deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0568
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in system/lib/package.php in MyPHPCommander 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the gl_root parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32055; http://secunia.com/advisories/23890; http://www.securityfocus.com/bid/22257
CVE: CVE-2007-0569
Published: 2007-01-30
Description: SQL injection vulnerability in xNews.php in xNews 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a shownews action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32999; http://secunia.com/advisories/23954; http://www.securityfocus.com/bid/22284
CVE: CVE-2007-0570
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in ains_main.php in Johannes Gijsbers (aka Taradino) Ad Fundum Integratable News Script (AINS) 0.02b allows remote attackers to execute arbitrary PHP code via a URL in the ains_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36620; http://www.securityfocus.com/bid/22259; http://www.vupen.com/english/advisories/2007/0384
CVE: CVE-2007-0571
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in include/lib/lib_head.php in phpMyReports 3.0.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfgPathModule parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33003; http://secunia.com/advisories/23959; http://www.securityfocus.com/bid/22290
CVE: CVE-2007-0572
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in include/irc/phpIRC.php in Drunken:Golem Gaming Portal 0.5.1 Alpha 2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36619; http://www.vupen.com/english/advisories/2007/0390; https://exchange.xforce.ibmcloud.com/vulnerabilities/31873
CVE: CVE-2007-0573
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in includes/config.inc.php in nsGalPHP 0.41 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the racineTBS parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32994; http://secunia.com/advisories/23969; http://www.attrition.org/pipermail/vim/2007-January/001257.html
CVE: CVE-2007-0574
Published: 2007-01-30
Description: SQL injection vulnerability in rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.40 allows remote attackers to execute arbitrary SQL commands via the wcHeadlines parameter, a different vector than CVE-2006-4715.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36631; http://www.securityfocus.com/bid/22282; http://osvdb.org/36631
CVE: CVE-2007-0575
Published: 2007-01-30
Description: Multiple SQL injection vulnerabilities in the administrative login page (admin/login.asp) in ASPCode.net AdMentor allow remote attackers to execute arbitrary SQL commands via the (1) Userid and (2) Password fields.
CVSS Score: 7.5 (HIGH)
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2606; http://securityreason.com/securityalert/2207; http://www.securityfocus.com/archive/1/458303/100/0/threaded
CVE: CVE-2007-0576
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in xt_counter.php in Xt-Stats 2.3.x up to 2.4.0.b3 allows remote attackers to execute arbitrary PHP code via a URL in the server_base_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32980; http://seclists.org/bugtraq/2007/Jan/0643.html; http://secunia.com/advisories/23967
CVE: CVE-2007-0577
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in function.inc.php in ACGVclick 0.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23970; http://www.securityfocus.com/bid/22278; http://www.vupen.com/english/advisories/2007/0391
CVE: CVE-2007-0578
Published: 2007-01-30
Description: The http_open function in httpget.c in mpg123 before 0.64 allows remote attackers to cause a denial of service (infinite loop) by closing the HTTP connection early.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/40128; http://sourceforge.net/project/shownotes.php?group_id=135704&release_id=478747; http://www.mandriva.com/security/advisories?name=MDKSA-2007:032
CVE: CVE-2007-0579
Published: 2007-01-30
Description: Unspecified vulnerability in the calendar component in Horde Groupware Webmail Edition before 1.0, and Groupware before 1.0, allows remote attackers to include certain files via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.horde.org/archives/announce/2007/000308.html; http://lists.horde.org/archives/announce/2007/000309.html; http://osvdb.org/33083
CVE: CVE-2007-0580
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in menu.php in Foro Domus 2.10 allows remote attackers to execute arbitrary PHP code via a URL in the sesion_idioma parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33004; http://secunia.com/advisories/23949; http://www.securityfocus.com/bid/22285
CVE: CVE-2007-0581
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in functions.php in EclipseBB 0.5.0 Lite allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35416; http://www.securityfocus.com/archive/1/466172/100/0/threaded; http://www.securityfocus.com/bid/22283
CVE: CVE-2007-0582
Published: 2007-01-30
Description: SQL injection vulnerability in default.asp in ChernobiLe 1.0 allows remote attackers to execute arbitrary SQL commands via the User (username) field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/36618; http://www.securityfocus.com/bid/22280; https://exchange.xforce.ibmcloud.com/vulnerabilities/31939
CVE: CVE-2007-0583
Published: 2007-01-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in HTTP Commander 6.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) LogoffMessage parameter to logofflast.aspx or the (2) txtUsername parameter to Default.aspx. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/32985; http://osvdb.org/32986; http://secunia.com/advisories/23964
CVE: CVE-2007-0584
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in membres/membreManager.php in PhP Generic Library & Framework for comm (g-neric) allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33606; http://osvdb.org/36632; http://www.securityfocus.com/archive/1/458556/100/0/threaded
CVE: CVE-2007-0585
Published: 2007-01-30
Description: include/debug.php in Webfwlog 0.92 and earlier, when register_globals is enabled, allows remote attackers to obtain source code of files via the conffile parameter.  NOTE: some of these details are obtained from third party information.  It is likely that this issue can be exploited to conduct directory traversal attacks.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/33015; http://secunia.com/advisories/23968; http://webfwlog.cvs.sourceforge.net/%2Acheckout%2A/webfwlog/webfwlog/ChangeLog
CVE: CVE-2007-0588
Published: 2007-01-30
Description: The InternalUnpackBits function in Apple QuickDraw, as used by Quicktime 7.1.3 and other applications on Mac OS X 10.4.8 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PICT file that triggers memory corruption in the _GetSrcBits32ARGB function. NOTE: this issue might overlap CVE-2007-0462.
CVSS Score: 7.1 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305214; http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html; http://secunia.com/advisories/24479
CVE: CVE-2007-0589
Published: 2007-01-30
Description: SQL injection vulnerability in Forum Livre 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to info_user.asp.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36644; https://www.exploit-db.com/exploits/3197; http://osvdb.org/36644
CVE: CVE-2007-0590
Published: 2007-01-30
Description: Cross-site scripting (XSS) vulnerability in busca2.asp in Forum Livre 1.0 remote attackers to inject arbitrary web script or HTML via the palavra parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/36645; https://www.exploit-db.com/exploits/3197; http://osvdb.org/36645
CVE: CVE-2007-0591
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in configure.php in Vu Le An Virtual Path (VirtualPath) 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31636; http://secunia.com/advisories/23918; http://www.securityfocus.com/bid/22241
CVE: CVE-2007-0592
Published: 2007-01-30
Description: Cross-site scripting (XSS) vulnerability in EzDatabase 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to admin/login.php and the Admin Panel Database.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36954; http://osvdb.org/36955; http://securityreason.com/securityalert/2196
CVE: CVE-2007-0593
Published: 2007-01-30
Description: Siteman 1.1.11 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing password hashes via a direct request for data/members.txt.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/31662; http://secunia.com/advisories/23925; http://securityreason.com/securityalert/2205
CVE: CVE-2007-0594
Published: 2007-01-30
Description: Siteman 2.0.x2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing password hashes via a direct request for db/siteman/users.MYD.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33590; http://securityreason.com/securityalert/2206; http://www.securityfocus.com/archive/1/458081/100/0/threaded
CVE: CVE-2007-0595
Published: 2007-01-30
Description: Cross-site scripting (XSS) vulnerability in search in High 5 Review Site allows remote attackers to inject arbitrary web script or HTML via the q parameter (aka the search box).
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/32974; http://secunia.com/advisories/23905; http://www.securityfocus.com/archive/1/458122/100/0/threaded
CVE: CVE-2007-0596
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in index/main.php in Aztek Forum 4.00 allows remote authenticated administrators to execute arbitrary PHP code via a URL in the PF[top_url] parameter.
CVSS Score: 6.0 (MEDIUM)
References: http://acid-root.new.fr/poc/21070125.txt; http://osvdb.org/33593; http://www.securityfocus.com/archive/1/458076/100/0/threaded
CVE: CVE-2007-0597
Published: 2007-01-30
Description: Aztek Forum 4.00 allows remote attackers to obtain sensitive information via a direct request to forum.php with the fid=XD query string, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://acid-root.new.fr/poc/21070125.txt; http://osvdb.org/33594; http://www.securityfocus.com/archive/1/458076/100/0/threaded
CVE: CVE-2007-0598
Published: 2007-01-30
Description: SQL injection vulnerability in forum/load.php in Aztek Forum 4.00 allows remote attackers to execute arbitrary SQL commands via the fid cookie to forum.php.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/21070125.txt; http://osvdb.org/33595; http://www.securityfocus.com/archive/1/458076/100/0/threaded
CVE: CVE-2007-0599
Published: 2007-01-30
Description: Variable overwrite vulnerability in common/config.php in Aztek Forum 4.00 allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as copying arbitrary files using index/common_actions.php, via vectors associated with extract operations on the (1) POST, (2) GET, (3) COOKIE, and (4) SERVER superglobal arrays.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/21070125.txt; http://osvdb.org/33596; http://www.securityfocus.com/archive/1/458076/100/0/threaded
CVE: CVE-2007-0600
Published: 2007-01-30
Description: SQL injection vulnerability in news_page.asp in Martyn Kilbryde Newsposter Script (aka makit news/blog poster) 3 and earlier allows remote attackers to execute arbitrary SQL commands via the uid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31640; http://osvdb.org/36633; http://secunia.com/advisories/23930
CVE: CVE-2007-0601
Published: 2007-01-30
Description: common/safety.php in Aztek Forum 4.00 allows remote attackers to enter certain data containing %22 sequences (URL encoded double quotes) and other potentially dangerous manipulations by sending a cookie, which bypasses the blacklist matching against the GET and PUT superglobal arrays.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/21070125.txt; http://osvdb.org/33597; http://www.securityfocus.com/archive/1/458076/100/0/threaded
CVE: CVE-2007-0602
Published: 2007-01-30
Description: Buffer overflow in libvsapi.so in the VSAPI library in Trend Micro VirusWall 3.81 for Linux, as used by IScan.BASE/vscan, allows local users to gain privileges via a long command line argument, a different vulnerability than CVE-2005-0533.
CVSS Score: 6.9 (MEDIUM)
References: http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034124&id=EN-1034124; http://osvdb.org/33043; http://securityreason.com/securityalert/2204
CVE: CVE-2007-0603
Published: 2007-01-30
Description: PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address.
CVSS Score: 7.1 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0025.html; http://osvdb.org/32969; http://osvdb.org/32970
CVE: CVE-2007-0604
Published: 2007-01-30
Description: Cross-site scripting (XSS) vulnerability in Movable Type (MT) before 3.34 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the MTCommentPreviewIsStatic tag, which can open the "comment entry screen," a different vulnerability than CVE-2007-0231.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32987; http://www.sixapart.com/movabletype/beta/distros/MT-3.34-beta-Release-Notes.html; http://osvdb.org/32987
CVE: CVE-2006-5753
Published: 2007-01-30
Description: Unspecified vulnerability in the listxattr system call in Linux kernel, when a "bad inode" is present, allows local users to cause a denial of service (data corruption) and possibly gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://fedoranews.org/cms/node/2739; http://fedoranews.org/cms/node/2740; http://lkml.org/lkml/2007/1/3/150
CVE: CVE-2006-5754
Published: 2007-01-30
Description: The aio_setup_ring function in Linux kernel does not properly initialize a variable, which allows local users to cause a denial of service (crash) via an unspecified error path that causes an incorrect free operation.
CVSS Score: 4.9 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2007-0014.html; http://secunia.com/advisories/23997; http://secunia.com/advisories/24206
CVE: CVE-2006-6535
Published: 2007-01-30
Description: The dev_queue_xmit function in Linux kernel 2.6 can fail before calling the local_bh_disable function, which could lead to data corruption and "node lockups."  NOTE: it is not clear whether this issue is exploitable.
CVSS Score: 9.4 (HIGH)
References: http://linux.bkbits.net:8080/linux-2.6/gnupatch%404186e5bfgUOMBbA6xFaY0_z84kaURw; http://rhn.redhat.com/errata/RHSA-2007-0014.html; http://secunia.com/advisories/23997
CVE: CVE-2007-0465
Published: 2007-01-31
Description: Format string vulnerability in Apple Installer 2.1.5 on Mac OS X 10.4.8 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a (1) PKG, (2) DISTZ, or (3) MPKG package filename.
CVSS Score: 7.6 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html; http://projects.info-pull.com/moab/MOAB-26-01-2007.html
CVE: CVE-2007-0466
Published: 2007-01-31
Description: Telestream Flip4Mac Windows Media Components for Quicktime 2.1.0.33 allows remote attackers to execute arbitrary code via a crafted ASF_File_Properties_Object size field in a WMV file, which triggers memory corruption.
CVSS Score: 10.0 (HIGH)
References: http://projects.info-pull.com/moab/MOAB-27-01-2007.html; http://secunia.com/advisories/23958; http://www.osvdb.org/32697
CVE: CVE-2007-0610
Published: 2007-01-31
Description: Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32976; http://secunia.com/advisories/23951; http://www.securityfocus.com/bid/22250
CVE: CVE-2007-0611
Published: 2007-01-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Free LAN In(tra|ter)net Portal (FLIP) before 1.0-RC2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1) inc.page.php and (2) inc.text.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36682; http://osvdb.org/36683; http://sourceforge.net/project/shownotes.php?release_id=480714&group_id=98260
CVE: CVE-2007-0467
Published: 2007-01-31
Description: crashdump in Apple Mac OS X 10.4.8 allows local users in the admin group to modify arbitrary files or gain privileges via a symlink attack on application logs in /Library/Logs/CrashReporter/.
CVSS Score: 6.2 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305214; http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html; http://projects.info-pull.com/moab/MOAB-28-01-2007.html
CVE: CVE-2007-0612
Published: 2007-01-31
Description: Multiple ActiveX controls in Microsoft Windows 2000, XP, 2003, and Vista allows remote attackers to cause a denial of service (Internet Explorer crash) by accessing the bgColor, fgColor, linkColor, alinkColor, vlinkColor, or defaultCharset properties in the (1) giffile, (2) htmlfile, (3) jpegfile, (4) mhtmlfile, (5) ODCfile, (6) pjpegfile, (7) pngfile, (8) xbmfile, (9) xmlfile, (10) xslfile, or (11) wdfile objects in (a) mshtml.dll; or the (12) TriEditDocument.TriEditDocument or (13) TriEditDocument.TriEditDocument.1 objects in (b) triedit.dll, which cause a NULL pointer dereference.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0547.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052057.html; http://osvdb.org/32628
CVE: CVE-2007-0613
Published: 2007-01-31
Description: The Bonjour functionality in mDNSResponder, iChat 3.1.6, and InstantMessage framework 428 in Apple Mac OS X 10.4.8 does not check for duplicate entries when adding newly discovered available contacts, which allows remote attackers to cause a denial of service (disrupted communication) via a flood of duplicate _presence._tcp mDNS queries.
CVSS Score: 5.0 (MEDIUM)
References: http://projects.info-pull.com/moab/MOAB-29-01-2007.html; http://www.osvdb.org/32698; http://www.osvdb.org/32699
CVE: CVE-2007-0614
Published: 2007-01-31
Description: The Bonjour functionality in mDNSResponder, iChat 3.1.6, and InstantMessage framework 428 in Apple Mac OS X 10.4.8 allows remote attackers to cause a denial of service (persistent application crash) via a crafted phsh hash attribute in a TXT key.
CVSS Score: 7.8 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305102; http://lists.apple.com/archives/Security-announce/2007/Feb/msg00000.html; http://projects.info-pull.com/moab/MOAB-29-01-2007.html
CVE: CVE-2007-0615
Published: 2007-01-31
Description: Unspecified vulnerability in Hitachi JP1/HIBUN Advanced Edition Management Server and Log Server before 20070124 allows remote attackers to cause a denial of service (application stop) via unexpected data.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/32963; http://secunia.com/advisories/23854; http://www.hitachi-support.com/security_e/vuls_e/HS06-019_e/01-e.html
CVE: CVE-2007-0616
Published: 2007-01-31
Description: Directory traversal vulnerability in zen/template-functions.php in zenphoto 1.0.4 up to 1.0.6 allows remote attackers to list arbitrary directories via ".." sequences in the album parameter to index.php.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33072; http://secunia.com/advisories/24026; http://www.securityfocus.com/bid/22368
CVE: CVE-2007-0617
Published: 2007-01-31
Description: The SpamBlocker.dll ActiveX control in Earthlink TotalAccess is marked "safe for scripting," which allows remote attackers to add arbitrary e-mail addresses and domains to the spam blocker whitelist via the (1) AddSenderToWhitelist and (2) AddDomainToWhitelist functions.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052021.html; http://securityreason.com/securityalert/2210; http://www.securityfocus.com/bid/22238
CVE: CVE-2007-0618
Published: 2007-01-31
Description: Unspecified vulnerability in (1) pop3d, (2) pop3ds, (3) imapd, and (4) imapds in IBM AIX 5.3.0 has unspecified impact and attack vectors, involving an "authentication vulnerability."
CVSS Score: 7.5 (HIGH)
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://secunia.com/advisories/23957; http://www-1.ibm.com/support/search.wss?rs=0&q=IY93084&apar=only
CVE: CVE-2007-0619
Published: 2007-01-31
Description: chmlib before 0.39 allows user-assisted remote attackers to execute arbitrary code via a crafted page block length in a CHM file, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=468; http://morte.jedrea.com/~jedwin/projects/chmlib/; http://secunia.com/advisories/23975
CVE: CVE-2007-0620
Published: 2007-01-31
Description: download.php in FD Script 1.3.2 and earlier allows remote attackers to read source of files under the web document root with certain extensions, including .php, via a relative pathname in the fname parameter, as demonstrated by downloading config.php.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33001; http://secunia.com/advisories/23947; http://securityreason.com/securityalert/2197
CVE: CVE-2007-0621
Published: 2007-01-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-6456.  Reason: This candidate is a duplicate of CVE-2006-6456.  It was assigned for a targeted zero-day attack, but further analysis revealed it was for an older issue.  Notes: All CVE users should reference CVE-2006-6456 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-0622
Published: 2007-01-31
Description: Cross-site request forgery (CSRF) vulnerability in MyBB (aka MyBulletinBoard) 1.2.2 allows remote attackers to send messages to arbitrary users.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32968; http://secunia.com/advisories/23934; http://osvdb.org/32968