deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-3532
Published: 2007-07-27
Description: NVIDIA drivers (nvidia-drivers) before 1.0.7185, 1.0.9639, and 100.14.11, as used in Gentoo Linux and possibly other distributions, creates /dev/nvidia* device files with insecure permissions, which allows local users to modify video card settings, cause a denial of service (crash or physical video card damage), and obtain sensitive information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/40177; http://secunia.com/advisories/26497; http://www.gentoo.org/security/en/glsa/glsa-200708-14.xml
CVE: CVE-2007-4031
Published: 2007-07-27
Description: Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via a .. (dot dot) in the argument to the deleteReport method, probably related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/26243; http://securitytracker.com/id?1018469; http://www.nessus.org/news/
CVE: CVE-2007-4032
Published: 2007-07-27
Description: Buffer overflow in CrystalPlayer Pro 1.98 allows user-assisted remote attackers to execute arbitrary code via a long string in a .mls Playlist file.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/38689; http://secunia.com/advisories/26198; http://www.securityfocus.com/bid/25083
CVE: CVE-2007-4033
Published: 2007-07-27
Description: Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter.  NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=193437; http://fedoranews.org/updates/FEDORA-2007-234.shtml; http://secunia.com/advisories/26241
CVE: CVE-2007-4034
Published: 2007-07-27
Description: Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka Yahoo! Installer Plugin for Widgets) ActiveX control before 2007.7.13.3 (20070620) in YDPCTL.dll in Yahoo! Widgets before 4.0.5 allows remote attackers to execute arbitrary code via a long argument to the GetComponentVersion method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://help.yahoo.com/l/us/yahoo/widgets/security/security-08.html; http://osvdb.org/37705; http://secunia.com/advisories/26011
CVE: CVE-2007-4035
Published: 2007-07-27
Description: Guidance Software EnCase does not properly handle (1) certain malformed MBR partition tables with many entries, which allows remote attackers to prevent logical collection of a disk image; (2) NTFS filesystems with directory loops, which allows remote attackers to prevent examination of certain directory contents; and (3) certain other malformed NTFS filesystems, which allows remote attackers to prevent examination of corrupted records. NOTE: the vendor disputes the significance of these issues, because physical collection can be used instead, because the vendor believes that relevant attackers typically do not corrupt an MBR or a filesystem, and because detection of a loop is valuable on its own
CVSS Score: 5.0 (MEDIUM)
References: http://www.blackhat.com/html/bh-usa-07/bh-usa-07-speakers.html#Palmer; http://www.isecpartners.com/files/iSEC-Breaking_Forensics_Software-Paper.v1_1.BH2007.pdf; http://www.securityfocus.com/archive/1/474727/100/0/threaded
CVE: CVE-2007-4036
Published: 2007-07-27
Description: Guidance Software EnCase allows user-assisted remote attackers to cause a denial of service via (1) a corrupted Microsoft Exchange database, which triggers an application crash when many options are selected; (2) a corrupted NTFS filesystem, which causes the application to report "memory allocation errors;" or (3) deeply nested directories, which trigger an application crash during an Expand All action. NOTE: the vendor disputes the significance of these vectors because the user can select fewer options, there is no operational impact, or the user can do less expansion
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www.blackhat.com/html/bh-usa-07/bh-usa-07-speakers.html#Palmer; http://www.isecpartners.com/files/iSEC-Breaking_Forensics_Software-Paper.v1_1.BH2007.pdf; http://www.securityfocus.com/archive/1/474727/100/0/threaded
CVE: CVE-2007-4037
Published: 2007-07-27
Description: Guidance Software EnCase allows user-assisted attackers to trigger a buffer over-read and application crash via a malformed NTFS filesystem containing a modified FILE record with a certain large offset. NOTE: the vendor disputes the significance of this issue, asserting that relevant attackers typically do not corrupt a filesystem, and indicating that the relevant read operation can be disabled
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.blackhat.com/html/bh-usa-07/bh-usa-07-speakers.html#Palmer; http://www.isecpartners.com/files/iSEC-Breaking_Forensics_Software-Paper.v1_1.BH2007.pdf; http://www.securityfocus.com/archive/1/474727/100/0/threaded
CVE: CVE-2007-4038
Published: 2007-07-27
Description: Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://larholm.com/2007/07/25/mozilla-protocol-abuse/; http://seclists.org/fulldisclosure/2007/Jul/0557.html; http://www.securityfocus.com/archive/1/474624/100/0/threaded
CVE: CVE-2007-4039
Published: 2007-07-27
Description: Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79, CWE-79
References: http://larholm.com/2007/07/25/mozilla-protocol-abuse/; http://seclists.org/fulldisclosure/2007/Jul/0557.html; http://larholm.com/2007/07/25/mozilla-protocol-abuse/
CVE: CVE-2007-4040
Published: 2007-07-27
Description: Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: http://larholm.com/2007/07/25/mozilla-protocol-abuse/; http://seclists.org/fulldisclosure/2007/Jul/0557.html; http://larholm.com/2007/07/25/mozilla-protocol-abuse/
CVE: CVE-2007-4041
Published: 2007-07-27
Description: Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/783400; http://www.securityfocus.com/bid/25053; http://xs-sniper.com/blog/2007/07/24/remote-command-execution-in-firefox-2005/
CVE: CVE-2007-4042
Published: 2007-07-27
Description: Multiple argument injection vulnerabilities in Netscape Navigator 9 allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/46832; http://xs-sniper.com/blog/remote-command-exec-firefox-2005/; http://osvdb.org/46832
CVE: CVE-2007-4043
Published: 2007-07-27
Description: file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) before 4.6.3 allows remote attackers to bypass authentication via a name parameter ending with a "%00.gif" sequence. NOTE: a separate traversal vulnerability could be leveraged to download arbitrary files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0476&w=2; http://www.oliverkarow.de/research/securityreporter.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0476&w=2
CVE: CVE-2007-4044
Published: 2007-07-27
Description: Rejected reason: The MS-RPC functionality in smbd in Samba 3 on SUSE Linux before 20070720 does not include "one character in the shell escape handling."  NOTE: this issue was originally characterized as a shell metacharacter issue due to an incomplete fix for CVE-2007-2447, which was interpreted by CVE to be security relevant.  However, SUSE and Red Hat have disputed the problem, stating that the only impact is that scripts will not be executed if they have a "c" in their name, but even this limitation might not exist.  This does not have security implications, so should not be included in CVE
CVE: CVE-2007-4045
Published: 2007-07-27
Description: The CUPS service, as used in SUSE Linux before 20070720 and other Linux distributions, allows remote attackers to cause a denial of service via unspecified vectors related to an incomplete fix for CVE-2007-0720 that introduced a different denial of service problem in SSL negotiation.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=199195; http://secunia.com/advisories/27577; http://secunia.com/advisories/27615
CVE: CVE-2007-4046
Published: 2007-07-27
Description: SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37098; http://www.securityfocus.com/bid/24972; http://www.vupen.com/english/advisories/2007/2616
CVE: CVE-2007-4047
Published: 2007-07-27
Description: geoBlog (aka BitDamaged) 1 does not require authentication for (1) deletecomment.php, (2) deleteblog.php, and (3) listcomment.php in admin/, which allows remote attackers to delete arbitrary comments, delete arbitrary blogs, and have other unspecified impact via a request with a valid id parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/42485; http://osvdb.org/42486; http://osvdb.org/42487
CVE: CVE-2007-4048
Published: 2007-07-30
Description: Cross-site scripting (XSS) vulnerability in index.php in phpSysInfo 2.5.4-dev and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
References: http://download.phpgroupware.org/; http://osvdb.org/36601; http://secunia.com/advisories/26248
CVE: CVE-2007-4049
Published: 2007-07-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2000-1205.  Reason: This candidate is a duplicate of CVE-2000-1205.  Notes: All CVE users should reference CVE-2000-1205 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-4050
Published: 2007-07-30
Description: Unspecified vulnerability in WebUI in ADempiere Bazaar before 3.3 beta Victoria edition allows remote attackers to access system-level windows via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://adempiere.com/wiki/index.php/Release_330; http://osvdb.org/38691; http://secunia.com/advisories/26247
CVE: CVE-2007-4051
Published: 2007-07-30
Description: Heap-based buffer overflow in the FindFiles function in UltraDefrag 1.0.3 allows local users to gain privileges via a file with a long pathname.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/38624; http://secunia.com/advisories/26233; http://sourceforge.net/project/showfiles.php?group_id=199532&package_id=236738&release_id=527964
CVE: CVE-2007-4052
Published: 2007-07-30
Description: Cross-site scripting (XSS) vulnerability in utilities/login.asp in nukedit 4.9.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/25081.html; http://osvdb.org/37129; http://www.securityfocus.com/bid/25081
CVE: CVE-2007-3911
Published: 2007-07-30
Description: Multiple heap-based buffer overflows in (1) clsscheduler.exe (aka scheduler client) and (2) srvscheduler.exe (aka scheduler server) in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/26222; http://securityreason.com/securityalert/2954; http://www.securityfocus.com/archive/1/474626/100/0/threaded
CVE: CVE-2007-4053
Published: 2007-07-30
Description: SQL injection vulnerability in include/img_view.class.php in LinPHA 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter to new_images.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36286; http://secunia.com/advisories/26259; http://www.securityfocus.com/bid/25119
CVE: CVE-2007-4054
Published: 2007-07-30
Description: SQL injection vulnerability in category.php in PHP123 Top Sites allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37130; http://www.securityfocus.com/bid/25128; http://www.vupen.com/english/advisories/2007/2693
CVE: CVE-2007-4055
Published: 2007-07-30
Description: SQL injection vulnerability in comments_get.asp in SimpleBlog 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: this may be related to CVE-2006-4300.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37268; http://www.securityfocus.com/bid/25123; http://www.vupen.com/english/advisories/2007/2694
CVE: CVE-2007-4056
Published: 2007-07-30
Description: SQL injection vulnerability in directory.php in Prozilla Adult Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. NOTE: the original report indicated that this was the "photo" SourceForge project (aka Maan Bsat Photo Collection), but that was incorrect.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.attrition.org/pipermail/vim/2007-July/001728.html; http://www.securityfocus.com/bid/25135; http://www.vupen.com/english/advisories/2007/2695
CVE: CVE-2007-4057
Published: 2007-07-30
Description: Unrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users to upload arbitrary PHP code via a filename ending with (1) .php.gif, (2) .php.jpg, or (3) .php.png.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/39023; http://www.securityfocus.com/bid/25130; https://exchange.xforce.ibmcloud.com/vulnerabilities/35681
CVE: CVE-2007-4058
Published: 2007-07-30
Description: Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll 2.2.5.42958 in EMC VMware 6.0.0 allows remote attackers to execute arbitrary local programs via a full pathname in the first argument to the StartProcess method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/25118; https://exchange.xforce.ibmcloud.com/vulnerabilities/35673; https://www.exploit-db.com/exploits/4244
CVE: CVE-2007-4059
Published: 2007-07-30
Description: Absolute path traversal vulnerability in a certain ActiveX control in IntraProcessLogging.dll 5.5.3.42958 in EMC VMware allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SetLogFileName method.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://secunia.com/advisories/26890; http://www.securityfocus.com/bid/25110
CVE: CVE-2007-4060
Published: 2007-07-30
Description: Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbitrary code via a long string in the (1) method name or (2) URI in an HTTP request.
CVSS Score: 9.0 (HIGH)
References: http://osvdb.org/46831; http://www.securityfocus.com/bid/25120; https://www.exploit-db.com/exploits/4243
CVE: CVE-2007-4061
Published: 2007-07-30
Description: Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument to the saveNessusRC method, which writes text specified by the addsetConfig method, possibly related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/26243; http://www.nessus.org/news/; http://www.securityfocus.com/bid/25088
CVE: CVE-2007-4062
Published: 2007-07-30
Description: The SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via unspecified vectors involving the deleteNessusRC method, probably a directory traversal vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/26243; http://www.nessus.org/news/; http://www.securityfocus.com/bid/25088
CVE: CVE-2007-4063
Published: 2007-07-30
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable menu items as privileged users, related to improper use of HTTP GET and the Forms API.
CVSS Score: 4.3 (MEDIUM)
References: http://drupal.org/files/sa-2007-017/advisory.txt; http://osvdb.org/37898; http://secunia.com/advisories/26224
CVE: CVE-2007-4064
Published: 2007-07-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHP_SELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/files/sa-2007-018/advisory.txt; http://secunia.com/advisories/26224; http://www.securityfocus.com/bid/25097
CVE: CVE-2007-4067
Published: 2007-07-30
Description: Absolute path traversal vulnerability in the clInetSuiteX6.clWebDav ActiveX control in CLINETSUITEX6.OCX in Clever Internet ActiveX Suite 6.2 allows remote attackers to create or overwrite arbitrary files via a full pathname in the second argument to the GetToFile method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/26213; http://www.attrition.org/pipermail/vim/2007-July/001729.html; http://www.securityfocus.com/bid/25063
CVE: CVE-2007-4068
Published: 2007-07-30
Description: Multiple SQL injection vulnerabilities in Webyapar 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the kat_id parameter to the default URI in a download action or (2) the id parameter to the default URI in a duyurular_detay action.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/37131; http://osvdb.org/37132; http://www.securityfocus.com/bid/25061
CVE: CVE-2007-4069
Published: 2007-07-30
Description: SQL injection vulnerability in show_cat.php in IndexScript 2.8 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36285; http://secunia.com/advisories/26218; http://www.indexscript.com/forum/showthread.php?t=2266
CVE: CVE-2007-4070
Published: 2007-07-30
Description: Unspecified vulnerability in Low Bandwidth X proxy (lbxproxy) on Sun Solaris 8 through 10 before 20070725 allows local users to read arbitrary files with root group ownership via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/26220; http://secunia.com/advisories/26344; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102948-1
CVE: CVE-2007-4071
Published: 2007-07-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in uploader/index.php in Webbler CMS before 3.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) login parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37133; http://securityreason.com/securityalert/2946; http://tincan.co.uk/?lid=1975
CVE: CVE-2007-4072
Published: 2007-07-30
Description: Webbler CMS before 3.1.6 provides the full installation path within HTML comments in certain documents, which allows remote attackers to obtain sensitive information by viewing the HTML source, as demonstrated by viewing the source generated from index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/38995; http://tincan.co.uk/?lid=1975; http://www.procheckup.com/Vulner_2007.php
CVE: CVE-2007-4073
Published: 2007-07-30
Description: Webbler CMS before 3.1.6 does not properly restrict use of "mail a friend" forms, which allows remote attackers to send arbitrary amounts of forged e-mail.  NOTE: this could be leveraged for spam or phishing attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/38994; http://securityreason.com/securityalert/2955; http://tincan.co.uk/?lid=1975
CVE: CVE-2007-4074
Published: 2007-07-30
Description: The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314, a different vulnerability than CVE-2001-0956.  NOTE: this issue is local in some environments, but remote on others.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://bugs.gentoo.org/show_bug.cgi?id=170477; http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html; http://secunia.com/advisories/26229
CVE: CVE-2007-4075
Published: 2007-07-30
Description: Cross-site scripting (XSS) vulnerability in index.asp in Alisveris Sitesi Scripti allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search mod action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37135; http://www.securityfocus.com/bid/25007; http://osvdb.org/37135
CVE: CVE-2007-4076
Published: 2007-07-30
Description: Multiple SQL injection vulnerabilities in index.asp in Alisveris Sitesi Scripti allow remote attackers to execute arbitrary SQL commands via the (1) product_id or (2) cat_id parameter in a product mod action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37136; http://www.securityfocus.com/bid/25005; http://osvdb.org/37136