deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2588
Published: 2007-05-10
Description: Multiple buffer overflows in the Office Viewer OCX ActiveX control (oa.ocx) 3.2 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long argument to the (1) HttpDownloadFile, (2) Open, (3) OpenWebFile, (4) DoOleCommand, (5) FTPDownloadFile, (6) FTPUploadFile, (7) HttpUploadFile, (8) Save, or (9) SaveWebFile function.
CVSS Score: 9.3 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-04-office-viewer-oaocx-v-32.html; http://osvdb.org/34335; http://secunia.com/advisories/25143
CVE: CVE-2007-0244
Published: 2007-05-11
Description: pptpgre.c in PoPToP Point to Point Tunneling Server (pptpd) before 1.3.4 allows remote attackers to cause a denial of service (PPTP connection tear-down) via (1) GRE packets with out-of-order sequence numbers or (2) certain GRE packets that are processed using a wrong pointer and improperly dequeued.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/25220; http://secunia.com/advisories/25255; http://secunia.com/advisories/26987
CVE: CVE-2007-1262
Published: 2007-05-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=306172; http://jvn.jp/en/jp/JVN09157962/index.html; http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000398.html
CVE: CVE-2007-2522
Published: 2007-05-11
Description: Stack-based buffer overflow in the inoweb Console Server in CA Anti-Virus for the Enterprise r8, Threat Manager r8, Anti-Spyware for the Enterprise r8, and Protection Suites r3 allows remote attackers to execute arbitrary code via a long (1) username or (2) password.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063275.html; http://secunia.com/advisories/25202; http://supportconnectw.ca.com/public/antivirus/infodocs/caav-secnotice050807.asp
CVE: CVE-2007-2523
Published: 2007-05-11
Description: CA Anti-Virus for the Enterprise r8 and Threat Manager r8 before 20070510 use weak permissions (NULL security descriptor) for the Task Service shared file mapping, which allows local users to modify this mapping and gain privileges by triggering a stack-based buffer overflow in InoCore.dll before 8.0.448.0.
CVSS Score: 7.2 (HIGH)
References: http://blog.48bits.com/?p=103; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=530; http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063275.html
CVE: CVE-2007-2589
Published: 2007-05-11
Description: Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data in the SRC attribute of an IMG element.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-352
References: http://docs.info.apple.com/article.html?artnum=306172; http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html; http://osvdb.org/35889
CVE: CVE-2007-2590
Published: 2007-05-11
Description: Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allows remote attackers to obtain user names and other sensitive information via a direct request to (1) usrmgr/userList.asp or (2) usrmgr/userStatusList.asp.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/34514; http://secunia.com/advisories/25212; http://securityreason.com/securityalert/2689
CVE: CVE-2007-2591
Published: 2007-05-11
Description: usrmgr/userList.asp in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allows remote attackers to modify user account details and cause a denial of service (account deactivation) via the userid parameter in an update action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34513; http://secunia.com/advisories/25212; http://securityreason.com/securityalert/2689
CVE: CVE-2007-2592
Published: 2007-05-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to de/pda/dev_logon.asp and (2) multiple unspecified vectors in (a) usrmgr/registerAccount.asp, (b) de/create_account.asp, and other files.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/34515; http://osvdb.org/34516; http://osvdb.org/34517
CVE: CVE-2007-2593
Published: 2007-05-11
Description: The Terminal Server in Microsoft Windows 2003 Server, when using TLS, allows remote attackers to bypass SSL and self-signed certificate requirements, downgrade the server security, and possibly conduct man-in-the-middle attacks via unspecified vectors, as demonstrated using the Remote Desktop Protocol (RDP) 6.0 client.  NOTE: a third party claims that the vendor may have fixed this in approximately 2006.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36146; http://www.securityfocus.com/archive/1/468049/100/0/threaded; http://www.securityfocus.com/archive/1/468057/100/0/threaded
CVE: CVE-2006-3456
Published: 2007-05-11
Description: The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via unspecified vectors related to content on a web site, and place Internet Explorer into a "defunct state" in which remote attackers can execute arbitrary code in addition to other Symantec ActiveX controls, regardless of whether they are marked safe for scripting.  NOTE: this CVE was inadvertently used for an E-mail Auto-Protect issue, but that issue has been assigned CVE-2007-3771.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=529; http://osvdb.org/35075; http://secunia.com/advisories/25172
CVE: CVE-2007-2594
Published: 2007-05-11
Description: PHP remote file inclusion vulnerability in inc/articles.inc.php in phpMyPortal 3.0.0 RC3 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[CHEMINMODULES] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35908; http://secunia.com/advisories/25210; http://www.securityfocus.com/bid/23898
CVE: CVE-2007-2595
Published: 2007-05-11
Description: RSAuction 2.73.1.3 allows remote authenticated users to move their own account status from Suspended to Active via a direct request for the activation URL that is provided at the time of account registration. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/35870; http://secunia.com/advisories/25149; http://www.securityfocus.com/bid/23895
CVE: CVE-2007-2596
Published: 2007-05-11
Description: PHP remote file inclusion vulnerability in common/func.php in aForum 1.32 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CommonAbsDir parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35907; http://secunia.com/advisories/25224; http://www.securityfocus.com/bid/23902
CVE: CVE-2007-2597
Published: 2007-05-11
Description: Multiple PHP remote file inclusion vulnerabilities in telltarget CMS 1.3.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) ordnertiefe parameter to site_conf.php; or the (2) tt_docroot parameter to (a) class.csv.php, (b) produkte_nach_serie.php, or (c) ref_kd_rubrik.php in functionen/; (d) hg_referenz_jobgalerie.php, (e) surfer_anmeldung_NWL.php, (f) produkte_nach_serie_alle.php, (g) surfer_aendern.php, (h) ref_kd_rubrik.php, or (i) referenz.php in module/; or (j) 1/lay.php or (k) 3/lay.php in standard/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38236; http://osvdb.org/38237; http://osvdb.org/38238
CVE: CVE-2007-2598
Published: 2007-05-11
Description: SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35910; http://secunia.com/advisories/25223; http://www.securityfocus.com/bid/23904
CVE: CVE-2007-2599
Published: 2007-05-11
Description: Multiple SQL injection vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) catFile parameter to (a) browseCat.php or (b) browseSubCat.php; the (2) id parameter to (c) openTutorial.php, (d) topFrame.php, or (e) admin/editListing.php; or (3) the search parameter to search.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35899; http://osvdb.org/35900; http://osvdb.org/35901
CVE: CVE-2007-2600
Published: 2007-05-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) catFile parameter to (a) browseCat.php or (b) browseSubCat.php; the (2) id parameter to (c) openTutorial.php, (d) topFrame.php, or (e) admin/editListing.php; or the (3) search parameter to search.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35892; http://osvdb.org/35893; http://osvdb.org/35894
CVE: CVE-2007-2601
Published: 2007-05-11
Description: Buffer overflow in a certain ActiveX control in the GDivX Zenith Player AviFixer class in fix.dll 1.0.0.1 allows remote attackers to execute arbitrary code via a long SetInputFile property value.
CVSS Score: 9.3 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-11-bonus-gdivx-zenith-player.html.; http://osvdb.org/36021; http://www.securityfocus.com/bid/23907
CVE: CVE-2007-2602
Published: 2007-05-11
Description: Buffer overflow in MIBEXTRA.EXE in Ipswitch WhatsUp Gold 11 allows attackers to cause a denial of service (application crash) or execute arbitrary code via a long MIB filename argument.  NOTE: If there is not a common scenario under which MIBEXTRA.EXE is called with attacker-controlled command line arguments, then perhaps this issue should not be included in CVE.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/36217; http://securityreason.com/securityalert/2708; http://www.securityfocus.com/archive/1/468070/100/0/threaded
CVE: CVE-2007-2603
Published: 2007-05-11
Description: Unspecified vulnerability in the Init function in the Audio CD Ripper OCX (AudioCDRipperOCX.ocx) 1.0 ActiveX control allows remote attackers to cause a denial of service (NULL dereference and Internet Explorer crash) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/36216; http://securityreason.com/securityalert/2708; http://www.securityfocus.com/archive/1/468070/100/0/threaded
CVE: CVE-2007-2604
Published: 2007-05-11
Description: Unspecified vulnerability in the FlexLabel ActiveX control allows remote attackers to cause a denial of service (unstable behavior) via an improper initialization, as demonstrated by a certain value of the Caption property.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/36211; http://securityreason.com/securityalert/2708; http://www.securityfocus.com/archive/1/468070/100/0/threaded
CVE: CVE-2007-2605
Published: 2007-05-11
Description: Unspecified vulnerability in the GetPropertyById function in ISoftomateObj in SoftomateLib in BRUJULA4.NET.DLL in the Brujula Toolbar (Brujula.net toolbar) allows attackers to cause a denial of service (NULL dereference and browser crash) via certain arguments.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/34773; http://securityreason.com/securityalert/2708; http://www.securityfocus.com/archive/1/468070/100/0/threaded
CVE: CVE-2007-2606
Published: 2007-05-11
Description: Multiple buffer overflows in Firebird 2.1 allow attackers to trigger memory corruption and possibly have other unspecified impact via certain input processed by (1) config\ConfigFile.cpp or (2) msgs\check_msgs.epp.  NOTE: if ConfigFile.cpp reads a configuration file with restrictive permissions, then the ConfigFile.cpp vector may not cross privilege boundaries and perhaps should not be included in CVE.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/37308; http://osvdb.org/37309; http://secunia.com/advisories/29501
CVE: CVE-2007-2607
Published: 2007-05-11
Description: PHP remote file inclusion vulnerability in views/print/printbar.php in LaVague 0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the views_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37790; http://www.securityfocus.com/bid/23877; http://www.vupen.com/english/advisories/2007/1733
CVE: CVE-2007-2608
Published: 2007-05-11
Description: PHP remote file inclusion vulnerability in lib/smarty/SmartyFU.class.php in Miplex2 Alpha 1 allows remote attackers to execute arbitrary PHP code via a URL in the system[smarty][dir] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37789; http://www.securityfocus.com/bid/23884; http://www.vupen.com/english/advisories/2007/1737
CVE: CVE-2007-2609
Published: 2007-05-11
Description: Multiple PHP remote file inclusion vulnerabilities in gnuedu 1.3b2 allow remote attackers to execute arbitrary PHP code via a URL in the (a) ETCDIR parameter to (1) libs/lom.php; (2) lom_update.php, (3) check-lom.php, and (4) weigh_keywords.php in scripts/; the (b) LIBSDIR parameter to (5) logout.php, (6) help.php, (7) index.php, (8) login.php; and the ETCDIR parameter to (9) web/lom.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/38248; http://osvdb.org/38249; http://osvdb.org/38250
CVE: CVE-2007-2610
Published: 2007-05-11
Description: Cross-site scripting (XSS) vulnerability in OpenLD before 1.1.9, and 1.1-modified before 1.1-modified3, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the Search feature, possibly the term parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35871; http://secunia.com/advisories/25168; http://sourceforge.net/project/shownotes.php?release_id=507099
CVE: CVE-2007-2611
Published: 2007-05-11
Description: Multiple PHP remote file inclusion vulnerabilities in CGX 20050314 allow remote attackers to execute arbitrary PHP code via a URL in the pathCGX parameter to (1) mtdialogo.php, (2) ltdialogo.php, (3) login.php, and (4) logingecon.php in inc/; and multiple unspecified files in frm/, sql/, and cns/.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35880; http://osvdb.org/35881; http://osvdb.org/35882
CVE: CVE-2007-2612
Published: 2007-05-11
Description: SQL injection vulnerability in libs/Wakka.class.php in WikkaWiki (Wikka Wiki) before 1.1.6.3 allows remote attackers to execute arbitrary SQL commands via the limit parameter.  NOTE: this issue only applies to a "modified installation."
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35826; http://wikkawiki.org/WikkaReleaseNotes; http://wush.net/trac/wikka/ticket/383
CVE: CVE-2007-2613
Published: 2007-05-11
Description: WikkaWiki (Wikka Wiki) before 1.1.6.3 allows attackers in a shared virtual host server environment to upload and execute an arbitrary configuration file by modifying the WAKKA_CONFIG environment variable.
CVSS Score: 8.3 (HIGH)
References: http://osvdb.org/35825; http://wikkawiki.org/WikkaReleaseNotes; http://wush.net/trac/wikka/ticket/98
CVE: CVE-2007-2614
Published: 2007-05-11
Description: PHP remote file inclusion vulnerability in examples/widget8.php in phpHtmlLib 2.4.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phphtmllib parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36168; http://securityreason.com/securityalert/2690; http://www.securityfocus.com/archive/1/467837/100/0/threaded
CVE: CVE-2007-2615
Published: 2007-05-11
Description: Multiple PHP remote file inclusion vulnerabilities in Crie seu PHPLojaFacil 0.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the path_local parameter to (1) ftp.php, (2) libs/db.php, and (3) libs/ftp.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37796; http://osvdb.org/37797; http://osvdb.org/37798
CVE: CVE-2007-2616
Published: 2007-05-11
Description: Stack-based buffer overflow in the SSL version of the NMDMC.EXE service in Novell NetMail 3.52e FTF2 and probably earlier allows remote attackers to execute arbitrary code via a crafted request.
CVSS Score: 10.0 (HIGH)
References: http://download.novell.com/Download?buildid=Ad2xk29hHTg~; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=532; http://osvdb.org/35941
CVE: CVE-2007-2617
Published: 2007-05-11
Description: srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file permissions when opening files, which allows local users to read the first line of arbitrary files via the -d and -v options.
CVSS Score: 2.1 (LOW)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=531; http://osvdb.org/35940; http://secunia.com/advisories/25194
CVE: CVE-2007-2618
Published: 2007-05-11
Description: CRLF injection vulnerability in index.php in Drake CMS 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the lang parameter. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports valid until the first official release of Drake CMS."
CVSS Score: 5.1 (MEDIUM)
References: http://osvdb.org/37303; http://securityreason.com/securityalert/2691; http://www.securityfocus.com/archive/1/467829/100/0/threaded
CVE: CVE-2007-2619
Published: 2007-05-11
Description: Symantec pcAnywhere 11.5.x and 12.0.x retains unencrypted login credentials for the most recent login within process memory, which allows local administrators to obtain the credentials by reading process memory, a different vulnerability than CVE-2006-3785.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/41982; http://securityresponse.symantec.com/avcenter/security/Content/2007.05.09b.html; http://securitytracker.com/id?1018032
CVE: CVE-2007-2620
Published: 2007-05-11
Description: PHP remote file inclusion vulnerability in inc/config.inc.php in Jakub Steiner (aka jimmac) original 0.11 allows remote attackers to execute arbitrary PHP code via a URL in the x[1] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35974; http://secunia.com/advisories/25213; http://www.securityfocus.com/bid/23913
CVE: CVE-2007-2621
Published: 2007-05-11
Description: SQL injection vulnerability in event_view.php in Thyme Calendar 1.3 allows remote attackers to execute arbitrary SQL commands via the eid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35971; http://secunia.com/advisories/25234; http://www.securityfocus.com/bid/23912
CVE: CVE-2007-2622
Published: 2007-05-11
Description: Multiple SQL injection vulnerabilities in TaskDriver 1.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to login.php or (2) the taskid parameter to notes.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35972; http://osvdb.org/35973; http://secunia.com/advisories/25221
CVE: CVE-2007-2623
Published: 2007-05-11
Description: Multiple buffer overflows in RControl.dll in Remote Display Dev kit 1.2.1.0 allow remote attackers to cause a denial of service (Internet Explorer 7 crash) via (1) a long first argument to the connect function or (2) a long InternalServer property value, possibly involving ntdll.dll.
CVSS Score: 7.8 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-10-rcontroldll-v-1210-denial-of.html; http://osvdb.org/36022; http://www.securityfocus.com/bid/23914
CVE: CVE-2007-2624
Published: 2007-05-11
Description: Dynamic variable evaluation vulnerability in shared/config/cp_config.php in All In One Control Panel (AIOCP) before 1.3.016 allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks via the SERVER superglobal array.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35534; http://secunia.com/advisories/25088; http://sourceforge.net/project/shownotes.php?release_id=504924
CVE: CVE-2007-2625
Published: 2007-05-11
Description: Cross-site scripting (XSS) vulnerability in shared/code/cp_authorization.php in All In One Control Panel (AIOCP) before 1.3.016 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35535; http://sourceforge.net/project/shownotes.php?release_id=504924; http://www.vupen.com/english/advisories/2007/1637
CVE: CVE-2007-2626
Published: 2007-05-11
Description: SQL injection vulnerability in admin.php in SchoolBoard allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.  NOTE: CVE disputes this issue, because 'username' does not exist, and the password is not used in any queries
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36162; http://securityreason.com/securityalert/2695; http://www.attrition.org/pipermail/vim/2007-May/001609.html
CVE: CVE-2007-2627
Published: 2007-05-11
Description: Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF), a different vulnerability than CVE-2007-1622.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37296; http://securityreason.com/securityalert/2694; http://www.securityfocus.com/archive/1/467360/100/0/threaded
CVE: CVE-2007-2628
Published: 2007-05-11
Description: PHP remote file inclusion vulnerability in include/logout.php in Justin Koivisto SecurityAdmin for PHP (aka PHPSecurityAdmin, PSA) 4.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the PSA_PATH parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36155; http://securityreason.com/securityalert/2693; http://www.securityfocus.com/archive/1/467662/100/0/threaded
CVE: CVE-2007-2629
Published: 2007-05-11
Description: Bradford CampusManager Network Control Application Server 3.1(6) allows remote attackers to obtain sensitive information (backup, log, and configuration files) via direct request for certain files in (1) /runTime/ or (2) /remediationReports/.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35820; http://secunia.com/advisories/25138; http://securityreason.com/securityalert/2698
CVE: CVE-2007-2630
Published: 2007-05-11
Description: Incomplete blacklist vulnerability in filemanager/browser/default/connectors/php/config.php in the FCKeditor module, as used in ActiveCampaign 1-2-All (aka 12All) 4.50 through 4.53.13, and possibly other products, allows remote authenticated administrators to upload and possibly execute .php4 and .php5 files via unspecified vectors.  NOTE: this issue is reachable through filemanager/browser/default/browser.html.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/36161; http://www.activecampaign.com/support/forum/showthread.php?t=3293; http://www.securityfocus.com/archive/1/467483/100/0/threaded