deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-7056
Published: 2007-02-24
Description: Multiple PHP remote file inclusion vulnerabilities in DreamCost HostAdmin 3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) functions.php and (2) members.php.  NOTE: the index.php vector is covered by CVE-2006-0791.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/18901; http://securityreason.com/securityalert/2289; http://www.majorsecurity.de/advisory/major_rls9.txt
CVE: CVE-2006-7057
Published: 2007-02-24
Description: SQL injection vulnerability in search.php in Sphider before 1.3.1c allows remote attackers to execute arbitrary SQL commands via the category parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue might be primary to CVE-2006-2506.2.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20131; http://www.vupen.com/english/advisories/2006/1845; http://secunia.com/advisories/20131
CVE: CVE-2006-7058
Published: 2007-02-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sphider before 1.3.1c allow remote attackers to inject arbitrary web script or HTML via the catid parameter to (1) templates/standard/search_form.html and (2) templates/dark/search_form.html.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20131; http://www.osvdb.org/25574; http://www.vupen.com/english/advisories/2006/1845
CVE: CVE-2006-7059
Published: 2007-02-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net E-Dating System allow remote attackers to inject arbitrary web script or HTML via encoded entities (&#0000039) in IMG tags to (1) messages, (2) profile fields, or (3) the id parameter in a dologin operation to cindex.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0067.html; http://secunia.com/advisories/20535; http://securityreason.com/securityalert/2300
CVE: CVE-2006-7060
Published: 2007-02-24
Description: cindex.php in Scriptsez.net E-Dating System allows remote attackers to obtain the full path via an invalid id parameter in a dologin action, which leaks the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0067.html; http://secunia.com/advisories/20535; http://securityreason.com/securityalert/2300
CVE: CVE-2006-7061
Published: 2007-02-24
Description: Scriptsez.net E-Dating System stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read private messages and leverage them for cross-site scripting (XSS) attacks.
CVSS Score: 9.3 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0067.html; http://secunia.com/advisories/20535; http://securityreason.com/securityalert/2300
CVE: CVE-2006-7062
Published: 2007-02-24
Description: calendar.php in Kamgaing Email System (kmail) 2.3 and earlier allows remote attackers to obtain the full path of the server via an invalid d parameter, which leaks the path in an error message.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2006/04/kmail-23-vuln.html; http://www.osvdb.org/25065; https://exchange.xforce.ibmcloud.com/vulnerabilities/26120
CVE: CVE-2006-7063
Published: 2007-02-24
Description: Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and execute arbitrary files via ".." sequences in the uname parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/18304; https://exchange.xforce.ibmcloud.com/vulnerabilities/26881; https://www.exploit-db.com/exploits/1857
CVE: CVE-2006-7064
Published: 2007-02-24
Description: Cross-site scripting (XSS) vulnerability in forum/admin.php for Invision Power Board (IPB) 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML as the administrator via the phpinfo parameter.
CVSS Score: 9.3 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0204.html; http://securityreason.com/securityalert/2307; http://www.securityfocus.com/bid/18450
CVE: CVE-2007-1090
Published: 2007-02-26
Description: Microsoft Windows Explorer on Windows XP and 2003 allows remote user-assisted attackers to cause a denial of service (crash) via a malformed WMF file, which triggers the crash when the user browses the folder.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/34490; http://securityvulns.com/Qdocument170.html; http://securityvulns.com/news/Microsoft/Windows/Explorer/DoS.html
CVE: CVE-2007-1091
Published: 2007-02-26
Description: Microsoft Internet Explorer 7 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via onUnload Javascript handlers.
CVSS Score: 6.8 (MEDIUM)
References: http://lcamtuf.coredump.cx/ietrap; http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052630.html; http://secunia.com/advisories/23014
CVE: CVE-2007-1092
Published: 2007-02-26
Description: Mozilla Firefox 1.5.0.9 and 2.0.0.1, and SeaMonkey before 1.0.8 allow remote attackers to execute arbitrary code via JavaScript onUnload handlers that modify the structure of a document, wich triggers memory corruption due to the lack of a finalize hook on DOM window objects.
CVSS Score: 9.3 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0525.html
CVE: CVE-2007-1093
Published: 2007-02-26
Description: Multiple unspecified vulnerabilities in JP1/Cm2/Network Node Manager (NNM) before 07-10-05, and before 08-00-02 in the 08-x series, allow remote attackers to execute arbitrary code, cause a denial of service, or trigger invalid Web utility behavior.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/33528; http://osvdb.org/33529; http://secunia.com/advisories/24276
CVE: CVE-2007-1094
Published: 2007-02-26
Description: Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (NULL dereference and application crash) via JavaScript onUnload handlers that modify the structure of a document.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/45248; http://securityreason.com/securityalert/2302; http://www.securityfocus.com/archive/1/461024/100/0/threaded
CVE: CVE-2007-1095
Published: 2007-02-26
Description: Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 do not properly implement JavaScript onUnload handlers, which allows remote attackers to run certain JavaScript code and access the location DOM hierarchy in the context of the next web site that is visited by a client.
CVSS Score: 6.8 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://lcamtuf.coredump.cx/ietrap/ff/; http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052630.html
CVE: CVE-2007-1096
Published: 2007-02-26
Description: Cross-site scripting (XSS) vulnerability in ps_cart.php in VirtueMart before 20070116 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this issue might overlap CVE-2007-0376.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24399; http://virtuemart.svn.sourceforge.net/viewvc/%2Acheckout%2A/virtuemart/trunk/virtuemart/CHANGELOG.php?revision=692; http://www.vupen.com/english/advisories/2007/0817
CVE: CVE-2007-1097
Published: 2007-02-26
Description: Unrestricted file upload vulnerability in the onAttachFiles function in the upload tool (inc/lib/attachment.lib.php) in Wiclear before 0.11.1 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors related to filename validation.  NOTE: some details were obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/33598; http://secunia.com/advisories/24286; http://wiclear.free.fr/?Download
CVE: CVE-2007-1098
Published: 2007-02-26
Description: Multiple unspecified vulnerabilities in ScryMUD before 2.1.11 have unknown impact and attack vectors, possibly related to denial of service caused by a search that begins with a .* sequence.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33600; http://scrymud.net/downloads/Changelog-2.1.10-2.1.11.txt; http://www.wanfear.com/pipermail/scrymud/2007q1/001157.html
CVE: CVE-2007-1099
Published: 2007-02-26
Description: dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks.
CVSS Score: 7.5 (HIGH)
References: http://matt.ucc.asn.au/dropbear/CHANGES; http://osvdb.org/33814; http://secunia.com/advisories/24345
CVE: CVE-2007-1100
Published: 2007-02-26
Description: Directory traversal vulnerability in download.php in Ahmet Sacan Pickle before 20070301 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33763; http://secunia.com/advisories/24294; http://securityreason.com/securityalert/2293
CVE: CVE-2007-1101
Published: 2007-02-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Photostand 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) message ("comment") or (2) name field, or the (3) q parameter in a search action in index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/33773; http://secunia.com/advisories/24310; http://securityreason.com/securityalert/2296
CVE: CVE-2007-1102
Published: 2007-02-26
Description: Photostand 1.2.0 allows remote attackers to obtain sensitive information via a ' (quote) character in (1) a PHPSESSID cookie or (2) the id parameter in an article action in index.php, which reveal the path in various error messages.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33774; http://osvdb.org/33775; http://securityreason.com/securityalert/2296
CVE: CVE-2007-1103
Published: 2007-02-26
Description: Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.seul.org/or/talk/Feb-2007/msg00197.html; http://archives.seul.org/or/talk/Feb-2007/msg00200.html; http://archives.seul.org/or/talk/Feb-2007/msg00202.html
CVE: CVE-2007-1104
Published: 2007-02-26
Description: PHP remote file inclusion vulnerability in top.php in PHP Module Implementation (PHP-MIP) 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the laypath parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36881; http://www.securityfocus.com/bid/22714; http://www.vupen.com/english/advisories/2007/0732
CVE: CVE-2007-1105
Published: 2007-02-26
Description: PHP remote file inclusion vulnerability in functions.php in Extreme phpBB (aka phpBB Extreme) 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/36957; http://www.securityfocus.com/bid/22708; http://www.vupen.com/english/advisories/2007/0733
CVE: CVE-2007-1106
Published: 2007-02-26
Description: PHP remote file inclusion vulnerability in includes/functions_nomoketos_rules.php in the NoMoKeTos Rules 0.0.1 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37000; http://www.securityfocus.com/bid/22713; http://www.vupen.com/english/advisories/2007/0735
CVE: CVE-2007-1107
Published: 2007-02-26
Description: SQL injection vulnerability in thumbnails.php in Coppermine Photo Gallery (CPG) 1.3.x allows remote authenticated users to execute arbitrary SQL commands via a cpg131_fav cookie.  NOTE: it was later reported that 1.4.10, 1.4.14, and other 1.4.x versions are also affected using similar cookies.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33133; http://securityreason.com/securityalert/2297; http://www.securityfocus.com/archive/1/461158/100/0/threaded
CVE: CVE-2007-1108
Published: 2007-02-26
Description: PHP remote file inclusion vulnerability in index.php in Christian Schneider CS-Gallery 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the album parameter during a securealbum todo action.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33754; http://secunia.com/advisories/24291; http://www.securityfocus.com/bid/22712
CVE: CVE-2007-1109
Published: 2007-02-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Phpwebgallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) login or (2) mail_address field in Register.php, or the (3) search_author, (4) mode, (5) start_year, (6) end_year, or (7) date_type field in Search.php, a different vulnerability than CVE-2006-1674.  NOTE: 1.6.2 and other versions might also be affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/33761; http://osvdb.org/33762; http://secunia.com/advisories/24308
CVE: CVE-2007-1110
Published: 2007-02-26
Description: Directory traversal vulnerability in data/showcode.php in ActiveCalendar 1.2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/2299; http://www.osvdb.org/33144; http://www.securityfocus.com/archive/1/461146/100/0/threaded
CVE: CVE-2007-1111
Published: 2007-02-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in ActiveCalendar 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the css parameter to (1) flatevents.php, (2) js.php, (3) mysqlevents.php, (4) m_2.php, (5) m_3.php, (6) m_4.php, (7) xmlevents.php, (8) y_2.php, or (9) y_3.php in data/.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2299; http://www.osvdb.org/33145; http://www.osvdb.org/33146
CVE: CVE-2007-0775
Published: 2007-02-26
Description: Multiple unspecified vulnerabilities in the layout engine in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, and SeaMonkey before 1.0.8 allow remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via certain vectors.
CVSS Score: 3.7 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2713
CVE: CVE-2007-0776
Published: 2007-02-26
Description: Heap-based buffer overflow in the _cairo_pen_init function in Mozilla Firefox 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, and SeaMonkey before 1.0.8 allows remote attackers to execute arbitrary code via a large stroke-width attribute in the clipPath element in an SVG file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://fedoranews.org/cms/node/2713; http://fedoranews.org/cms/node/2728; http://fedoranews.org/cms/node/2747
CVE: CVE-2007-0777
Published: 2007-02-26
Description: The JavaScript engine in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, and SeaMonkey before 1.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain vectors that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2713
CVE: CVE-2007-0995
Published: 2007-02-26
Description: Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 ignores trailing invalid HTML characters in attribute names, which allows remote attackers to bypass content filters that use regular expressions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2713
CVE: CVE-2007-0008
Published: 2007-02-26
Description: Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the "Master Secret", which results in a heap-based overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2709
CVE: CVE-2007-0009
Published: 2007-02-26
Description: Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via invalid "Client Master Key" length values.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2709
CVE: CVE-2007-0778
Published: 2007-02-26
Description: The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors when the target page is reloaded from the cache.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2713
CVE: CVE-2007-0779
Published: 2007-02-26
Description: GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 allows remote attackers to spoof certain user interface elements, such as the host name or security indicators, via the CSS3 hotspot property with a large, transparent, custom cursor.
CVSS Score: 6.4 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2713
CVE: CVE-2007-0780
Published: 2007-02-26
Description: browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows, which allows remote attackers to conduct cross-site scripting (XSS) attacks by opening a blocked popup originating from a javascript: URI in combination with multiple frames having the same data: URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2713
CVE: CVE-2007-1114
Published: 2007-02-26
Description: The child frames in Microsoft Internet Explorer 7 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/24314; http://www.hardened-php.net/advisory_032007.142.html; http://www.osvdb.org/32119
CVE: CVE-2007-1115
Published: 2007-02-26
Description: The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/32118; http://secunia.com/advisories/24312; http://secunia.com/advisories/25027
CVE: CVE-2007-1116
Published: 2007-02-26
Description: The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can be loaded via JavaScript, which allows remote attackers to obtain sensitive information by querying the browser's session history.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/33804; http://securityreason.com/securityalert/2309; http://www.gnucitizen.org/projects/hscan-redux/
CVE: CVE-2007-0996
Published: 2007-02-27
Description: The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the parent window, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
CVSS Score: 5.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc; http://fedoranews.org/cms/node/2713
CVE: CVE-2007-1117
Published: 2007-02-27
Description: Unspecified vulnerability in Publisher 2007 in Microsoft Office 2007 allows remote attackers to execute arbitrary code via unspecified vectors, related to a "file format vulnerability." NOTE: this information is based upon a vague pre-advisory with no actionable information.  However, the advisory is from a reliable source.
CVSS Score: 10.0 (HIGH)
References: http://news.com.com/2100-1002_3-6161835.html; http://osvdb.org/45264; http://research.eeye.com/html/advisories/upcoming/20070216.html
CVE: CVE-2007-1118
Published: 2007-02-27
Description: Multiple PHP remote file inclusion vulnerabilities in eFiction 3.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path_to_smf parameter to (1) bridges/SMF/logout.php or (2) get_session_vars.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33526; http://osvdb.org/33527; http://secunia.com/advisories/24268
CVE: CVE-2007-1119
Published: 2007-02-27
Description: Unspecified vulnerability in Novell ZENworks 7 Desktop Management Support Pack 1 before Hot patch 3 (ZDM7SP1HP3) allows remote attackers to upload images to certain folders that were not configured in the "Only allow uploads to the following directories" setting via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/33533; http://secunia.com/advisories/24274; http://www.securityfocus.com/bid/22686
CVE: CVE-2007-1120
Published: 2007-02-27
Description: The (1) Import.LoadFromURL and (2) Export.asText.SaveToFile functions in TeeChart Pro ActiveX control (TeeChart7.ocx) allow remote attackers to download a crafted .tee file to an arbitrary location.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/33534; http://secunia.com/advisories/24263; http://www.securityfocus.com/bid/22689
CVE: CVE-2007-1121
Published: 2007-02-27
Description: Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) 1.00 allow remote attackers to execute arbitrary SQL commands via the id parameter to the (1) updateRow and (2) deleteRow functions in functions.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/24269; http://sourceforge.net/project/shownotes.php?release_id=488406; http://www.securityfocus.com/bid/22685