deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1467
Published: 2007-03-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) PreSearch.html and (2) PreSearch.class in Cisco Secure Access Control Server (ACS), VPN Client, Unified Personal Communicator, MeetingPlace, Unified MeetingPlace, Unified MeetingPlace Express, CallManager, IP Communicator, Unified Video Advantage, Unified Videoconferencing 35xx products, Unified Videoconferencing Manager, WAN Manager, Security Device Manager, Network Analysis Module (NAM), CiscoWorks and related products, Wireless LAN Solution Engine (WLSE), 2006 Wireless LAN Controllers (WLC), and Wireless Control System (WCS) allow remote attackers to inject arbitrary web script or HTML via the text field of the search form.
CVSS Score: 3.5 (LOW)
References: http://secunia.com/advisories/24499; http://securityreason.com/securityalert/2437; http://www.cisco.com/en/US/products/products_security_response09186a0080803fe4.html
CVE: CVE-2007-1468
Published: 2007-03-16
Description: Cross-site scripting (XSS) vulnerability in IBM Rational ClearQuest (CQ) Web 7.0.0.0 allows remote attackers to inject arbitrary web script or HTML via an attachment to a defect log entry.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/34346; http://secunia.com/advisories/24523; http://securityreason.com/securityalert/2442
CVE: CVE-2007-1469
Published: 2007-03-16
Description: SQL injection vulnerability in gallery.asp in Absolute Image Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a viewimage action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/24543; http://securityreason.com/securityalert/2429; http://www.osvdb.org/34239
CVE: CVE-2007-1470
Published: 2007-03-16
Description: Multiple buffer overflows in LIBFtp 5.0 allow user-assisted remote attackers to execute arbitrary code via certain long arguments to the (1) FtpArchie, (2) FtpDebugDebug, (3) FtpOpenDir, (4) FtpSize, or (5) FtpChmod function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/35038; http://securityreason.com/securityalert/2441; http://www.securityfocus.com/archive/1/462954/100/0/threaded
CVE: CVE-2007-1471
Published: 2007-03-16
Description: admin/default.asp in Orion-Blog 2.0 allows remote attackers to bypass authentication controls and gain privileges via a direct URL request for admin/AdminBlogNewsEdit.asp.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35039; http://securityreason.com/securityalert/2440; http://www.securityfocus.com/archive/1/462920/100/0/threaded
CVE: CVE-2007-1472
Published: 2007-03-16
Description: Variable overwrite vulnerability in groupit/base/groupit.start.inc in Groupit 2.00b5 allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via arguments that are written to $_GLOBALS, as demonstrated using a URL in the c_basepath parameter to (1) content.php, (2) userprofile.php, (3) password.php, (4) dispatch.php, and (5) deliver.php in html/, and possibly (6) load.inc.php and related files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://advisories.echo.or.id/adv/adv75-theday-2007.txt; http://osvdb.org/34476; http://securityreason.com/securityalert/2428
CVE: CVE-2007-1473
Published: 2007-03-16
Description: Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selection box, allows remote attackers to inject arbitrary web script or HTML via the new_lang parameter to login.php.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.horde.org/archives/announce/2007/000315.html; http://secunia.com/advisories/24528; http://secunia.com/advisories/24995
CVE: CVE-2007-1474
Published: 2007-03-16
Description: Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files and possibly gain privileges via multiple space-delimited pathnames.
CVSS Score: 6.8 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=489; http://lists.horde.org/archives/announce/2007/000315.html; http://secunia.com/advisories/27565
CVE: CVE-2007-1475
Published: 2007-03-16
Description: Multiple buffer overflows in the (1) ibase_connect and (2) ibase_pconnect functions in the interbase extension in PHP 4.4.6 and earlier allow context-dependent attackers to execute arbitrary code via a long argument.
CVSS Score: 5.4 (MEDIUM)
References: http://retrogod.altervista.org/php_446_ibase_connect_bof.html; http://secunia.com/advisories/24529; http://securityreason.com/securityalert/2439
CVE: CVE-2007-1476
Published: 2007-03-16
Description: The SymTDI device driver (SYMTDI.SYS) in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVirus Corporate Edition 3.0.x through 10.1.x, and other Norton products, allows local users to cause a denial of service (system crash) by sending crafted data to the driver's \Device file, which triggers invalid memory access, a different vulnerability than CVE-2006-4855.
CVSS Score: 1.9 (LOW)
CWE: CWE-20
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]7148&w=2; http://osvdb.org/35088; http://securityreason.com/securityalert/2438
CVE: CVE-2007-1477
Published: 2007-03-16
Description: Directory traversal vulnerability in index.php in PHP Point Of Sale for osCommerce 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cfg_language parameter. NOTE: this issue has been disputed by CVE, since the cfg_language variable is configured upon proper product installation
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-April/001564.html; http://securityreason.com/securityalert/2426; http://www.securityfocus.com/archive/1/462970/100/0/threaded
CVE: CVE-2007-1478
Published: 2007-03-16
Description: download.php in McGallery 0.5b allows remote attackers to read arbitrary files and obtain script source code via the filename parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/22989; http://www.vupen.com/english/advisories/2007/1003; https://exchange.xforce.ibmcloud.com/vulnerabilities/33004
CVE: CVE-2007-1479
Published: 2007-03-16
Description: Cross-site scripting (XSS) vulnerability in Guestbook.php in Creative Guestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/34233; http://secunia.com/advisories/24536; https://exchange.xforce.ibmcloud.com/vulnerabilities/33015
CVE: CVE-2007-1480
Published: 2007-03-16
Description: Creative Guestbook 1.0 allows remote attackers to add an administrative account via a direct request to createadmin.php with Name, Email, and PASSWORD parameters set.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/34234; http://secunia.com/advisories/24536; https://exchange.xforce.ibmcloud.com/vulnerabilities/33014
CVE: CVE-2007-1481
Published: 2007-03-16
Description: SQL injection vulnerability in index.php in WBBlog allows remote attackers to execute arbitrary SQL commands via the e_id parameter in a viewentry cmd.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24532; http://www.securityfocus.com/bid/22998; http://www.vupen.com/english/advisories/2007/1001
CVE: CVE-2007-1482
Published: 2007-03-16
Description: Cross-site scripting (XSS) vulnerability in index.php in WBBlog allows remote attackers to inject arbitrary web script or HTML via the e_id parameter in a viewentry cmd.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/24532; http://www.securityfocus.com/bid/22998; http://www.vupen.com/english/advisories/2007/1001
CVE: CVE-2007-1483
Published: 2007-03-16
Description: Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote attackers to execute arbitrary PHP code via a URL in the includedir parameter to (1) login.php, (2) get_reminders.php, or (3) get_events.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/2425; http://sourceforge.net/mailarchive/forum.php?thread_name=45EAF[PII_REDACTED]%40k5n.us&forum_name=webcalendar-announce; http://www.securityfocus.com/archive/1/462957/100/0/threaded
CVE: CVE-2007-1484
Published: 2007-03-16
Description: The array_user_key_compare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zval_dtor, which triggers memory corruption and allows local users to bypass safe_mode and execute arbitrary code via a certain unset operation after array_user_key_compare has been called.
CVSS Score: 4.6 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=306172; http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html; http://secunia.com/advisories/24542
CVE: CVE-2007-1485
Published: 2007-03-16
Description: Buffer overflow in the set_umask function in QFTP in LIBFtp 3.1-1 allows local users to execute arbitrary code via a long -m argument. NOTE: CVE disputes this issue because QFTP is not setuid, and it is unlikely that there are web interfaces to QFTP that would accept untrusted command line arguments
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35089; http://securityreason.com/securityalert/2443; http://www.securityfocus.com/archive/1/462952/100/0/threaded
CVE: CVE-2007-1486
Published: 2007-03-16
Description: PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to admin.php, probably due to a dynamic variable evaluation vulnerability.
CVSS Score: 10.0 (HIGH)
References: http://carbonize.co.uk/Lazarus/Forum/index.php?topic=1164.0; http://securityreason.com/securityalert/2432; http://www.attrition.org/pipermail/vim/2007-March/001417.html
CVE: CVE-2007-1487
Published: 2007-03-16
Description: Directory traversal vulnerability in index.php in Sascha Schroeder (aka CyberTeddy or Cyber-inside) WebLog allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a showarticles action.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34043; http://secunia.com/advisories/24521; http://www.securityfocus.com/bid/22995
CVE: CVE-2007-1488
Published: 2007-03-16
Description: Unspecified vulnerability in Sun Java System Web Server 6.0 and 6.1 before 20070315 allows remote attackers to "gain unauthorized access to data", possibly involving a sample application.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34080; http://secunia.com/advisories/24545; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102833-1
CVE: CVE-2007-1489
Published: 2007-03-16
Description: Unspecified vulnerability in web-app.org Web Automated Perl Portal (WebAPP) 0.9.9.4 to 0.9.9.6 allows remote attackers to obtain admin access by modifying cookies and performing "certain consecutive actions," possibly due to a cross-site request forgery (CSRF) vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/33273; http://secunia.com/advisories/24540; http://www.attrition.org/pipermail/vim/2007-March/001446.html
CVE: CVE-2007-0450
Published: 2007-03-16
Description: Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx; http://docs.info.apple.com/article.html?artnum=306172; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
CVE: CVE-2007-1490
Published: 2007-03-16
Description: Unspecified maintenance web pages in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allow remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors (aka "shell command injection").
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/24434; http://support.avaya.com/elmodocs2/security/ASA-2007-052.htm; http://www.osvdb.org/33300
CVE: CVE-2007-1491
Published: 2007-03-16
Description: Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside parties.
CVSS Score: 5.2 (MEDIUM)
References: http://secunia.com/advisories/24434; http://support.avaya.com/elmodocs2/security/ASA-2007-051.htm; http://www.osvdb.org/33346
CVE: CVE-2007-1492
Published: 2007-03-16
Description: winmm.dll in Microsoft Windows XP allows user-assisted remote attackers to cause a denial of service (infinite loop) via a large cch argument value to the mmioRead function, as demonstrated by a crafted WAV file.
CVSS Score: 7.1 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0063.html; http://osvdb.org/34101; http://www.securityfocus.com/bid/22938
CVE: CVE-2007-1493
Published: 2007-03-16
Description: nukesentinel.php in NukeSentinel 2.5.06 and earlier uses a permissive regular expression to validate an IP address, which allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, due to an incomplete patch for CVE-2007-1172.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-March/001429.html; http://securityreason.com/securityalert/2430; http://www.securityfocus.com/archive/1/462453/100/0/threaded
CVE: CVE-2007-1494
Published: 2007-03-16
Description: Cross-site scripting (XSS) vulnerability in NukeSentinel before 2.5.06 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "filters for https:// and http://".
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35078; http://www.nukescripts.net/modules.php?name=Downloads&op=getit&lid=1055; http://osvdb.org/35078
CVE: CVE-2007-1495
Published: 2007-03-16
Description: The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7, and possibly other products using symevent.sys 12.0.0.20, allows local users to cause a denial of service (system crash) via invalid data, as demonstrated by calling DeviceIoControl to send the data, a reintroduction of CVE-2006-4855.
CVSS Score: 4.9 (MEDIUM)
References: http://securityreason.com/securityalert/2445; http://www.securityfocus.com/archive/1/462792/100/0/threaded; http://www.securityfocus.com/bid/22961
CVE: CVE-2007-1496
Published: 2007-03-16
Description: nfnetlink_log in netfilter in the Linux kernel before 2.6.20.3 allows attackers to cause a denial of service (crash) via unspecified vectors involving the (1) nfulnl_recv_config function, (2) using "multiple packets per netlink message", and (3) bridged packets, which trigger a NULL pointer dereference.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/24492; http://secunia.com/advisories/25228; http://secunia.com/advisories/25288
CVE: CVE-2007-1497
Published: 2007-03-16
Description: nf_conntrack in netfilter in the Linux kernel before 2.6.20.3 does not set nfctinfo during reassembly of fragmented packets, which leaves the default value as IP_CT_ESTABLISHED and might allow remote attackers to bypass certain rulesets using IPv6 fragments.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24492; http://secunia.com/advisories/25228; http://secunia.com/advisories/25288
CVE: CVE-2007-1498
Published: 2007-03-16
Description: Multiple stack-based buffer overflows in the SiteManager.SiteMgr.1 ActiveX control (SiteManager.dll) in the ePO management console in McAfee ePolicy Orchestrator (ePO) before 3.6.1 Patch 1 and ProtectionPilot (PRP) before 1.5.0 HotFix allow remote attackers to execute arbitrary code via a long argument to the (1) ExportSiteList and (2) VerifyPackageCatalog functions, and (3) unspecified vectors involving a swprintf function call.
CVSS Score: 9.3 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052960.html; http://secunia.com/advisories/24466; http://securityreason.com/securityalert/2444
CVE: CVE-2007-1447
Published: 2007-03-16
Description: The Tape Engine in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC procedure arguments, which result in memory corruption, a different vulnerability than CVE-2006-6076.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24512; http://supportconnectw.ca.com/public/storage/infodocs/babtapeng-securitynotice.asp; http://www.kb.cert.org/vuls/id/375353
CVE: CVE-2007-1448
Published: 2007-03-16
Description: The Tape Engine in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to cause a denial of service (disabled interface) by calling an unspecified RPC function.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/24512; http://supportconnectw.ca.com/public/storage/infodocs/babtapeng-securitynotice.asp; http://www.kb.cert.org/vuls/id/647273
CVE: CVE-2007-1499
Published: 2007-03-17
Description: Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx; http://news.com.com/2100-1002_3-6167410.html; http://osvdb.org/35352
CVE: CVE-2007-0237
Published: 2007-03-19
Description: The ndeb-binary feature in Lookup (lookup-el) allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 4.6 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=197306; http://osvdb.org/34263; http://secunia.com/advisories/24377
CVE: CVE-2007-1319
Published: 2007-03-19
Description: Unspecified vulnerability in the IOPCServer::RemoveGroup function in the OPCDA interface in Takebishi Electric DeviceXPlorer OLE for Process Control (OPC) Server before 3.12 Build3 allows remote attackers to execute arbitrary code via unspecified vectors involving access to arbitrary memory. NOTE: this issue affects the (1) HIDIC, (2) MELSEC, (3) FA-M3, (4) MODBUS, and (5) SYSMAC OPC Servers.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24570; http://www.faweb.net/us/opc/1231207.html; http://www.kb.cert.org/vuls/id/926551
CVE: CVE-2007-1500
Published: 2007-03-19
Description: The Linux Security Auditing Tool (LSAT) allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using /tmp/lsat1.lsat.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=159542; http://osvdb.org/34267; http://secunia.com/advisories/24526
CVE: CVE-2007-1501
Published: 2007-03-19
Description: Stack-based buffer overflow in Avant Browser 11.0 build 26 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Content-Type HTTP header.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/34990; http://www.securityfocus.com/bid/23002; https://exchange.xforce.ibmcloud.com/vulnerabilities/33049
CVE: CVE-2007-1502
Published: 2007-03-19
Description: Multiple buffer overflows in Rhapsody IRC 0.28b allow remote attackers to execute arbitrary code via a (1) long command, (2) long server argument to the (a) connect or (b) server commands, (3) long nick argument to the (c) nick command, or a long (4) nick or (5) message argument to the (d) ctcp, (e) chat, (f) notice, (g) message (msg), or (h) query commands.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35002; http://osvdb.org/35003; http://osvdb.org/35004
CVE: CVE-2007-1503
Published: 2007-03-19
Description: Multiple format string vulnerabilities in comm.c in Rhapsody IRC 0.28b allow remote attackers to execute arbitrary code via format string specifiers to the create_ctcp_message function using the message argument to the (1) me or (2) ctcp commands, and possibly related vectors involving the (3) whois, (4) mode, and (5) topic commands.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35001; http://securityreason.com/securityalert/2447; http://www.securityfocus.com/archive/1/463092/100/0/threaded
CVE: CVE-2007-1504
Published: 2007-03-19
Description: Cross-site scripting (XSS) vulnerability in the Servlet Service in Fujitsu Interstage Application Server (IJServer) 8.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving web.xml and HTTP 404 and 500 status codes.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/34276; http://secunia.com/advisories/24508
CVE: CVE-2007-1505
Published: 2007-03-19
Description: Fujitsu FENCE-Pro before V5L01, and Systemwalker Desktop Encryption V12.0L10, V12.0L10A, V12.0L10B, V12.0L20 and V13.0.0 allows local users to obtain sensitive information by extracting the decoding password from certain "self-decoding" file types.
CVSS Score: 2.1 (LOW)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/34184; http://secunia.com/advisories/24537
CVE: CVE-2007-1506
Published: 2007-03-19
Description: Cross-site scripting (XSS) vulnerability in PORTAL.wwv_main.render_warning_screen in the Oracle Portal 10g allows remote attackers to inject arbitrary web script or HTML via the (1) p_oldurl and (2) p_newurl parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/34299; http://securityreason.com/securityalert/2463; http://www.securityfocus.com/archive/1/463012/100/0/threaded
CVE: CVE-2006-7164
Published: 2007-03-20
Description: SimpleFileServlet in IBM WebSphere Application Server 5.0.1 through 5.0.2.7 on Linux and UNIX does not block certain invalid URIs and does not issue a security challenge, which allows remote attackers to read secure files and obtain sensitive information via certain requests.
CVSS Score: 4.3 (MEDIUM)
References: http://www-1.ibm.com/support/docview.wss?uid=swg24013029; http://www-1.ibm.com/support/docview.wss?uid=swg24013029
CVE: CVE-2006-7165
Published: 2007-03-20
Description: IBM WebSphere Application Server (WAS) 5.0 through 5.1.1.0 allows remote attackers to obtain JSP source code and other sensitive information via certain "special URIs."
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/24478; http://www-1.ibm.com/support/docview.wss?uid=swg21243541; http://www-1.ibm.com/support/docview.wss?uid=swg24013032
CVE: CVE-2006-7166
Published: 2007-03-20
Description: IBM WebSphere Application Server (WAS) 5.1.1.9 and earlier allows remote attackers to obtain JSP source code and other sensitive information via "a specific JSP URL."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24478; http://www-1.ibm.com/support/docview.wss?uid=swg21243541; http://www-1.ibm.com/support/docview.wss?uid=swg24011720
CVE: CVE-2006-7167
Published: 2007-03-20
Description: Unspecified vulnerability in ProRat Server 1.9 Fix2 allows remote attackers to bypass the authentication mechanism for remote login via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20293; http://www.securityfocus.com/bid/20293