deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2724
Published: 2007-05-16
Description: Cross-site scripting (XSS) vulnerability in all_photos.html in fotolog allows remote attackers to inject arbitrary web script or HTML via the user parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37916; http://securityreason.com/securityalert/2713; http://www.securityfocus.com/archive/1/468316/100/0/threaded
CVE: CVE-2007-2725
Published: 2007-05-16
Description: The DB Software Laboratory DeWizardX (DEWizardAX.ocx) ActiveX control allows remote attackers to overwrite arbitrary files via the SaveToFile function.
CVSS Score: 7.5 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-15-db-software-laboratory.html; http://osvdb.org/36023; http://shinnai.altervista.org/viewtopic.php?id=42&t_id=17
CVE: CVE-2007-2726
Published: 2007-05-16
Description: BitsCast 0.13.0 allows remote attackers to cause a denial of service (application crash) via an RSS 2.0 feed item with certain invalid strings in a pubDate element, as demonstrated by repeated "../A" or "A/../" patterns.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/39767; http://www.securityfocus.com/bid/23993; https://exchange.xforce.ibmcloud.com/vulnerabilities/34344
CVE: CVE-2007-2727
Published: 2007-05-16
Description: The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.
CVSS Score: 2.6 (LOW)
References: http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html; http://bugs.php.net/bug.php?id=40999; http://cvs.php.net/viewvc.cgi/php-src/ext/mcrypt/mcrypt.c?r1=1.91.2.3.2.9&r2=1.91.2.3.2.10
CVE: CVE-2007-2728
Published: 2007-05-16
Description: The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcrypt_create_iv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue.
CVSS Score: 5.0 (MEDIUM)
References: http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html; http://osvdb.org/36086; http://secunia.com/advisories/25306
CVE: CVE-2007-2729
Published: 2007-05-16
Description: Comodo Firewall Pro 2.4.18.184 and Comodo Personal Firewall 2.3.6.81, and probably older Comodo Firewall versions, do not properly test for equivalence of process identifiers for certain Microsoft Windows API functions in the NT kernel 5.0 and greater, which allows local users to call these functions, and bypass firewall rules or gain privileges, via a modified identifier that is one, two, or three greater than the canonical identifier.
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/37375; http://securityreason.com/securityalert/2714; http://www.matousec.com/info/advisories/Bypassing-PWF-HIPS-open-process-control-with-uncommon-identifier.php
CVE: CVE-2007-2730
Published: 2007-05-16
Description: Check Point ZoneAlarm Pro before 6.5.737.000 does not properly test for equivalence of process identifiers for certain Microsoft Windows API functions in the NT kernel 5.0 and greater, which allows local users to call these functions, and bypass firewall rules or gain privileges, via a modified identifier that is one, two, or three greater than the canonical identifier.
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/37383; http://securityreason.com/securityalert/2714; http://www.matousec.com/info/advisories/Bypassing-PWF-HIPS-open-process-control-with-uncommon-identifier.php
CVE: CVE-2007-2731
Published: 2007-05-16
Description: CRLF injection vulnerability in formmail.php in Jetbox CMS 2.1 might allow remote attackers to inject arbitrary e-mail headers via LF (%0A) sequences in the subject parameter, a related issue to CVE-2007-1898.
CVSS Score: 4.0 (MEDIUM)
References: http://securityreason.com/securityalert/2710; http://www.netvigilance.com/advisory0026; http://www.osvdb.org/34088
CVE: CVE-2007-2732
Published: 2007-05-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML via the (1) path parameter to view/search/; or the (2) companyname, (3) country, (4) email, (5) firstname, (6) middlename, (7) required, (8) surname, or (9) title parameter to view/supplynews/.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37451; http://osvdb.org/37452; http://securityreason.com/securityalert/2711
CVE: CVE-2007-2733
Published: 2007-05-16
Description: Unrestricted file upload vulnerability in Jetbox CMS allows remote authenticated users with author privileges to upload arbitrary scripts via unspecified vectors, which can be accessed in webfiles/.  NOTE: this issue might be a duplicate of CVE-2004-1448.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/37450; http://securityreason.com/securityalert/2711; http://www.securityfocus.com/archive/1/468681/100/0/threaded
CVE: CVE-2007-2734
Published: 2007-05-16
Description: The 3Com TippingPoint IPS do not properly handle certain full-width and half-width Unicode character encodings in an HTTP POST request, which might allow remote attackers to evade detection of HTTP traffic.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35968; http://secunia.com/advisories/25302; http://securityreason.com/securityalert/2712
CVE: CVE-2007-2735
Published: 2007-05-17
Description: SQL injection vulnerability in edit_day.php in the ResManager 1.2.1 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id_reserv parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35380; http://secunia.com/advisories/25298; http://www.securityfocus.com/bid/23997
CVE: CVE-2007-2736
Published: 2007-05-17
Description: PHP remote file inclusion vulnerability in index.php in Achievo 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the config_atkroot parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/37919; http://www.securityfocus.com/bid/23992; https://exchange.xforce.ibmcloud.com/vulnerabilities/34305
CVE: CVE-2007-2737
Published: 2007-05-17
Description: SQL injection vulnerability in index.php in the MyConference 1.0 module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37920; http://www.vupen.com/english/advisories/2007/1830; http://osvdb.org/37920
CVE: CVE-2007-2738
Published: 2007-05-17
Description: SQL injection vulnerability in glossaire-p-f.php in the Glossaire 1.7 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the sid parameter in an ImprDef action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37921; http://www.securityfocus.com/bid/23998; http://www.vupen.com/english/advisories/2007/1829
CVE: CVE-2007-2739
Published: 2007-05-17
Description: Cross-site scripting (XSS) vulnerability in xajax before 0.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36174; http://secunia.com/advisories/25299; http://secunia.com/advisories/33265
CVE: CVE-2007-2740
Published: 2007-05-17
Description: Unspecified vulnerability in xajax before 0.2.5 has unknown impact and attack vectors, not related to XSS.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36175; http://secunia.com/advisories/25299; http://sourceforge.net/project/shownotes.php?release_id=508650
CVE: CVE-2007-2741
Published: 2007-05-17
Description: Stack-based buffer overflow in Little CMS (lcms) before 1.15 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ICC profile in a JPG file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/36179; http://scary.beasts.org/security/CESA-2007-001.html; http://secunia.com/advisories/25294
CVE: CVE-2007-2742
Published: 2007-05-17
Description: Unrestricted file upload vulnerability in labs.beffa.org w2box 4.0.0 Beta4 allows remote attackers to upload arbitrary PHP code via a filename with a double extension such as .php.jpg.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0935&w=2; http://osvdb.org/36830; http://www.securityfocus.com/bid/23975
CVE: CVE-2007-2743
Published: 2007-05-17
Description: PHP remote file inclusion vulnerability in custom_vars.php in GlossWord 1.8.1 allows remote attackers to execute arbitrary PHP code via a URL in the sys[path_addon] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35520; http://secunia.com/advisories/25303; http://www.securityfocus.com/bid/24009
CVE: CVE-2007-2744
Published: 2007-05-17
Description: Stack-based buffer overflow in the PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll allows remote attackers to cause a denial of service (Internet Explorer 6 crash), and possibly execute arbitrary code, via a long argument to the SaveBarCode method.  NOTE: this issue might overlap CVE-2007-2657.
CVSS Score: 7.5 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-16-ie-6-precisionid-barcode.html; http://osvdb.org/36024; http://secunia.com/advisories/25253
CVE: CVE-2007-1693
Published: 2007-05-17
Description: The SIP channel module in Yet Another Telephony Engine (Yate) before 1.2.0 sets the caller_info_uri parameter using an incorrect variable that can be NULL, which allows remote attackers to cause a denial of service (NULL dereference and application crash) via a Call-Info header without a purpose parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/2716; http://voip.null.ro/cgi-bin/cvsweb.cgi/yate/modules/ysipchan.cpp; http://www.securityfocus.com/archive/1/467289/100/200/threaded
CVE: CVE-2007-2745
Published: 2007-05-17
Description: Cross-site scripting (XSS) vulnerability in printcal.pl in vDesk Webmail 4.03 allows remote attackers to inject arbitrary web script or HTML via the type parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37922; http://pridels-team.blogspot.com/2007/05/vdeck-webmail-system-xss-vuln.html; http://www.securityfocus.com/bid/24022
CVE: CVE-2007-2746
Published: 2007-05-17
Description: The viewList function in lib/WebGUI/Asset/Wobject/DataForm.pm in Plain Black WebGUI before 7.3.14 does not properly use data structures containing privilege information, which allows remote authenticated users to obtain sensitive information or possibly have other unspecified impact.
CVSS Score: 3.5 (LOW)
References: http://osvdb.org/36566; http://secunia.com/advisories/25355; http://www.plainblack.com/bugs/tracker/dataform-security-bug
CVE: CVE-2007-2747
Published: 2007-05-17
Description: Directory traversal vulnerability in rdw_helpers.py in rdiffWeb before 0.3.5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to the /browse URI.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/36519; http://secunia.com/advisories/25368; http://www.rdiffweb.org/wiki/index.php?title=Roadmap#Version_0.3.5.1
CVE: CVE-2007-2748
Published: 2007-05-17
Description: The substr_count function in PHP 5.2.1 and earlier allows context-dependent attackers to obtain sensitive information via unspecified vectors, a different affected function than CVE-2007-1375.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/34730; http://secunia.com/advisories/26895; http://us2.php.net/releases/5_2_2.php
CVE: CVE-2007-2749
Published: 2007-05-17
Description: SQL injection vulnerability in question.php in FAQEngine 4.16.03 and earlier allows remote attackers to execute arbitrary SQL commands via the questionref parameter in a display action.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/36091; http://secunia.com/advisories/25297; http://www.securityfocus.com/bid/24032
CVE: CVE-2007-2750
Published: 2007-05-17
Description: SQL injection vulnerability in print.php in SimpNews 2.40.01 and earlier allows remote attackers to execute arbitrary SQL commands via the newsnr parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36090; http://secunia.com/advisories/25296; http://www.securityfocus.com/bid/24028
CVE: CVE-2007-2751
Published: 2007-05-17
Description: Multiple PHP remote file inclusion vulnerabilities in PHPGlossar 0.8 allow remote attackers to execute arbitrary PHP code via a URL in the format_menue parameter to (1) admin/inc/change_action.php or (2) admin/inc/add.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37925; http://osvdb.org/37926; http://www.securityfocus.com/bid/24024
CVE: CVE-2007-2752
Published: 2007-05-17
Description: SQL injection vulnerability in devami.asp in RunawaySoft Haber portal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/36092; http://secunia.com/advisories/25304; http://www.securityfocus.com/bid/24018
CVE: CVE-2007-2753
Published: 2007-05-17
Description: RunawaySoft Haber portal 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for data/xice.mdb.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/41976; https://www.exploit-db.com/exploits/3936; http://osvdb.org/41976
CVE: CVE-2007-2754
Published: 2007-05-17
Description: Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://cvs.savannah.nongnu.org/viewvc/freetype2/src/truetype/ttgload.c?root=freetype&r1=1.177&r2=1.178; http://lists.apple.com/archives/Security-announce/2007/Nov/msg00003.html
CVE: CVE-2007-2755
Published: 2007-05-17
Description: The PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll, when Internet Explorer 6 is used, allows remote attackers to overwrite arbitrary files via a full pathname to the SaveToFile function, a different vulnerability than CVE-2007-2744.
CVSS Score: 10.0 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-16-bonus-ie-6-precisionid-barcode.html; http://osvdb.org/37957; http://www.securityfocus.com/bid/24014
CVE: CVE-2007-2682
Published: 2007-05-18
Description: The installer for Adobe Version Cue CS3 Server on Apple Mac OS X, as used in Adobe Creative Suite 3 (CS3), does not re-enable the personal firewall after completing the product installation, which allows remote attackers to bypass intended firewall rules.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35868; http://secunia.com/advisories/25291; http://securitytracker.com/id?1018075
CVE: CVE-2007-2756
Published: 2007-05-18
Description: The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.libgd.org/?do=details&task_id=86; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795; http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html
CVE: CVE-2007-2757
Published: 2007-05-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Redoable 1.2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to (1) wp-content/themes/redoable/searchloop.php or (2) wp-content/themes/redoable/header.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37040; http://osvdb.org/37041; http://redlevel.org/wp-content/uploads/redoable.txt
CVE: CVE-2007-2758
Published: 2007-05-18
Description: Multiple buffer overflows in WinImage 8.0.8000 allow user-assisted remote attackers to execute arbitrary code via a FAT image that contains long directory names in a deeply nested directory structure, which triggers (1) a stack-based buffer overflow during extraction, or (2) a heap-based buffer overflow during traversal.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/36081; http://osvdb.org/36082; http://secunia.com/advisories/25277
CVE: CVE-2007-2759
Published: 2007-05-18
Description: Multiple SQL injection vulnerabilities in the insert function in the ValuePreference class (grid/ed/ValuePreference.java) in Adempiere before 3.1.6 allow remote attackers to execute arbitrary SQL commands via the (1) m_Attribute or (2) m_Value parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37956; http://www.adempiere.com/wiki/index.php/Release_316; http://www.vupen.com/english/advisories/2007/1842
CVE: CVE-2007-2760
Published: 2007-05-18
Description: The canUpdate function in model/MRole.java in Adempiere before 3.1.6 does not properly validate user roles, which allows remote authenticated read-only users to gain read-write privileges.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.0 (HIGH)
References: http://osvdb.org/41979; http://www.adempiere.com/wiki/index.php/Release_316; http://www.vupen.com/english/advisories/2007/1842
CVE: CVE-2007-2761
Published: 2007-05-18
Description: Stack-based buffer overflow in MagicISO 5.4 build 239 and earlier allows remote attackers to execute arbitrary code via a long filename in a .cue file.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36077; http://secunia.com/advisories/25325; http://www.securityfocus.com/archive/1/469302/100/0/threaded
CVE: CVE-2007-2762
Published: 2007-05-18
Description: Multiple PHP remote file inclusion vulnerabilities in Build it Fast (bif3) 0.4.1 allow remote attackers to execute arbitrary PHP code via a URL in (1) the pear_dir parameter to Base/Application.php, or the (2) sys_dir parameter to (a) Footer.php, (b) widget.BifContainer.php, (c) widget.BifRoot.php, (d) widget.BifRoot2.php, (e) widget.BifRoot3.php, or (f) widget.BifWarning.php in Widgets/Base/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37949; http://osvdb.org/37950; http://osvdb.org/37951
CVE: CVE-2007-2763
Published: 2007-05-18
Description: Buffer overflow in the UnlockSupport function in the LockModules subsystem in a certain ActiveX control in ltmm15.dll in Sienzo Digital Music Mentor (DMM) 2.6.0.4 allows remote attackers to execute arbitrary code via a long string in the second argument, a different issue than CVE-2007-2564.
CVSS Score: 10.0 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-17-sienzo-digital-music-mentor.html; http://osvdb.org/36025; http://shinnai.altervista.org/viewtopic.php?id=42&t_id=19
CVE: CVE-2007-2764
Published: 2007-05-18
Description: The embedded Linux kernel in certain Sun-Brocade SilkWorm switches before 20070516 does not properly handle a situation in which a non-root user creates a kernel process, which allows attackers to cause a denial of service (oops and device reboot) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/39117; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102752-1; http://www.securityfocus.com/bid/24036
CVE: CVE-2007-2765
Published: 2007-05-18
Description: blockhosts.py in BlockHosts before 2.0.3 does not properly parse daemon log files, which allows remote attackers to add arbitrary deny entries to the /etc/hosts.allow file and cause a denial of service by adding arbitrary IP addresses to a daemon log file, as demonstrated by logging in through ssh using a login name containing certain strings with an IP address, which is not properly handled by a regular expression, a related issue to CVE-2006-6301.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36516; http://secunia.com/advisories/25352; http://www.aczoom.com/tools/blockhosts/CHANGES
CVE: CVE-2007-2766
Published: 2007-05-18
Description: lib/backup-methods.sh in Backup Manager before 0.7.6 provides the MySQL password as a plaintext command line argument, which allows local users to obtain this password by listing the process and its arguments, related to lib/backup-methods.sh.
CVSS Score: 7.2 (HIGH)
CWE: CWE-255
References: http://bugzilla.backup-manager.org/cgi-bin/show_bug.cgi?id=146; http://osvdb.org/34780; http://www.backup-manager.org/pipermail/backup-manager-commits/2007-January/000212.html
CVE: CVE-2007-1355
Published: 2007-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795; http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
CVE: CVE-2007-2684
Published: 2007-05-21
Description: Jetbox CMS 2.1 allows remote attackers to obtain sensitive information via (1) a direct request to (a) main_page.php, (b) open_tree.php, and (c) outputs.php; (2) a malformed view parameter to index.php, as demonstrated with an SQL injection manipulation; or (3) the id[] parameter to admin/cms/opentree.php, which reveals the installation path in the resulting error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9054&w=2; http://osvdb.org/34787; http://osvdb.org/34788
CVE: CVE-2007-2685
Published: 2007-05-21
Description: Multiple SQL injection vulnerabilities in index.php in Jetbox CMS 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) view or (2) login parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6496&w=2; http://www.netvigilance.com/advisory0028; http://www.osvdb.org/34784
CVE: CVE-2007-2767
Published: 2007-05-21
Description: Unspecified vulnerability in BES before 3.5.0 in OPeNDAP 4 (Hydrax) before 1.2.1 allows remote attackers to list filesystem contents and obtain sensitive information via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35486; http://secunia.com/advisories/25319; http://www.kb.cert.org/vuls/id/671028
CVE: CVE-2007-2768
Published: 2007-05-21
Description: OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-04/0635.html; http://www.osvdb.org/34601; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2007-2769
Published: 2007-05-21
Description: BES before 3.5.0 in OPeNDAP 4 (Hydrax) before 1.2.1 does not properly handle compressed files, which allows remote attackers to upload arbitrary files or execute arbitrary commands via a crafted compressed file.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35487; http://secunia.com/advisories/25319; http://www.kb.cert.org/vuls/id/659148
CVE: CVE-2007-2770
Published: 2007-05-21
Description: Stack-based buffer overflow in Eudora 7.1 allows user-assisted, remote SMTP servers to execute arbitrary code via a long SMTP reply.  NOTE: the user must click through a warning about a possible buffer overflow exploit to trigger this issue.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/36198; http://secunia.com/advisories/25282; https://exchange.xforce.ibmcloud.com/vulnerabilities/34324