deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-4323
Published: 2007-08-14
Description: DenyHosts 2.6 does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a client protocol version identification containing an IP address string, a different vector than CVE-2006-6301.
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=181213; http://osvdb.org/42482; http://secunia.com/advisories/27254
CVE: CVE-2007-4324
Published: 2007-08-14
Description: ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make, then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not.  NOTE: 9.0.115.0 introduces support for a workaround, but does not fix the vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://kb.adobe.com/selfservice/viewContent.do?externalId=kb402956&sliceId=2; http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
CVE: CVE-2007-4325
Published: 2007-08-14
Description: PHP remote file inclusion vulnerability in index.php in Gaestebuch 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37515; http://secunia.com/advisories/26401; http://securityreason.com/securityalert/2994
CVE: CVE-2007-4326
Published: 2007-08-14
Description: Multiple PHP remote file inclusion vulnerabilities in Bilder Uploader 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) gruppen.php, (2) bild.php, (3) feed.php, (4) mitglieder.php, (5) online.php, (6) profil.php, and possibly other unspecified PHP scripts.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36443; http://osvdb.org/36444; http://osvdb.org/36445
CVE: CVE-2007-4327
Published: 2007-08-14
Description: Multiple PHP remote file inclusion vulnerabilities in File Uploader 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php or (2) datei.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36424; http://osvdb.org/36425; http://secunia.com/advisories/26397
CVE: CVE-2007-4328
Published: 2007-08-14
Description: Multiple PHP remote file inclusion vulnerabilities in Mapos Bilder Galerie 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php, (2) galerie.php, or (3) anzagien.php.  NOTE: A later report states that 1.1 is also affected, but that the filename for vector 3 is anzeigen.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/36455; http://osvdb.org/36456; http://osvdb.org/36457
CVE: CVE-2007-4329
Published: 2007-08-14
Description: Multiple PHP remote file inclusion vulnerabilities in Web News 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php, (2) news.php, or (3) feed.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36427; http://osvdb.org/36428; http://osvdb.org/36429
CVE: CVE-2007-4330
Published: 2007-08-14
Description: PHP remote file inclusion vulnerability in shoutbox.php in Shoutbox 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36622; http://secunia.com/advisories/26396; http://securityreason.com/securityalert/2997
CVE: CVE-2007-4331
Published: 2007-08-14
Description: PHP remote file inclusion vulnerability in index.php in FindNix allows remote attackers to include the contents of arbitrary URLs and conduct cross-site scripting (XSS) attacks via a URL in the page parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38709; http://securityreason.com/securityalert/2992; http://www.securityfocus.com/archive/1/475962/100/0/threaded
CVE: CVE-2007-3848
Published: 2007-08-14
Description: Linux kernel 2.4.35 and other versions allows local users to send arbitrary signals to a child process that is running at higher privileges by causing a setuid-root parent process to die, which delivers an attacker-controlled parent process death signal (PR_SET_PDEATHSIG).
CVSS Score: 1.9 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2007-3848; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00007.html
CVE: CVE-2007-3852
Published: 2007-08-14
Description: The init script (sysstat.in) in sysstat 5.1.2 up to 7.1.6 creates /tmp/sysstat.run insecurely, which allows local users to execute arbitrary code.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/39709; http://secunia.com/advisories/26527; http://www.redhat.com/support/errata/RHSA-2011-1005.html
CVE: CVE-2007-4332
Published: 2007-08-14
Description: SQL injection vulnerability in article.php in Article Dashboard, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36422; http://secunia.com/advisories/26163; http://www.securityfocus.com/bid/25309
CVE: CVE-2007-4333
Published: 2007-08-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in signup.php in Article Dashboard allow remote attackers to inject arbitrary web script or HTML via the (1) f_emailaddress, (2) f_reemailaddress, and other unspecified parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36423; http://secunia.com/advisories/26163; http://www.securityfocus.com/bid/25309
CVE: CVE-2007-4334
Published: 2007-08-14
Description: Cross-site scripting (XSS) vulnerability in whois.php in Php-stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the IP parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36421; http://secunia.com/advisories/26422; http://securityreason.com/securityalert/3003
CVE: CVE-2007-4335
Published: 2007-08-14
Description: Format string vulnerability in the SMTP server component in Qbik WinGate 5.x and 6.x before 6.2.2 allows remote attackers to cause a denial of service (service crash) via format string specifiers in certain unexpected commands, which trigger a crash during error logging.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/26412; http://securityreason.com/securityalert/3001; http://www.harmonysecurity.com/HS-A007.html
CVE: CVE-2007-4336
Published: 2007-08-14
Description: Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 (DirectTransform FlashPix) ActiveX control in DXTLIPI.DLL 6.0.2.827, as packaged in Microsoft DirectX Media 6.0 SDK, allows remote attackers to execute arbitrary code via a long SourceUrl property value.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36399; http://secunia.com/advisories/26426; http://www.kb.cert.org/vuls/id/466601
CVE: CVE-2007-4337
Published: 2007-08-14
Description: Multiple buffer overflows in the httplib_parse_sc_header function in lib/http.c in Streamripper before 1.62.2 allow remote attackers to execute arbitrary code via long (1) Location and (2) Server HTTP headers, a different vulnerability than CVE-2006-3124.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/39533; http://secunia.com/advisories/26406; http://secunia.com/advisories/26814
CVE: CVE-2007-4338
Published: 2007-08-14
Description: index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie.  NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/39534; http://secunia.com/advisories/26421; http://securityreason.com/securityalert/3009
CVE: CVE-2007-4339
Published: 2007-08-14
Description: Multiple PHP remote file inclusion vulnerabilities in PHPCentral Poll Script 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter in (1) poll.php and (2) pollarchive.php.  NOTE: a reliable third party states that this issue is resultant from a variable extraction error in functions.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/36418; http://osvdb.org/36419; http://secunia.com/advisories/26434
CVE: CVE-2007-4340
Published: 2007-08-14
Description: PHP remote file inclusion vulnerability in index.php in phpDVD 1.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the dvd_config_file parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/3007; http://www.securityfocus.com/archive/1/476141/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/35964
CVE: CVE-2007-4341
Published: 2007-08-14
Description: PHP remote file inclusion vulnerability in adm/my_statistics.php in Omnistar Lib2 PHP 0.2 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38716; http://securityreason.com/securityalert/3006; http://www.securityfocus.com/archive/1/476271/100/0/threaded
CVE: CVE-2007-4342
Published: 2007-08-14
Description: PHP remote file inclusion vulnerability in include.php in PHPCentral Login 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter.  NOTE: a third party disputes this vulnerability because of the special nature of the SERVER superglobal array.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/38880; http://securityreason.com/securityalert/3005; http://www.securityfocus.com/archive/1/476274/100/0/threaded
CVE: CVE-2007-0943
Published: 2007-08-14
Description: Unspecified vulnerability in Internet Explorer 5.01 and 6 SP1 allows remote attackers to execute arbitrary code via crafted Cascading Style Sheets (CSS) strings that trigger memory corruption during parsing, related to use of out-of-bounds pointers.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/26419; http://securitytracker.com/id?1018562; http://www.nsfocus.com/english/homepage/research/0701.htm
CVE: CVE-2007-2216
Published: 2007-08-14
Description: The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function, which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file, aka "ActiveX Object Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-16
References: http://secunia.com/advisories/26419; http://securitytracker.com/id?1018562; http://www.osvdb.org/36396
CVE: CVE-2007-2223
Published: 2007-08-14
Description: Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119, CWE-190
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=576; http://secunia.com/advisories/26447; http://www.kb.cert.org/vuls/id/361968
CVE: CVE-2007-2224
Published: 2007-08-14
Description: Object linking and embedding (OLE) Automation, as used in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Office 2004 for Mac, and Visual Basic 6.0 allows remote attackers to execute arbitrary code via the substringData method on a TextNode object, which causes an integer overflow that leads to a buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119, CWE-189
References: http://secunia.com/advisories/26449; http://www.securityfocus.com/archive/1/476527/100/0/threaded; http://www.securityfocus.com/bid/25282
CVE: CVE-2007-3034
Published: 2007-08-14
Description: Integer overflow in the AttemptWrite function in Graphics Rendering Engine (GDI) on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted metafile (image) with a large record length value, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/26423; http://www.kb.cert.org/vuls/id/640136; http://www.securityfocus.com/archive/1/476505/100/0/threaded
CVE: CVE-2007-3035
Published: 2007-08-14
Description: Unspecified vulnerability in Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafted header information that is not properly handled during decompression, aka "Windows Media Player Code Execution Vulnerability Decompressing Skins."
CVSS Score: 7.6 (HIGH)
References: http://secunia.com/advisories/26433; http://securitytracker.com/id?1018565; http://www.securityfocus.com/archive/1/476548/100/0/threaded
CVE: CVE-2007-3037
Published: 2007-08-14
Description: Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafted header information that causes a size mismatch between compressed and decompressed data and triggers a heap-based buffer overflow, aka "Windows Media Player Code Execution Vulnerability Parsing Skins."
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-94, CWE-119
References: http://secunia.com/advisories/26433; http://securitytracker.com/id?1018565; http://www.osvdb.org/36385
CVE: CVE-2007-3041
Published: 2007-08-14
Description: Unspecified vulnerability in the pdwizard.ocx ActiveX object for Internet Explorer 5.01, 6 SP1, and 7 allows remote attackers to execute arbitrary code via unknown vectors related to Microsoft Visual Basic 6 objects and memory corruption, aka "ActiveX Object Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/26419; http://securitytracker.com/id?1018562; http://www.osvdb.org/36395
CVE: CVE-2007-3890
Published: 2007-08-14
Description: Microsoft Excel in Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via a Workspace with a certain index value that triggers memory corruption.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/26145; http://www.securityfocus.com/bid/25280; http://www.securitytracker.com/id?1018561
CVE: CVE-2007-0948
Published: 2007-08-14
Description: Heap-based buffer overflow in Microsoft Virtual PC 2004 and PC for Mac 7.1 and 7, and Virtual Server 2005 and 2005 R2, allows local guest OS administrators to execute arbitrary code on the host OS via unspecified vectors related to "interaction and initialization of components."
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/26444; http://www.securityfocus.com/bid/25298; http://www.securitytracker.com/id?1018567
CVE: CVE-2007-1749
Published: 2007-08-14
Description: Integer underflow in the CDownloadSink class code in the Vector Markup Language (VML) component (VGX.DLL), as used in Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code via compressed content with an invalid buffer size, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
References: http://research.eeye.com/html/advisories/published/AD20070814a.html; http://secunia.com/advisories/26409; http://securityreason.com/securityalert/3020
CVE: CVE-2007-3032
Published: 2007-08-14
Description: Unspecified vulnerability in Windows Vista Contacts Gadget in Windows Vista allows user-assisted remote attackers to execute arbitrary code via crafted contact information that is not properly handled when it is imported.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/26439; http://www.kb.cert.org/vuls/id/121024; http://www.securityfocus.com/bid/25304
CVE: CVE-2007-3033
Published: 2007-08-14
Description: Cross-site scripting (XSS) vulnerability in Windows Vista Feed Headlines Gadget (aka Sidebar RSS Feeds Gadget) in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zone.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=575; http://secunia.com/advisories/26439; http://www.kb.cert.org/vuls/id/558648
CVE: CVE-2007-3382
Published: 2007-08-14
Description: Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
CVE: CVE-2007-3385
Published: 2007-08-14
Description: Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
CVE: CVE-2007-3386
Published: 2007-08-14
Description: Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
CVE: CVE-2007-3891
Published: 2007-08-14
Description: Unspecified vulnerability in Windows Vista Weather Gadgets in Windows Vista allows remote attackers to execute arbitrary code via crafted HTML attributes.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/26439; http://www.kb.cert.org/vuls/id/542808; http://www.securityfocus.com/bid/25306
CVE: CVE-2007-4353
Published: 2007-08-15
Description: Multiple buffer overflows in IBM AIX 5.2 and 5.3 allow local users in the system group to gain root privileges via unspecified vectors involving the (1) chpath, (2) rmpath, and (3) devinstall programs in bos.rte.methods.
CVSS Score: 6.9 (MEDIUM)
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://secunia.com/advisories/26420; http://www-1.ibm.com/support/docview.wss?uid=isg1IZ00531
CVE: CVE-2007-4354
Published: 2007-08-15
Description: Buffer overflow in fileplace in bos.perf.tools in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://secunia.com/advisories/26420; http://www-1.ibm.com/support/docview.wss?uid=isg1IZ00149
CVE: CVE-2007-4355
Published: 2007-08-15
Description: Buffer overflow in the at program on IBM AIX 5.3 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://osvdb.org/36794; http://secunia.com/advisories/26437
CVE: CVE-2007-4356
Published: 2007-08-15
Description: Microsoft Internet Explorer 6 and 7 embeds FTP credentials in HTML files that are retrieved during an FTP session, which allows context-dependent attackers to obtain sensitive information by reading the HTML source, as demonstrated by a (1) .htm, (2) .html, or (3) .mht file.
CVSS Score: 9.3 (HIGH)
References: http://blog.washingtonpost.com/securityfix/2007/08/ftp_files_expose_web_site_cred.html; http://osvdb.org/36400; http://secunia.com/advisories/26427
CVE: CVE-2007-4357
Published: 2007-08-15
Description: Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL.  NOTE: the severity of this issue has been disputed by a reliable third party, since the intended functionality of the status bar allows it to be modified.
CVSS Score: 5.0 (MEDIUM)
References: http://my.opera.com/MichalBucko/blog/firefox-2-0-0-5-uri-encoding-allows-phishing; http://www.eleytt.com/michal.bucko/Eleytt_PhishAGoGo/bucked2.html; http://www.securityfocus.com/archive/1/475467/100/100/threaded
CVE: CVE-2007-0319
Published: 2007-08-15
Description: Multiple stack-based buffer overflows in the Motive ActiveEmailTest.EmailData (ActiveUtils EmailData) ActiveX control in ActiveUtils.dll in Motive Service Activation Manager 5.1 and Self Service Manager 5.1 and earlier allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37710; http://secunia.com/advisories/26481; http://securitytracker.com/id?1018571
CVE: CVE-2007-2240
Published: 2007-08-15
Description: The IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix pack 1), does not properly validate digital signatures of downloaded software, which makes it easier for remote attackers to spoof a download.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/39555; http://secunia.com/advisories/26482; http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-67649
CVE: CVE-2007-2928
Published: 2007-08-15
Description: Format string vulnerability in the IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix pack 1), allows remote attackers to execute arbitrary code via format string specifiers in unknown data.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/26482; http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-67649; http://www.kb.cert.org/vuls/id/599657
CVE: CVE-2007-2929
Published: 2007-08-15
Description: The IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix pack 1), exposes unsafe methods to arbitrary web domains, which allows remote attackers to download arbitrary code onto a client system and execute this code.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/26482; http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-67649; http://www.kb.cert.org/vuls/id/426737