-05
Description: The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the network, as demonstrated by starting Excel with the Palo plugin, opening a cube, and performing an Insert View.
CVSS Score: 5.0 (MEDIUM)
References: http://85.10.222.122/mantis/public_show_bug.php?bug_id=452; http://osvdb.org/45754; http://85.10.222.122/mantis/public_show_bug.php?bug_id=452
CVE: CVE-2007-3582
Published: 2007-07-05
Description: SQL injection vulnerability in index.php in SuperCali PHP Event Calendar 0.4.0 allows remote attackers to execute arbitrary SQL commands via the o parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36300; http://secunia.com/advisories/25921; http://www.securityfocus.com/bid/24756
CVE: CVE-2007-3583
Published: 2007-07-05
Description: SQL injection vulnerability in details_news.php in Girlserv ads 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the idnew parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36365; http://secunia.com/advisories/25925; http://www.securityfocus.com/bid/24755
CVE: CVE-2007-3584
Published: 2007-07-05
Description: SQL injection vulnerability in viewforum.php in PNphpBB2 1.2i and earlier for Postnuke allows remote attackers to execute arbitrary SQL commands via the order parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/45777; https://exchange.xforce.ibmcloud.com/vulnerabilities/35256; https://www.exploit-db.com/exploits/4147
CVE: CVE-2007-3585
Published: 2007-07-05
Description: PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/43962; http://www.securityfocus.com/bid/24757; https://www.exploit-db.com/exploits/4144
CVE: CVE-2007-3586
Published: 2007-07-05
Description: Multiple direct static code injection vulnerabilities in MyCMS 0.9.8 and earlier allow remote attackers to inject arbitrary PHP code into (1) a _score.txt file via the score parameter, or (2) a _setby.txt file via a login cookie, which is then included by games.php.  NOTE: programs that use games.php might include (a) snakep.php, (b) tetrisp.php, and possibly other site-specific files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/45778; http://www.securityfocus.com/bid/24757; https://exchange.xforce.ibmcloud.com/vulnerabilities/35254
CVE: CVE-2007-3587
Published: 2007-07-05
Description: MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a post to admin/settings.php that injects PHP code into settings.inc, which can then be executed via a direct request to index.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/45779; http://www.securityfocus.com/archive/1/484064/100/100/threaded; http://www.securityfocus.com/archive/1/484111/100/100/threaded
CVE: CVE-2007-3588
Published: 2007-07-05
Description: SQL injection vulnerability in reply.php in VBZooM 1.12 allows remote attackers to execute arbitrary SQL commands via the UserID parameter to sub-join.php.  NOTE: this may be the same as CVE-2006-3691.4.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2861; http://www.securityfocus.com/archive/1/472510/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/35171
CVE: CVE-2007-2839
Published: 2007-07-05
Description: gfax 0.4.2 and probably other versions creates temporary files insecurely, which allows local users to execute arbitrary commands via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/37883; http://secunia.com/advisories/25937; http://secunia.com/advisories/25967
CVE: CVE-2007-3589
Published: 2007-07-05
Description: Multiple SQL injection vulnerabilities in b1gbb 2.24.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) showthread.php or (2) showboard.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38950; http://osvdb.org/38951; http://www.securityfocus.com/bid/24696
CVE: CVE-2007-3590
Published: 2007-07-05
Description: Cross-site scripting (XSS) vulnerability in visitenkarte.php in b1gBB 2.24.0 allows remote attackers to inject arbitrary web script or HTML via the user parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38937; http://www.securityfocus.com/bid/24698; https://exchange.xforce.ibmcloud.com/vulnerabilities/35131
CVE: CVE-2007-3591
Published: 2007-07-06
Description: Unspecified vulnerability in Profile.php in Elite Bulletin Board before 1.0.10 allows remote attackers to modify profile information via unspecified vectors related to "a remote form," probably related to direct requests and missing authorization checks.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/37819; http://secunia.com/advisories/25926; http://sourceforge.net/project/shownotes.php?release_id=520558&group_id=175118
CVE: CVE-2007-3592
Published: 2007-07-06
Description: PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via modified id fields.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/37820; http://secunia.com/advisories/25926; http://sourceforge.net/project/shownotes.php?release_id=520558&group_id=175118
CVE: CVE-2007-3593
Published: 2007-07-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine NetFlow Analyzer 5 allow remote attackers to inject arbitrary web script or HTML via the (1) alpha parameter in (a) netflow/jspui/applicationList.jsp, the (2) task parameter in (b) netflow/jspui/appConfig.jsp, the (3) view parameter in (c) netflow/jspui/index.jsp, and the (4) rtype parameter in (d) netflow/jspui/selectDevice.jsp and (e) netflow/jspui/customReport.jsp. NOTE: it was later reported that vector 3 also affects 7.5 build 7500.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2007/07/netflow-analizer-5-opmanager-7-multiple.html; http://osvdb.org/37826; http://osvdb.org/37827