deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-5316
Published: 2007-10-09
Description: SQL injection vulnerability in browsecats.php in Softbiz Jobs and Recruitment Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/37619; http://secunia.com/advisories/27138; http://www.securityfocus.com/bid/25980
CVE: CVE-2007-5317
Published: 2007-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-5292.  Reason: This candidate is a duplicate of CVE-2007-5292.  Notes: All CVE users should reference CVE-2007-5292 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CWE: CWE-79
CVE: CVE-2007-5318
Published: 2007-10-09
Description: Unspecified vulnerability in preview.php in TYPOlight webCMS 2.4.6 allows remote attackers to download arbitrary files via the src parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/41649; http://secunia.com/advisories/27142; http://www.securityfocus.com/bid/25975
CVE: CVE-2007-2217
Published: 2007-10-09
Description: Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute arbitrary code via crafted image files that trigger memory corruption, as demonstrated by a certain .tif (TIFF) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/27092; http://securitytracker.com/id?1018784; http://www.kb.cert.org/vuls/id/180345
CVE: CVE-2007-2228
Published: 2007-10-09
Description: rpcrt4.dll (aka the RPC runtime library) in Microsoft Windows XP SP2, XP Professional x64 Edition, Server 2003 SP1 and SP2, Server 2003 x64 Edition and x64 Edition SP2, and Vista and Vista x64 Edition allows remote attackers to cause a denial of service (RPCSS service stop and system restart) via an RPC request that uses NTLMSSP PACKET authentication with a zero-valued verification trailer signature, which triggers an invalid dereference.  NOTE: this also affects Windows 2000 SP4, although the impact is an information leak.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/27134; http://secunia.com/advisories/27153; http://securitytracker.com/id?1018787
CVE: CVE-2007-3892
Published: 2007-10-09
Description: Microsoft Internet Explorer 5.01 through 7 allows remote attackers to spoof the URL address bar and other "trust UI" components via unspecified vectors, a different issue than CVE-2007-1091 and CVE-2007-3826.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/27133; http://securitytracker.com/id?1018788; http://www.securityfocus.com/archive/1/482366/100/0/threaded
CVE: CVE-2007-3893
Published: 2007-10-09
Description: Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via unspecified vectors involving memory corruption from an unhandled error.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/23469; http://securitytracker.com/id?1018788; http://www.securityfocus.com/archive/1/482366/100/0/threaded
CVE: CVE-2007-3897
Published: 2007-10-09
Description: Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607; http://secunia.com/advisories/27112; http://securitytracker.com/id?1018785
CVE: CVE-2007-3899
Published: 2007-10-09
Description: Unspecified vulnerability in Microsoft Word 2000 SP3, Word 2002 SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string in a Word file, aka "Word Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/27151; http://securitytracker.com/id?1018790; http://www.securityfocus.com/archive/1/482366/100/0/threaded
CVE: CVE-2007-4466
Published: 2007-10-09
Description: Multiple stack-based buffer overflows in Electronic Arts (EA) SnoopyCtrl ActiveX control (NPSnpy.dll) allow remote attackers to execute arbitrary code via unspecified methods and parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94, CWE-119
References: http://osvdb.org/37723; http://secunia.com/advisories/27143; http://www.kb.cert.org/vuls/id/179281
CVE: CVE-2007-5319
Published: 2007-10-09
Description: Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 8, 9, and 10 allows local users with console (/dev/console) access to cause a denial of service ("unusable" system console) via unspecified vectors.
CVSS Score: 3.5 (LOW)
References: http://osvdb.org/37715; http://secunia.com/advisories/27135; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103065-1
CVE: CVE-2007-5320
Published: 2007-10-09
Description: Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete arbitrary files via the CacheFile attribute in the ThumbnailXpres.1 ActiveX control (PegasusImaging.ActiveX.ThumnailXpress1.dll) or (2) overwrite arbitrary files via the CompactFile function in the ImagXpress.8 ActiveX control (PegasusImaging.ActiveX.ImagXpress8.dll).
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/37959; http://osvdb.org/37960; http://secunia.com/advisories/27095
CVE: CVE-2007-5321
Published: 2007-10-09
Description: Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22, CWE-94
References: http://osvdb.org/37612; http://secunia.com/advisories/27113; http://www.securityfocus.com/bid/25968
CVE: CVE-2007-5322
Published: 2007-10-09
Description: Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote attackers to execute arbitrary programs by specifying them as an argument to the FoxDoCmd function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://osvdb.org/38487; http://secunia.com/advisories/27165; http://shinnai.altervista.org/exploits/txt/TXT_14md9AHOoCycrnk9l095.html
CVE: CVE-2007-3896
Published: 2007-10-11
Description: The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://blogs.zdnet.com/security/?p=577; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2107&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5918&w=2
CVE: CVE-2007-4992
Published: 2007-10-11
Description: Stack-based buffer overflow in the process_packet function in fbserver.exe in Firebird SQL 2.0.2 allows remote attackers to execute arbitrary code via a long request to TCP port 3050.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=195569; http://secunia.com/advisories/27982; http://security.gentoo.org/glsa/glsa-200712-06.xml
CVE: CVE-2007-5323
Published: 2007-10-11
Description: The RepliStor Server Service in EMC Replistor 6.1.3 allows remote attackers to execute arbitrary code via a size value that causes RepliStor to create a smaller buffer than expected, which triggers a buffer overflow when that buffer is used in a recv function call.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-07-18; http://secunia.com/advisories/27166; http://www.securityfocus.com/bid/26014
CVE: CVE-2007-5362
Published: 2007-10-11
Description: Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite (com_mosmedia) 4.5.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) credits.html.php, (2) info.html.php, (3) media.divs.php, (4) media.divs.js.php, (5) purchase.html.php, or (6) support.html.php in includes/.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: vector 3 may be the same as CVE-2007-2043.2.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/38586; http://osvdb.org/38587; http://osvdb.org/38588
CVE: CVE-2007-5363
Published: 2007-10-11
Description: PHP remote file inclusion vulnerability in admin.panoramic.php in the Panoramic Picture Viewer (com_panoramic) mambot (plugin) 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/38585; http://www.securityfocus.com/bid/25946; http://www.vupen.com/english/advisories/2007/3428
CVE: CVE-2007-5364
Published: 2007-10-11
Description: Directory traversal vulnerability in payments/ideal_process.php in the iDEAL transaction handler in ViArt Shopping Cart allows remote attackers to have an unknown impact via directory traversal sequences in the filename parameter to the createCertFingerprint function.  NOTE: this issue is disputed by CVE because PHP encounters a fatal function-call error on a direct request for payments/ideal_process.php
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3212; http://www.securityfocus.com/archive/1/481658/100/0/threaded; http://www.securityfocus.com/archive/1/481848
CVE: CVE-2007-3917
Published: 2007-10-11
Description: The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp.  NOTE: this issue affects both clients and servers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-134
References: http://osvdb.org/41711; http://secunia.com/advisories/27137; http://secunia.com/advisories/27218
CVE: CVE-2007-5169
Published: 2007-10-11
Description: Stack-based buffer overflow in MAIPM6.dll in Adobe PageMaker 7.0.1 and 7.0.2 on Windows allows user-assisted remote attackers to execute arbitrary code via a long font name in a .PMD file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/38067; http://secunia.com/advisories/27158; http://securitytracker.com/id?1018791
CVE: CVE-2007-5365
Published: 2007-10-11
Description: Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446354; http://secunia.com/advisories/27160; http://secunia.com/advisories/27273
CVE: CVE-2007-5366
Published: 2007-10-11
Description: The Tomcat 4.1-based Servlet Service in Fujitsu Interstage Application Server 7.0 through 9.0.0 and Interstage Apworks/Studio 7.0 through 9.0.0 allows remote attackers to obtain sensitive information (web root path) via unspecified vectors that trigger an error message, probably related to enabling the useCanonCaches Java Virtual Machine (JVM) option.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/41318; http://secunia.com/advisories/27136; http://www.fujitsu.com/global/support/software/security/products-f/interstage-200705e.html
CVE: CVE-2007-5367
Published: 2007-10-11
Description: Unspecified vulnerability in the Virtual File System (VFS) in Sun Solaris 10 allows local users to cause a denial of service (kernel memory consumption) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/37720; http://secunia.com/advisories/27154; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103088-1
CVE: CVE-2007-5368
Published: 2007-10-11
Description: Multiple unspecified vulnerabilities in labeld in Trusted Extensions in Sun Solaris 10 allow local users to cause a denial of service (multiple application hang) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/37716; http://secunia.com/advisories/27152; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103109-1
CVE: CVE-2007-5369
Published: 2007-10-11
Description: The GetMagicNumberString function in Massive Entertainment World in Conflict 1.000 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a string to the VoIP port (52999/tcp) with an invalid value in the third byte.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/27157; http://securityreason.com/securityalert/3214; http://www.massive.se/Index.asp?nNewsId=1387
CVE: CVE-2007-5370
Published: 2007-10-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/dnewsweb.exe in NetWin DNewsWeb (DNews News Server) 57e1 allow remote attackers to inject arbitrary web script or HTML via the (1) group or (2) utag parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37651; http://secunia.com/advisories/27163; http://securityreason.com/securityalert/3208
CVE: CVE-2007-5371
Published: 2007-10-11
Description: Multiple SQL injection vulnerabilities in mutate_content.dynamic.php in MODx 0.9.6 allow remote attackers to execute arbitrary SQL commands via the (1) documentDirty or (2) modVariables parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/38584; http://securityreason.com/securityalert/3215; http://www.securityfocus.com/archive/1/481870/100/0/threaded
CVE: CVE-2007-5372
Published: 2007-10-11
Description: Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field.
CVSS Score: 10.0 (HIGH)
CWE: CWE-89
References: http://osvdb.org/37865; http://osvdb.org/37866; http://secunia.com/advisories/27159
CVE: CVE-2007-5373
Published: 2007-10-11
Description: ldapscripts 1.4 and 1.7 sends a password as a command line argument when calling some LDAP programs, which might allow local users to read the password by listing the process and its arguments, as demonstrated by a call to ldappasswd in the _changepassword function.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445582; http://secunia.com/advisories/27111; http://secunia.com/advisories/29395
CVE: CVE-2007-5374
Published: 2007-10-11
Description: cp_memberedit.php in LightBlog 8.4.1.1 does not check for administrative credentials when processing an admin action, which allows remote authenticated users to increase the privileges of any account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/27164; http://www.securityfocus.com/bid/25990; https://exchange.xforce.ibmcloud.com/vulnerabilities/37050
CVE: CVE-2007-5375
Published: 2007-10-11
Description: Interpretation conflict in the Sun Java Virtual Machine (JVM) allows user-assisted remote attackers to conduct a multi-pin DNS rebinding attack and execute arbitrary JavaScript in an intranet context, when an intranet web server has an HTML document that references a "mayscript=true" Java applet through a local relative URI, which may be associated with different IP addresses by the browser and the JVM.
CVSS Score: 2.6 (LOW)
CWE: CWE-16, CWE-20
References: http://crypto.stanford.edu/dns/dns-rebinding.pdf; http://osvdb.org/40930; http://crypto.stanford.edu/dns/dns-rebinding.pdf
CVE: CVE-2007-5377
Published: 2007-10-12
Description: The (1) tramp-make-temp-file and (2) tramp-make-tramp-temp-file functions in Tramp 2.1.10 extension for Emacs, and possibly earlier 2.1.x versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.gentoo.org/show_bug.cgi?id=194713; http://lists.gnu.org/archive/html/emacs-devel/2007-10/msg00132.html; http://lists.gnu.org/archive/html/emacs-devel/2007-10/msg00158.html
CVE: CVE-2007-5378
Published: 2007-10-12
Description: Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, allows user-assisted attackers to cause a denial of service (segmentation fault) via an animated GIF in which the first subimage is smaller than a subsequent subimage, which triggers the overflow in the ReadImage function, a different vulnerability than CVE-2007-5137.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/27207; http://secunia.com/advisories/27295; http://secunia.com/advisories/27801
CVE: CVE-2007-5381
Published: 2007-10-12
Description: Stack-based buffer overflow in the Line Printer Daemon (LPD) in Cisco IOS before 12.2(18)SXF11, 12.4(16a), and 12.4(2)T6 allow remote attackers to execute arbitrary code by setting a long hostname on the target system, then causing an error message to be printed, as demonstrated by a telnet session to the LPD from a source port other than 515.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/37935; http://secunia.com/advisories/27169; http://www.cisco.com/en/US/products/products_security_response09186a00808d72e3.html
CVE: CVE-2007-5382
Published: 2007-10-12
Description: The conversion utility for converting CiscoWorks Wireless LAN Solution Engine (WLSE) 4.1.91.0 and earlier to Cisco Wireless Control System (WCS) creates administrator accounts with default usernames and passwords, which allows remote attackers to gain privileges.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/37936; http://www.cisco.com/en/US/products/products_security_advisory09186a00808d72db.shtml; http://www.securityfocus.com/bid/26000
CVE: CVE-2007-5383
Published: 2007-10-12
Description: The Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allows remote attackers on an intranet to bypass authentication and gain administrative access via vectors including a '/' (slash) character at the end of the PATH_INFO to cgi/b, aka "double-slash auth bypass." NOTE: remote attackers outside the intranet can exploit this by leveraging a separate CSRF vulnerability. NOTE: SpeedTouch 780 might also be affected by some of these issues.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/3213; http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub; http://www.gnucitizen.org/blog/holes-in-embedded-devices-authentication-bypass-pt-1/
CVE: CVE-2007-5384
Published: 2007-10-12
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. NOTE: an authentication bypass can be leveraged to exploit this in the absence of an existing administrative session.  NOTE: SpeedTouch 780 might also be affected by some of these issues.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://securityreason.com/securityalert/3213; http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub; http://www.securityfocus.com/archive/1/481835/100/0/threaded
CVE: CVE-2007-5385
Published: 2007-10-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3213; http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub; http://www.securityfocus.com/archive/1/481835/100/0/threaded
CVE: CVE-2007-5386
Published: 2007-10-12
Description: Cross-site scripting (XSS) vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37678; http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10748&r2=10747&pathrev=10748; http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/?view=log
CVE: CVE-2007-5387
Published: 2007-10-12
Description: PHP remote file inclusion vulnerability in active/components/xmlrpc/client.php in Pindorama 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the c[components] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/37879; http://www.securityfocus.com/bid/26026; https://exchange.xforce.ibmcloud.com/vulnerabilities/37179
CVE: CVE-2007-5388
Published: 2007-10-12
Description: Multiple PHP remote file inclusion vulnerabilities in WebDesktop 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) app parameter to apps/apps.php and the (2) wsk parameter to wsk/wsk.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/37881; http://osvdb.org/37882; http://www.securityfocus.com/bid/26030
CVE: CVE-2007-5389
Published: 2007-10-12
Description: PHP remote file inclusion vulnerability in preview.php in the swMenuFree (com_swmenufree) 4.6 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: a reliable third party disputes this issue because preview.php tests a certain constant to prevent direct requests
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/37903; http://securityreason.com/securityalert/3210; http://www.attrition.org/pipermail/vim/2007-October/001825.html
CVE: CVE-2007-5390
Published: 2007-10-12
Description: PHP remote file inclusion vulnerability in index.php in PicoFlat CMS 0.4.14 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pagina parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/37686; http://secunia.com/advisories/27208; http://www.securityfocus.com/bid/26043
CVE: CVE-2007-5391
Published: 2007-10-12
Description: Unspecified vulnerability in HP Select Identity 4.01 through 4.01.010 and 4.10 through 4.13.001 allows remote attackers to obtain unspecified access via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01081130; http://osvdb.org/41728; http://secunia.com/advisories/27211
CVE: CVE-2007-5407
Published: 2007-10-12
Description: Multiple PHP remote file inclusion vulnerabilities in the JContentSubscription (com_jcs) 1.5.8 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) jcs.function.php; (2) add.php, (3) history.php, and (4) register.php, in view/; and (5) list.sub.html.php, (6) list.user.sub.html.php, and (7) reports.html.php in views/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/43619; http://osvdb.org/43620; http://osvdb.org/43621