deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1263
Published: 2007-03-06
Description: GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2775; http://fedoranews.org/cms/node/2776
CVE: CVE-2007-1264
Published: 2007-03-06
Description: Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html; http://secunia.com/advisories/24416; http://securityreason.com/securityalert/2353
CVE: CVE-2007-1265
Published: 2007-03-06
Description: KMail 1.9.5 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents KMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
CVSS Score: 7.8 (HIGH)
References: http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html; http://secunia.com/advisories/24413; http://securityreason.com/securityalert/2353
CVE: CVE-2007-1266
Published: 2007-03-06
Description: Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html; http://secunia.com/advisories/24412; http://securityreason.com/securityalert/2353
CVE: CVE-2007-1267
Published: 2007-03-06
Description: Sylpheed 2.2.7 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Sylpheed from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html; http://secunia.com/advisories/24414; http://securityreason.com/securityalert/2353
CVE: CVE-2007-1268
Published: 2007-03-06
Description: Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html; http://secunia.com/advisories/24415; http://securityreason.com/securityalert/2353
CVE: CVE-2007-1269
Published: 2007-03-06
Description: GNUMail 1.1.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents GNUMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html; http://secunia.com/advisories/24417; http://securityreason.com/securityalert/2353
CVE: CVE-2007-1285
Published: 2007-03-06
Description: The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html; http://rhn.redhat.com/errata/RHSA-2007-0154.html; http://rhn.redhat.com/errata/RHSA-2007-0155.html
CVE: CVE-2007-1286
Published: 2007-03-06
Description: Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
CVSS Score: 6.8 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137; http://rhn.redhat.com/errata/RHSA-2007-0154.html
CVE: CVE-2007-1287
Published: 2007-03-06
Description: A regression error in the phpinfo function in PHP 4.4.3 to 4.4.6, and PHP 6.0 in CVS, allows remote attackers to conduct cross-site scripting (XSS) attacks via GET, POST, or COOKIE array values, which are not escaped in the phpinfo output, as originally fixed for CVE-2005-3388.
CVSS Score: 4.3 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=306172; http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html; http://secunia.com/advisories/26235
CVE: CVE-2006-7135
Published: 2007-03-07
Description: PHP remote file inclusion vulnerability in lib/functions.inc.php in PHP Poll Creator (phpPC) 1.04 allows remote attackers to execute arbitrary PHP code via a URL in the relativer_pfad parameter, a different vector and version than CVE-2005-1755.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15510; https://exchange.xforce.ibmcloud.com/vulnerabilities/29393; http://secunia.com/advisories/15510
CVE: CVE-2006-7136
Published: 2007-03-07
Description: Multiple PHP remote file inclusion vulnerabilities in PHP Poll Creator (phpPC) 1.04 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the relativer_pfad parameter to (1) poll.php, (2) poll_kommentar.php, and (3) poll_sm.php, different vectors and version than CVE-2005-1755.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/15510; http://www.securityfocus.com/bid/21245; https://exchange.xforce.ibmcloud.com/vulnerabilities/29393
CVE: CVE-2006-7137
Published: 2007-03-07
Description: Cross-site scripting (XSS) vulnerability in TinyPortal before 0.8.6 allows remote attackers to inject arbitrary web script or HTML via the shoutbox.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/442308/100/0/threaded; http://www.securityfocus.com/archive/1/462018/100/0/threaded; http://www.securityfocus.com/bid/19357
CVE: CVE-2007-1288
Published: 2007-03-07
Description: Multiple PHP remote file inclusion vulnerabilities in Webmobo WB News 1.4.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) comment.php, (2) themes.php, (3) directory.php, and (4) sendmsg.php in admin/.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34951; http://osvdb.org/34952; http://osvdb.org/34953
CVE: CVE-2007-1289
Published: 2007-03-07
Description: SQL injection vulnerability in ViewBugs.php in Tyger Bug Tracking System (TygerBT) 1.1.3 allows remote attackers to execute arbitrary SQL commands via the s parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/35817; http://secunia.com/advisories/24385; http://securityreason.com/securityalert/2356
CVE: CVE-2007-1290
Published: 2007-03-07
Description: SQL injection vulnerability in ViewReport.php in Tyger Bug Tracking System (TygerBT) 1.1.3 allows remote attackers to execute arbitrary SQL commands via the bug parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24385; https://exchange.xforce.ibmcloud.com/vulnerabilities/32791; http://secunia.com/advisories/24385
CVE: CVE-2007-1291
Published: 2007-03-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Tyger Bug Tracking System (TygerBT) 1.1.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) Login.php and (2) Register.php.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/24385; http://securityreason.com/securityalert/2356; http://www.securityfocus.com/archive/1/461801/100/0/threaded
CVE: CVE-2007-1292
Published: 2007-03-07
Description: SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter.  NOTE: the vendor states that the attack is feasible only in circumstances "almost impossible to achieve."
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33835; http://secunia.com/advisories/24341; http://www.securityfocus.com/bid/22780
CVE: CVE-2007-1293
Published: 2007-03-07
Description: SQL injection vulnerability in Rigter Portal System (RPS) 6.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the categoria parameter to the top-level URI (index.php), possibly related to ver_descarga.php.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/33831; http://secunia.com/advisories/24382; http://www.securityfocus.com/archive/1/462146/100/0/threaded
CVE: CVE-2007-1294
Published: 2007-03-07
Description: A certain ActiveX control in the DivXBrowserPlugin (npdivx32.dll) in DivX Web Player, as distributed with DivX Player 1.3.0, allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via large values to DivxWP.Resize, related to resizing images.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35377; http://www.securityfocus.com/bid/22776; https://exchange.xforce.ibmcloud.com/vulnerabilities/32759
CVE: CVE-2007-1295
Published: 2007-03-07
Description: SQL injection vulnerability in topic_title.php in AJ Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the td_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33827; http://secunia.com/advisories/24378; http://www.securityfocus.com/bid/22808
CVE: CVE-2007-1296
Published: 2007-03-07
Description: SQL injection vulnerability in postingdetails.php in AJ Classifieds 1.0 allows remote attackers to execute arbitrary SQL commands via the postingid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35452; http://www.securityfocus.com/bid/22808; http://www.vupen.com/english/advisories/2007/0833
CVE: CVE-2007-1297
Published: 2007-03-07
Description: SQL injection vulnerability in view_profile.php in AJDating 1.0 allows remote attackers to execute arbitrary SQL commands via the user_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33828; http://secunia.com/advisories/24376; http://www.securityfocus.com/bid/22808
CVE: CVE-2007-1298
Published: 2007-03-07
Description: SQL injection vulnerability in subcat.php in AJ Auction 1.0 allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33826; http://secunia.com/advisories/24375; http://www.securityfocus.com/bid/22808
CVE: CVE-2007-1299
Published: 2007-03-07
Description: PHP remote file inclusion vulnerability in index.php in Mani Stats Reader 1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ipath parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33870; http://secunia.com/advisories/24394; http://www.securityfocus.com/bid/22794
CVE: CVE-2007-1300
Published: 2007-03-07
Description: DOURAN Software Technologies ISPUtil 3.32.84.1, and possibly earlier versions, stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and reseller data via a direct request for scripts/activesessions.ini.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33845; http://secunia.com/advisories/24304; https://exchange.xforce.ibmcloud.com/vulnerabilities/32800
CVE: CVE-2007-1301
Published: 2007-03-07
Description: Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allows remote authenticated users to execute arbitrary code via a long argument to the APPEND command.  NOTE: this is probably different than CVE-2006-6423.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/24361; http://www.mailenable.com/hotfix/; http://www.securityfocus.com/bid/22792
CVE: CVE-2007-1302
Published: 2007-03-07
Description: SQL injection vulnerability in guestbook.php in LI-Guestbook 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the country parameter.  NOTE: it was later reported that 1.2 is also affected.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://belsec.com/advisories/139/summary.html; http://secunia.com/advisories/27650; http://securityreason.com/securityalert/2348
CVE: CVE-2007-1303
Published: 2007-03-07
Description: Directory traversal vulnerability in rb.cgi in RRDBrowse 1.6 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 7.8 (HIGH)
References: http://securityreason.com/securityalert/2349; http://www.devtarget.org/rrdbrowse-advisory-03-2007.txt; http://www.rrdbrowse.org/index.php
CVE: CVE-2007-1304
Published: 2007-03-07
Description: Multiple SQL injection vulnerabilities in add2.php in Sava's Guestbook 23.11.2006, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) country, (3) email, (4) website, and (5) message parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://belsec.com/advisories/142/summary.html; http://secunia.com/advisories/24411; http://securityreason.com/securityalert/2350
CVE: CVE-2007-1305
Published: 2007-03-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in add2.php in Sava's Guestbook 23.11.2006 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) country, (3) email, and (4) website parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://belsec.com/advisories/142/summary.html; http://secunia.com/advisories/24411; http://securityreason.com/securityalert/2350
CVE: CVE-2007-1306
Published: 2007-03-07
Description: Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.
CVSS Score: 7.8 (HIGH)
References: http://asterisk.org/node/48319; http://asterisk.org/node/48320; http://labs.musecurity.com/advisories/MU-200703-01.txt
CVE: CVE-2007-1307
Published: 2007-03-07
Description: Unspecified vulnerability in Lenovo Intel PRO/1000 LAN adapter before Build 135400, as used on IBM Lenovo ThinkPad systems, has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/33854; http://secunia.com/advisories/24349; http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-62922
CVE: CVE-2007-1308
Published: 2007-03-07
Description: ecma/kjs_html.cpp in KDE JavaScript (KJS), as used in Konqueror in KDE 3.5.5, allows remote attackers to cause a denial of service (crash) by accessing the content of an iframe with an ftp:// URI in the src attribute, probably due to a NULL pointer dereference.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://bindshell.net/advisories/konq355; http://bindshell.net/advisories/konq355/konq355-patch.diff; http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052793.html
CVE: CVE-2007-1309
Published: 2007-03-07
Description: Novell Access Management 3 SSLVPN Server allows remote authenticated users to bypass VPN restrictions by making policy.txt read-only, disconnecting, then manually modifying policy.txt.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/33841; http://secunia.com/advisories/24369; http://www.securitytracker.com/id?1017722
CVE: CVE-2006-7138
Published: 2007-03-07
Description: SQL injection vulnerability in wwv_flow_utilities.gen_popup_list in the WWV_FLOW_UTILITIES package for Oracle APEX/HTMLDB before 2.2 allows remote authenticated users to execute arbitrary SQL by modifying the P_LOV parameter and calculating a matching MD5 checksum for the P_LOV_CHECKSUM parameter.  NOTE: it is likely that this issue is subsumed by CVE-2006-5351, but due to lack of details from Oracle, this cannot be proven.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050265.html; http://securityreason.com/securityalert/2346; http://www.red-database-security.com/advisory/oracle_apex_sql_injection_wwv_flow_utilities.html
CVE: CVE-2006-7139
Published: 2007-03-07
Description: Kmail 1.9.1 on KDE 3.5.2, with "Prefer HTML to Plain Text" enabled, allows remote attackers to cause a denial of service (crash) via an HTML e-mail with certain table and frameset tags that trigger a segmentation fault, possibly involving invalid free or delete operations.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0293.html; http://secunia.com/advisories/24889; http://securityreason.com/securityalert/2347
CVE: CVE-2006-7140
Published: 2007-03-07
Description: The libike library, as used by in.iked, elfsign, and kcfd in Sun Solaris 9 and 10, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents libike from correctly verifying X.509 and other certificates that use PKCS #1, a similar issue to CVE-2006-4339.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/23104; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102722-1; http://www.vupen.com/english/advisories/2006/4744
CVE: CVE-2006-7141
Published: 2007-03-07
Description: Absolute path traversal vulnerability in Oracle Database Server, when utl_file_dir is set to a wildcard value or "CREATE ANY DIRECTORY to PUBLIC" privileges exist, allows remote authenticated users to read and modify arbitrary files via full filepaths to utl_file functions such as (1) utl_file.put_line and (2) utl_file.get_line, a related issue to CVE-2005-0701.  NOTE: this issue is disputed by third parties who state that this is due to an insecure configuration instead of an inherent vulnerability
CVSS Score: 6.0 (MEDIUM)
References: http://www.0xdeadbeef.info/exploits/raptor_orafile.sql; http://www.securityfocus.com/archive/1/454862/100/0/threaded; http://www.securityfocus.com/archive/1/454964/100/0/threaded
CVE: CVE-2006-7142
Published: 2007-03-07
Description: The centralized management feature for Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configuration files, which allows attackers to recover the keys from the configuration files and decrypt the disk drive.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: http://www.securityfocus.com/archive/1/448598/100/0/threaded; http://www.securityfocus.com/archive/1/449120/100/0/threaded; http://www.securityfocus.com/bid/20529
CVE: CVE-2006-7143
Published: 2007-03-07
Description: Cross-site scripting (XSS) vulnerability in Call Center Software 0.93 and earlier allows remote attackers to inject arbitrary web script or HTML via the problem description field.
CVSS Score: 5.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0217.html; http://secunia.com/advisories/22365; http://securityreason.com/securityalert/2389
CVE: CVE-2006-7144
Published: 2007-03-07
Description: SQL injection vulnerability in Call Center Software 0.93 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the user name in the login page.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0217.html; http://secunia.com/advisories/22365; http://securityreason.com/securityalert/2389
CVE: CVE-2006-7145
Published: 2007-03-07
Description: edit_user.php in Call Center Software 0.93 and earlier allows remote attackers to obtain sensitive information such as account passwords via a modified user_id parameter.
CVSS Score: 5.5 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0217.html; http://secunia.com/advisories/22365; http://securityreason.com/securityalert/2389
CVE: CVE-2006-7146
Published: 2007-03-07
Description: PHP remote file inclusion vulnerability in bug.php in Leicestershire communityPortals 1.0 build 20051018 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cp_root_path parameter, a different vector than CVE-2006-5280.  NOTE: CVE disputes this issue, since bug.php is not in communityPortals source distributions
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/2387; http://www.securityfocus.com/archive/1/448311/100/0/threaded; http://www.securityfocus.com/bid/20467
CVE: CVE-2006-7147
Published: 2007-03-07
Description: PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Import Tools Mod 0.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/20525; https://exchange.xforce.ibmcloud.com/vulnerabilities/29512; https://www.exploit-db.com/exploits/2531
CVE: CVE-2006-7148
Published: 2007-03-07
Description: PHP remote file inclusion vulnerability in includes/bb_usage_stats.php in maluinfo 206.2.38 for Brazilian PHPBB allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter.  NOTE: this might be the same issues as CVE-2006-4893.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/2380; http://www.securityfocus.com/archive/1/448639/100/0/threaded; http://www.securityfocus.com/bid/20507
CVE: CVE-2006-7149
Published: 2007-03-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the query string to (a) index.php, which reflects the string in an error message from mod_login.php; and the (2) mcname parameter to (b) moscomment.php and (c) com_comment.php.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/2379; http://www.kapda.ir/advisory-444.html; http://www.securityfocus.com/archive/1/449305/100/0/threaded
CVE: CVE-2006-7150
Published: 2007-03-07
Description: Multiple SQL injection vulnerabilities in Mambo 4.6.x allow remote attackers to execute arbitrary SQL commands via the mcname parameter to (1) moscomment.php and (2) com_comment.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2379; http://www.kapda.ir/advisory-444.html; http://www.securityfocus.com/archive/1/449305/100/0/threaded
CVE: CVE-2006-7151
Published: 2007-03-07
Description: Untrusted search path vulnerability in the libtool-ltdl library (libltdl.so) 1.5.22-2.3 in Fedora Core 5 might allow local users to execute arbitrary code via a malicious library in the (1) hwcap, (2) 0, and (3) nosegneg subdirectories.
CVSS Score: 6.6 (MEDIUM)
References: http://securityreason.com/securityalert/2378; http://www.securityfocus.com/archive/1/448153/100/0/threaded; http://www.securityfocus.com/bid/20434
CVE: CVE-2006-7152
Published: 2007-03-07
Description: default.asp in ASP-Nuke Community 1.5 and earlier allows remote attackers to gain privileges by setting certain pseudo cookie values.
CVSS Score: 8.5 (HIGH)
References: http://www.securityfocus.com/bid/21309; https://exchange.xforce.ibmcloud.com/vulnerabilities/30541; https://www.exploit-db.com/exploits/2849