deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2672
Published: 2007-05-14
Description: SQL injection vulnerability in index.php in PHP Coupon Script 3.0 allows remote attackers to execute arbitrary SQL commands via the bus parameter in a viewbus page.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35590; http://secunia.com/advisories/25145; http://www.securityfocus.com/bid/23799
CVE: CVE-2007-2673
Published: 2007-05-14
Description: SQL injection vulnerability in includes/funcs_vendors.php in Censura 1.15.04, and other versions before 1.16.04, allows remote attackers to execute arbitrary SQL commands via the vendorid parameter in a vendor_info cmd action to censura.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/35598; http://secunia.com/advisories/25141; http://www.censura.info/forums/showthread.php?t=556
CVE: CVE-2007-2674
Published: 2007-05-14
Description: SQL injection vulnerability in detail.php in Pre Shopping Mall 1.0 allows remote attackers to execute arbitrary SQL commands via the prodid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37814; http://www.securityfocus.com/bid/23794; https://exchange.xforce.ibmcloud.com/vulnerabilities/34034
CVE: CVE-2007-2675
Published: 2007-05-14
Description: SQL injection vulnerability in search.php in Pre Classifieds Listings 1.0 allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35597; http://secunia.com/advisories/25144; http://www.securityfocus.com/bid/23795
CVE: CVE-2007-2676
Published: 2007-05-14
Description: PHP remote file inclusion vulnerability in skins/header.php in Open Translation Engine (OTE) 0.7.8 allows remote attackers to execute arbitrary PHP code via a URL in the ote_home parameter.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-May/001585.html; http://osvdb.org/35591; http://secunia.com/advisories/25146
CVE: CVE-2007-2677
Published: 2007-05-14
Description: Multiple PHP remote file inclusion vulnerabilities in phpChess Community Edition 2.0 allow remote attackers to execute arbitrary PHP code via a URL in (1) the config parameter to includes/language.php, or the Root_Path parameter to (2) layout_admin_cfg.php, (3) layout_cfg.php, or (4) layout_t_top.php in skins/phpchess/.  NOTE: vector 1 has been disputed by CVE, since the code is defined within a function that is not called from within includes/language.php.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-May/001586.html; http://osvdb.org/35592; http://osvdb.org/35593
CVE: CVE-2007-2678
Published: 2007-05-15
Description: Buffer overflow in the isChecked function in toolbar.dll in Netsprint Toolbar 1.1 might allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/465980/100/0/threaded; http://www.securityfocus.com/archive/1/465992/100/0/threaded; http://www.securityfocus.com/archive/1/465980/100/0/threaded
CVE: CVE-2007-2679
Published: 2007-05-15
Description: PHP file inclusion vulnerability in index.php in Ivan Peevski gallery 0.3 in Simple PHP Scripts (sphp) allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the file_exists function.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24912; http://www.attrition.org/pipermail/vim/2007-April/001536.html; http://www.securityfocus.com/bid/23534
CVE: CVE-2007-2680
Published: 2007-05-15
Description: Cross-site scripting (XSS) vulnerability in the management interface in Canon Network Camera Server VB100 and VB101 with firmware 3.0 R69 and earlier, and VB150 with firmware 1.1 R39 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://cweb.canon.jp/drv-upd/webview/notification.html; http://jvn.jp/jp/JVN%[PII_REDACTED]/; http://osvdb.org/35019
CVE: CVE-2007-2681
Published: 2007-05-15
Description: Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the core_subdir parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2697; http://www.securityfocus.com/archive/1/465733/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33687
CVE: CVE-2007-2683
Published: 2007-05-15
Description: Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias expansion.
CVSS Score: 3.5 (LOW)
References: http://dev.mutt.org/trac/ticket/2885; http://osvdb.org/34973; http://secunia.com/advisories/25408
CVE: CVE-2007-2688
Published: 2007-05-16
Description: The Cisco Intrusion Prevention System (IPS) and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/25285; http://www.cisco.com/en/US/products/products_security_response09186a008083f82e.html; http://www.gamasec.net/english/gs07-01.html
CVE: CVE-2007-2689
Published: 2007-05-16
Description: Check Point Web Intelligence does not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.
CVSS Score: 7.8 (HIGH)
References: http://www.gamasec.net/english/gs07-01.html; http://www.kb.cert.org/vuls/id/739224; http://www.securityfocus.com/archive/1/468633/100/0/threaded
CVE: CVE-2007-2690
Published: 2007-05-16
Description: Multiple IBM ISS Proventia Series products, including the A, G, and M series, do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.
CVSS Score: 7.8 (HIGH)
References: http://www.gamasec.net/english/gs07-01.html; http://www.kb.cert.org/vuls/id/739224; http://www.securityfocus.com/archive/1/468633/100/0/threaded
CVE: CVE-2007-2691
Published: 2007-05-16
Description: MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.
CVSS Score: 4.9 (MEDIUM)
References: http://bugs.mysql.com/bug.php?id=27515; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
CVE: CVE-2007-2692
Published: 2007-05-16
Description: The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.
CVSS Score: 6.0 (MEDIUM)
References: http://bugs.mysql.com/bug.php?id=27337; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html; http://lists.mysql.com/announce/470
CVE: CVE-2007-2693
Published: 2007-05-16
Description: MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to obtain sensitive information from partitioned tables via an ALTER TABLE statement.
CVSS Score: 3.5 (LOW)
References: http://bugs.mysql.com/bug.php?id=23675; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html; http://secunia.com/advisories/25301
CVE: CVE-2007-2694
Published: 2007-05-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/232; http://osvdb.org/36075; http://secunia.com/advisories/25284
CVE: CVE-2007-2695
Published: 2007-05-16
Description: The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality.
CVSS Score: 5.1 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/227; http://dev2dev.bea.com/pub/advisory/274; http://osvdb.org/36074
CVE: CVE-2007-2696
Published: 2007-05-16
Description: The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server.
CVSS Score: 6.8 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/228; http://osvdb.org/36073; http://secunia.com/advisories/25284
CVE: CVE-2007-2697
Published: 2007-05-16
Description: The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service.
CVSS Score: 5.1 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/229; http://osvdb.org/36072; http://secunia.com/advisories/25284
CVE: CVE-2007-2698
Published: 2007-05-16
Description: The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information.
CVSS Score: 5.0 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/230; http://osvdb.org/36071; http://securitytracker.com/id?1018057
CVE: CVE-2007-2699
Published: 2007-05-16
Description: The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.
CVSS Score: 7.1 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/231; http://osvdb.org/36069; http://packetstormsecurity.com/files/153072/Oracle-Application-Testing-Suite-WebLogic-Server-Administration-Console-War-Deployment.html
CVE: CVE-2007-2700
Published: 2007-05-16
Description: The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information.
CVSS Score: 4.0 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/233; http://osvdb.org/36068; http://secunia.com/advisories/25284
CVE: CVE-2007-2701
Published: 2007-05-16
Description: The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected queue."
CVSS Score: 4.6 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/234; http://osvdb.org/36067; http://secunia.com/advisories/25284
CVE: CVE-2007-2702
Published: 2007-05-16
Description: Cross-site scripting (XSS) vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the rich text editor.
CVSS Score: 3.5 (LOW)
References: http://dev2dev.bea.com/pub/advisory/235; http://osvdb.org/36066; http://secunia.com/advisories/25284
CVE: CVE-2007-2703
Published: 2007-05-16
Description: BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description, which might allow remote authenticated users to access privileged resources.
CVSS Score: 3.6 (LOW)
References: http://dev2dev.bea.com/pub/advisory/236; http://osvdb.org/36065; http://secunia.com/advisories/25284
CVE: CVE-2007-2704
Published: 2007-05-16
Description: BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket.
CVSS Score: 5.4 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/237; http://osvdb.org/36064; http://secunia.com/advisories/25284
CVE: CVE-2007-2705
Published: 2007-05-16
Description: Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through SP6, when "deployed in an exploded format," allows remote attackers to list a WebLogic Workshop Directory (wlwdir) parent directory via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/239; http://osvdb.org/36063; http://www.securitytracker.com/id?1018059
CVE: CVE-2007-2706
Published: 2007-05-16
Description: PHP remote file inclusion vulnerability in maint/ftpmedia.php in Media Gallery 1.4.8a and earlier for Geeklog allows remote attackers to execute arbitrary PHP code via a URL in the _MG_CONF[path_html] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36239; http://secunia.com/advisories/25272; http://www.securityfocus.com/bid/23983
CVE: CVE-2007-2707
Published: 2007-05-16
Description: PHP remote file inclusion vulnerability in linksnet_linkslog_rss.php in Linksnet Newsfeed 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the dirpath_linksnet_newsfeed parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36050; http://secunia.com/advisories/25271; http://www.securityfocus.com/bid/23982
CVE: CVE-2007-2708
Published: 2007-05-16
Description: PHP remote file inclusion vulnerability in newsadmin.php in Feindt Computerservice News (News-Script) 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the action parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/23970; http://www.vupen.com/english/advisories/2007/1801; https://exchange.xforce.ibmcloud.com/vulnerabilities/34276
CVE: CVE-2007-2709
Published: 2007-05-16
Description: PHP remote file inclusion vulnerability in functions/prepend_adm.php in NagiosQL 2005 2.00 allows remote attackers to execute arbitrary PHP code via a URL in the SETS[path][physical] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36054; http://secunia.com/advisories/25274; http://www.securityfocus.com/bid/23966
CVE: CVE-2007-2710
Published: 2007-05-16
Description: PHP remote file inclusion vulnerability in functions/prepend_adm.php in NagiosQL 2.00-P00 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the SETS[path][IT] parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36054; http://secunia.com/advisories/25274; http://www.vupen.com/english/advisories/2007/1800
CVE: CVE-2007-2711
Published: 2007-05-16
Description: Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long string to TCP port 113.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/36053; http://secunia.com/advisories/25248; http://www.securityfocus.com/bid/23981
CVE: CVE-2007-2712
Published: 2007-05-16
Description: Unspecified vulnerability in MH Software Connect Daily before 3.3.3 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34782; http://secunia.com/advisories/25240; http://www.mhsoftware.com/changelog.html
CVE: CVE-2007-2713
Published: 2007-05-16
Description: ifdate 2.x sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to obtain administrative access via a direct request for the admin/ URI.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/36173; http://secunia.com/advisories/25237; http://securityreason.com/securityalert/2707
CVE: CVE-2007-2714
Published: 2007-05-16
Description: Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/062980.html; http://michaeldaw.org/alerts/alert-140507/; http://michaeldaw.org/alerts/alerts-140507-1/
CVE: CVE-2007-2715
Published: 2007-05-16
Description: Admin/users.php in Snaps! Gallery 1.4.4 allows remote attackers to change arbitrary usernames and passwords via the (1) username, or the (2) password and password2 parameters in an edit action.
CVSS Score: 10.0 (HIGH)
References: http://0day.2600.ir/exploits/3900; http://www.securityfocus.com/bid/23940; http://www.vupen.com/english/advisories/2007/1781
CVE: CVE-2007-2439
Published: 2007-05-16
Description: Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to cause a denial of service (device hang) and read data from a COM or LPT device via a DOS device name with an arbitrary extension.
CVSS Score: 9.4 (HIGH)
References: http://osvdb.org/36059; http://secunia.com/advisories/25286; http://www.caucho.com/resin-3.1/changes/changes.xtp
CVE: CVE-2007-2440
Published: 2007-05-16
Description: Directory traversal vulnerability in Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to read certain files via a .. (dot dot) in a URI containing a "\web-inf" sequence.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/36058; http://secunia.com/advisories/25286; http://www.caucho.com/resin-3.1/changes/changes.xtp
CVE: CVE-2007-2441
Published: 2007-05-16
Description: Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to obtain the system path via certain URLs associated with (1) deploying web applications or (2) displaying .xtp files.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/36057; http://secunia.com/advisories/25286; http://www.caucho.com/resin-3.1/changes/changes.xtp
CVE: CVE-2007-2716
Published: 2007-05-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in EQdkp 1.3.2c and earlier allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) listmembers.php and (2) stats.php. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6948&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3812&w=2; http://osvdb.org/36051
CVE: CVE-2007-2717
Published: 2007-05-16
Description: SQL injection vulnerability in shop/page.php in iGeneric (iG) Shop 1.4 allows remote attackers to execute arbitrary SQL commands via the type_id[] parameter, a different vector than CVE-2005-0537.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37910; http://www.securityfocus.com/bid/23949; https://www.exploit-db.com/exploits/3907
CVE: CVE-2007-2718
Published: 2007-05-16
Description: Cross-site scripting (XSS) vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via crafted STYLE tags.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9206&w=2; http://osvdb.org/36017; http://secunia.com/advisories/25250
CVE: CVE-2007-2719
Published: 2007-05-16
Description: Session fixation vulnerability in HP Systems Insight Manager (SIM) 4.2 and 5.0 SP4 and SP5 allows remote attackers to hijack web sessions by setting the JSESSIONID cookie.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01049713; http://osvdb.org/36061; http://secunia.com/advisories/25275
CVE: CVE-2007-2720
Published: 2007-05-16
Description: Group-Office before 2.16-13 does not properly validate user IDs, which allows remote attackers to obtain sensitive information via certain requests for (1) message.php and (2) messages.php in modules/email/. NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://group-office.svn.sourceforge.net/viewvc/group-office?view=rev&revision=261; http://secunia.com/advisories/25369; http://sourceforge.net/project/shownotes.php?release_id=498556&group_id=76359
CVE: CVE-2007-1689
Published: 2007-05-16
Description: Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows remote attackers to execute arbitrary code via long arguments to the (1) Get and (2) Set functions.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/36164; http://secunia.com/advisories/25290; http://www.kb.cert.org/vuls/id/983953
CVE: CVE-2007-2721
Published: 2007-05-16
Description: The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before 1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the heap via malformed image files, as originally demonstrated using imagemagick convert.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=413033; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=413041; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=413041%3Bmsg=88
CVE: CVE-2007-1173
Published: 2007-05-16
Description: Multiple buffer overflows in the CentennialIPTransferServer service (XFERWAN.EXE), as used by (1) Centennial Discovery 2006 Feature Pack 1, (2) Numara Asset Manager 8.0, and (3) Symantec Discovery 6.5, allow remote attackers to execute arbitrary code via long strings in a crafted TCP packet.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35076; http://secunia.com/advisories/24090; http://secunia.com/advisories/24281
CVE: CVE-2007-1898
Published: 2007-05-16
Description: formmail.php in Jetbox CMS 2.1 allows remote attackers to send arbitrary e-mails (spam) via modified recipient, _SETTINGS[allowed_email_hosts][], and subject parameters.
CVSS Score: 5.8 (MEDIUM)
References: http://securityreason.com/securityalert/2710; http://www.netvigilance.com/advisory0026; http://www.osvdb.org/34088
CVE: CVE-2007-2445
Published: 2007-05-16
Description: The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.
CVSS Score: 5.0 (MEDIUM)
References: http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html; http://docs.info.apple.com/article.html?artnum=307562; http://irrlicht.sourceforge.net/changes.txt
CVE: CVE-2007-2568
Published: 2007-05-16
Description: Multiple stack-based buffer overflows in VCDGear 3.55 allow user-assisted remote attackers to execute arbitrary code via a long (1) tag or (2) track type in a CUE file.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/36178; http://secunia.com/advisories/25117; http://secunia.com/secunia_research/2007-51/advisory/
CVE: CVE-2007-2722
Published: 2007-05-16
Description: Unspecified vulnerability in NewzCrawler 1.8 allows remote attackers to cause a denial of service (application instability) via certain invalid strings in the URL attribute of an ENCLOSURE element, as demonstrated by a "%s" sequence, a "%Y" sequence, a "%%" sequence, and an "n," sequence.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/39768; http://www.securityfocus.com/bid/23994; https://exchange.xforce.ibmcloud.com/vulnerabilities/34350
CVE: CVE-2007-2723
Published: 2007-05-16
Description: Media Player Classic 6.4.9.0 allows user-assisted remote attackers to cause a denial of service (web browser crash) via an "empty" .MPA file, which triggers a divide-by-zero error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://osvdb.org/37376; http://www.securityfocus.com/archive/1/468626/100/0/threaded; http://www.securityfocus.com/archive/1/468758/100/0/threaded