deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-4847
Published: 2007-09-12
Description: Google Picasa allows remote attackers to read image files stored by Picasa via unspecified vectors involving a picasa:// URI.  NOTE: this information is based upon a vague pre-advisory.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/40565; http://xs-sniper.com/blog/2007/08/20/say-cheeeeeese/; http://osvdb.org/40565
CVE: CVE-2007-4848
Published: 2007-09-12
Description: Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of local files that have associated images via a res:// URI in the src property of a JavaScript Image object, as demonstrated by the URI for a bitmap image resource within a (1) .exe or (2) .dll file.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37638; http://xs-sniper.com/blog/2007/07/20/more-uri-stuff-ies-resouce-uri/; http://osvdb.org/37638
CVE: CVE-2007-4849
Published: 2007-09-12
Description: JFFS2, as used on One Laptop Per Child (OLPC) build 542 and possibly other Linux systems, when POSIX ACL support is enabled, does not properly store permissions during (1) inode creation or (2) ACL setting, which might allow local users to access restricted files or directories after a remount of a filesystem, related to "legacy modes" and an inconsistency between dentry permissions and inode permissions.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://dev.laptop.org/ticket/2732; http://git.infradead.org/?p=mtd-2.6.git%3Ba=commitdiff%3Bh=9ed437c50d89eabae763dd422579f73fdebf288d; http://lists.infradead.org/pipermail/linux-mtd-cvs/2007-August/005897.html
CVE: CVE-2007-4879
Published: 2007-09-13
Description: Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by requesting the TLS client certificates from other domains.
CVSS Score: 5.0 (MEDIUM)
References: http://0x90.eu/ff_tls_poc.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html; http://secunia.com/advisories/29526
CVE: CVE-2006-7223
Published: 2007-09-14
Description: PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://jira.xwiki.org/jira/browse/XWIKI-366; http://jira.xwiki.org/jira/browse/XWIKI-366
CVE: CVE-2007-1688
Published: 2007-09-14
Description: Buffer overflow in the PhPInfo ActiveX control in PhPCtrl.dll in Callisto PhotoParade Player allows remote attackers to execute arbitrary code via the FileVersionof property.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/37731; http://secunia.com/advisories/26789; http://www.kb.cert.org/vuls/id/171449
CVE: CVE-2007-4465
Published: 2007-09-14
Description: Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset.  NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://bugs.gentoo.org/show_bug.cgi?id=186219; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432; http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
CVE: CVE-2007-4749
Published: 2007-09-14
Description: The cmdjob utility in Autodesk Backburner 3.0.2 allows remote attackers to execute arbitrary commands on render servers by queueing jobs that contain these commands.  NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the security risks of operating Backburner on untrusted networks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-16
References: http://secunia.com/advisories/26797; http://securityreason.com/securityalert/3132; http://securitytracker.com/id?1018686
CVE: CVE-2007-4881
Published: 2007-09-14
Description: SQL injection vulnerability in profile/myprofile.php in psi-labs.com social networking script (psisns), probably 1.0, allows remote attackers to execute arbitrary SQL commands via the u parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/36942; http://secunia.com/advisories/26774; http://securityreason.com/securityalert/3131
CVE: CVE-2007-4882
Published: 2007-09-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in TechExcel CustomerWise (formerly TechExcel CRM) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://arquilliere.blog.rhonealpesjob.com/index.php/post/2007/09/11/Premiere-faille-publiee-de-lannee; http://arquilliere.blog.rhonealpesjob.com/index.php/post/2007/09/12/Decouverte-de-vulnerabilite-publication-et-patch; http://osvdb.org/37083
CVE: CVE-2007-4883
Published: 2007-09-14
Description: Cross-site scripting (XSS) vulnerability in the BotQuery extension in MediaWiki 1.7.x and earlier before SVN 20070910 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a similar issue to CVE-2007-4828.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html; http://osvdb.org/37336; http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html
CVE: CVE-2007-4884
Published: 2007-09-14
Description: Media Player Classic (MPC) allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0154.html; http://osvdb.org/37377; http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0154.html
CVE: CVE-2007-4885
Published: 2007-09-14
Description: Avnex AV MP3 Player allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0154.html; http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0154.html
CVE: CVE-2007-4886
Published: 2007-09-14
Description: Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftp, (3) ftps, or (4) ssh2.sftp URL, in the pilih parameter, for which PHP remote file inclusion is blocked only for http URLs.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/40506; http://www.auracms.org/?pilih=news&aksi=lihat&id=117; https://www.exploit-db.com/exploits/4390
CVE: CVE-2007-4887
Published: 2007-09-14
Description: The dl function in PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in the library parameter.  NOTE: there are limited usage scenarios under which this would be a vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://docs.info.apple.com/article.html?artnum=307562; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2007-4888
Published: 2007-09-14
Description: The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribute of the doc variable.
CVSS Score: 3.5 (LOW)
References: http://jira.xwiki.org/jira/browse/XWIKI-726; http://osvdb.org/40499; http://jira.xwiki.org/jira/browse/XWIKI-726
CVE: CVE-2007-3739
Published: 2007-09-14
Description: mm/mmap.c in the hugetlb kernel, when run on PowerPC systems, does not prevent stack expansion from entering into reserved kernel page memory, which allows local users to cause a denial of service (OOPS) via unspecified vectors.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119, CWE-399
References: http://lkml.org/lkml/2007/1/29/180; http://secunia.com/advisories/23955; http://secunia.com/advisories/26760
CVE: CVE-2007-3740
Published: 2007-09-14
Description: The CIFS filesystem in the Linux kernel before 2.6.22, when Unix extension support is enabled, does not honor the umask of a process, which allows local users to gain privileges.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00002.html; http://secunia.com/advisories/26760
CVE: CVE-2007-4138
Published: 2007-09-14
Description: The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307179; http://secunia.com/advisories/26764; http://secunia.com/advisories/26776
CVE: CVE-2007-4889
Published: 2007-09-14
Description: The MySQL extension in PHP 5.2.4 and earlier allows remote attackers to bypass safe_mode and open_basedir restrictions via the MySQL (1) LOAD_FILE, (2) INTO DUMPFILE, and (3) INTO OUTFILE functions, a different issue than CVE-2007-3997.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/3134; http://www.securityfocus.com/archive/1/479082/100/0/threaded; http://www.securityfocus.com/archive/1/479187/100/200/threaded
CVE: CVE-2007-4890
Published: 2007-09-14
Description: Absolute directory traversal vulnerability in a certain ActiveX control in the VB To VSI Support Library (VBTOVSI.DLL) 1.0.0.0 in Microsoft Visual Studio 6.0 allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SaveAs method.  NOTE: contents can be copied from local files via the Load method.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/26779; http://shinnai.altervista.org/exploits/txt/TXT_qwFZc3a35RLy5AGxVBjJ.html; http://www.securityfocus.com/bid/25635
CVE: CVE-2007-4891
Published: 2007-09-14
Description: A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) SyncShell, (3) SaveAs, (4) CABDefaultURL, (5) CABFileName, and (6) CABRunFile methods, which allows remote attackers to execute arbitrary programs and have other impacts, as demonstrated using absolute pathnames in arguments to StartProcess and SyncShell.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://osvdb.org/37106; http://secunia.com/advisories/26779; http://shinnai.altervista.org/exploits/txt/TXT_AZJ5bXwXvMARqwtfe97I.html
CVE: CVE-2007-4892
Published: 2007-09-14
Description: Multiple SQL injection vulnerabilities in SWSoft Plesk 7.6.1, 8.1.0, 8.1.1, and 8.2.0 for Windows allow remote attackers to execute arbitrary SQL commands via a PLESKSESSID cookie to (1) login.php3 or (2) auth.php3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://kb.swsoft.com/en/2159; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7910&w=2; http://secunia.com/advisories/26741
CVE: CVE-2007-4893
Published: 2007-09-14
Description: wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a no_filter field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://fedoranews.org/updates/FEDORA-2007-214.shtml; http://secunia.com/advisories/26771; http://secunia.com/advisories/26796
CVE: CVE-2007-4894
Published: 2007-09-14
Description: Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the post_type parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters related to "early database escaping" and missing validation of "query string like parameters."
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://fedoranews.org/updates/FEDORA-2007-214.shtml; http://secunia.com/advisories/26771; http://secunia.com/advisories/26796
CVE: CVE-2007-4895
Published: 2007-09-14
Description: Directory traversal vulnerability in dwoprn.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitrary files via the f parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/36534; https://www.exploit-db.com/exploits/4386; https://exchange.xforce.ibmcloud.com/vulnerabilities/36534
CVE: CVE-2007-4896
Published: 2007-09-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/header.php in Toms Gaestebuch 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lang[adminseite], (2) lang[ueberschrift], or (3) einst[metachar] parameter, different vectors than CVE-2007-4711.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38660; http://www.securityfocus.com/archive/1/478869/100/0/threaded; http://www.securityfocus.com/archive/1/479992/100/100/threaded
CVE: CVE-2007-4897
Published: 2007-09-14
Description: pwlib, as used by Ekiga 2.0.5 and possibly other products, allows remote attackers to cause a denial of service (application crash) via a long argument to the PString::vsprintf function, related to a "memory management flaw". NOTE: this issue was originally reported as being in the SIPURL::GetHostAddress function in Ekiga (formerly GnomeMeeting).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://blog.s21sec.com/2007/09/sobre-la-vulnerabilidad-del-ekiga.html; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2339&w=2; http://openh323.cvs.sourceforge.net/openh323/opal/src/sip/sipcon.cxx?r1=2.120.2.25&r2=2.120.2.26&pathrev=v2_2_9
CVE: CVE-2007-4898
Published: 2007-09-14
Description: Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki in a multiwiki environment, to obtain sensitive information via unknown attack vectors.  NOTE: Some of these details are obtained from third party information.
CVSS Score: 2.1 (LOW)
References: http://osvdb.org/40500; http://secunia.com/advisories/26777; http://www.securityfocus.com/bid/25647
CVE: CVE-2007-4899
Published: 2007-09-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Boinc Forum 5.10.20 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to forum_forum.php, or the search_string parameter to forum_text_search_action.php in a (2) titles or (3) bodies search.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3139; http://www.securityfocus.com/archive/1/479182/100/0/threaded; http://www.securityfocus.com/bid/25644
CVE: CVE-2007-4900
Published: 2007-09-14
Description: Cross-site scripting (XSS) vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37099; http://secunia.com/advisories/26707; http://securityreason.com/securityalert/3137
CVE: CVE-2007-4901
Published: 2007-09-14
Description: The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly constrain the use of mshtml.dll's web script and HTML functionality for incoming instant messages, which allows remote attackers to place HTML into unexpected contexts or execute arbitrary code, as demonstrated by writing arbitrary HTML to a notification window, and writing contents of arbitrary local image files to this window via IMG SRC.
CVSS Score: 5.8 (MEDIUM)
References: http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx; http://secunia.com/advisories/26786; http://securityreason.com/securityalert/3136
CVE: CVE-2007-4902
Published: 2007-09-17
Description: Absolute path traversal vulnerability in a certain ActiveX control in CryptoX.dll 2.0 and earlier in the Ultra Crypto Component allows remote attackers to write to arbitrary files via a full pathname in the argument to the SaveToFile method.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/38982; http://www.securityfocus.com/bid/25611; http://www.securitytracker.com/id?1018675
CVE: CVE-2007-4903
Published: 2007-09-17
Description: Multiple buffer overflows in a certain ActiveX control in CryptoX.dll 2.0 and earlier in the Ultra Crypto Component allow remote attackers to execute arbitrary code via (1) a long string in the first argument to the AcquireContext method or (2) an unspecified vector to the DeleteContext method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/38979; http://www.securityfocus.com/bid/25609; http://www.securitytracker.com/id?1018674
CVE: CVE-2007-4904
Published: 2007-09-17
Description: RealNetworks RealPlayer 10.1.0.3114 and earlier, and Helix Player 1.0.6.778 on Fedora Core 6 (FC6) and possibly other platforms, allow user-assisted remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0154.html; http://osvdb.org/39904; http://www.securityfocus.com/archive/1/479081/100/0/threaded
CVE: CVE-2007-4905
Published: 2007-09-17
Description: Unrestricted file upload vulnerability in mod/contak.php in AuraCMS 2.1 allows remote attackers to upload and execute arbitrary PHP files via the image parameter, which places a file under files/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/40505; http://secunia.com/advisories/26747; http://www.auracms.org/?pilih=news&aksi=lihat&id=117
CVE: CVE-2007-4906
Published: 2007-09-17
Description: PHP remote file inclusion vulnerability in tasks/send_queued_emails.php in NuclearBB Alpha 2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/38978; http://securityreason.com/securityalert/3142; http://www.securityfocus.com/archive/1/479086/100/0/threaded
CVE: CVE-2007-4907
Published: 2007-09-17
Description: Multiple PHP remote file inclusion vulnerabilities in X-Cart allow remote attackers to execute arbitrary PHP code via a URL in the xcart_dir parameter to (1) config.php, (2) prepare.php, (3) smarty.php, (4) customer/product.php, (5) provider/auth.php, and (6) admin/auth.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/38972; http://osvdb.org/38973; http://osvdb.org/38974
CVE: CVE-2007-4908
Published: 2007-09-17
Description: Directory traversal vulnerability in index.php in AuraCMS 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pilih parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/40504; http://secunia.com/advisories/26747; http://www.auracms.org/?pilih=news&aksi=lihat&id=117
CVE: CVE-2007-3379
Published: 2007-09-17
Description: Unspecified vulnerability in the kernel in Red Hat Enterprise Linux (RHEL) 4 on the x86_64 platform allows local users to cause a denial of service (OOPS) via unspecified vectors related to the get_gate_vma function and the fuser command.
CVSS Score: 2.1 (LOW)
References: http://rhn.redhat.com/errata/RHBA-2007-0304.html; https://bugzilla.redhat.com/show_bug.cgi?id=178981; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10426
CVE: CVE-2007-3654
Published: 2007-09-17
Description: The display driver allocattr functions in NetBSD 3.0 through 4.0_BETA2, and NetBSD-current before 20070728, allow local users to cause a denial of service (panic) via a (1) negative or (2) large value in an ioctl call, as demonstrated by the vga_allocattr function.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-006.txt.asc; http://osvdb.org/40810; http://www.securityfocus.com/bid/25682
CVE: CVE-2007-3731
Published: 2007-09-17
Description: The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations, which allows local users to cause a denial of service (NULL dereference and OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP requests, related to the TRACE_IRQS_ON function, and possibly related to the arch_ptrace function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.kernel.org/show_bug.cgi?id=8765; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=29eb51101c02df517ca64ec472d7501127ad1da8; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=a10d9a71bafd3a283da240d2868e71346d2aef6f
CVE: CVE-2007-4909
Published: 2007-09-17
Description: Interpretation conflict in WinSCP before 4.0.4 allows remote attackers to perform arbitrary file transfers with a remote server via file-transfer commands in the final portion of a (1) scp, and possibly a (2) sftp or (3) ftp, URL, as demonstrated by a URL specifying login to the remote server with a username of scp, which is interpreted as an HTTP scheme name by the protocol handler in a web browser, but is interpreted as a username by WinSCP.  NOTE: this is related to an incomplete fix for CVE-2006-3015.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/26820; http://securityreason.com/securityalert/3141; http://winscp.cvs.sourceforge.net/winscp/winscp3/core/SessionData.cpp?r1=1.29&r2=1.30
CVE: CVE-2007-4910
Published: 2007-09-17
Description: Unspecified vulnerability in netInvoicing before 2.7.3 has unknown impact and attack vectors, related to "security check soap".
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/26730; http://www.netinvoicing.com/downloads/ChangeLog; http://www.securityfocus.com/bid/25661
CVE: CVE-2007-4911
Published: 2007-09-17
Description: JSMP3OGGWt.dll in JetCast Server 2.0.0.4308 allows remote attackers to cause a denial of service (daemon crash) via a long .mp3 URI to TCP port 8000.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/40520; http://secunia.com/advisories/26815; http://www.securityfocus.com/bid/25660
CVE: CVE-2007-4912
Published: 2007-09-17
Description: Cross-site scripting (XSS) vulnerability in ips_kernel/class_ajax.php in Invision Power Board (IPB or IP.Board) 2.3.1 up to 20070912 allows remote attackers to inject arbitrary web script or HTML into user profile fields via unspecified vectors related to character sets other than iso-8859-1 or utf-8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forums.invisionpower.com/index.php?act=attach&type=post&id=11870; http://forums.invisionpower.com/index.php?showtopic=237075; http://secunia.com/advisories/26788