deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1547
Published: 2007-03-20
Description: The ReadRequestFromClient function in server/os/io.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) via multiple simultaneous connections, which triggers a NULL pointer dereference.
CVSS Score: 7.8 (HIGH)
References: http://aluigi.altervista.org/adv/nasbugs-adv.txt; http://secunia.com/advisories/24527; http://secunia.com/advisories/24601
CVE: CVE-2007-1548
Published: 2007-03-20
Description: SQL injection vulnerability in functions/functions_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not properly filter certain characters in SQL commands, which allows remote attackers to execute arbitrary SQL commands via \"' (backslash double-quote quote) sequences, which are collapsed into \'', as demonstrated via the name parameter to forum/pop_up_member_search.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://ifsec.blogspot.com/2007/03/web-wiz-forums-805-mysql-version-sql.html; http://osvdb.org/34344; http://secunia.com/advisories/24561
CVE: CVE-2007-1549
Published: 2007-03-20
Description: Unrestricted file upload vulnerability in gallery.php in phpx 3.5.15 allows remote attackers to upload and execute arbitrary PHP scripts via an addImage action, which places scripts into the gallery/shelties/ directory.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2457; http://www.securityfocus.com/archive/1/463192/100/0/threaded; http://www.securityfocus.com/bid/23033
CVE: CVE-2007-1550
Published: 2007-03-20
Description: Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the (1) image_id or (2) cat_id parameter to (a) gallery.php; the (3) news_id parameter to (b) news.php or (c) print.php; (4) the news_cat_id parameter to news.php; the (5) cat_id, (6) topic_id, or (7) post_id parameter to (d) forums.php; or (8) the user_id parameter to (e) users.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34414; http://osvdb.org/34415; http://osvdb.org/34416
CVE: CVE-2007-1551
Published: 2007-03-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpx 3.5.15 allow remote attackers to inject arbitrary web script or HTML via (1) the signature in "dans profile," or (2) search.php.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/34412; http://osvdb.org/34413; http://secunia.com/advisories/24565
CVE: CVE-2007-1552
Published: 2007-03-20
Description: Unrestricted file upload vulnerability in usercp.php in MetaForum 0.513 Beta restricts file types based on the MIME type in the Content-type HTTP header, which allows remote attackers to upload and execute arbitrary scripts via an image MIME type with a filename containing an executable extension such as .php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34523; http://securityreason.com/securityalert/2454; http://www.aeroxteam.fr/exploit-MetaForum-0.513b.txt
CVE: CVE-2007-1553
Published: 2007-03-20
Description: admin/configuration.php in Guestbara 1.2 and earlier allows remote attackers to modify the e-mail, name, and password of the admin account by setting the zapis parameter to "ok" and providing modified admin_mail, login, and pass parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34519; https://www.exploit-db.com/exploits/3506; http://osvdb.org/34519
CVE: CVE-2007-1554
Published: 2007-03-20
Description: Direct static code injection vulnerability in admin/configuration.php in Guestbara 1.2 and earlier allows remote authenticated users to inject arbitrary PHP code into config.php via the (1) admin_mail, (2) emotpatch, (3) login, (4) pass, and unspecified other parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.osvdb.org/33783; http://www.vupen.com/english/advisories/2007/1010; http://www.osvdb.org/33783
CVE: CVE-2007-1555
Published: 2007-03-20
Description: SQL injection vulnerability in forum.php in the Minerva mod 2.0.21 build 238a and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the c parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/33748; http://www.securityfocus.com/bid/23036; http://www.vupen.com/english/advisories/2007/1028
CVE: CVE-2007-1556
Published: 2007-03-21
Description: SQL injection vulnerability in kommentare.php in Creative Files 1.2 allows remote attackers to execute arbitrary SQL commands via the dlid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33747; http://www.securityfocus.com/bid/23000; https://exchange.xforce.ibmcloud.com/vulnerabilities/33021
CVE: CVE-2007-1557
Published: 2007-03-21
Description: Format string vulnerability in F-Secure Anti-Virus Client Security 6.02 allows local users to cause a denial of service and possibly gain privileges via format string specifiers in the Management Server name field on the Communication settings page.
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/34764; http://securityreason.com/securityalert/2472; http://www.layereddefense.com/F-SecureMar18.html
CVE: CVE-2007-1560
Published: 2007-03-21
Description: The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12 allows remote attackers to cause a denial of service (daemon crash) via crafted TRACE requests that trigger an assertion error.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24611; http://secunia.com/advisories/24614; http://secunia.com/advisories/24625
CVE: CVE-2007-0238
Published: 2007-03-21
Description: Stack-based buffer overflow in filter\starcalc\scflt.cxx in the StarCalc parser in OpenOffice.org (OOo) Office Suite before 2.2, and 1.x before 1.1.5 Patch, allows user-assisted remote attackers to execute arbitrary code via a document with a long Note.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.suse.com/archive/suse-security-announce/2007-Mar/0007.html; http://secunia.com/advisories/24465; http://secunia.com/advisories/24550
CVE: CVE-2007-0239
Published: 2007-03-21
Description: OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted document.
CVSS Score: 9.3 (HIGH)
References: http://lists.suse.com/archive/suse-security-announce/2007-Mar/0007.html; http://secunia.com/advisories/24465; http://secunia.com/advisories/24550
CVE: CVE-2007-0348
Published: 2007-03-21
Description: Stack-based buffer overflow in the IASystemInfo.dll ActiveX control in (1) InterActual Player 2.60.12.0717, (2) Roxio CinePlayer 3.2, (3) WinDVD 7.0.27.172, and possibly other products, allows remote attackers to execute arbitrary code via a long ApplicationType property.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/34314; http://osvdb.org/34315; http://secunia.com/advisories/23032
CVE: CVE-2007-0606
Published: 2007-03-21
Description: w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the (1) bn[] array parameter to index.php, which expects a string, and (2) certain parameters to delete_forum.php, which displays the path name in the resulting error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/2461; http://www.netvigilance.com/advisory0014; http://www.osvdb.org/31668
CVE: CVE-2007-1313
Published: 2007-03-21
Description: NETxAutomation NETxEIB OPC Server before 3.0.1300 does not properly validate OLE for Process Control (OPC) server handles, which allows attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors involving the (1) IOPCSyncIO::Read, (2) IOPCSyncIO::Write, (3) IOPCServer::AddGroup, (4) IOPCServer::RemoveGroup, (5) IOPCCommon::SetClientName, and (6) IOPCGroupStateMgt::CloneGroup functions, which allow access to arbitrary memory. NOTE: the vectors might be limited to attackers with physical access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/34440; http://secunia.com/advisories/24612; http://www.kb.cert.org/vuls/id/296593
CVE: CVE-2007-1463
Published: 2007-03-21
Description: Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24584; http://secunia.com/advisories/24597; http://secunia.com/advisories/24615
CVE: CVE-2007-1464
Published: 2007-03-21
Description: Format string vulnerability in the whiteboard Jabber protocol in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24615; http://secunia.com/advisories/24661; http://secunia.com/advisories/24859
CVE: CVE-2007-1561
Published: 2007-03-21
Description: The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
CVSS Score: 7.8 (HIGH)
References: http://asterisk.org/node/48339; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1737&w=2; http://secunia.com/advisories/24564
CVE: CVE-2007-1562
Published: 2007-03-21
Description: The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdf; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://secunia.com/advisories/25476
CVE: CVE-2007-1563
Published: 2007-03-21
Description: The FTP protocol implementation in Opera 9.10 allows remote attackers to allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdf; http://secunia.com/advisories/25027; http://www.novell.com/linux/security/advisories/2007_28_opera.html
CVE: CVE-2007-1564
Published: 2007-03-21
Description: The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdf; http://secunia.com/advisories/24889; http://secunia.com/advisories/27108
CVE: CVE-2007-1565
Published: 2007-03-21
Description: Konqueror 3.5.5 allows remote attackers to cause a denial of service (crash) by using JavaScript to read a child iframe having an ftp:// URI.
CVSS Score: 7.8 (HIGH)
References: http://bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdf; http://bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdf
CVE: CVE-2007-1566
Published: 2007-03-21
Description: SQL injection vulnerability in News/page.asp in NetVIOS Portal allows remote attackers to execute arbitrary SQL commands via the NewsID parameter.  NOTE: this issue might be the same as CVE-2006-5954.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/23045; https://exchange.xforce.ibmcloud.com/vulnerabilities/33072; https://www.exploit-db.com/exploits/3520
CVE: CVE-2006-7174
Published: 2007-03-21
Description: PHP remote file inclusion vulnerability in includes/functions.php in the Dimension module of phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.  NOTE: this may be the same issue as CVE-2006-5235.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/2464; http://www.securityfocus.com/archive/1/452012/100/200/threaded; http://www.securityfocus.com/archive/1/452100/100/200/threaded
CVE: CVE-2007-1567
Published: 2007-03-21
Description: Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors, as demonstrated by warftp_165.tar by Immunity.  NOTE: this might be the same issue as CVE-1999-0256, CVE-2000-0131, or CVE-2006-2171, but due to Immunity's lack of details, this cannot be certain.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24494; http://www.securityfocus.com/bid/22944; http://www.vupen.com/english/advisories/2007/0933
CVE: CVE-2007-1568
Published: 2007-03-21
Description: Stack-based buffer overflow in DaanSystems NewsReactor 20070220.21 allows remote attackers to execute arbitrary code via a yEnc (yEncode) encoded article with a long filename.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34035; http://secunia.com/advisories/24487; http://www.vupen.com/english/advisories/2007/0934
CVE: CVE-2007-1569
Published: 2007-03-21
Description: Stack-based buffer overflow in NewsBin Pro 4.32 allows remote attackers to cause a denial of service or execute arbitrary code via a yEnc (yEncode) encoded article with a long filename, as demonstrated using a .nzb file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34003; http://secunia.com/advisories/24491; http://www.securityfocus.com/bid/22940
CVE: CVE-2007-1570
Published: 2007-03-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-1438.  Reason: This candidate is a duplicate of CVE-2007-1438.  Notes: All CVE users should reference CVE-2007-1438 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-1571
Published: 2007-03-21
Description: PHP remote file inclusion vulnerability in includes/base.php in Radical Designs Activist Mobilization Platform (AMP) 3.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://advisories.echo.or.id/adv/adv71-theday-2007.txt; http://www.securityfocus.com/archive/1/462805/100/100/threaded; http://www.vupen.com/english/advisories/2007/0939
CVE: CVE-2007-1572
Published: 2007-03-21
Description: SQL injection vulnerability in search.asp in JGBBS 3.0 Beta 1 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter, a different vector than CVE-2007-1440.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.vupen.com/english/advisories/2007/0940; http://www.vupen.com/english/advisories/2007/0940
CVE: CVE-2007-1573
Published: 2007-03-21
Description: SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/34070; http://secunia.com/advisories/24503; http://www.securityfocus.com/archive/1/462963/100/0/threaded
CVE: CVE-2007-1574
Published: 2007-03-21
Description: CARE2X 2.2, and possibly earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34044; http://secunia.com/advisories/24481; http://osvdb.org/34044
CVE: CVE-2007-1575
Published: 2007-03-21
Description: Multiple SQL injection vulnerabilities in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via (1) unspecified vectors to the (a) calendar and (2) search modules, and an (2) unspecified cookie when the user logs out.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24509; http://secunia.com/advisories/25748; http://security.gentoo.org/glsa/glsa-200706-07.xml
CVE: CVE-2007-1576
Published: 2007-03-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the (1) Projects, (2) Contacts, (3) Helpdesk, (4) Search (only Gecko engine driven Browsers), and (5) Notes modules; the (6) Mail summary page; and unspecified other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/34064; http://osvdb.org/34065; http://osvdb.org/34066
CVE: CVE-2007-0653
Published: 2007-03-21
Description: Integer overflow in X MultiMedia System (xmms) 1.2.10, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via crafted header information in a skin bitmap image, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/23986; http://secunia.com/advisories/24645; http://secunia.com/advisories/24804
CVE: CVE-2007-0654
Published: 2007-03-21
Description: Integer underflow in X MultiMedia System (xmms) 1.2.10 allows user-assisted remote attackers to execute arbitrary code via crafted header information in a skin bitmap image, which results in a stack-based buffer overflow.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/23986; http://secunia.com/advisories/24645; http://secunia.com/advisories/24804
CVE: CVE-2007-1002
Published: 2007-03-21
Description: Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier versions, allows user-assisted remote attackers to execute arbitrary code via format specifiers in the categories of a crafted shared memo.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24234; http://secunia.com/advisories/24651; http://secunia.com/advisories/24668
CVE: CVE-2007-1577
Published: 2007-03-21
Description: Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[tplname] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/33776; http://www.securityfocus.com/bid/23052; https://exchange.xforce.ibmcloud.com/vulnerabilities/33089
CVE: CVE-2007-1578
Published: 2007-03-21
Description: Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD (mcrimap4.exe) 5.00.14, with SP4, allow remote attackers to execute arbitrary code via a long NTLMSSP argument that triggers a stack-based buffer overflow.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0280.html; http://secunia.com/advisories/24596; http://securitytracker.com/id?1017798
CVE: CVE-2007-1579
Published: 2007-03-21
Description: Stack-based buffer overflow in Atrium MERCUR IMAPD allows remote attackers to have an unknown impact via a certain SUBSCRIBE command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/24619; http://www.immunitysec.com/partners-index.shtml; http://www.osvdb.org/33546
CVE: CVE-2007-1580
Published: 2007-03-21
Description: FTPDMIN 0.96 allows remote attackers to cause a denial of service (daemon crash) via a LIST command for a Windows drive letter, as demonstrated using "//A:".  NOTE: this has been reported as a buffer overflow by some sources, but there is not a long argument.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/34524; http://www.securityfocus.com/bid/23049; https://exchange.xforce.ibmcloud.com/vulnerabilities/33091
CVE: CVE-2007-1581
Published: 2007-03-21
Description: The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hash_update_file function via a userspace (1) error or (2) stream handler, which can then be used to destroy and modify internal resources.  NOTE: it was later reported that PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 are also affected.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://php-security.org/2010/05/01/mops-2010-001-php-hash_update_file-already-freed-resource-access-vulnerability/index.html; http://secunia.com/advisories/24542; http://www.php-security.org/MOPB/MOPB-28-2007.html
CVE: CVE-2007-1582
Published: 2007-03-21
Description: The resource system in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting certain functions in the GD (ext/gd) extension and unspecified other extensions via a userspace error handler, which can be used to destroy and modify internal resources.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24542; http://www.php-security.org/MOPB/MOPB-27-2007.html; http://www.securityfocus.com/bid/23046
CVE: CVE-2007-1583
Published: 2007-03-21
Description: The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with register_globals functionality that is not detectable by these scripts, as demonstrated by forcing a memory_limit violation.
CVSS Score: 6.8 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=306172; http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html; http://rhn.redhat.com/errata/RHSA-2007-0155.html
CVE: CVE-2007-1584
Published: 2007-03-21
Description: Buffer underflow in the header function in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by passing an all-whitespace string to this function, which causes it to write '\0' characters in whitespace that precedes the string.
CVSS Score: 6.8 (MEDIUM)
References: http://www.php-security.org/MOPB/MOPB-25-2007.html; https://www.exploit-db.com/exploits/3517; http://www.php-security.org/MOPB/MOPB-25-2007.html
CVE: CVE-2007-1585
Published: 2007-03-21
Description: The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3388&w=2; http://secunia.com/advisories/24658; http://www.securityfocus.com/archive/1/463342/100/0/threaded
CVE: CVE-2007-1586
Published: 2007-03-21
Description: ZynOS 3.40 allows remote attackers to cause a denial of service (link restart) by sending a request for the name \M via the SMB Mail Slot Protocol.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/34522; http://securitytracker.com/id?1017795; http://www.securityfocus.com/archive/1/463238/100/0/threaded
CVE: CVE-2007-1587
Published: 2007-03-21
Description: templates/config/mail.tpl in Tim Soderstrom StatsDawg 0.92 allows remote attackers to execute arbitrary programs by specifying the program name in the qshapeLocation parameter.
CVSS Score: 10.0 (HIGH)
References: http://www.statsdawg.org/; https://exchange.xforce.ibmcloud.com/vulnerabilities/33283; http://www.statsdawg.org/
CVE: CVE-2007-1588
Published: 2007-03-21
Description: server.cpp in MyServer 0.8.5 calls Process::setuid before calling Process::setgid and thus does not properly drop privileges, which might allow remote attackers to execute CGI programs with unintended privileges.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34521; http://sourceforge.net/mailarchive/forum.php?thread_id=31631045&forum_id=47875; http://www.myserverproject.net/news.php