deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-5408
Published: 2007-10-12
Description: SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/27185; http://www.securityfocus.com/bid/26018; http://www.vupen.com/english/advisories/2007/3468
CVE: CVE-2007-5409
Published: 2007-10-12
Description: PHP remote file inclusion vulnerability in admin/nuseo_admin_d.php in NuSEO PHP Enterprise 1.6 (NuSEO.PHP), when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the nuseo_dir parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/27172; http://www.securityfocus.com/bid/26021; https://exchange.xforce.ibmcloud.com/vulnerabilities/37062
CVE: CVE-2007-5410
Published: 2007-10-12
Description: PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader (com_wmtrssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/43765; http://securityreason.com/securityalert/3211; http://www.securityfocus.com/archive/1/481979/100/0/threaded
CVE: CVE-2007-5411
Published: 2007-10-12
Description: Cross-site scripting (XSS) vulnerability in the Linksys SPA941 VoIP Phone with firmware 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the From header in a SIP message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066430.html; http://secunia.com/advisories/27116; http://www.securityfocus.com/bid/25987
CVE: CVE-2007-5412
Published: 2007-10-12
Description: Multiple PHP remote file inclusion vulnerabilities in the Quoc-Huy MP3 Allopass (com_mp3_allopass) 1.0 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter to (1) allopass.php and (2) allopass-error.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/43630; http://osvdb.org/43631; http://www.securityfocus.com/bid/26002
CVE: CVE-2007-3675
Published: 2007-10-12
Description: Multiple format string vulnerabilities in the kavwebscan.CKAVWebScan ActiveX control (kavwebscan.dll) in Kaspersky Online Scanner before 5.0.98 allow remote attackers to execute arbitrary code via format string specifiers in "various string formatting functions," which trigger heap-based buffer overflows.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=606; http://secunia.com/advisories/27187; http://securitytracker.com/id?1018800
CVE: CVE-2007-4619
Published: 2007-10-12
Description: Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation, resulting in a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://bugzilla.redhat.com/show_bug.cgi?id=331991; http://flac.sourceforge.net/changelog.html#flac_1_2_1; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608
CVE: CVE-2007-5414
Published: 2007-10-12
Description: Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0, when UTF-7 document content is rendered directly in UTF-7, allows remote attackers to inject arbitrary web script or HTML via a gopher URI that uses single quote characters to delimit a literal string within an XSS sequence, a related issue to CVE-2007-5415.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://osvdb.org/43670; http://securityreason.com/securityalert/3216; http://www.securityfocus.com/archive/1/482006/100/0/threaded
CVE: CVE-2007-5415
Published: 2007-10-12
Description: Cross-site scripting (XSS) vulnerability in Mozilla Firefox 2.0, when UTF-7 document content is rendered directly in UTF-7, allows remote attackers to inject arbitrary web script or HTML via a gopher URI that uses '/' (slash) characters to delimit a literal string within an XSS sequence, a related issue to CVE-2007-5414.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3216; http://www.securityfocus.com/archive/1/482006/100/0/threaded; http://securityreason.com/securityalert/3216
CVE: CVE-2007-5416
Published: 2007-10-12
Description: Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupal_eval function through a callback parameter to the default URI, as demonstrated by the _menu[callbacks][1][callback] parameter.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Drupal.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://securityreason.com/securityalert/3216; http://securityvulns.ru/Sdocument137.html; http://www.securityfocus.com/archive/1/482006/100/0/threaded
CVE: CVE-2007-5417
Published: 2007-10-12
Description: Directory traversal vulnerability in index.php in boastMachine (aka bMachine) 2.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/43632; http://securityreason.com/securityalert/3216; http://securityvulns.com/Sdocument42.html
CVE: CVE-2007-5418
Published: 2007-10-12
Description: Multiple PHP remote file inclusion vulnerabilities in CARE2X 2G 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) en_copyrite.php, (2) vi_copyrite.php, and (3) ar_copyrite.php in language/ directories; (4) class_access.php, (5) class_department.php, (6) class_config.php, (7) class_image.php, (8) class_ward.php, and (9) class_product.php in include/care_api_classes/; (10) gui/smarty_template/smarty_care.class.php; and possibly other components, different vectors than CVE-2007-1458.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/43639; http://osvdb.org/43640; http://osvdb.org/43641
CVE: CVE-2007-5419
Published: 2007-10-12
Description: The 3Com 3CRWER100-75 router with 1.2.10ww software, when enabling an optional virtual server, configures this server to accept all source IP addresses on the external (Internet) interface unless the user selects other options, which might expose the router to unintended incoming traffic from remote attackers, as demonstrated by setting up a virtual server on port 80, which allows remote attackers to access the web management interface.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://osvdb.org/43657; http://securityreason.com/securityalert/3217; http://www.securityfocus.com/archive/1/481977/100/0/threaded
CVE: CVE-2007-5420
Published: 2007-10-12
Description: The 3Com 3CRWER100-75 router with 1.2.10ww software, when remote management is disabled but a web server has been configured, serves a web page to external clients, which might allow remote attackers to obtain information about the router's existence and product details.
CVSS Score: 2.6 (LOW)
CWE: CWE-16, CWE-200
References: http://osvdb.org/45490; http://securityreason.com/securityalert/3217; http://www.securityfocus.com/archive/1/481977/100/0/threaded
CVE: CVE-2007-5421
Published: 2007-10-12
Description: Rejected reason: Multiple stack-based buffer overflows in Cisco IOS 12.x and IOS XR allow attackers to execute arbitrary code, as demonstrated via the "Bind Shell", "Reverse Shell", and "Two byte rootshell (Tiny Shell)" attacks.  NOTE: the vendor and researcher agree that this issue does not cross privilege boundaries, saying they do not "represent a vulnerability."  The disclosure was intended to demonstrate techniques for exploitation, which is not covered by CVE
CVE: CVE-2007-5422
Published: 2007-10-12
Description: Unspecified vulnerability in "Solaris Auditing" in the Basic Security Module (BSM) in Sun Solaris 10, when configured for auditing of networking (nt) events, allows local users to cause a denial of service (panic) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-16
References: http://osvdb.org/37727; http://secunia.com/advisories/27175; http://securitytracker.com/id?1018803
CVE: CVE-2007-5358
Published: 2007-10-12
Description: Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow (1) remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or (2) local users to execute arbitrary code via a long combination of astspooldir, voicemail context, and voicemail mailbox fields.  NOTE: vector 2 requires write access to Asterisk configuration files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://downloads.digium.com/pub/security/AST-2007-022.html; http://osvdb.org/38201; http://osvdb.org/38202
CVE: CVE-2007-5423
Published: 2007-10-12
Description: tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://bugs.gentoo.org/show_bug.cgi?id=195503; http://osvdb.org/40478; http://secunia.com/advisories/27190
CVE: CVE-2007-5424
Published: 2007-10-12
Description: The disable_functions feature in PHP 4 and 5 allows attackers to bypass intended restrictions by using an alias, as demonstrated by using ini_alter when ini_set is disabled.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/3216; http://securityvulns.com/news/PHP/alias-pb.html; http://securityvulns.ru/Sdocument67.html
CVE: CVE-2007-5425
Published: 2007-10-12
Description: SQL injection vulnerability in admin/index.php in Interspire ActiveKB 1.5 allows remote attackers to execute arbitrary SQL commands via the questId parameter in a hideQuestion ToDo action.  NOTE: the catId vector is already covered by CVE-2007-5131.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/45486; http://securityreason.com/securityalert/3216; http://securityvulns.ru/Rdocument901.html
CVE: CVE-2007-5426
Published: 2007-10-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in ActiveKB NX 2.5.4 allow remote attackers to inject arbitrary web script or HTML via the page parameter to the default URI for some directories, as demonstrated by (1) ActiveKB/ and (2) default/categories/ActiveKB/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37661; http://secunia.com/advisories/27194; http://securityreason.com/securityalert/3216
CVE: CVE-2007-5427
Published: 2007-10-12
Description: Cross-site scripting (XSS) vulnerability in the com_search component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchword parameter.  NOTE: this might be related to CVE-2007-4189.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37709; http://secunia.com/advisories/27196; http://securityreason.com/securityalert/3216
CVE: CVE-2007-5428
Published: 2007-10-12
Description: Cross-site scripting (XSS) vulnerability in UMI CMS allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to the default URI in search_do/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/43766; http://securityreason.com/securityalert/3216; http://securityvulns.ru/Rdocument957.html
CVE: CVE-2007-5429
Published: 2007-10-12
Description: Cross-site scripting (XSS) vulnerability in index.php in Nucleus 3.01 allows remote attackers to inject arbitrary web script or HTML via the archive parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/40611; http://securityreason.com/securityalert/3216; http://securityvulns.ru/Sdocument3.html
CVE: CVE-2007-5430
Published: 2007-10-12
Description: Multiple SQL injection vulnerabilities in Stride 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the p parameter to main.php in the Content Management System, (2) the id parameter in a sto cmd action to shop.php in the Merchant subsystem, or the (3) course or (4) provider parameter to detail.php in the Courses subsystem.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/43491; http://osvdb.org/43492; http://osvdb.org/43494
CVE: CVE-2007-5431
Published: 2007-10-12
Description: include/imageupload.js in the MyFTPUploader module in Stride 1.0 contains sensitive information including FTP login credentials, which might allow remote attackers to gain unauthorized access to the FTP server being used by the module by viewing the source code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://osvdb.org/45487; http://securityreason.com/securityalert/3216; http://securityvulns.ru/Sdocument4.html
CVE: CVE-2007-5432
Published: 2007-10-12
Description: Stride 1.0 has a default administrator username of "scott" with the password "running", which allows remote attackers to obtain administrative access through login.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://osvdb.org/43485; http://securityreason.com/securityalert/3216; http://securityvulns.ru/Sdocument4.html
CVE: CVE-2007-5433
Published: 2007-10-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Site-Up 2.64 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search or (2) search mask field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/42477; http://securityreason.com/securityalert/3216; http://securityvulns.ru/Sdocument12.html
CVE: CVE-2007-5434
Published: 2007-10-12
Description: Cross-site scripting (XSS) vulnerability in PRO-search 0.17.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/43484; http://securityreason.com/securityalert/3216; http://securityvulns.ru/Sdocument68.html
CVE: CVE-2007-5208
Published: 2007-10-13
Description: hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=195565; http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html; http://qa.mandriva.com/show_bug.cgi?id=30719
CVE: CVE-2007-5324
Published: 2007-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-2582.  Reason: This candidate is a duplicate of CVE-2007-2582.  Notes: All CVE users should reference CVE-2007-2582 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-5325
Published: 2007-10-13
Description: Multiple buffer overflows in (1) the Message Engine and (2) AScore.dll in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27192; http://supportconnectw.ca.com/public/storage/infodocs/basb-secnotice.asp; http://www.securityfocus.com/archive/1/482121/100/0/threaded
CVE: CVE-2007-5326
Published: 2007-10-13
Description: Multiple buffer overflows in (1) RPC and (2) rpcx.dll in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/41368; http://secunia.com/advisories/27192; http://secunia.com/secunia_research/2007-49/advisory/
CVE: CVE-2007-5327
Published: 2007-10-13
Description: Stack-based buffer overflow in the RPC interface for the Message Engine (mediasvr.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to execute arbitrary code via a long argument in the 0x10d opnum.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://ruder.cdut.net/blogview.asp?logID=231; http://secunia.com/advisories/27192; http://securityreason.com/securityalert/3218
CVE: CVE-2007-5328
Published: 2007-10-13
Description: The Message Engine RPC service in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows attackers to execute arbitrary code by using certain "insecure method calls" to modify the file system and registry, aka "Privileged function exposure."
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/27192; http://supportconnectw.ca.com/public/storage/infodocs/basb-secnotice.asp; http://www.securityfocus.com/archive/1/482121/100/0/threaded
CVE: CVE-2007-5329
Published: 2007-10-13
Description: Unspecified vulnerability in dbasvr in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, has unknown impact and attack vectors related to memory corruption.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://osvdb.org/41372; http://secunia.com/advisories/27192; http://supportconnectw.ca.com/public/storage/infodocs/basb-secnotice.asp
CVE: CVE-2007-5330
Published: 2007-10-13
Description: The cadbd RPC service in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to (1) execute arbitrary code via stack-based buffer overflows in unspecified RPC procedures, and (2) trigger memory corruption related to the use of "handle" RPC arguments as pointers.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119, CWE-399
References: http://osvdb.org/41373; http://osvdb.org/41374; http://secunia.com/advisories/27192
CVE: CVE-2007-5331
Published: 2007-10-13
Description: Queue.dll for the message queuing service (LQserver.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to execute arbitrary code via a malformed ONRPC protocol request for operation 0x76, which causes ARCserve Backup to dereference arbitrary pointers.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/41371; http://research.eeye.com/html/advisories/published/AD20071011.html; http://secunia.com/advisories/27192
CVE: CVE-2007-5332
Published: 2007-10-13
Description: Multiple unspecified vulnerabilities in (1) mediasvr and (2) caloggerd in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, have unknown impact and attack vectors related to memory corruption.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://osvdb.org/41366; http://osvdb.org/41367; http://secunia.com/advisories/27192
CVE: CVE-2007-4995
Published: 2007-10-13
Description: Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=195634; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01299773; http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html
CVE: CVE-2007-5435
Published: 2007-10-13
Description: Unspecified vulnerability in CA ERwin Process Modeler (formerly AllFusion Process Modeler) 7.2 might allow user-assisted remote attackers to cause a denial of service via a crafted Data Standards File (Datatype Standards File).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/43483; http://securityreason.com/securityalert/3219; http://www.eleytt.com/advisories/eleytt_ERWINDSF.pdf
CVE: CVE-2007-5436
Published: 2007-10-13
Description: Buffer overflow in a certain ActiveX control in ScanObjectBrowser.DLL in G DATA Antivirus 2007 might allow remote attackers to execute arbitrary code via unspecified parameters to the SelectPath function. NOTE: this issue might not cross privilege boundaries in most environments, since it is not marked as safe for scripting.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://osvdb.org/42476; http://securityreason.com/securityalert/3219; http://www.eleytt.com/advisories/eleytt_GDATA2007_1.pdf
CVE: CVE-2007-5437
Published: 2007-10-13
Description: The web console in CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 allows remote attackers to redirect users to arbitrary web sites via a crafted HTTP URL on port 6689.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-59
References: http://osvdb.org/43482; http://securityreason.com/securityalert/3219; http://www.eleytt.com/advisories/eleytt_ETRUSTITM2.pdf
CVE: CVE-2007-5438
Published: 2007-10-13
Description: Unspecified vulnerability in a certain ActiveX control in Reconfig.DLL in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 might allow local users to cause a denial of service to the Virtual Disk Mount Service (vmount2.exe), related to the ConnectPopulatedDiskEx function.
CVSS Score: 1.9 (LOW)
CWE: CWE-20
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://osvdb.org/43488; http://secunia.com/advisories/31707
CVE: CVE-2007-5439
Published: 2007-10-13
Description: CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 stores sensitive user information in log files with predictable names, which allows remote attackers to obtain this information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://osvdb.org/43487; http://securityreason.com/securityalert/3219; http://www.eleytt.com/advisories/eleytt_ETRUSTITM1.pdf
CVE: CVE-2007-5440
Published: 2007-10-14
Description: Multiple PHP remote file inclusion vulnerabilities in CRS Manager allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter to (1) index.php or (2) login.php.  NOTE: this issue is disputed by CVE, since DOCUMENT_ROOT cannot be modified by an attacker
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/43486; http://securityreason.com/securityalert/3216; http://securityvulns.com/Rdocument959.html
CVE: CVE-2007-5195
Published: 2007-10-14
Description: Unspecified vulnerability in the SSL implementation in Groupwise client system in the novell-groupwise-client package in SUSE Linux Enterprise Desktop 10 allows remote attackers to obtain credentials via a man-in-the-middle attack, a different vulnerability than CVE-2007-5196.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-310
References: http://osvdb.org/45492; http://secunia.com/advisories/27229; http://www.novell.com/linux/security/advisories/2007_20_sr.html
CVE: CVE-2007-5196
Published: 2007-10-14
Description: Unspecified vulnerability in the SSL implementation in Groupwise client system in the novell-groupwise-client package in SUSE Linux Enterprise Desktop 10 allows remote attackers to obtain credentials via a man-in-the-middle attack, a different vulnerability than CVE-2007-5195.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-310
References: http://osvdb.org/45491; http://secunia.com/advisories/27229; http://www.novell.com/linux/security/advisories/2007_20_sr.html
CVE: CVE-2007-5200
Published: 2007-10-14
Description: hugin, as used on various operating systems including SUSE openSUSE 10.2 and 10.3, allows local users to overwrite arbitrary files via a symlink attack on the hugin_debug_optim_results.txt temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://osvdb.org/42224; http://secunia.com/advisories/27229; http://secunia.com/advisories/27623