deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-3809
Published: 2007-07-17
Description: Multiple SQL injection vulnerabilities in Prozilla Directory Script allow remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action to directory.php, and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36512; http://www.securityfocus.com/bid/24915; https://exchange.xforce.ibmcloud.com/vulnerabilities/35425
CVE: CVE-2007-3810
Published: 2007-07-17
Description: SQL injection vulnerability in index.php in Realtor 747 allows remote attackers to execute arbitrary SQL commands via the categoryid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36244; http://secunia.com/advisories/26068; http://www.securityfocus.com/bid/24916
CVE: CVE-2007-3811
Published: 2007-07-17
Description: Multiple SQL injection vulnerabilities in eSyndiCat allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to news.php or (2) the name parameter to page.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36266; http://osvdb.org/36267; http://www.securityfocus.com/bid/24908
CVE: CVE-2007-3812
Published: 2007-07-17
Description: SQL injection vulnerability in forums.php in CMScout 1.23 and earlier allows remote attackers to execute arbitrary SQL commands via the f parameter in a forums action to index.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36242; http://packetstorm.linuxsecurity.com/0707-exploits/cmscout.txt; http://secunia.com/advisories/26026
CVE: CVE-2007-3813
Published: 2007-07-17
Description: PHP remote file inclusion vulnerability in include/user.php in the NoBoard BETA module for MKPortal allows remote attackers to execute arbitrary PHP code via a URL in the MK_PATH parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36265; https://exchange.xforce.ibmcloud.com/vulnerabilities/35426; https://www.exploit-db.com/exploits/4180
CVE: CVE-2007-3814
Published: 2007-07-17
Description: Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the idurlo field in the delete_urlo function in (a) index.php in the urlobox module; the iden field in the (2) update_file and (3) del_file functions in (b) index.php in the reviews module; the (4) idnews field in the delete_news function and the (5) idcomm field in the del_comment function in (c) index.php in the news module; the (6) idcomm field in the delete_comments function in (d) index.php in the gallery module; the iden field in the (7) edit_file, (8) update_file, and (9) del_file functions in index.php in the gallery module; the (10) ide and (11) cat fields in the slide_update function in index.php in the gallery module; the iden field in the (12) update_file and (13) del_file functions in (d) index.php in the downloads module; and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/41719; http://osvdb.org/41720; http://osvdb.org/41721
CVE: CVE-2007-3815
Published: 2007-07-17
Description: Buffer overflow in pirs32.exe in Poslovni informator Republike Slovenije (PIRS) 2007 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long search string in certain fields in the GUI.  NOTE: this may cross privilege boundaries if PIRS is used by data-entry workers who do not have full access to the underlying Windows environment.
CVSS Score: 4.9 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064627.html; http://osvdb.org/38697; http://securityreason.com/securityalert/2898
CVE: CVE-2007-3816
Published: 2007-07-17
Description: JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates.  NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed.  However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064768.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064933.html; http://seclists.org/bugtraq/2007/Jul/0206.html
CVE: CVE-2007-3817
Published: 2007-07-17
Description: Cross-site scripting (XSS) vulnerability in the LoginToboggan module 4.7.x-1.0, 4.7.x-1.x-dev, and 5.x-1.x-dev before 20070712 for Drupal, when configured to display a "Log out" link, allows remote attackers to inject arbitrary web script or HTML via a crafted username.  NOTE: Drupal sanitizes the username by removing certain characters, so this might not be a vulnerability on default installations.
CVSS Score: 4.3 (MEDIUM)
References: http://drupal.org/node/158921; http://osvdb.org/36343; http://secunia.com/advisories/26028
CVE: CVE-2007-3818
Published: 2007-07-17
Description: Cross-site scripting (XSS) vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated users with "administer blocks" permission to inject arbitrary JavaScript and gain privileges via "the message displayed above the default user login block."
CVSS Score: 3.5 (LOW)
References: http://drupal.org/node/158921; http://osvdb.org/37010; http://drupal.org/node/158921
CVE: CVE-2007-3819
Published: 2007-07-17
Description: Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed.
CVSS Score: 5.0 (MEDIUM)
References: http://alt.swiecki.net/oper1.html; http://osvdb.org/38122; http://secunia.com/advisories/26074
CVE: CVE-2007-3820
Published: 2007-07-17
Description: konqueror/konq_combo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed.
CVSS Score: 2.6 (LOW)
References: http://alt.swiecki.net/oper1.html; http://osvdb.org/37242; http://secunia.com/advisories/26091
CVE: CVE-2007-3821
Published: 2007-07-17
Description: Cross-site request forgery (CSRF) vulnerability in Webcit before 7.11 allows remote attackers to modify configurations and perform other actions as arbitrary users via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38181; http://secunia.com/advisories/26090; http://securityreason.com/securityalert/2890
CVE: CVE-2007-3822
Published: 2007-07-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via (1) the who parameter to showuser; and other vectors involving (2) calendar mode, (3) bulletin board mode, (4) room names, and (5) uploaded file names.
CVSS Score: 2.6 (LOW)
References: http://osvdb.org/38176; http://osvdb.org/38177; http://osvdb.org/38178
CVE: CVE-2007-3823
Published: 2007-07-17
Description: The Logging Server (Logsrv.exe) in IPSwitch WS_FTP 7.5.29.0 allows remote attackers to cause a denial of service (daemon crash) by sending a crafted packet containing a long string to port 5151/udp.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.org/0707-advisories/wsftp75290-dos.txt; http://secunia.com/advisories/26040; http://www.osvdb.org/36218
CVE: CVE-2007-3824
Published: 2007-07-17
Description: SQL injection vulnerability in katgoster.asp in MzK Blog (tr) allows remote attackers to execute arbitrary SQL commands via the katID parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/36257; http://secunia.com/advisories/26070; http://www.packetstormsecurity.org/0707-exploits/mzkblog-sql.txt
CVE: CVE-2007-3826
Published: 2007-07-17
Description: Microsoft Internet Explorer 7 on Windows XP SP2 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via repeated document.open function calls after a user requests a new page, but before the onBeforeUnload function is called.
CVSS Score: 9.3 (HIGH)
References: http://lcamtuf.coredump.cx/ietrap3/; http://osvdb.org/38212; http://secunia.com/advisories/26069
CVE: CVE-2007-3827
Published: 2007-07-17
Description: Mozilla Firefox allows for cookies to be set with a null domain (aka "domainless cookies"), which allows remote attackers to pass information between arbitrary domains and track user activity, as demonstrated by the domain attribute in the document.cookie variable in a javascript: window.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/2892; http://www.securityfocus.com/archive/1/473702/100/0/threaded; http://securityreason.com/securityalert/2892
CVE: CVE-2007-3828
Published: 2007-07-17
Description: Unspecified vulnerability in mDNSResponder in Apple Mac OS X allows remote attackers to execute arbitrary code via unspecified vectors, a related issue to CVE-2007-2386.
CVSS Score: 10.0 (HIGH)
References: http://infosecsellout.blogspot.com/2007/07/oh-look-apple-worm.html; http://www.securityfocus.com/bid/24924; http://www.securitytracker.com/id?1018399
CVE: CVE-2007-3829
Published: 2007-07-17
Description: Multiple stack-based buffer overflows in (a) InterActual Player 2.60.12.0717 and (b) Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via a (1) long FailURL attribute in the IAMCE ActiveX Control (IAMCE.dll) or a (2) long URLCode attribute in the IAKey ActiveX Control (IAKey.dll).  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/37717; http://osvdb.org/37718; http://secunia.com/advisories/25718
CVE: CVE-2007-3830
Published: 2007-07-17
Description: Cross-site scripting (XSS) vulnerability in alert.php in ISS Proventia Network IPS GX5108 1.3 and GX5008 1.5 allows remote attackers to inject arbitrary web script or HTML via the reminder parameter.
CVSS Score: 3.5 (LOW)
References: http://osvdb.org/36475; http://secunia.com/advisories/25979; http://www.sybsecurity.com/hack-proventia-1.pdf
CVE: CVE-2007-3831
Published: 2007-07-17
Description: PHP remote file inclusion in main.php in ISS Proventia Network IPS GX5108 1.3 and GX5008 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/36474; http://secunia.com/advisories/25979; http://www.sybsecurity.com/hack-proventia-1.pdf
CVE: CVE-2007-3832
Published: 2007-07-17
Description: Buffer overflow in the AOL Instant Messenger (AIM) protocol handler in AIM.DLL in Cerulean Studios Trillian allows remote attackers to execute arbitrary code via a malformed aim: URI, as demonstrated by a long URI beginning with the aim:///#1111111/ substring.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0356.html; http://secunia.com/advisories/26086; http://www.kb.cert.org/vuls/id/786920
CVE: CVE-2007-3833
Published: 2007-07-17
Description: The AOL Instant Messenger (AIM) protocol handler in Cerulean Studios Trillian allows remote attackers to create files with arbitrary contents via certain aim: URIs, as demonstrated by a URI that begins with the "aim: &c:\" substring and contains a full pathname in the ini field.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/26086; http://www.securityfocus.com/bid/24927; http://www.vupen.com/english/advisories/2007/2546
CVE: CVE-2007-3834
Published: 2007-07-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ex Libris ALEPH allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a URL that can be discovered through a keyword search.  NOTE: this may be related to the MetaLib XSS issue, CVE-2007-3835.
CVSS Score: 4.3 (MEDIUM)
References: http://escarpment.net/exlibris.txt; http://secunia.com/advisories/26041; http://securityreason.com/securityalert/2889
CVE: CVE-2007-3835
Published: 2007-07-17
Description: Cross-site scripting (XSS) vulnerability in Ex Libris MetaLib 3.13 and 4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a resource id that can be discovered through a search.
CVSS Score: 2.6 (LOW)
References: http://escarpment.net/exlibris.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064666.html; http://osvdb.org/36877
CVE: CVE-2007-3836
Published: 2007-07-17
Description: Format string vulnerability in HydraIRC 0.3.151 allows remote attackers to cause a denial of service via format string specifiers in certain data related to failed DCC file transfer negotiation.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/38623; http://www.portcullis-security.com/uplds/advisories/HydraIRC_fmt-07_008.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/35409
CVE: CVE-2007-3837
Published: 2007-07-17
Description: Heap-based buffer overflow in HydraIRC 0.3.151 allows remote IRC servers to cause a denial of service (application crash) via a long CTCP request message containing '%' (percent) characters.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/38625; http://www.portcullis-security.com/uplds/advisories/HydraIRC_bof-07_007.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/35408
CVE: CVE-2007-3838
Published: 2007-07-17
Description: Cross-site scripting (XSS) vulnerability in takeprofedit.php in TBDev.NET DR 11-10-05-BETA-SF1:111005 and earlier allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of a SCRIPT element in the avatar parameter.  NOTE: this may be related to the tracker program in the Janitor package.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/26120; http://www.securityfocus.com/bid/24923; http://www.securityfocus.com/data/vulnerabilities/exploits/24923.txt
CVE: CVE-2007-3839
Published: 2007-07-17
Description: Cross-site scripting (XSS) vulnerability in takeprofedit.php in TBDev.NET DR 010306 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the avatar parameter.  NOTE: this may be related to the tracker program in the Janitor package.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/26120; http://www.securityfocus.com/bid/24923; http://www.securityfocus.com/data/vulnerabilities/exploits/24923.txt
CVE: CVE-2007-3840
Published: 2007-07-17
Description: SQL injection vulnerability in referralUrl.php in Traffic Stats allows remote attackers to execute arbitrary SQL commands via the offset parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/36258; http://www.securityfocus.com/bid/24925; https://www.exploit-db.com/exploits/4187
CVE: CVE-2007-3841
Published: 2007-07-17
Description: Unspecified vulnerability in Pidgin (formerly Gaim) 2.0.2 for Linux allows remote authenticated users, who are listed in a users list, to execute certain commands via unspecified vectors, aka ZD-00000035. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.
CVSS Score: 9.0 (HIGH)
References: http://www.securityfocus.com/bid/24904; http://www.wslabi.com/wabisabilabi/initPublishedBid.do?; http://www.securityfocus.com/bid/24904
CVE: CVE-2007-3842
Published: 2007-07-17
Description: Cross-site scripting (XSS) vulnerability in the 8e6 R3000 Enterprise Filter before 2.0.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this may be the same as CVE-2007-2970.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36706; http://www.8e6.com/products/R3000/docs/readme_r3000_2.0.05.pdf; http://osvdb.org/36706
CVE: CVE-2007-3796
Published: 2007-07-17
Description: The password reset feature in the Spam Quarantine HTTP interface for MailMarshal SMTP 6.2.0.x before 6.2.1 allows remote attackers to modify arbitrary account information via a UserId variable with a large amount of trailing whitespace followed by a malicious value, which triggers SQL buffer truncation due to length inconsistencies between variables.
CVSS Score: 7.6 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064676.html; http://secunia.com/advisories/26018; http://securityreason.com/securityalert/2895
CVE: CVE-2007-3564
Published: 2007-07-18
Description: libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/26104; http://secunia.com/advisories/26108; http://secunia.com/advisories/26128
CVE: CVE-2007-3734
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 2.0.0.5 and Thunderbird before 2.0.0.5 allow remote attackers to cause a denial of service (crash) via unspecified vectors that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
References: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt; ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
CVE: CVE-2007-3735
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 2.0.0.5 and Thunderbird before 2.0.0.5 allow remote attackers to cause a denial of service (crash) via unspecified vectors that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
References: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt; ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
CVE: CVE-2007-3736
Published: 2007-07-18
Description: Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.5 allows remote attackers to inject arbitrary web script "into another site's context" via a "timing issue" involving the (1) addEventListener or (2) setTimeout function, probably by setting events that activate after the context has changed.
CVSS Score: 4.3 (MEDIUM)
References: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt; ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
CVE: CVE-2007-3737
Published: 2007-07-18
Description: Mozilla Firefox before 2.0.0.5 allows remote attackers to execute arbitrary code with chrome privileges by calling an event handler from an unspecified "element outside of a document."
CVSS Score: 9.3 (HIGH)
References: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt; ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
CVE: CVE-2007-3738
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.5 allow remote attackers to execute arbitrary code via a crafted XPCNativeWrapper.
CVSS Score: 9.3 (HIGH)
References: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt; ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
CVE: CVE-2007-3762
Published: 2007-07-18
Description: Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to execute arbitrary code by sending a long (1) voice or (2) video RTP frame.
CVSS Score: 9.3 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=185713; http://ftp.digium.com/pub/asa/ASA-2007-014.pdf; http://secunia.com/advisories/26099
CVE: CVE-2007-3763
Published: 2007-07-18
Description: The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted (1) LAGRQ or (2) LAGRP frame that contains information elements of IAX frames, which results in a NULL pointer dereference when Asterisk does not properly set an associated variable.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=185713; http://ftp.digium.com/pub/asa/ASA-2007-015.pdf; http://secunia.com/advisories/26099
CVE: CVE-2007-3764
Published: 2007-07-18
Description: The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a certain data length value in a crafted packet, which results in an "overly large memcpy."
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=185713; http://ftp.digium.com/pub/asa/ASA-2007-016.pdf; http://secunia.com/advisories/26099
CVE: CVE-2007-3765
Published: 2007-07-18
Description: The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
CVSS Score: 5.0 (MEDIUM)
References: http://ftp.digium.com/pub/asa/ASA-2007-017.pdf; http://secunia.com/advisories/26099; http://www.securityfocus.com/bid/24950
CVE: CVE-2007-3853
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to have unknown impact via (1) DBMS_JAVA_TEST in the JavaVM component (DB01), (2) Oracle Text component (DB09), and (3) MDSYS.SDO_GEOR_INT in the Spatial component (DB15).  NOTE: a reliable researcher claims that DB01 is SQL injection in DBMS_PRVTAQIS.
CVSS Score: 6.5 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3854
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12).  NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.
CVSS Score: 5.5 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3855
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to have an unknown impact via (1) SYS.DBMS_DRS in the DataGuard component (DB03), (2) SYS.DBMS_STANDARD in the PL/SQL component (DB10), (3) MDSYS.RTREE_IDX in the Spatial component (DB16), and (4) SQL Compiler (DB17).  NOTE: a reliable researcher claims that DB17 is for using Views to perform unauthorized insert, update, or delete actions.
CVSS Score: 6.5 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://rawlab.mindcreations.com/codes/exp/oracle/bunkerview.sql; http://secunia.com/advisories/26114