deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1907
Published: 2007-04-10
Description: PHP remote file inclusion vulnerability in warn.php in Pathos Content Management System (CMS) 0.92-2 allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37394; http://www.securityfocus.com/bid/23393; http://www.vupen.com/english/advisories/2007/1321
CVE: CVE-2007-1908
Published: 2007-04-10
Description: PHP file inclusion vulnerability in php121db.php in PHP121 Instant Messenger 2.2 allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the php121dir parameter, which is accessed by the file_exists function.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34720; http://secunia.com/advisories/24818; http://www.securityfocus.com/bid/23392
CVE: CVE-2007-1909
Published: 2007-04-10
Description: SQL injection vulnerability in login.php in Ryan Haudenschilt Battle.net Clan Script for PHP 1.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) user or (2) pass parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34747; http://secunia.com/advisories/24838; http://www.securityfocus.com/bid/23383
CVE: CVE-2007-1910
Published: 2007-04-10
Description: Buffer overflow in wwlib.dll in Microsoft Word 2007 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted document, as demonstrated by file789-1.doc.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/23380; http://www.securitytracker.com/id?1017902; https://www.exploit-db.com/exploits/3690
CVE: CVE-2007-1911
Published: 2007-04-10
Description: Multiple unspecified vulnerabilities in Microsoft Word 2007 allow remote attackers to cause a denial of service (CPU consumption) via crafted documents, as demonstrated by (1) file798-1.doc and (2) file613-1.doc, possibly related to a buffer overflow.
CVSS Score: 7.1 (HIGH)
References: https://www.exploit-db.com/exploits/3690; https://www.exploit-db.com/exploits/3690
CVE: CVE-2007-1912
Published: 2007-04-10
Description: Heap-based buffer overflow in Microsoft Windows allows user-assisted remote attackers to have an unknown impact via a crafted .HLP file.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/23382; http://www.securitytracker.com/id?1017901; https://www.exploit-db.com/exploits/3693
CVE: CVE-2007-1913
Published: 2007-04-10
Description: The TRUSTED_SYSTEM_SECURITY function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to verify the existence of users and groups on systems and domains via unspecified vectors, a different vulnerability than CVE-2006-6010.  NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24722; http://securityreason.com/securityalert/2535; http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_TRUSTED_SYSTEM_SECURITY_RFC_Function_Information_Disclosure.pdf
CVE: CVE-2007-1914
Published: 2007-04-10
Description: The RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to obtain sensitive information (external RFC server configuration data) via unspecified vectors, a different vulnerability than CVE-2006-6010.  NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24722; http://securityreason.com/securityalert/2538; http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_RFC_START_PROGRAM_RFC_Function_Multiple_Vulnerabilities.pdf
CVE: CVE-2007-1915
Published: 2007-04-10
Description: Buffer overflow in the RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24722; http://securityreason.com/securityalert/2538; http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_RFC_START_PROGRAM_RFC_Function_Multiple_Vulnerabilities.pdf
CVE: CVE-2007-1916
Published: 2007-04-10
Description: Buffer overflow in the RFC_START_GUI function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24722; http://securityreason.com/securityalert/2537; http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_RFC_START_GUI_RFC_Function_Buffer_Overflow.pdf
CVE: CVE-2007-1917
Published: 2007-04-10
Description: Buffer overflow in the SYSTEM_CREATE_INSTANCE function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24722; http://securityreason.com/securityalert/2536; http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_SYSTEM_CREATE_INSTANCE_RFC_Function_Buffer_Overflow.pdf
CVE: CVE-2007-1918
Published: 2007-04-10
Description: The RFC_SET_REG_SERVER_PROPERTY function in the SAP RFC Library 6.40 and 7.00 before 20070109 implements an option for exclusive access to an RFC server, which allows remote attackers to cause a denial of service (client lockout) via unspecified vectors.  NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24722; http://securityreason.com/securityalert/2540; http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_RFC_SET_REG_SERVER_PROPERTY_RFC_Function_Denial_of_Service.pdf
CVE: CVE-2007-1919
Published: 2007-04-10
Description: Cross-site scripting (XSS) vulnerability in index.php in Arizona Dream Livre d'or (livor) 2.5 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35280; http://www.securityfocus.com/archive/1/464888/100/0/threaded; http://www.securityfocus.com/bid/23353
CVE: CVE-2007-1920
Published: 2007-04-10
Description: SQL injection vulnerability in index.php in the aktualnosci module in SmodBIP 1.06 and earlier allows remote attackers to execute arbitrary SQL commands via the zoom parameter, possibly related to home.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/34745; http://secunia.com/advisories/24802; http://www.securityfocus.com/bid/23356
CVE: CVE-2007-1921
Published: 2007-04-10
Description: LIBSNDFILE.DLL, as used by AOL Nullsoft Winamp 5.33 and possibly other products, allows remote attackers to execute arbitrary code via a crafted .MAT file that contains a value that is used as an offset, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
References: http://marc.info/?l=dailydave&m=[PII_REDACTED]2659&w=2; http://osvdb.org/34432; http://secunia.com/advisories/24766
CVE: CVE-2007-1922
Published: 2007-04-10
Description: The Impulse Tracker (IT) and ScreamTracker 3 (S3M) modules in IN_MOD.DLL in AOL Nullsoft Winamp 5.33 allows remote attackers to execute arbitrary code via a crafted (1) .IT or (2) .S3M file containing integer values that are used as memory offsets, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://marc.info/?l=dailydave&m=[PII_REDACTED]0906&w=2; http://marc.info/?l=dailydave&m=[PII_REDACTED]1511&w=2; http://osvdb.org/34430
CVE: CVE-2007-1923
Published: 2007-04-10
Description: (1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38217; http://osvdb.org/38218; http://securityreason.com/securityalert/2552
CVE: CVE-2007-1924
Published: 2007-04-10
Description: Multiple PHP remote file inclusion vulnerabilities in phpContact allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) contact_business.php or (2) contact_person.php.  NOTE: this issue is disputed by CVE and a reliable third party, because include_path is initialized to a fixed value before use
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2528; http://www.attrition.org/pipermail/vim/2007-April/001495.html; http://www.securityfocus.com/archive/1/464877/100/0/threaded
CVE: CVE-2007-1925
Published: 2007-04-10
Description: The borrado function in modules/Your_Account/index.php in Tru-Zone Nuke ET 3.4 before fix 7 does not verify that account deletion requests come from the account owner, which allows remote authenticated users to delete arbitrary accounts via a modified cookie.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/34665; http://secunia.com/advisories/24800; http://truzone.org/modules.php?name=Forums&file=viewtopic&p=287012
CVE: CVE-2007-1926
Published: 2007-04-10
Description: Cross-site scripting (XSS) vulnerability in JBMC Software DirectAdmin before 1.293 does not properly display log files, which allows remote authenticated users to inject arbitrary web script or HTML via (1) http or (2) ftp requests logged in /var/log/directadmin/security.log; (3) allows context-dependent attackers to inject arbitrary web script or HTML into /var/log/messages via a PHP script that invokes /usr/bin/logger; (4) allows local users to inject arbitrary web script or HTML into /var/log/messages by invoking /usr/bin/logger at the command line; and allows remote attackers to inject arbitrary web script or HTML via remote requests logged in the (5) /var/log/exim/rejectlog, (6) /var/log/exim/mainlog, (7) /var/log/proftpd/auth.log, (8) /var/log/httpd/error_log, (9) /var/log/httpd/access_log, (10) /var/log/directadmin/error.log, and (11) /var/log/directadmin/security.log files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/24728; http://securityreason.com/securityalert/2534; http://www.directadmin.com/features.php?id=760
CVE: CVE-2007-1927
Published: 2007-04-10
Description: Cross-site scripting (XSS) vulnerability in signup.asp in CmailServer WebMail 5.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the POP3Mail parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/34119; http://secunia.com/advisories/24812; http://securityreason.com/securityalert/2529
CVE: CVE-2007-1928
Published: 2007-04-10
Description: Directory traversal vulnerability in index.php in witshare 0.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the menu parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24813; http://securityreason.com/securityalert/2539; http://www.securityfocus.com/archive/1/464969/100/0/threaded
CVE: CVE-2007-1929
Published: 2007-04-10
Description: Directory traversal vulnerability in downloadpic.php in Beryo 2.0, and possibly other versions including 2.4, allows remote attackers to read arbitrary files via a .. (dot dot) in the chemin parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34778; http://secunia.com/advisories/24811; http://www.securityfocus.com/bid/23387
CVE: CVE-2007-1930
Published: 2007-04-10
Description: Directory traversal vulnerability in download2.php in cattaDoc 2.21, and possibly other versions including 3.0, allows remote attackers to read arbitrary files via a .. (dot dot) in the fn1 parameter.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/34736; http://secunia.com/advisories/24807; http://www.securityfocus.com/bid/23390
CVE: CVE-2007-1931
Published: 2007-04-10
Description: SQL injection vulnerability in index.php in the slownik module in SmodCMS 2.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ssid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37395; http://www.vupen.com/english/advisories/2007/1299; https://exchange.xforce.ibmcloud.com/vulnerabilities/33477
CVE: CVE-2007-1932
Published: 2007-04-10
Description: Directory traversal vulnerability in scarnews.inc.php in ScarNews 1.2.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sn_admin_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24796; http://www.securityfocus.com/bid/23375; http://www.vupen.com/english/advisories/2007/1304
CVE: CVE-2007-1933
Published: 2007-04-10
Description: Multiple directory traversal vulnerabilities in PcP-Guestbook (PcP-Book) 3.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to (1) index.php, (2) gb.php, or (3) faq.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38459; http://osvdb.org/38460; http://osvdb.org/38461
CVE: CVE-2007-1934
Published: 2007-04-10
Description: Directory traversal vulnerability in member.php in the eBoard 1.0.7 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[name] parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34806; http://secunia.com/advisories/24806; http://www.securityfocus.com/bid/23365
CVE: CVE-2007-1935
Published: 2007-04-10
Description: PHP file inclusion vulnerability in admin/index.php in ScarAdControl (ScarAdController) 1.1 allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the site parameter, which is accessed by the file_exists function.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37403; https://www.exploit-db.com/exploits/3682; http://osvdb.org/37403
CVE: CVE-2007-1936
Published: 2007-04-10
Description: PHP remote file inclusion vulnerability in scaradcontrol.php in ScarAdControl (ScarAdController) 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the sac_config_dir parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37547; https://www.exploit-db.com/exploits/3682; http://osvdb.org/37547
CVE: CVE-2007-1937
Published: 2007-04-10
Description: PHP remote file inclusion vulnerability in smilies.php in Scorp Book 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the config parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34754; http://secunia.com/advisories/24809; http://www.securityfocus.com/archive/1/465079/100/0/threaded
CVE: CVE-2007-1938
Published: 2007-04-10
Description: Ichitaro 2005 through 2007, and possibly related products, allows remote attackers to have an unknown impact via unspecified vectors in a document distributed through e-mail or a web site, possibly due to a buffer overflow or cross-site scripting (XSS).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-119
References: http://osvdb.org/34759; http://secunia.com/advisories/24780; http://vil.mcafeesecurity.com/vil/content/v_141950.htm
CVE: CVE-2007-1939
Published: 2007-04-10
Description: Cross-site scripting (XSS) vulnerability in the embedded webserver in Daniel Naber LanguageTool before 0.8.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message, possibly the demultiplex method in HTTPServer.java.
CVSS Score: 6.8 (MEDIUM)
References: http://www.danielnaber.de/languagetool/download/CHANGES.txt; http://www.vupen.com/english/advisories/2007/1759; http://www.danielnaber.de/languagetool/download/CHANGES.txt
CVE: CVE-2007-1357
Published: 2007-04-11
Description: The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21, and possibly 2.4.x, allows remote attackers to cause a denial of service (crash) via an AppleTalk frame that is shorter than the specified length, which triggers a BUG_ON call when an attempt is made to perform a checksum.
CVSS Score: 7.8 (HIGH)
References: http://lists.suse.com/archive/suse-security-announce/2007-May/0001.html; http://secunia.com/advisories/24793; http://secunia.com/advisories/24901
CVE: CVE-2007-1940
Published: 2007-04-11
Description: IBM Tivoli Business Service Manager (TBSM) 4.1 before Interim Fix 1 logs passwords in plaintext, which allows local users to obtain sensitive information by reading (1) ncisetup.db or (2) msi.log.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/34770; http://secunia.com/advisories/24763; http://www-1.ibm.com/support/docview.wss?uid=swg24015473
CVE: CVE-2007-1941
Published: 2007-04-11
Description: Cross-site scripting (XSS) vulnerability in the Active Content Filter feature in Domino Web Access (DWA) in IBM Lotus Notes before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via a multipart/related e-mail message, a different issue than CVE-2006-4843.
CVSS Score: 4.3 (MEDIUM)
References: http://www-1.ibm.com/support/docview.wss?rs=477&uid=swg21247201; http://www.intrinsec.com/Advisory_DWA_XSS_200704.txt; http://www.securityfocus.com/bid/23421
CVE: CVE-2007-1942
Published: 2007-04-11
Description: Integer overflow in FastStone Image Viewer 2.9 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted BMP image, as demonstrated by wh3intof.bmp and wh4intof.bmp.
CVSS Score: 9.3 (HIGH)
References: http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html; http://osvdb.org/34664; http://secunia.com/advisories/24784
CVE: CVE-2007-1943
Published: 2007-04-11
Description: Integer overflow in ACDSee Photo Manager 9.0 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via large width image sizes in a crafted BMP image, as demonstrated by w3intof.bmp and w4intof.bmp.
CVSS Score: 9.3 (HIGH)
References: http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html; http://osvdb.org/34663; http://secunia.com/advisories/24779
CVE: CVE-2007-1944
Published: 2007-04-11
Description: The Java Message Service (JMS) in IBM WebSphere Application Server (WAS) before 6.1.0.7 allows attackers to cause a denial of service via unknown vectors involving the "double release [of] a bytebuffer input stream," possibly a double free vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/24852; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27007951#6107; http://www.vupen.com/english/advisories/2007/1282
CVE: CVE-2007-1945
Published: 2007-04-11
Description: Unspecified vulnerability in the Servlet Engine/Web Container in IBM WebSphere Application Server (WAS) before 6.1.0.7 has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/41605; http://secunia.com/advisories/24852; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27007951#6107
CVE: CVE-2007-1946
Published: 2007-04-11
Description: Integer overflow in Windows Explorer in Microsoft Windows XP SP1 might allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large width dimension in a crafted BMP image, as demonstrated by w4intof.bmp.
CVSS Score: 10.0 (HIGH)
References: http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html; http://osvdb.org/41553; http://securityreason.com/securityalert/2558
CVE: CVE-2007-1947
Published: 2007-04-11
Description: Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.04 for Mozilla Firefox allows remote attackers to bypass zone restrictions, read arbitrary file:// URIs, or execute arbitrary code in the browser chrome by overwriting the toString function via a certain function declaration, related to incorrect identification of anonymous JavaScript functions, a different issue than CVE-2007-1878.
CVSS Score: 3.5 (LOW)
References: http://larholm.com/2007/04/06/more-0day-in-firebug/; http://larholm.com/2007/04/06/more-0day-in-firebug/#comment-6; http://www.securityfocus.com/archive/1/464875/100/0/threaded
CVE: CVE-2007-1948
Published: 2007-04-11
Description: Buffer overflow in IrfanView 3.99 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via the (1) xoffset or (2) yoffset RLE command, or (3) large non-RLE encoded blocks in a crafted BMP image, as demonstrated by rle8of3.bmp and rle8of4.bmp.
CVSS Score: 9.3 (HIGH)
References: http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html; http://osvdb.org/41554; http://securityreason.com/securityalert/2558
CVE: CVE-2007-1949
Published: 2007-04-11
Description: Session fixation vulnerability in WebBlizzard CMS allows remote attackers to hijack web sessions by setting a PHPSESSID cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/2557; http://www.majorsecurity.de/index_2.php?major_rls=major_rls42; http://www.securityfocus.com/archive/1/464959/100/0/threaded
CVE: CVE-2007-1950
Published: 2007-04-11
Description: Cross-site scripting (XSS) vulnerability in index_cms.php in WebBlizzard CMS allows remote attackers to inject arbitrary web script or HTML via the Suchzeile parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/2557; http://www.majorsecurity.de/index_2.php?major_rls=major_rls42; http://www.securityfocus.com/archive/1/464959/100/0/threaded
CVE: CVE-2007-1951
Published: 2007-04-11
Description: Session fixation vulnerability in onelook obo Shop allows remote attackers to hijack web sessions by setting a PHPSESSID cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.majorsecurity.de/index_2.php?major_rls=major_rls40; http://www.securityfocus.com/archive/1/464886/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33500
CVE: CVE-2007-1952
Published: 2007-04-11
Description: Session fixation vulnerability in onelook onebyone CMS allows remote attackers to hijack web sessions by setting a PHPSESSID cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/2546; http://www.majorsecurity.de/index_2.php?major_rls=major_rls39; http://www.securityfocus.com/archive/1/464884/100/0/threaded
CVE: CVE-2007-1953
Published: 2007-04-11
Description: Session fixation vulnerability in onelook courts on-line allows remote attackers to hijack web sessions by setting a PHPSESSID cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.majorsecurity.de/index_2.php?major_rls=major_rls41; http://www.securityfocus.com/archive/1/464887/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33502
CVE: CVE-2007-1954
Published: 2007-04-11
Description: Multiple directory traversal vulnerabilities in ArchiveXpert 2.02 build 80 allow remote attackers to create files in arbitrary directories via a .. (dot dot) in a (1) .gz, (2) .jar, (3) .rar, (4) .tar.gz, (5) .zip, or (6) .tar file.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24827; http://www.bugtraq.ir/articles/advisory/archivexpert_directory_traversal/8; http://www.securityfocus.com/bid/23372
CVE: CVE-2007-1955
Published: 2007-04-11
Description: Multiple stack-based buffer overflows in the SignKorea SKCrypAX ActiveX control module 5.4.1.2 allow remote attackers to execute arbitrary code via a long string in unspecified arguments to the (1) DownloadCert, (2) DecryptFileByKey, and (3) EncryptFileByKey functions, a different module and vectors than CVE-2007-1722.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34322; http://secunia.com/advisories/24820; http://www.securityfocus.com/bid/23374