deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2042
Published: 2007-04-16
Description: Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite 1.0.6 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) support.html.php or (2) info.html.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37430; http://osvdb.org/37431; http://www.vupen.com/english/advisories/2007/1357
CVE: CVE-2007-2043
Published: 2007-04-16
Description: Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia (com_mosmedia) 1.08 and earlier module for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) media.tab.php or (2) media.divs.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37433; http://osvdb.org/37434; http://www.securityfocus.com/bid/23432
CVE: CVE-2007-2044
Published: 2007-04-16
Description: PHP remote file inclusion vulnerability in mod_weather.php in the Antonis Ventouris Weather module for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37435; http://www.vupen.com/english/advisories/2007/1356; https://www.exploit-db.com/exploits/3712
CVE: CVE-2007-2045
Published: 2007-04-16
Description: Unspecified vulnerability in the IP implementation in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (CPU consumption) via crafted IP packets, probably related to fragmented packets with duplicate or missing fragments.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34901; http://secunia.com/advisories/24857; http://secunia.com/advisories/24987
CVE: CVE-2007-2046
Published: 2007-04-16
Description: Multiple CRLF injection vulnerabilities in adclick.php in (a) Openads (phpAdsNew) 2.0.11 and earlier and (b) Openads for PostgreSQL (phpPgAds) 2.0.11 and earlier allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in (1) the dest parameter and (2) the Referer HTTP header.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://forum.openads.org/index.php?showtopic=503413399&pid=39136; http://secunia.com/advisories/24876; http://sourceforge.net/forum/forum.php?forum_id=685278
CVE: CVE-2007-2047
Published: 2007-04-16
Description: CRLF injection vulnerability in www/delivery/ck.php in Openads 2.3 (aka Max Media Manager, MMM) before 0.3.31-alpha-pr3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the destination parameter. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://forum.openads.org/index.php?showtopic=503413399&pid=39136; http://www.vupen.com/english/advisories/2007/1365; http://forum.openads.org/index.php?showtopic=503413399&pid=39136
CVE: CVE-2007-2048
Published: 2007-04-16
Description: Directory traversal vulnerability in /console in the Management Console in webMethods Glue 6.5.1 and earlier allows remote attackers to read arbitrary system files via a .. (dot dot) in the resource parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24933; http://securityreason.com/securityalert/2589; http://www.aushack.com/advisories/200704-webmethods.txt
CVE: CVE-2007-2049
Published: 2007-04-16
Description: Multiple PHP remote file inclusion vulnerabilities in the Calendar Module (com_calendar) 1.5.5 for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to (1) com_calendar.php or (2) mod_calendar.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37583; http://osvdb.org/37584; http://www.securityfocus.com/bid/23435
CVE: CVE-2007-2050
Published: 2007-04-16
Description: Multiple directory traversal vulnerabilities in header.php in RicarGBooK 1.2.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) a lang cookie or (2) the language parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34909; http://secunia.com/advisories/24858; http://www.securityfocus.com/bid/23450
CVE: CVE-2007-2051
Published: 2007-04-16
Description: Buffer overflow in the parsecmd function in bftpd before 1.8 has unknown impact and attack vectors related to the confstr variable.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34890; http://sourceforge.net/project/shownotes.php?release_id=500238&group_id=32077; http://www.vupen.com/english/advisories/2007/1347
CVE: CVE-2007-2052
Published: 2007-04-16
Description: Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-193
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=416934; http://lists.vmware.com/pipermail/security-announce/2008/000005.html; http://secunia.com/advisories/25190
CVE: CVE-2007-1674
Published: 2007-04-18
Description: Stack-based buffer overflow in the Alert Service (aolnsrvr.exe) in LANDesk Management Suite 8.7 allows remote attackers to execute arbitrary code via a crafted packet to port 65535/UDP.
CVSS Score: 10.0 (HIGH)
References: http://kb.landesk.com/display/4n/kb/article.asp?aid=4142; http://osvdb.org/34964; http://secunia.com/advisories/24892
CVE: CVE-2007-1856
Published: 2007-04-18
Description: Vixie Cron before 4.1-r10 on Gentoo Linux is installed with insecure permissions, which allows local users to cause a denial of service (cron failure) by creating hard links, which results in a failed st_nlink check in database.c.
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://rhn.redhat.com/errata/RHSA-2007-0345.html; http://secunia.com/advisories/24905
CVE: CVE-2007-1869
Published: 2007-04-18
Description: lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24886; http://secunia.com/advisories/24947; http://secunia.com/advisories/24995
CVE: CVE-2007-1870
Published: 2007-04-18
Description: lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24886; http://secunia.com/advisories/24947; http://secunia.com/advisories/24995
CVE: CVE-2007-1891
Published: 2007-04-18
Description: Stack-based buffer overflow in the GetPrivateProfileSectionW function in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) after 2.0.4.4 but before 2.2.1.0 allows remote attackers to execute arbitrary code, related to misinterpretation of the nSize parameter as a byte count instead of a wide character count.
CVSS Score: 9.3 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=514; http://secunia.com/advisories/24900; http://www.kb.cert.org/vuls/id/120241
CVE: CVE-2007-1892
Published: 2007-04-18
Description: Stack-based buffer overflow in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) before 2.2.1.0 allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2007-1891.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/24900; http://www.osvdb.org/34324; http://www.securityfocus.com/archive/1/465908/100/0/threaded
CVE: CVE-2007-2057
Published: 2007-04-18
Description: Stack-based buffer overflow in aircrack-ng airodump-ng 0.7 allows remote attackers to execute arbitrary code via crafted 802.11 authentication packets.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34931; http://secunia.com/advisories/24880; http://secunia.com/advisories/24964
CVE: CVE-2007-2058
Published: 2007-04-18
Description: Directory traversal vulnerability in Acubix PicoZip 4.02 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the file path in an (1) GZ, (2) TAR, (3) RAR, (4) JAR, or (5) ZIP archive.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24868; http://www.bugtraq.ir/articles/advisory/picozip_directory_traversal/9; http://www.securityfocus.com/bid/23471
CVE: CVE-2007-2059
Published: 2007-04-18
Description: Multiple buffer overflows in the ESA protocol implementation in eIQnetworks Enterprise Security Analyzer (ESA) 2.5 allow remote attackers to execute arbitrary code via a long parameter to the (1) DELETESEARCHFOLDER, (2) DELTASK, (3) HMGR_CHECKHOSTSCSV, (4) TASKUPDATEDUSER, (5) VERIFYUSERKEY, or (6) VERIFYPWD command.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24881; http://www.infigo.hr/en/in_focus/advisories/INFIGO-2007-04-05; http://www.securityfocus.com/archive/1/465488/100/0/threaded
CVE: CVE-2007-2060
Published: 2007-04-18
Description: Cross-zone scripting vulnerability in the Wizz RSS Reader before 2.1.9 extension to Mozilla Firefox allows remote attackers to execute arbitrary Javascript in the browser chrome via the RSS feed DOM.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34534; http://secunia.com/advisories/24913; http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment/
CVE: CVE-2007-2061
Published: 2007-04-18
Description: Cross-site scripting (XSS) vulnerability in check_login.asp in AfterLogic MailBee WebMail Pro 3.4 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/34974; http://secunia.com/advisories/24882; http://securityreason.com/securityalert/2572
CVE: CVE-2007-2062
Published: 2007-04-18
Description: Stack-based buffer overflow in VCDGear 3.55 and 3.56 BETA allows user-assisted remote attackers to execute arbitrary code via a long FILE argument in a CUE file.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/24884; http://www.securityfocus.com/archive/1/465725/100/0/threaded; http://www.securityfocus.com/bid/23475
CVE: CVE-2007-2063
Published: 2007-04-18
Description: SSH Tectia Server for IBM z/OS before 5.4.0 uses insecure world-writable permissions for (1) the server pid file, which allows local users to cause arbitrary processes to be stopped, or (2) when _BPX_BATCH_UMASK is missing from the environment, creates HFS files with insecure permissions, which allows local users to read or modify these files and have other unknown impact.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/34998; http://secunia.com/advisories/24916; http://securitytracker.com/id?1017913
CVE: CVE-2007-2064
Published: 2007-04-18
Description: Multiple PHP remote file inclusion vulnerabilities in Robert Ladstaetter ActionPoll 1.1.0, and possibly 1.1.1, allow remote attackers to execute arbitrary PHP code via a URL in (1) the CONFIG_POLLDB parameter to actionpoll.php or (2) the CONFIG_DB parameter to db/DataReaderWriter.php, different vectors than CVE-2001-1297.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2587; http://www.securityfocus.com/archive/1/465871/100/0/threaded; http://www.securityfocus.com/bid/20788
CVE: CVE-2007-2065
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in db/PollDB.php in Robert Ladstaetter ActionPoll 1.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG_DATAREADERWRITER parameter, a different vector than CVE-2001-1297.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20788; http://www.securityfocus.com/bid/20788
CVE: CVE-2007-2066
Published: 2007-04-18
Description: UseBB before 1.0.6 allows remote attackers to obtain sensitive information via a request with unspecified GET or POST parameters to an unspecified script, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24837; http://www.netvigilance.com/advisory0016; http://www.usebb.net/community/topic.php?id=1541
CVE: CVE-2007-2067
Published: 2007-04-18
Description: Multiple PHP remote file inclusion vulnerabilities in Marco Antonio Islas Cruz Web Slider (WebSlider) 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) index.php, (2) modules/pdf.php, (3) plugins/highlight.php, or (4) include/modules.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37436; http://osvdb.org/37437; http://osvdb.org/37438
CVE: CVE-2007-2068
Published: 2007-04-18
Description: Multiple PHP remote file inclusion vulnerabilities in the StoreFront mods for Gallery allow remote attackers to execute arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter to (1) mods/business_functions.php or (2) mods/ui_functions.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34969; http://osvdb.org/34970; http://secunia.com/advisories/24890
CVE: CVE-2007-2069
Published: 2007-04-18
Description: Directory traversal vulnerability in scr/soustab.php in openMairie 1.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the dsn[phptype] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37416; http://www.securityfocus.com/bid/23505; http://www.vupen.com/english/advisories/2007/1421
CVE: CVE-2007-2070
Published: 2007-04-18
Description: Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools SunShop Shopping Cart before 3.5.1 allow remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter to (1) index.php or (2) checkout.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/37414; http://osvdb.org/37415; http://www.securityfocus.com/bid/23511
CVE: CVE-2007-2071
Published: 2007-04-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open-gorotto 2.0a 2006/02/08 edition, 2006/03/19 edition, and 2006/04/07 edition before 20070416 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) pub/modules/d/_top.html; (2) /pub/modules/a/_access.html; (3) _circletop.html or (4) _cir66.html in pub/modules/ci/; or (5) _fri66.html, (6) _inv66.html, (7) _top.html, (8) _friends.html, or (9) _fri33.html in pub/modules/f/.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/37593; http://osvdb.org/37594
CVE: CVE-2007-2072
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in index.php in Ivan Gallery Script 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter.  NOTE: this issue has been disputed by third party researchers for 0.3, stating that the dir variable is properly initialized before use
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-April/001534.html; http://osvdb.org/35395; http://securityreason.com/securityalert/2580
CVE: CVE-2007-2073
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in index.php in Ivan Gallery Script 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the gallery parameter in a new session.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-April/001534.html; http://osvdb.org/35396; http://attrition.org/pipermail/vim/2007-April/001534.html
CVE: CVE-2007-2074
Published: 2007-04-18
Description: Certain programs in containers in ScramDisk 4 Linux before 1.0-1 execute with SUID permissions, which allows local users to gain privileges via mounted containers.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/34965; http://secunia.com/advisories/24903; http://sourceforge.net/tracker/index.php?func=detail&aid=1696777&group_id=101952&atid=630783
CVE: CVE-2007-2075
Published: 2007-04-18
Description: ScramDisk 4 Linux before 1.0-1 does not perform permission checks on mount points, which allows local users to gain privileges by using a system directory as a mount point for a container.
CVSS Score: 6.9 (MEDIUM)
References: http://osvdb.org/34966; http://secunia.com/advisories/24903; http://sourceforge.net/tracker/index.php?func=detail&aid=1696780&group_id=101952&atid=630783
CVE: CVE-2007-2076
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in index.php in Maian Gallery 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this problem existed only briefly in v1.0."
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html; http://attrition.org/pipermail/vim/2007-April/001530.html; http://www.osvdb.org/34149
CVE: CVE-2007-2077
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this issue was fixed last year and [no] is longer a problem."
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html; http://attrition.org/pipermail/vim/2007-April/001524.html; http://www.osvdb.org/34150
CVE: CVE-2007-2078
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in index.php in Maian Weblog 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, since the path_to_folder variable is initialized before use
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html; http://attrition.org/pipermail/vim/2007-April/001527.html; http://osvdb.org/35360
CVE: CVE-2007-2079
Published: 2007-04-18
Description: The ADONewConnection Connect function in adodb.php in XAMPP 1.6.0a and earlier for Windows uses untrusted input for the database server hostname, which allows remote attackers to trigger a library buffer overflow and execute arbitrary code via a long host parameter, or have other unspecified impact.  NOTE: it could be argued that this is an issue in mssql_connect (CVE-2007-1411.1) in PHP, or an issue in the ADOdb Library, and the proper fix should be in one of these products; if so, then this should not be treated as a vulnerability in XAMPP.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/41594; http://www.securityfocus.com/bid/23491; https://exchange.xforce.ibmcloud.com/vulnerabilities/33683
CVE: CVE-2007-2080
Published: 2007-04-18
Description: Multiple SQL injection vulnerabilities in XAMPP 1.6.0a for Windows allow remote attackers to execute arbitrary SQL commands via unspecified vectors in certain test scripts.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37440; https://www.exploit-db.com/exploits/3738; http://osvdb.org/37440
CVE: CVE-2007-2081
Published: 2007-04-18
Description: MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demonstrated by admin/settings.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/41593; http://securityreason.com/securityalert/2581; http://www.securityfocus.com/archive/1/465873/100/0/threaded
CVE: CVE-2007-2082
Published: 2007-04-18
Description: Direct static code injection vulnerability in admin/settings.php in MyBlog 0.9.8 and earlier allows remote authenticated admin users to inject arbitrary PHP code via the content parameter, which can be executed by accessing index.php.  NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/35392; http://securityreason.com/securityalert/2581; http://www.securityfocus.com/archive/1/465873/100/0/threaded
CVE: CVE-2007-2083
Published: 2007-04-18
Description: vsdatant.sys in Check Point Zone Labs ZoneAlarm Pro before 7.0.302.000 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service (system crash) or possibly execute arbitrary code via crafted arguments to the (1) NtCreateKey and (2) NtDeleteFile functions.
CVSS Score: 6.9 (MEDIUM)
References: http://osvdb.org/35239; http://securityreason.com/securityalert/2591; http://www.matousec.com/info/advisories/ZoneAlarm-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php
CVE: CVE-2006-7194
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php in Agora 1.4 RC1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the _SESSION[PATH_COMPOSANT] parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://advisories.echo.or.id/adv/adv59-theday-2006.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4075&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/30031
CVE: CVE-2007-2084
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in MobilePublisherphp 1.1.2 allows remote attackers to execute arbitrary PHP code via a URL in the auth_method parameter to (1) index.php, (2) list.php, (3) postreview.php, (4) reindex.php, (5) sections.php, (6) templates.php, (7) userinfo.php, (8) users.php, and (9) view.php in admin/.  NOTE: this issue has been disputed by a reliable third party, who states that $auth_method is defined before use
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://attrition.org/pipermail/vim/2007-April/001523.html; http://securityreason.com/securityalert/2583; http://www.osvdb.org/35325
CVE: CVE-2007-2085
Published: 2007-04-18
Description: Cross-site scripting (XSS) vulnerability in oe2edit.cgi in oe2edit CMS allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34972; http://secunia.com/advisories/24919; http://www.majorsecurity.de/index_2.php?major_rls=major_rls45
CVE: CVE-2007-2086
Published: 2007-04-18
Description: Multiple PHP remote file inclusion vulnerabilities in CNStats 2.9 allow remote attackers to execute arbitrary PHP code via a URL in the bj parameter to (1) who_r.php or (2) who_s.php in reports/.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24902; http://www.securityfocus.com/bid/23501; https://exchange.xforce.ibmcloud.com/vulnerabilities/33672
CVE: CVE-2007-2087
Published: 2007-04-18
Description: Multiple PHP remote file inclusion vulnerabilities in CNStats 2.12, when register_globals is enabled and .htaccess is not recognized, allow remote attackers to execute arbitrary PHP code via a URL in the bn parameter to (1) who_r.php or (2) who_s.php in reports/.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24902; https://exchange.xforce.ibmcloud.com/vulnerabilities/33977; http://secunia.com/advisories/24902
CVE: CVE-2007-2088
Published: 2007-04-18
Description: Multiple PHP remote file inclusion vulnerabilities in Sitebar 3.3.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) writerFile parameter to index.php and the (2) file parameter to Integrator.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35393; http://osvdb.org/35394; http://securityreason.com/securityalert/2586