deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0163
Published: 2008-02-12
Description: Linux kernel 2.6, when using vservers, allows local users to access resources of other vservers via a symlink attack in /proc.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://secunia.com/advisories/28875; http://www.debian.org/security/2008/dsa-1494; http://www.securityfocus.com/bid/27704
CVE: CVE-2008-0600
Published: 2008-02-12
Description: The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer before dereference, which allows local users to gain root privileges via crafted arguments in a vmsplice system call, a different vulnerability than CVE-2008-0009 and CVE-2008-0010.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html
CVE: CVE-2008-0729
Published: 2008-02-12
Description: Mobile Safari on Apple iPhone 1.1.2 and 1.1.3 allows remote attackers to cause a denial of service (memory exhaustion and device crash) via certain JavaScript code that constructs a long string and an array containing long string elements, possibly a related issue to CVE-2006-3677.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://securityreason.com/securityalert/3630; http://www.securityfocus.com/archive/1/487607/100/0/threaded; http://www.securityfocus.com/archive/1/492225/100/0/threaded
CVE: CVE-2008-0730
Published: 2008-02-12
Description: The (1) Simplified Chinese, (2) Traditional Chinese, (3) Korean, and (4) Thai language input methods in Sun Solaris 10 create files and directories with weak permissions under (a) .iiim/le and (b) .Xlocale in home directories, which might allow local users to write to, or read from, the home directories of other users.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28931; http://sunsolve.sun.com/search/document.do?assetkey=1-26-201315-1; http://www.securityfocus.com/bid/27770
CVE: CVE-2008-0731
Published: 2008-02-12
Description: The Linux kernel before 2.6.18.8-0.8 in SUSE openSUSE 10.2 does not properly handle failure of an AppArmor change_hat system call, which might allow attackers to trigger the unconfining of an apparmored task.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00002.html; http://secunia.com/advisories/28806; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00002.html
CVE: CVE-2008-0732
Published: 2008-02-12
Description: The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
CVSS Score: 2.1 (LOW)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html; http://secunia.com/advisories/28838; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
CVE: CVE-2007-0065
Published: 2008-02-12
Description: Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, Office 2004 for Mac, and Visual basic 6.0 SP6 allows remote attackers to execute arbitrary code via a crafted script request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28902; http://www.securityfocus.com/bid/27661
CVE: CVE-2007-0216
Published: 2008-02-12
Description: wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section length headers, aka "Microsoft Works File Converter Input Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=659; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28904
CVE: CVE-2008-0076
Published: 2008-02-12
Description: Unspecified vulnerability in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via crafted HTML layout combinations, aka "HTML Rendering Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28903; http://www.securityfocus.com/bid/27668
CVE: CVE-2008-0077
Published: 2008-02-12
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 SP1, 6 SP2, and and 7 allows remote attackers to execute arbitrary code by assigning malformed values to certain properties, as demonstrated using the by property of an animateMotion SVG element, aka "Property Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=661; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28903
CVE: CVE-2008-0078
Published: 2008-02-12
Description: Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via a crafted image, aka "Argument Handling Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28903; http://www.securityfocus.com/bid/27689
CVE: CVE-2008-0080
Published: 2008-02-12
Description: Heap-based buffer overflow in the WebDAV Mini-Redirector in Microsoft Windows XP SP2, Server 2003 SP1 and SP2, and Vista allows remote attackers to execute arbitrary code via a crafted WebDAV response.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28894; http://www.securityfocus.com/bid/27670
CVE: CVE-2008-0102
Published: 2008-02-12
Description: Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file, related to invalid "memory values," aka "Publisher Invalid Memory Reference Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28906; http://www.securityfocus.com/bid/27739
CVE: CVE-2008-0104
Published: 2008-02-12
Description: Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file, aka "Publisher Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28906; http://www.securityfocus.com/bid/27740
CVE: CVE-2008-0105
Published: 2008-02-12
Description: Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section header index table information, aka "Microsoft Works File Converter Index Table Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28904; http://www.securityfocus.com/bid/27658
CVE: CVE-2008-0108
Published: 2008-02-12
Description: Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted field lengths, aka "Microsoft Works File Converter Field Length Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=660; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28904
CVE: CVE-2008-0109
Published: 2008-02-12
Description: Word in Microsoft Office 2000 SP3, XP SP3, Office 2003 SP2, and Office Word Viewer 2003 allows remote attackers to execute arbitrary code via crafted fields within the File Information Block (FIB) of a Word file, which triggers length calculation errors and memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28901; http://www.kb.cert.org/vuls/id/692417
CVE: CVE-2007-3676
Published: 2008-02-13
Description: IBM DB2 Universal Database (UDB) Administration Server (DAS) 8 before Fix Pack 16 and 9 before Fix Pack 4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via modified pointer values in unspecified remote administration requests, which triggers memory corruption or other invalid memory access. NOTE: this might be the same issue as CVE-2008-0698.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=654; http://securitytracker.com/id?1019318; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=654
CVE: CVE-2007-5757
Published: 2008-02-13
Description: Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database (UDB) 8 before FixPak 16 and 9 before Fix Pack 4 allows local users to gain root privileges via a modified DB2INSTANCE environment variable that points to a malicious library.  NOTE: this might be the same issue as CVE-2008-0697.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=653; http://securitytracker.com/id?1019319
CVE: CVE-2008-0103
Published: 2008-02-13
Description: Unspecified vulnerability in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Office document that contains a malformed object, related to a "memory handling error," aka "Microsoft Office Execution Jump Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6386&w=2; http://secunia.com/advisories/28909; http://www.securityfocus.com/bid/27738
CVE: CVE-2008-0733
Published: 2008-02-13
Description: SQL injection vulnerability in index.php in CS Team Counter Strike Portals allows remote attackers to execute arbitrary SQL commands via the id parameter, as demonstrated using the downloads page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/487988/100/0/threaded; http://www.securityfocus.com/bid/27747; https://exchange.xforce.ibmcloud.com/vulnerabilities/40520
CVE: CVE-2008-0734
Published: 2008-02-13
Description: SQL injection vulnerability in class_auth.php in Limbo CMS 1.0.4.2, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the cuid cookie parameter to admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27710; https://exchange.xforce.ibmcloud.com/vulnerabilities/40415; https://www.exploit-db.com/exploits/5088
CVE: CVE-2008-0735
Published: 2008-02-13
Description: SQL injection vulnerability in mod/gallery/ajax/gallery_data.php in AuraCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the albums parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28950; http://www.securityfocus.com/bid/27764; https://www.exploit-db.com/exploits/5105
CVE: CVE-2008-0736
Published: 2008-02-13
Description: admin/SA_shipFedExMeter.asp in CandyPress (CP) 4.1.1.26, and possibly other 4.x and 3.x versions, allows remote attackers to obtain the path via a certain value of the FedExAccount parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://securityreason.com/securityalert/3600; http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1; http://www.securityfocus.com/archive/1/487058/100/0/threaded
CVE: CVE-2008-0737
Published: 2008-02-13
Description: SQL injection vulnerability in admin/utilities_ConfigHelp.asp in CandyPress (CP) 4.1.1.26, and other 4.x and 3.x versions, allows remote attackers to execute arbitrary SQL commands via the helpfield parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28662; http://securityreason.com/securityalert/3600; http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1
CVE: CVE-2008-0738
Published: 2008-02-13
Description: Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the (1) idcust parameter to (a) ajax_getTiers.asp and (b) ajax_getCust.asp in ajax/, and the (2) tableName parameter to (c) ajax/ajax_tableFields.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28662; http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1; http://www.vupen.com/english/advisories/2008/0314
CVE: CVE-2008-0739
Published: 2008-02-13
Description: SQL injection vulnerability in admin/SA_shipFedExMeter.asp in CandyPress (CP) 4.1.1.26, and earlier 4.x and 3.x versions, allows remote attackers to execute arbitrary SQL commands via the FedExAccount parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28662; http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1; http://www.vupen.com/english/advisories/2008/0314
CVE: CVE-2008-0740
Published: 2008-02-13
Description: IBM WebSphere Application Server (WAS) before 6.0.2 Fix Pack 25 (6.0.2.25) and 6.1 before Fix Pack 15 (6.1.0.15) writes unspecified cleartext information to http_plugin.log, which might allow local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://osvdb.org/42878; http://www-1.ibm.com/support/docview.wss?uid=swg1PK48785; http://www-1.ibm.com/support/docview.wss?uid=swg27006876
CVE: CVE-2008-0741
Published: 2008-02-13
Description: Unspecified vulnerability in the PropFilePasswordEncoder utility in IBM WebSphere Application Server (WAS) before 6.0.2 Fix Pack 25 (6.0.2.25) has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/28588; http://securitytracker.com/id?1019254; http://www-1.ibm.com/support/docview.wss?rs=0&dc=DB550&q1=PK52709&uid=swg1PK58871&loc=en_US&cs=utf-8&lang=
CVE: CVE-2008-0742
Published: 2008-02-13
Description: Multiple directory traversal vulnerabilities in PowerScripts PowerNews 2.5.6 allow remote attackers to read and include arbitrary files via a .. (dot dot) in the (1) subpage parameter in (a) categories.inc.php, (b) news.inc.php, (c) other.inc.php, (d) permissions.inc.php, (e) templates.inc.php, and (f) users.inc.php in pnadmin/; and (2) the page parameter to (g) pnadmin/index.php.  NOTE: vector 2 is only exploitable by administrators.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3647; http://www.securityfocus.com/archive/1/487773/100/0/threaded; http://www.securityfocus.com/bid/27688
CVE: CVE-2008-0743
Published: 2008-02-13
Description: PHP remote file inclusion vulnerability in members_help.php in Joovili 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the hlp parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/3640; http://www.securityfocus.com/archive/1/487779/100/0/threaded; http://www.securityfocus.com/bid/27693
CVE: CVE-2008-0744
Published: 2008-02-13
Description: SQL injection vulnerability in user_login.asp in PreProjects.com Pre Hotels & Resorts Management System allows remote attackers to execute arbitrary SQL commands via the login page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3644; http://www.securityfocus.com/archive/1/487053/100/100/threaded; http://www.securityfocus.com/bid/27450
CVE: CVE-2008-0745
Published: 2008-02-13
Description: Directory traversal vulnerability in aides/index.php in DomPHP 0.82 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/27712; https://www.exploit-db.com/exploits/5089; http://www.securityfocus.com/bid/27712
CVE: CVE-2008-0746
Published: 2008-02-13
Description: SQL injection vulnerability in index.php in the Gallery (com_gallery) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.attrition.org/pipermail/vim/2008-February/001901.html; http://www.attrition.org/pipermail/vim/2008-February/001902.html; http://www.securityfocus.com/bid/27695
CVE: CVE-2008-0747
Published: 2008-02-13
Description: Stack-based buffer overflow in COWON America jetAudio 7.0.5 and earlier allows user-assisted remote attackers to execute arbitrary code via a long URL in a .asx file, a different vulnerability than CVE-2007-5487.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28855; http://securityreason.com/securityalert/3642; http://www.securityfocus.com/archive/1/487806/100/0/threaded
CVE: CVE-2008-0748
Published: 2008-02-13
Description: Buffer overflow in the Sony AxRUploadServer.AxRUploadControl.1 ActiveX control in AxRUploadServer.dll 1.0.0.38 in SonyISUpload.cab 1.0.0.38 for Sony ImageStation allows remote attackers to execute arbitrary code via a long argument to the SetLogging method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28854; http://securityreason.com/securityalert/3648; http://www.securityfocus.com/archive/1/487802/100/0/threaded
CVE: CVE-2008-0749
Published: 2008-02-13
Description: Cross-site scripting (XSS) vulnerability in index.php in Calimero.CMS 3.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a calimero_webpage action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/27690.html; http://osvdb.org/ref/41/41573-calimero.txt; http://www.osvdb.org/41573
CVE: CVE-2008-0750
Published: 2008-02-13
Description: SQL injection vulnerability in philboard_forum.asp in Husrev BlackBoard 2.0.2 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28842; http://securityreason.com/securityalert/3641; http://www.securityfocus.com/archive/1/487780/100/200/threaded
CVE: CVE-2008-0751
Published: 2008-02-13
Description: Cross-site scripting (XSS) vulnerability in the Freetag before 2.96 plugin for S9Y Serendipity, when using Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to plugin/tag/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.s9y.org/archives/190-Freetag-plugin-updated-to-prevent-XSS.html; http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060122.html; http://secunia.com/advisories/28852
CVE: CVE-2008-0752
Published: 2008-02-13
Description: SQL injection vulnerability in index.php in the Neogallery (com_neogallery) 1.1 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a show action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27692; https://exchange.xforce.ibmcloud.com/vulnerabilities/40357; https://www.exploit-db.com/exploits/5083
CVE: CVE-2008-0753
Published: 2008-02-13
Description: SQL injection vulnerability in calendar.php in Virtual War (VWar) 1.5 allows remote attackers to execute arbitrary SQL commands via the month parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3643; http://www.securityfocus.com/archive/1/487900/100/0/threaded; http://www.securityfocus.com/bid/27722
CVE: CVE-2008-0754
Published: 2008-02-13
Description: Multiple SQL injection vulnerabilities in index.php in the Rapid Recipe (com_rapidrecipe) 1.6.5 component for Joomla! allow remote attackers to execute arbitrary SQL commands via (1) the user_id parameter in a showuser action or (2) the category_id parameter in a viewcategorysrecipes action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28883; http://securityreason.com/securityalert/3649; http://www.securityfocus.com/archive/1/487901/100/0/threaded
CVE: CVE-2008-0755
Published: 2008-02-13
Description: Format string vulnerability in the ReportSysLogEvent function in the LPD server in cyan soft Opium OPI Server 4.10.1028 and earlier; cyanPrintIP Easy OPI, Professional, and Basic 4.10.1030 and earlier; Workstation 4.10.836 and earlier; and Standard 4.10.940 and earlier; might allow remote attackers to execute arbitrary code via format string specifiers in the queue name in a request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/cyanuro-adv.txt; http://secunia.com/advisories/28870; http://www.securityfocus.com/archive/1/487955/100/0/threaded
CVE: CVE-2008-0756
Published: 2008-02-13
Description: The LPD server in cyan soft Opium OPI Server 4.10.1028 and earlier; cyanPrintIP Easy OPI, Professional, and Basic 4.10.1030 and earlier; Workstation 4.10.836 and earlier; and Standard 4.10.940 and earlier; allows remote attackers to cause a denial of service (daemon crash) via a connection that begins with (1) a "Send queue state" LPD command 3 or (2) a "Send queue state" LPD command 4.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/cyanuro-adv.txt; http://secunia.com/advisories/28870; http://www.securityfocus.com/archive/1/487955/100/0/threaded
CVE: CVE-2007-6148
Published: 2008-02-13
Description: Use-after-free vulnerability in the Edge server in Adobe Flash Media Server 2 before 2.0.5, and Connect Enterprise Server 6 before SP3, allows remote attackers to execute arbitrary code via an unspecified sequence of Real Time Message Protocol (RTMP) requests.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=663; http://secunia.com/advisories/28946; http://secunia.com/advisories/28947
CVE: CVE-2007-6149
Published: 2008-02-13
Description: Multiple integer overflows in the Edge server in Adobe Flash Media Server 2 before 2.0.5, and Connect Enterprise Server 6 before SP3, allow remote attackers to execute arbitrary code via a Real Time Message Protocol (RTMP) message with a crafted integer field that is used for allocation.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=662; http://secunia.com/advisories/28946; http://secunia.com/advisories/28947
CVE: CVE-2007-6431
Published: 2008-02-13
Description: Unspecified vulnerability in Adobe Flash Media Server 2 before 2.0.5, and Connect Enterprise Server 6 before SP3, allows remote attackers to "take control of the affected system" via unspecified vectors, a different issue than CVE-2007-6148 and CVE-2007-6149.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/28946; http://secunia.com/advisories/28947; http://www.adobe.com/support/security/bulletins/apsb08-03.html
CVE: CVE-2007-6701
Published: 2008-02-13
Description: Multiple stack-based buffer overflows in the Spooler service (nwspool.dll) in Novell Client 4.91 SP4 for Windows allow remote attackers to execute arbitrary code via long arguments to multiple unspecified RPC functions, aka Novell bug 287919, a different vulnerability than CVE-2007-2954.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2007-08/0082.html; http://secunia.com/advisories/26238; http://securitytracker.com/id?1018471