deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1195
Published: 2007-03-02
Description: Multiple buffer overflows in XM Easy Personal FTP Server 5.3.0 allow remote attackers to execute arbitrary code via unspecified vectors. NOTE: this issue might overlap CVE-2006-2225, CVE-2006-2226, or CVE-2006-5728.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/22747.pl; http://osvdb.org/33813; http://www.securityfocus.com/bid/22747
CVE: CVE-2007-1196
Published: 2007-03-02
Description: Unspecified vulnerability in Citrix Presentation Server Client for Windows before 10.0 allows remote web sites to execute arbitrary code via unspecified vectors, related to the implementation of ICA connectivity through proxy servers.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/33833; http://secunia.com/advisories/24350; http://support.citrix.com/article/CTX112589
CVE: CVE-2007-1197
Published: 2007-03-02
Description: Multiple unspecified vulnerabilities in Epiware before 4.7.5 have unknown impact and attack vectors, possibly related to cross-site scripting (XSS) and other unspecified issues.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/33817; http://sourceforge.net/forum/forum.php?forum_id=669653; http://osvdb.org/33817
CVE: CVE-2007-1198
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in TaskFreak! before 0.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly a variant of CVE-2007-0982.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/32089; http://www.taskfreak.com/versions.html; http://osvdb.org/32089
CVE: CVE-2007-1199
Published: 2007-03-02
Description: Adobe Reader and Acrobat Trial allow remote attackers to read arbitrary files via a file:// URI in a PDF document, as demonstrated with <</URI(file:///C:/)/S/URI>>, a different issue than CVE-2007-0045.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33897; http://secunia.com/advisories/24408; http://secunia.com/advisories/29205
CVE: CVE-2007-1217
Published: 2007-03-02
Description: Buffer overflow in the bufprint function in capiutil.c in libcapi, as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local users to cause a denial of service (crash) and possibly gain privileges via a crafted CAPI packet.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=408530; http://bugzilla.kernel.org/show_bug.cgi?id=8028; http://osvdb.org/34742
CVE: CVE-2007-1218
Published: 2007-03-02
Description: Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame.  NOTE: this was originally referred to as heap-based, but it might be stack-based.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119, CWE-189
References: http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-802_11.c; http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-802_11.c?r1=1.31.2.11&r2=1.31.2.12; http://docs.info.apple.com/article.html?artnum=307179
CVE: CVE-2007-1219
Published: 2007-03-02
Description: PHP remote file inclusion vulnerability in actions/del.php in Admin Phorum 3.3.1a allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34635; http://www.securityfocus.com/bid/22739; http://www.vupen.com/english/advisories/2007/0778
CVE: CVE-2007-1220
Published: 2007-03-02
Description: The Hypervisor in Microsoft Xbox 360 kernel 4532 and 4548 does not properly verify the parameters passed to the syscall dispatcher, which allows attackers with physical access to bypass code-signing requirements and execute arbitrary code.
CVSS Score: 6.2 (MEDIUM)
References: http://securityreason.com/securityalert/2367; http://www.securityfocus.com/archive/1/461489/100/0/threaded; http://www.securityfocus.com/bid/22745
CVE: CVE-2007-1221
Published: 2007-03-02
Description: The Hypervisor in Microsoft Xbox 360 kernel 4532 and 4548 allows attackers with physical access to force execution of the hypervisor syscall with a certain register set, which bypasses intended code protection.
CVSS Score: 7.2 (HIGH)
References: http://securityreason.com/securityalert/2367; http://www.securityfocus.com/archive/1/461489/100/0/threaded; http://www.securityfocus.com/archive/1/463974/100/200/threaded
CVE: CVE-2007-1222
Published: 2007-03-02
Description: Parallels Desktop for Mac before 20070216 implements Drag and Drop by sharing the entire host filesystem as the .psf share, which allows local users of the guest operating system to write arbitrary files to the host filesystem, and execute arbitrary code via launchd by writing a plist file to a LaunchAgents directory.
CVSS Score: 7.2 (HIGH)
References: http://lists.immunitysec.com/pipermail/dailydave/2007-February/004091.html; http://osvdb.org/33799; http://secunia.com/advisories/24171
CVE: CVE-2007-1223
Published: 2007-03-02
Description: Unspecified vulnerability in Hitachi OSAS/FT/W before 20070223 allows attackers to cause a denial of service (responder control processing halt) by sending "data unexpectedly through the port".
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/36003; http://www.hitachi-support.com/security_e/vuls_e/HS07-004_e/index-e.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/32696
CVE: CVE-2007-1224
Published: 2007-03-02
Description: Grok Developments NetProxy 4.03 allows remote attackers to bypass URL filtering via a request that omits "http://" from the URL and specifies the destination port (:80).
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/36001; http://www.securityfocus.com/bid/22741; http://www.vupen.com/english/advisories/2007/0779
CVE: CVE-2007-1225
Published: 2007-03-02
Description: The connection log file implementation in Grok Developments NetProxy 4.03 does not record requests that omit http:// in a URL, which might allow remote attackers to conduct unauthorized activities and avoid detection.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/36002; http://www.securityfocus.com/bid/22741; http://www.vupen.com/english/advisories/2007/0779
CVE: CVE-2007-1226
Published: 2007-03-02
Description: McAfee VirusScan for Mac (Virex) before 7.7 patch 1 has weak permissions (0666) for /Library/Application Support/Virex/VShieldExclude.txt, which allows local users to reconfigure Virex to skip scanning of arbitrary files.
CVSS Score: 4.1 (MEDIUM)
References: http://osvdb.org/33798; http://secunia.com/advisories/24337; http://securityreason.com/securityalert/2342
CVE: CVE-2007-1227
Published: 2007-03-02
Description: VShieldCheck in McAfee VirusScan for Mac (Virex) before 7.7 patch 1 allow local users to change permissions of arbitrary files via a symlink attack on /Library/Application Support/Virex/VShieldExclude.txt, as demonstrated by symlinking to the root crontab file to execute arbitrary commands.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/33797; http://secunia.com/advisories/24337; http://securityreason.com/securityalert/2342
CVE: CVE-2007-1228
Published: 2007-03-02
Description: IBM DB2 UDB 8.2 before Fixpak 7 (aka fixpack 14), and DB2 9 before Fix Pack 2, on UNIX allows the "fenced" user to access certain unauthorized directories.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/24387; http://www-1.ibm.com/support/docview.wss?uid=swg1IY86711; http://www-1.ibm.com/support/docview.wss?uid=swg1IY87492
CVE: CVE-2007-1229
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in the Nullsoft ShoutcastServer 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the top-level URI on the Incoming interface (port 8001/tcp), which is not properly handled in the administrator interface when viewing the log file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0604.html; http://osvdb.org/33793; http://secunia.com/advisories/24323
CVE: CVE-2007-1230
Published: 2007-03-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via (1) the Referer HTTP header or (2) the URI, a different vulnerability than CVE-2007-1049.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/34361; http://secunia.com/advisories/24566; http://trac.wordpress.org/changeset/4951
CVE: CVE-2006-7098
Published: 2007-03-03
Description: The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0579.html; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=357561; http://osvdb.org/33816
CVE: CVE-2006-7099
Published: 2007-03-03
Description: Directory traversal vulnerability in index.php in SolarPay allows remote attackers to read certain files via a .. (dot dot) in the read parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34693; http://www.securityfocus.com/bid/22722; http://osvdb.org/34693
CVE: CVE-2007-1231
Published: 2007-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) database name, (2) table name, (3) ViewName, (4) view, (5) trigger, and (6) function fields in main.php and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/34634; http://securityreason.com/securityalert/2366; http://www.securityfocus.com/archive/1/461304/100/0/threaded
CVE: CVE-2007-1232
Published: 2007-03-03
Description: Directory traversal vulnerability in SQLiteManager 1.2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in a SQLiteManager_currentTheme cookie.
CVSS Score: 5.1 (MEDIUM)
References: http://osvdb.org/33801; http://secunia.com/advisories/24296; http://securityreason.com/securityalert/2366
CVE: CVE-2007-1233
Published: 2007-03-03
Description: PHP remote file inclusion vulnerability in downloadcounter.php in STWC-Counter 3.4.0.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the stwc_counter_verzeichniss parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/33777; http://secunia.com/advisories/24280; http://www.securityfocus.com/bid/22723
CVE: CVE-2007-1234
Published: 2007-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in sitex allow remote attackers to inject arbitrary web script or HTML via (1) the sxYear parameter to calendar.php, (2) the search parameter to search.php, (3) the linkid parameter to redirect.php, or (4) the page parameter to calendar_events.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/33158; http://osvdb.org/33159; http://osvdb.org/33160
CVE: CVE-2007-1235
Published: 2007-03-03
Description: Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/33157; http://securityreason.com/securityalert/2373; http://www.securityfocus.com/archive/1/461305/100/0/threaded
CVE: CVE-2007-1236
Published: 2007-03-03
Description: sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the (1) sxMonth[] or (2) sxYear[] parameter to calendar.php, or the (3) page[] parameter to calendar_events.php, which reveals the path in various error messages.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/33155; http://osvdb.org/33156; http://securityreason.com/securityalert/2373
CVE: CVE-2007-1237
Published: 2007-03-03
Description: sitex allows remote attackers to obtain potentially sensitive information via a ' (quote) value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/33154; http://securityreason.com/securityalert/2373; http://www.securityfocus.com/archive/1/461305/100/0/threaded
CVE: CVE-2007-1238
Published: 2007-03-03
Description: Microsoft Office 2003 allows user-assisted remote attackers to cause a denial of service (application crash) by attempting to insert a corrupted WMF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/34489; http://securityvulns.com/Qdocument120.html; http://www.securityfocus.com/archive/1/461373/100/0/threaded
CVE: CVE-2007-1239
Published: 2007-03-03
Description: Microsoft Excel 2003 does not properly parse .XLS files, which allows remote attackers to cause a denial of service (application crash) via a file with a (1) corrupted XML format or a (2) corrupted XLS format, which triggers a NULL pointer dereference.
CVSS Score: 4.3 (MEDIUM)
References: http://securityvulns.com/news/Microsoft/Excel/XML/DoS.html; http://www.securityfocus.com/archive/1/461373/100/0/threaded; http://www.securityfocus.com/bid/22717
CVE: CVE-2007-1240
Published: 2007-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Docebo CMS 3.0.3 through 3.0.5 allow remote attackers to inject arbitrary web script or HTML via (1) the searchkey parameter to index.php, or the (2) sn or (3) ri parameter to modules/htmlframechat/index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/22719.html; http://osvdb.org/35995; http://osvdb.org/35996
CVE: CVE-2007-1241
Published: 2007-03-03
Description: Cross-site scripting (XSS) vulnerability in setup.php in Audins Audiens 3.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.8 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/22728.html; http://osvdb.org/35994; http://www.securityfocus.com/bid/22728
CVE: CVE-2007-1242
Published: 2007-03-03
Description: SQL injection vulnerability in system/index.php in Audins Audiens 3.3 allows remote attackers to execute arbitrary SQL commands via the PHPSESSID cookie.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34631; http://www.securityfocus.com/bid/22728; https://exchange.xforce.ibmcloud.com/vulnerabilities/32837
CVE: CVE-2007-1243
Published: 2007-03-03
Description: Audins Audiens 3.3 allows remote attackers to bypass authentication and perform certain privileged actions, possibly an uninstall of the product, by calling unistall.php with the values cnf=disinstalla and status=on.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33792; http://secunia.com/advisories/24254; http://www.securityfocus.com/bid/22728
CVE: CVE-2007-1244
Published: 2007-03-03
Description: Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php.  NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0583.html; http://osvdb.org/33787; http://osvdb.org/33788
CVE: CVE-2007-1245
Published: 2007-03-03
Description: IrfanView 3.99 allows remote attackers to cause a denial of service (application crash) via a malformed WMF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/34487; http://securityvulns.com/Qdocument120.html; http://securityvulns.com/news/IrfanView/WMF/DoS.html
CVE: CVE-2007-1246
Published: 2007-03-03
Description: The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052738.html; http://secunia.com/advisories/24443; http://secunia.com/advisories/24444
CVE: CVE-2007-1247
Published: 2007-03-03
Description: Multiple PHP remote file inclusion vulnerabilities in aWeb Labs aWebNews 1.5 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_news parameter to (1) listing.php or (2) visview.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/33824; http://osvdb.org/33825; http://secunia.com/advisories/24351
CVE: CVE-2007-1248
Published: 2007-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in built2go News Manager Blog 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) uid, and (3) nid parameters to (a) news.php, and the nid parameter to (b) rating.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/24334; http://securityreason.com/securityalert/2343; http://www.securityfocus.com/archive/1/461672/100/0/threaded
CVE: CVE-2007-1249
Published: 2007-03-03
Description: MoveSortedContentAction in C1 Financial Services Contelligent 9.1.4 does not check "the additional environment security configuration," which allows remote attackers with write permissions to reorder components.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://osvdb.org/33497; http://secunia.com/advisories/24364; http://www.contelligent.com/contell/cms/c1web/contelligent/site/contelligent/changelog.html?fromRelease=9.1.4
CVE: CVE-2007-1250
Published: 2007-03-03
Description: SQL injection vulnerability in section/default.asp in ANGEL Learning Management Suite (LMS) 7.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/33846; http://secunia.com/advisories/24368; http://www.securityfocus.com/archive/1/461638/100/0/threaded
CVE: CVE-2007-1251
Published: 2007-03-03
Description: Format string vulnerability in the new_warning function in ntserv/warning.c for Netrek Vanilla Server 2.12.0, when EVENTLOG is enabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the message handling.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/netrekfs-adv.txt; http://secunia.com/advisories/24357; http://sourceforge.net/project/shownotes.php?release_id=490561
CVE: CVE-2007-1252
Published: 2007-03-03
Description: Buffer overflow in Symantec Mail Security for SMTP 5.0 before Patch 175 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted headers in an e-mail message.  NOTE: some information was obtained from third party sources.
CVSS Score: 9.3 (HIGH)
References: ftp://ftp.symantec.com/public/english_us_canada/products/symantec_mail_security/5.0_smtp/updates/release_notes_p175.txt; http://osvdb.org/33840; http://secunia.com/advisories/24371
CVE: CVE-2007-1253
Published: 2007-03-03
Description: Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h, as used in (b) Blender before 2.43, allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted (1) KML or (2) KMZ file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/33836; http://secunia.com/advisories/24232; http://secunia.com/advisories/24233
CVE: CVE-2007-1254
Published: 2007-03-03
Description: SQL injection vulnerability in part.userprofile.php in Connectix Boards 0.7 and earlier allows remote authenticated users to execute arbitrary SQL commands and obtain privileges via the p_skin parameter to index.php.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/33537; http://secunia.com/advisories/24255; http://securityreason.com/securityalert/2364
CVE: CVE-2007-1255
Published: 2007-03-03
Description: Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to execute arbitrary PHP code by uploading a crafted GIF smiley image with a .php extension via the uploadimage parameter to admin.php, which can be later accessed via a direct request for the file in smileys/.  NOTE: this can be leveraged with a separate SQL injection issue for remote unauthenticated attacks.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/33538; http://secunia.com/advisories/24255; http://securityreason.com/securityalert/2364
CVE: CVE-2007-1256
Published: 2007-03-03
Description: Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites, by repeatedly setting document.location in the onunload attribute when linking to another website, a variant of CVE-2007-1092.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2007&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2112&w=2; http://osvdb.org/35913
CVE: CVE-2007-1257
Published: 2007-03-03
Description: The Network Analysis Module (NAM) in Cisco Catalyst Series 6000, 6500, and 7600 allows remote attackers to execute arbitrary commands via certain SNMP packets that are spoofed from the NAM's own IP address.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/33066; http://secunia.com/advisories/24344; http://www.cisco.com/warp/public/707/cisco-sa-20070228-nam.shtml
CVE: CVE-2007-1258
Published: 2007-03-03
Description: Unspecified vulnerability in Cisco IOS 12.2SXA, SXB, SXD, and SXF; and the MSFC2, MSFC2a and MSFC3 running in Hybrid Mode on Cisco Catalyst 6000, 6500 and Cisco 7600 series systems; allows remote attackers on a local network segment to cause a denial of service (software reload) via a certain MPLS packet.
CVSS Score: 6.1 (MEDIUM)
References: http://osvdb.org/33067; http://secunia.com/advisories/24348; http://www.cisco.com/warp/public/707/cisco-sa-20070228-mpls.shtml
CVE: CVE-2007-1259
Published: 2007-03-03
Description: Multiple unspecified vulnerabilities in WebAPP before 0.9.9.6 have unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33272; http://secunia.com/advisories/24227; http://www.vupen.com/english/advisories/2007/0720
CVE: CVE-2006-7100
Published: 2007-03-03
Description: PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://securityreason.com/securityalert/2331; http://www.securityfocus.com/archive/1/448542/100/0/threaded; http://www.securityfocus.com/bid/20493
CVE: CVE-2006-7101
Published: 2007-03-03
Description: SQL injection vulnerability in admin.php in PHPWind 5.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the AdminUser cookie.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22846; http://www.vupen.com/english/advisories/2006/4462; https://exchange.xforce.ibmcloud.com/vulnerabilities/30184