deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2798
Published: 2007-06-26
Description: Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal.
CVSS Score: 9.0 (HIGH)
CWE: CWE-787
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://docs.info.apple.com/article.html?artnum=306172; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427
CVE: CVE-2007-3410
Published: 2007-06-26
Description: Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp in RealNetworks RealPlayer 10, 10.1, and possibly 10.5, RealOne Player, RealPlayer Enterprise, and Helix Player 10.5-GOLD and 10.0.5 through 10.0.8, allows remote attackers to execute arbitrary code via an SMIL (SMIL2) file with a long wallclock value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=547; http://osvdb.org/37374; http://osvdb.org/38342
CVE: CVE-2006-7208
Published: 2007-06-26
Description: PHP remote file inclusion vulnerability in download.php in the Adam van Dongen Forum (com_forum) component (aka phpBB component) 1.2.4RC3 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/45364; http://securityreason.com/securityalert/2836; http://www.securityfocus.com/archive/1/472005/100/0/threaded
CVE: CVE-2007-3411
Published: 2007-06-26
Description: SQL injection vulnerability in edit_image.asp in ClickGallery Server 5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the image_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36370; http://pridels-team.blogspot.com/2007/06/clickgallery-server-vuln.html; http://secunia.com/advisories/25805
CVE: CVE-2007-3412
Published: 2007-06-26
Description: Cross-site scripting (XSS) vulnerability in edit_image.asp in ClickGallery Server 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the from parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36371; http://pridels-team.blogspot.com/2007/06/clickgallery-server-vuln.html; http://secunia.com/advisories/25805
CVE: CVE-2007-3413
Published: 2007-06-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in bosDataGrid 2.50 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) GridSearch, (2) gsearch, or (3) ParentID parameter to an unspecified component.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38226; http://pridels-team.blogspot.com/2007/06/bosdatagrid-xss-vuln.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/35026
CVE: CVE-2007-3414
Published: 2007-06-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in access2asp 4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) od and (2) search parameters to (a) suppliersList.asp and (b) contactsList.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels-team.blogspot.com/2007/06/access2asp-xss-vuln.html; http://secunia.com/advisories/25807; http://www.osvdb.org/37750
CVE: CVE-2007-3415
Published: 2007-06-26
Description: Multiple SQL injection vulnerabilities in index.php in phpRaider 1.0.0 rc8 allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) type parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38222; http://pridels-team.blogspot.com/2007/06/phpraider-sql-vuln.html; http://www.securityfocus.com/bid/24593
CVE: CVE-2007-3416
Published: 2007-06-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the administration of (1) polls, (2) profiles, (3) IP bans, and (4) forums in (a) web-app.org WebAPP 0.8 through 0.9.9.6; and (b) web-app.net WebAPP 0.9.9.3.3, 0.9.9.3.4, and 2007; allow remote attackers to perform deletions as administrators.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-352
References: http://www.attrition.org/pipermail/vim/2007-June/001687.html; http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458; http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip
CVE: CVE-2007-3417
Published: 2007-06-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/cgi-lib/search.pl in web-app.org WebAPP before 0.9.9.7 allow remote attackers to inject arbitrary web script or HTML via a search string, which is not sanitized when an HREF attribute is printed by the (1) process_search or (2) show_recent_searches function.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/45398; http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458; http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip
CVE: CVE-2007-3418
Published: 2007-06-26
Description: The displaypost function in cgi-bin/cgi-lib/forum_display.pl in web-app.org WebAPP before 0.9.9.7 does not display usernames in conjunction with real names, which makes it easier for remote authenticated users to impersonate other users.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/45399; http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458; http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip
CVE: CVE-2007-3419
Published: 2007-06-26
Description: The editprofile3 function in cgi-bin/cgi-lib/user.pl in web-app.org WebAPP before 0.9.9.7 does not properly check the (1) themes.dat, (2) languages.dat, (3) profession.dat, (4) gen.dat, (5) marstat.dat, (6) states.dat, and (7) ages.dat files before saving profile settings of members, which has unknown impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/45400; http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458; http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip
CVE: CVE-2007-3420
Published: 2007-06-26
Description: The Random Cookie Password functionality in the loaduser function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 does not clear the (1) username, (2) password, (3) usertheme, and (4) userlang cookies for unauthorized users, which has unknown impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/45401; http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458; http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip
CVE: CVE-2007-3421
Published: 2007-06-26
Description: The (1) login, (2) admin profile edit, (3) reminder, (4) edit profile, (5) profile view, (6) gallery view, (7) gallery comment, and (8) gallery feedback capabilities in web-app.org WebAPP before 0.9.9.7 do not verify presence of users in memberlist.dat, which has unknown impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/45402; http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458; http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip
CVE: CVE-2007-3422
Published: 2007-06-26
Description: The getcgi function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 attempts to parse query strings that contain (1) non-printing characters, (2) certain printing characters that do not commonly occur in URLs, or (3) invalid URL encoding sequences, which has unknown impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/45408; http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458; http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip
CVE: CVE-2007-3423
Published: 2007-06-26
Description: cgi-bin/cgi-lib/instantmessage.pl in web-app.org WebAPP before 0.9.9.7 uses the From field of an instant message as the beginning of the .dat file name when the (1) imview2 or (2) imview3 function reads (a) an internal IM, or a message from a (b) guest or (c) removed member, which has unknown impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/45409; http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458; http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip
CVE: CVE-2007-3424
Published: 2007-06-26
Description: The moveim function in cgi-bin/cgi-lib/instantmessage.pl in web-app.org WebAPP before 0.9.9.7 uses the tocat parameter as a subdirectory name when moving an instant message, which has unknown impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/45410; http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458; http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip
CVE: CVE-2006-7209
Published: 2007-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpTrafficA before 1.2beta2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to keywords results in the (1) main, (2) daily, (3) weekly, (4) monthly, (5) new trends, (6) individual page, and (7) search engine statistics.
CVSS Score: 4.3 (MEDIUM)
References: http://soft.zoneo.net/phpTrafficA/news.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/39973; http://soft.zoneo.net/phpTrafficA/news.php
CVE: CVE-2007-1663
Published: 2007-06-27
Description: Memory leak in the image message functionality in ekg before 1:1.7~rc2-1etch1 on Debian GNU/Linux Etch allows remote attackers to cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/45377; http://www.debian.org/security/2007/dsa-1318; http://www.securityfocus.com/bid/24600
CVE: CVE-2007-1664
Published: 2007-06-27
Description: ekg before 1:1.7~rc2-1etch1 on Debian GNU/Linux Etch allows remote attackers to cause a denial of service (NULL pointer dereference) via a vector related to the token OCR functionality.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/45378; http://www.debian.org/security/2007/dsa-1318; http://www.securityfocus.com/bid/24600
CVE: CVE-2007-1665
Published: 2007-06-27
Description: Memory leak in the token OCR functionality in ekg before 1:1.7~rc2-1etch1 on Debian GNU/Linux Etch allows remote attackers to cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/45379; http://www.debian.org/security/2007/dsa-1318; http://www.securityfocus.com/bid/24600
CVE: CVE-2007-3425
Published: 2007-06-27
Description: Directory traversal vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to include arbitrary local files via the lang parameter, a different vector and version than CVE-2007-1076.2.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/37474; http://secunia.com/advisories/25773; http://soft.zoneo.net/phpTrafficA/Files/get.php?phpTrafficA-1.4.3.tgz
CVE: CVE-2007-3426
Published: 2007-06-27
Description: Cross-site scripting (XSS) vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37475; http://secunia.com/advisories/25773; http://soft.zoneo.net/phpTrafficA/Files/get.php?phpTrafficA-1.4.3.tgz
CVE: CVE-2007-3427
Published: 2007-06-27
Description: SQL injection vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pageid parameter in a stats action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37476; http://secunia.com/advisories/25773; http://soft.zoneo.net/phpTrafficA/Files/get.php?phpTrafficA-1.4.3.tgz
CVE: CVE-2007-3428
Published: 2007-06-27
Description: Multiple unspecified vulnerabilities in phpTrafficA before 1.4.2 allow remote attackers to have an unknown impact via the file parameter to (1) plotStatBar.php or (2) plotStatPie.php, different vectors than CVE-2007-1076.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/43469; http://osvdb.org/43470; http://soft.zoneo.net/phpTrafficA/news.php
CVE: CVE-2007-3429
Published: 2007-06-27
Description: Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allows remote attackers to upload and execute arbitrary PHP code via a filename with a double extension such as .php.jpg.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/45426; http://www.g00ns-forum.net/showthread.php?t=9388; http://www.securityfocus.com/bid/24609
CVE: CVE-2007-3430
Published: 2007-06-27
Description: SQL injection vulnerability in index.php in Simple Invoices 2007 05 25 allows remote attackers to execute arbitrary SQL commands via the submit parameter in an email action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36293; http://secunia.com/advisories/25789; http://www.securityfocus.com/bid/24601
CVE: CVE-2007-3431
Published: 2007-06-27
Description: PHP remote file inclusion vulnerability in cal.func.php in Valerio Capello Dagger - The Cutting Edge r23jan2007 allows remote attackers to execute arbitrary PHP code via a URL in the dir_edge_lang parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36302; http://secunia.com/advisories/25790; http://www.attrition.org/pipermail/vim/2007-June/001691.html
CVE: CVE-2007-3432
Published: 2007-06-27
Description: Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute arbitrary PHP code via a .jpg filename.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/42420; http://www.securityfocus.com/archive/1/472205/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/35016
CVE: CVE-2007-3433
Published: 2007-06-27
Description: SQL injection vulnerability in index.php in Pharmacy System 2 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter in an add action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38224; http://www.securityfocus.com/bid/24602; http://www.vupen.com/english/advisories/2007/2308
CVE: CVE-2007-3434
Published: 2007-06-27
Description: index.php in Pharmacy System 2 and earlier allows remote attackers to obtain sensitive information via a ' (quote) character in the page parameter, which reveals the table prefix in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/37578; http://secunia.com/advisories/25792/; http://www.vupen.com/english/advisories/2007/2308
CVE: CVE-2007-3435
Published: 2007-06-27
Description: Stack-based buffer overflow in the BeginPrint method in a certain ActiveX control in RKD Software (barcodetools.com) BarCodeAx.dll 4.9 allows remote attackers to execute arbitrary code via a long argument.
CVSS Score: 9.3 (HIGH)
References: http://goodfellas.shellcode.com.ar/own/VULWAR200706223.txt; http://osvdb.org/37482; http://secunia.com/advisories/25788
CVE: CVE-2007-3436
Published: 2007-06-27
Description: Microsoft MSN Messenger 4.7 on Windows XP allows remote attackers to cause a denial of service (resource consumption) via a flood of SIP INVITE requests to the port specified for voice conversation.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/45427; http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=292&; https://exchange.xforce.ibmcloud.com/vulnerabilities/35064
CVE: CVE-2007-3437
Published: 2007-06-27
Description: AOL Instant Messenger (AIM) 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service (application crash) via a malformed header value in a SIP INVITE message, a different vulnerability than CVE-2007-3350.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/45428; http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=294&; https://exchange.xforce.ibmcloud.com/vulnerabilities/35070
CVE: CVE-2007-3438
Published: 2007-06-27
Description: Buffer overflow in the SIP header parsing module in the Nortel PC Client SIP Soft Phone 4.1 3.5.208[20051015] allows remote attackers to execute arbitrary code via a malformed message, a different vulnerability than CVE-2007-3361.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/45429; http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=297&; http://osvdb.org/45429
CVE: CVE-2007-3439
Published: 2007-06-27
Description: The Snom 320 SIP Phone, running snom320 linux 3.25, snom320-SIP 6.2.3, and snom320 jffs23.36, allows remote attackers to read a list of missed calls, received calls, and dialed numbers via a direct request to the web server on port 1800.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/37753; http://secunia.com/advisories/25840; http://www.securityfocus.com/bid/24532
CVE: CVE-2007-3440
Published: 2007-06-27
Description: The Snom 320 SIP Phone, running snom320 linux 3.25, snom320-SIP 6.2.3, and snom320 jffs23.36, allows remote attackers to place calls to arbitrary phone numbers via certain requests to the web server on port 1800.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/37752; http://secunia.com/advisories/25840; http://www.securityfocus.com/bid/24535
CVE: CVE-2007-3441
Published: 2007-06-27
Description: Format string vulnerability in the Aastra 9112i SIP Phone with firmware 1.4.0.1048 and boot version 1.1.0.10 allows remote attackers to cause a denial of service (blocked call reception and slow calling) via format string specifiers in an SDP header value, a different vulnerability than CVE-2007-3349.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/45403; http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=278&; https://exchange.xforce.ibmcloud.com/vulnerabilities/35079
CVE: CVE-2007-3442
Published: 2007-06-27
Description: Format string vulnerability on the Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 allows remote attackers to cause a denial of service (blocked call reception and calling) via format string specifiers in an SIP INVITE message that lacks a host name in the Contact header.
CVSS Score: 2.3 (LOW)
References: http://osvdb.org/37646; http://secunia.com/advisories/25824; http://www.blackberry.com/btsc/articles/218/KB12707_f.SAL_Public.html
CVE: CVE-2007-3443
Published: 2007-06-27
Description: The Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 does not properly manage transaction states, which allows remote attackers to cause a denial of service (temporary device hang) by sending a certain SIP INVITE message, but not providing an ACK when the call is answered.
CVSS Score: 2.3 (LOW)
References: http://osvdb.org/37647; http://secunia.com/advisories/25824; http://www.blackberry.com/btsc/articles/220/KB12705_f.SAL_Public.html
CVE: CVE-2007-3444
Published: 2007-06-27
Description: The Research in Motion BlackBerry 7270 with 4.0 SP1 Bundle 83 allows remote attackers to cause a denial of service (blocked call reception) via a malformed SIP invite message, possibly related to multiple format string specifiers in the From field, a spoofed source IP address, and limitations of the function stack frame.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37648; http://secunia.com/advisories/25824; http://www.blackberry.com/btsc/articles/225/KB12700_f.SAL_Public.html
CVE: CVE-2007-3445
Published: 2007-06-27
Description: Buffer overflow in SJ Labs SJphone 1.60.303c, running under Windows Mobile 2003 on the Samsung SCH-i730 phone, allows remote attackers to cause a denial of service (device hang and call termination) via a malformed SIP INVITE message, a different vulnerability than CVE-2007-3351.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/45404; http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=216&; https://exchange.xforce.ibmcloud.com/vulnerabilities/35076
CVE: CVE-2007-3446
Published: 2007-06-27
Description: BugMall Shopping Cart 2.5 and earlier has a default username "demo" and password "demo," which allows remote attackers to obtain login access.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/40152; http://www.h4cky0u.org/viewtopic.php?t=26834; http://www.securityfocus.com/bid/24627
CVE: CVE-2007-3447
Published: 2007-06-27
Description: SQL injection vulnerability in BugMall Shopping Cart 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the "basic search box."  NOTE: 4.0.2 and other versions might also be affected.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/38223; http://secunia.com/advisories/25836; http://www.h4cky0u.org/viewtopic.php?t=26834
CVE: CVE-2007-3448
Published: 2007-06-27
Description: Cross-site scripting (XSS) vulnerability in index.php in BugMall Shopping Cart 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the msgs parameter.  NOTE: 4.0.2 and other versions might also be affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38205; http://secunia.com/advisories/25836; http://www.h4cky0u.org/viewtopic.php?t=26834
CVE: CVE-2007-3449
Published: 2007-06-27
Description: SQL injection vulnerability in member.php in 6ALBlog allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37012; http://secunia.com/advisories/25834; http://www.securityfocus.com/bid/24630
CVE: CVE-2007-3450
Published: 2007-06-27
Description: SQL injection vulnerability in member.php in 6ALBlog allows remote attackers to execute arbitrary SQL commands via the member parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37012; http://www.vupen.com/english/advisories/2007/2323; http://osvdb.org/37012
CVE: CVE-2007-3451
Published: 2007-06-27
Description: PHP remote file inclusion vulnerability in admin/index.php in 6ALBlog allows remote authenticated administrators to execute arbitrary PHP code via a URL in the pg parameter.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/37013; http://secunia.com/advisories/25834; http://www.securityfocus.com/bid/24632
CVE: CVE-2007-3452
Published: 2007-06-27
Description: SQL injection vulnerability in essentials/minutes/doc.php in eDocStore allows remote attackers to execute arbitrary SQL commands via the doc_id parameter in an inline action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36292; http://secunia.com/advisories/25831; http://www.vupen.com/english/advisories/2007/2327
CVE: CVE-2007-3453
Published: 2007-06-27
Description: SQL injection vulnerability in Papoo 3.6, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the selmenuid parameter to certain components.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37543; http://securityreason.com/securityalert/2843; http://www.papoo.de/index/menuid/204/reporeid/215
CVE: CVE-2007-3454
Published: 2007-06-27
Description: Stack-based buffer overflow in CGIOCommon.dll before 8.0.0.1042 in Trend Micro OfficeScan Corporate Edition 8.0 allows remote attackers to execute arbitrary code via long crafted requests, as demonstrated using a long session cookie to unspecified CGI programs that use this library.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=559; http://osvdb.org/36629; http://secunia.com/advisories/25778
CVE: CVE-2007-3455
Published: 2007-06-27
Description: cgiChkMasterPwd.exe before 8.0.0.142 in Trend Micro OfficeScan Corporate Edition 8.0 allows remote attackers to bypass the password requirement and gain access to the Management Console via an empty hash and empty encrypted password string, related to "stored decrypted user logon information."
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=558; http://osvdb.org/36628; http://secunia.com/advisories/25778