deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2133
Published: 2007-04-18
Description: Unspecified vulnerability in the PeopleSoft Enterprise Human Capital Management component in Oracle PeopleSoft Enterprise 8.9 has unknown impact and attack vectors, aka PSEHCM01.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.securityfocus.com/archive/1/466329/100/200/threaded
CVE: CVE-2007-2134
Published: 2007-04-18
Description: Unspecified vulnerability in the HTML Server in Oracle JD Edwards EnterpriseOne SP23_Q1 and 8.96.I1 has unknown impact and local attack vectors, aka JDE01.
CVSS Score: 7.2 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.securityfocus.com/archive/1/466329/100/200/threaded
CVE: CVE-2007-1009
Published: 2007-04-19
Description: Macrovision InstallAnywhere Enterprise before 8.0.1 uses the InstallScript.iap_xml configuration file without integrity protection to verify authorization for installing an application, which allows local users to perform unauthorized installations by removing the (1) password or (2) serial number verification sections from this file.
CVSS Score: 4.6 (MEDIUM)
References: http://securityreason.com/securityalert/2596; http://www.securityfocus.com/archive/1/466035/100/0/threaded; http://www.securityfocus.com/bid/22643
CVE: CVE-2007-1681
Published: 2007-04-19
Description: Format string vulnerability in libwebconsole_services.so in Sun Java Web Console 2.2.2 through 2.2.5 allows remote attackers to cause a denial of service (application crash), obtain sensitive information, and possibly execute arbitrary code via unspecified vectors during a failed login attempt, related to syslog.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34902; http://secunia.com/advisories/24927; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102854-1
CVE: CVE-2007-1690
Published: 2007-04-19
Description: Multiple stack-based buffer overflows in Second Sight Software ActiveGS ActiveX control (ActiveGS.ocx) allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34326; http://secunia.com/advisories/24960; http://www.kb.cert.org/vuls/id/118737
CVE: CVE-2007-1691
Published: 2007-04-19
Description: Stack-based buffer overflow in Second Sight Software ActiveMod ActiveX control (ActiveMod.ocx) allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34325; http://secunia.com/advisories/24928; http://www.kb.cert.org/vuls/id/962305
CVE: CVE-2007-2140
Published: 2007-04-19
Description: PHP remote file inclusion vulnerability in everything.php in Franklin Huang Flip (aka Flip-search-add-on) 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the incpath parameter.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-May/001576.html; http://www.osvdb.org/34147; http://www.securityfocus.com/archive/1/465738/100/0/threaded
CVE: CVE-2007-2141
Published: 2007-04-19
Description: Direct static code injection vulnerability in shoutbox.php in ShoutPro 1.5.2 allows remote attackers to inject arbitrary PHP code into shouts.php via the shout parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34999; http://secunia.com/advisories/24939; http://securityreason.com/securityalert/2593
CVE: CVE-2007-2142
Published: 2007-04-19
Description: Multiple PHP remote file inclusion vulnerabilities in AjPortal2Php allow remote attackers to execute arbitrary PHP code via a URL in the PagePrefix parameter to (1) begin.inc.php, (2) connection.inc.php, (3) events.inc.php, (4) footer.inc.php, (5) header.inc.php, (6) menuleft.inc.php, or (7) pages.inc.php in includes/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37565; http://osvdb.org/37566; http://osvdb.org/37567
CVE: CVE-2007-2143
Published: 2007-04-19
Description: PHP remote file inclusion vulnerability in index.php in the Be2004-2 template for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37572; http://www.securityfocus.com/bid/23549; https://exchange.xforce.ibmcloud.com/vulnerabilities/33728
CVE: CVE-2007-2144
Published: 2007-04-19
Description: PHP remote file inclusion vulnerability in includes/CAltInstaller.php in the JoomlaPack (com_jpack) 1.0.4a2 RE component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/37573; http://www.securityfocus.com/bid/23529; http://www.vupen.com/english/advisories/2007/1429
CVE: CVE-2007-2145
Published: 2007-04-19
Description: The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the input parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2007/1430; https://www.exploit-db.com/exploits/3754; http://www.vupen.com/english/advisories/2007/1430
CVE: CVE-2007-2146
Published: 2007-04-19
Description: The imagecomments function in classes.php in MiniGal b13 allow remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the (1) name or (2) email parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2007/1430; http://www.vupen.com/english/advisories/2007/1430
CVE: CVE-2007-2147
Published: 2007-04-19
Description: admin/options.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier does not check for administrative credentials, which allows remote attackers to read and modify the classes/vars.php and classes/varstuff.php configuration files via direct requests.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24873; http://securityreason.com/securityalert/2595; http://www.securityfocus.com/archive/1/465547/100/0/threaded
CVE: CVE-2007-2148
Published: 2007-04-19
Description: Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html parameter, as demonstrated by head.html and foot.html, which are included and executed upon a direct request for index.php.  NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/24873; http://securityreason.com/securityalert/2595; http://www.securityfocus.com/archive/1/465547/100/0/threaded
CVE: CVE-2007-2149
Published: 2007-04-19
Description: Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier stores usernames and unencrypted passwords in (1) classes/vars.php and (2) classes/varstuff.php, and recommends 0666 or 0777 permissions for these files, which allows local users to gain privileges by reading the files, and allows remote attackers to obtain credentials via a direct request for admin/options.php.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24873; http://securityreason.com/securityalert/2595; http://www.securityfocus.com/archive/1/465547/100/0/threaded
CVE: CVE-2007-2150
Published: 2007-04-19
Description: BlueArc-FTPD in BlueArc Titan 2x00 devices with firmware 4.2.944b allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command, a variant of CVE-1999-0017.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35414; http://www.securityfocus.com/archive/1/466025/100/0/threaded; http://www.securityfocus.com/bid/23540
CVE: CVE-2007-2151
Published: 2007-04-19
Description: The administration server in McAfee e-Business Server before 8.1.1 and 8.5.x before 8.5.2 allows remote attackers to cause a denial of service (service crash) via a large length value in a malformed authentication packet, which triggers a heap over-read.
CVSS Score: 5.0 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=516; http://secunia.com/advisories/24893; http://www.securityfocus.com/bid/23544
CVE: CVE-2007-2152
Published: 2007-04-19
Description: Buffer overflow in the On-Access Scanner in McAfee VirusScan Enterprise before 8.0i Patch 12 allows user-assisted remote attackers to execute arbitrary code via a long filename containing multi-byte (Unicode) characters.
CVSS Score: 7.9 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=515; http://secunia.com/advisories/24914; http://www.kb.cert.org/vuls/id/324929
CVE: CVE-2007-2153
Published: 2007-04-19
Description: Cross-site scripting (XSS) vulnerability in atmail.php in @Mail 5.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2594; http://www.majorsecurity.de/index_2.php?major_rls=major_rls43; http://www.securityfocus.com/archive/1/465378/100/100/threaded
CVE: CVE-2007-2154
Published: 2007-04-19
Description: PHP remote file inclusion vulnerability in services/samples/inclusionService.php in Cabron Connector 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the CabronServiceFolder parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37574; http://www.securityfocus.com/bid/23531; http://www.vupen.com/english/advisories/2007/1431
CVE: CVE-2007-2155
Published: 2007-04-19
Description: Directory traversal vulnerability in template.php in in phpFaber TopSites 3 allows remote attackers to read arbitrary files via a .. (dot dot) in the modify parameter in a template action to admin/index.php.
CVSS Score: 7.8 (HIGH)
References: http://www.attrition.org/pipermail/vim/2007-April/001538.html; http://www.phpfaber.com/m/News/phpfaber_topsites_v_3_3-58.html; http://www.securityfocus.com/archive/1/465339/100/100/threaded
CVE: CVE-2007-2156
Published: 2007-04-19
Description: Multiple PHP remote file inclusion vulnerabilities in Rezervi Generic 0.9 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to (1) datumVonDatumBis.inc.php, (2) footer.inc.php, (3) header.inc.php, and (4) stylesheets.php in templates/; and (5) wochenuebersicht.inc.php, (6) monatsuebersicht.inc.php, (7) jahresuebersicht.inc.php, and (8) tagesuebersicht.inc.php in belegungsplan/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35006; http://osvdb.org/35007; http://osvdb.org/35008
CVE: CVE-2007-2157
Published: 2007-04-19
Description: Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35016; http://secunia.com/advisories/24899; http://www.securityfocus.com/bid/23553
CVE: CVE-2007-2158
Published: 2007-04-19
Description: PHP remote file inclusion vulnerability in index.php in jGallery 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the G_JGALL[inc_path] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24956; http://www.vupen.com/english/advisories/2007/1445; https://exchange.xforce.ibmcloud.com/vulnerabilities/33738
CVE: CVE-2007-1972
Published: 2007-04-22
Description: PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP parameters.  NOTE: the vendor disputes this vulnerability, stating that it does not exist when the system is properly configured
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2599; http://www.securityfocus.com/archive/1/466223/100/0/threaded; http://www.securityfocus.com/archive/1/466274/100/0/threaded
CVE: CVE-2007-2136
Published: 2007-04-22
Description: Stack-based buffer overflow in bgs_sdservice.exe in BMC Patrol PerformAgent allows remote attackers to execute arbitrary code by connecting to TCP port 10128 and sending certain XDR data, which is not properly parsed.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24937; http://securityreason.com/securityalert/2598; http://www.securityfocus.com/archive/1/466222/100/0/threaded
CVE: CVE-2007-2137
Published: 2007-04-22
Description: Heap-based buffer overflow in kde.dll in IBM Tivoli Monitoring Express 6.1.0 before Fix Pack 2, as used in Tivoli Universal Agent, Windows OS Monitoring agent, and Enterprise Portal Server, allows remote attackers to execute arbitrary code by sending a long string to a certain TCP port.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24938; http://securityreason.com/securityalert/2597; http://www-1.ibm.com/support/docview.wss?uid=swg24012341
CVE: CVE-2007-2159
Published: 2007-04-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Database Administration (dba) module 4.6.x-*, and before 4.7.x-1.2 in the 4.7.x-1.* series, for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors relating to (1) direct display of data from the database and (2) other portions of the user interface.
CVSS Score: 4.3 (MEDIUM)
References: http://drupal.org/node/135549; http://osvdb.org/34961; http://secunia.com/advisories/24848
CVE: CVE-2007-2160
Published: 2007-04-22
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Database Administration (dba) module 4.6.x-*, and before 4.7.x-1.2 in the 4.7.x-1.* series, for Drupal allow remote attackers to perform unauthorized actions as an arbitrary user, a related issue to CVE-2006-5476.
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/135549; http://osvdb.org/34962; http://secunia.com/advisories/24848
CVE: CVE-2007-2161
Published: 2007-04-22
Description: Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (browser hang) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/43314; http://www.securityfocus.com/archive/1/466017/100/0/threaded; http://www.securityfocus.com/archive/1/466043/100/0/threaded
CVE: CVE-2007-2162
Published: 2007-04-22
Description: (1) Mozilla Firefox 2.0.0.3 and (2) GNU IceWeasel 2.0.0.3 allow remote attackers to cause a denial of service (browser crash or system hang) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/archive/1/466017/100/0/threaded; http://www.securityfocus.com/archive/1/466147/100/0/threaded; http://www.securityfocus.com/archive/1/466220/100/0/threaded
CVE: CVE-2007-2163
Published: 2007-04-22
Description: Apple Safari allows remote attackers to cause a denial of service (browser crash) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/466017/100/0/threaded; http://www.securityfocus.com/archive/1/466043/100/0/threaded; http://www.securityfocus.com/archive/1/466017/100/0/threaded
CVE: CVE-2007-2164
Published: 2007-04-22
Description: Konqueror 3.5.5 release 45.4 allows remote attackers to cause a denial of service (browser crash or abort) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/2600; http://www.securityfocus.com/archive/1/466017/100/0/threaded; http://www.securityfocus.com/archive/1/466147/100/0/threaded
CVE: CVE-2007-2165
Published: 2007-04-22
Description: The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.
CVSS Score: 5.1 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419255; http://bugs.proftpd.org/show_bug.cgi?id=2922; http://osvdb.org/34602
CVE: CVE-2007-2166
Published: 2007-04-22
Description: PHP remote file inclusion vulnerability in administration/user/lib/group.inc.php in OpenSurveyPilot (osp) 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfgPathToProjectAdmin parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osp.cvs.sourceforge.net/osp/osp12/administration/user/lib/group.inc.php?revision=1.1.1.1&view=markup; http://osvdb.org/35022; http://secunia.com/advisories/24915
CVE: CVE-2007-2167
Published: 2007-04-22
Description: Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number parameter in an update action.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24955; http://www.securityfocus.com/bid/23573; http://www.vupen.com/english/advisories/2007/1447
CVE: CVE-2007-2168
Published: 2007-04-22
Description: Static code injection vulnerability in process.php in AimStats 3.2 and earlier allows remote attackers to inject PHP code into config.php via the databasehost parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24955; http://www.securityfocus.com/bid/23573; http://www.vupen.com/english/advisories/2007/1447
CVE: CVE-2007-2169
Published: 2007-04-22
Description: Static code injection vulnerability in add.php in Mozzers SubSystem 1.0 allows remote attackers to inject PHP code into subs.php via the (1) Sub-name or (2) Sub-url field.  NOTE: an earlier report indicated that the add action can be reached through a request to index.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/23548; http://www.vupen.com/english/advisories/2007/1446; https://exchange.xforce.ibmcloud.com/vulnerabilities/33739
CVE: CVE-2007-2172
Published: 2007-04-22
Description: A typo in Linux kernel 2.6 before 2.6.21-rc6 and 2.4 before 2.4.35 causes RTA_MAX to be used as an array size instead of RTN_MAX, which leads to an "out of bound access" by the (1) dn_fib_props (dn_fib.c, DECNet) and (2) fib_props (fib_semantics.c, IPv4) functions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.21-rc6; http://rhn.redhat.com/errata/RHSA-2007-0488.html; http://secunia.com/advisories/25068
CVE: CVE-2007-0443
Published: 2007-04-24
Description: Multiple buffer overflows in the CDDBControl ActiveX control in Gracenote CDDB before 20070418 allow remote attackers to execute arbitrary code via long values for certain Proxy configuration parameters.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/34327; http://secunia.com/advisories/22924; http://www.gracenote.com/corporate/FAQs.html/faqset=update/page=0
CVE: CVE-2007-0725
Published: 2007-04-24
Description: Buffer overflow in the AirPortDriver module for AirPort in Apple Mac OS X 10.3.9 through 10.4.9, when running on hardware with the original AirPort wireless card, allows local users to execute arbitrary code by "sending malformed control commands."
CVSS Score: 7.2 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0729
Published: 2007-04-24
Description: Apple File Protocol (AFP) Client in Apple Mac OS X 10.3.9 through 10.4.9 does not properly clean the environment before executing commands, which allows local users to gain privileges by setting unspecified environment variables.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-0732
Published: 2007-04-24
Description: Unspecified vulnerability in the CoreServices daemon in CarbonCore in Apple Mac OS X 10.4 through 10.4.9 allows local users to gain privileges via unspecified vectors involving "obtaining a send right to [the] Mach task port."
CVSS Score: 7.2 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://secunia.com/advisories/24966
CVE: CVE-2007-1353
Published: 2007-04-24
Description: The setsockopt function in the L2CAP and HCI Bluetooth support in the Linux kernel before 2.4.34.3 allows context-dependent attackers to read kernel memory and obtain sensitive information via unspecified vectors involving the copy_from_user function accessing an uninitialized stack buffer.
CVSS Score: 2.1 (LOW)
References: http://rhn.redhat.com/errata/RHSA-2007-0488.html; http://secunia.com/advisories/24976; http://secunia.com/advisories/25596
CVE: CVE-2007-2173
Published: 2007-04-24
Description: Eval injection vulnerability in (1) courier-imapd.indirect and (2) courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2, and 4.1.x before 4.1.2-r1, on Gentoo Linux allows remote attackers to execute arbitrary commands via the XMAILDIR variable, related to the LOGINRUN variable.
CVSS Score: 10.0 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=168196; http://osvdb.org/35274; http://secunia.com/advisories/24963
CVE: CVE-2007-2174
Published: 2007-04-24
Description: The IOCTL handling in srescan.sys in the ZoneAlarm Spyware Removal Engine (SRE) in Check Point ZoneAlarm before 5.0.156.0 allows local users to execute arbitrary code via certain IOCTL lrp parameter addresses.
CVSS Score: 7.2 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=517; http://secunia.com/advisories/24986; http://www.securityfocus.com/archive/1/466656/100/0/threaded
CVE: CVE-2007-2175
Published: 2007-04-24
Description: Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the "PWN 2 0WN" contest at CanSecWest 2007.
CVSS Score: 7.6 (HIGH)
References: http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow; http://docs.info.apple.com/article.html?artnum=305446; http://lists.apple.com/archives/security-announce/2007/May/msg00001.html
CVE: CVE-2007-2176
Published: 2007-04-24
Description: Unspecified vulnerability in Mozilla Firefox allows remote attackers to execute arbitrary code via unspecified vectors involving Javascript errors.  NOTE: this might be the same issue as CVE-2007-2175.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/38857; http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/; http://osvdb.org/38857
CVE: CVE-2007-2177
Published: 2007-04-24
Description: Stack-based buffer overflow in the Microgaming Download Helper ActiveX control (dlhelper.dll) before 7.2.0.19, and the WebHandler Class control, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34329; http://secunia.com/advisories/25017; http://www.kb.cert.org/vuls/id/184473