deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-3936
Published: 2007-07-21
Description: Directory traversal vulnerability in admin/filebrowser.asp in A-shop 0.70 and earlier, and possibly 0.71, allows remote attackers to delete arbitrary files via unspecified filename references in the delfiles parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/26126; http://www.securityfocus.com/bid/24971; https://exchange.xforce.ibmcloud.com/vulnerabilities/35483
CVE: CVE-2007-3937
Published: 2007-07-21
Description: Multiple SQL injection vulnerabilities in A-shop 0.70 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/35484; https://www.exploit-db.com/exploits/4198; https://exchange.xforce.ibmcloud.com/vulnerabilities/35484
CVE: CVE-2007-3938
Published: 2007-07-21
Description: SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a view action in the Topics module, a different vulnerability than CVE-2006-1676.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/36336; http://secunia.com/advisories/26113; http://www.maxdev.com/Article637.phtml
CVE: CVE-2007-3939
Published: 2007-07-21
Description: SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/39110; http://www.securityfocus.com/bid/24955; https://exchange.xforce.ibmcloud.com/vulnerabilities/35464
CVE: CVE-2007-3940
Published: 2007-07-21
Description: Cross-site scripting (XSS) vulnerability in default.asp in QuickerSite 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the svalue parameter in a search action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://packetstormsecurity.org/0707-advisories/quickersite-xss.txt; http://secunia.com/advisories/26094; http://securityreason.com/securityalert/2910
CVE: CVE-2007-3941
Published: 2007-07-21
Description: Cross-site scripting (XSS) vulnerability in profile.php in Jasmine CMS 1.0_1 allows remote authenticated users to inject arbitrary web script or HTML via the profile_email parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37531; http://secunia.com/advisories/26071; http://www.securityfocus.com/bid/24939
CVE: CVE-2007-3942
Published: 2007-07-21
Description: Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.1.3 allows remote attackers to include local files via unspecified vectors related to the sourcedir parameter or the actionArray hash.  NOTE: CVE and multiple third parties dispute this vulnerability because both sourcedir and actionArray are defined before use
CVSS Score: 5.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/473866/100/0/threaded; http://www.securityfocus.com/archive/1/473991/100/0/threaded; http://www.securityfocus.com/archive/1/480572/100/0/threaded
CVE: CVE-2007-3943
Published: 2007-07-21
Description: SQL injection vulnerability in Infinite Responder before 1.48 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/26008; http://sourceforge.net/project/shownotes.php?release_id=523684&group_id=199618; http://www.securityfocus.com/bid/24931
CVE: CVE-2007-2950
Published: 2007-07-23
Description: Centennial Discovery 2006 Feature Pack 1, which is used by (1) Numara Asset Manager 8.0 and (2) Symantec Discovery 6.5, uses insecure permissions on certain directories, which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/25354; http://secunia.com/advisories/25374; http://secunia.com/advisories/25379
CVE: CVE-2007-3944
Published: 2007-07-23
Description: Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via certain JavaScript regular expressions. NOTE: this issue was originally reported only for MobileSafari on the iPhone.  NOTE: it is not clear whether this stems from an issue in the original distribution of PCRE, which might already have a separate CVE identifier.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=306173; http://docs.info.apple.com/article.html?artnum=306174; http://secunia.com/advisories/26287
CVE: CVE-2007-3945
Published: 2007-07-23
Description: Rule Set Based Access Control (RSBAC) before 1.3.5 does not properly use the Linux Kernel Crypto API for the Linux kernel 2.6.x, which allows context-dependent attackers to bypass authentication controls via unspecified vectors, possibly involving User Management password hashing and unchecked function return codes.
CVSS Score: 6.4 (MEDIUM)
References: http://download.rsbac.org/code/1.3.5/changes-1.3.5.txt; http://secunia.com/advisories/26147; http://securityreason.com/securityalert/2911
CVE: CVE-2007-3946
Published: 2007-07-24
Description: mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving (1) a memory leak, (2) use of md5-sess without a cnonce, (3) base64 encoded strings, and (4) trailing whitespace in the Auth-Digest header.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/38314; http://osvdb.org/38315; http://osvdb.org/38316
CVE: CVE-2007-3947
Published: 2007-07-24
Description: request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/38313; http://secunia.com/advisories/26130; http://secunia.com/advisories/26158
CVE: CVE-2007-3948
Published: 2007-07-24
Description: connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service (failed assertion) via a large number of connection attempts.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38312; http://secunia.com/advisories/26130; http://secunia.com/advisories/26158
CVE: CVE-2007-3949
Published: 2007-07-24
Description: mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings.
CVSS Score: 8.3 (HIGH)
References: http://osvdb.org/38311; http://secunia.com/advisories/26130; http://secunia.com/advisories/26158
CVE: CVE-2007-3950
Published: 2007-07-24
Description: lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the (1) mod_scgi, (2) mod_fastcgi, and (3) mod_webdav modules.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/26130; http://secunia.com/advisories/26158; http://secunia.com/advisories/26505
CVE: CVE-2007-2925
Published: 2007-07-24
Description: The default access control lists (ACL) in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/26227; http://secunia.com/advisories/26236; http://secunia.com/advisories/26509
CVE: CVE-2007-2926
Published: 2007-07-24
Description: ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for remote attackers to guess the next query id and perform DNS cache poisoning.
CVSS Score: 4.3 (MEDIUM)
References: ftp://aix.software.ibm.com/aix/efixes/security/README; ftp://patches.sgi.com/support/free/security/advisories/20070801-01-P.asc; http://docs.info.apple.com/article.html?artnum=307041
CVE: CVE-2007-3951
Published: 2007-07-24
Description: Multiple buffer overflows in Norman Antivirus 5.90 allow remote attackers to execute arbitrary code via a crafted (1) ACE or (2) LZH file, resulting from an "integer cast around."
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37982; http://osvdb.org/37983; http://secunia.com/advisories/26178
CVE: CVE-2007-3952
Published: 2007-07-24
Description: The OLE2 parsing in Norman Antivirus before 5.91.02 allows remote attackers to bypass the malware detection via a crafted DOC file, resulting from an "integer cast around".
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37981; http://secunia.com/advisories/26178; http://securityreason.com/securityalert/2913
CVE: CVE-2007-3953
Published: 2007-07-24
Description: The OLE2 parsing in Norman Antivirus before 5.91.02 allows remote attackers to cause a denial of service via a crafted DOC file that triggers a divide-by-zero error.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37980; http://secunia.com/advisories/26178; http://securityreason.com/securityalert/2914
CVE: CVE-2007-3954
Published: 2007-07-24
Description: Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with SeaMonkey installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking SeaMonkey.exe, a related issue to CVE-2007-3670.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://larholm.com/2007/07/23/seamonkey-suite-affected-by-url-vulnerability/; http://www.securityfocus.com/bid/25021; http://larholm.com/2007/07/23/seamonkey-suite-affected-by-url-vulnerability/
CVE: CVE-2007-3955
Published: 2007-07-24
Description: Buffer overflow in the IEToolbar.IEContextMenu.1 ActiveX control in LinkedInIEToolbar.dll in the LinkedIn Toolbar 3.0.2.1098 allows remote attackers to execute arbitrary code via a long second argument (varBrowser argument) to the search method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37696; http://secunia.com/advisories/26181; http://www.securityfocus.com/bid/25032
CVE: CVE-2007-3956
Published: 2007-07-24
Description: TeamSpeak WebServer 2.0 for Windows does not validate parameter value lengths and does not expire TCP sessions, which allows remote attackers to cause a denial of service (CPU and memory consumption) via long username and password parameters in a request to login.tscmd on TCP port 14534.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/38595; http://secunia.com/advisories/26141; http://www.securityfocus.com/bid/24977
CVE: CVE-2007-3957
Published: 2007-07-24
Description: Buffer overflow in Nipun Jain xserver 0.1 alpha allows remote attackers to cause a denial of service via a POST request with a long URI.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/25030; https://exchange.xforce.ibmcloud.com/vulnerabilities/35612; https://www.exploit-db.com/exploits/4216
CVE: CVE-2007-3958
Published: 2007-07-24
Description: Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain GIF file, as demonstrated by Art.gif.
CVSS Score: 7.1 (HIGH)
References: http://lostmon.blogspot.com/2007/08/windows-extended-file-attributes-buffer.html; http://osvdb.org/43773; http://www.securityfocus.com/bid/25013
CVE: CVE-2007-3959
Published: 2007-07-24
Description: The IM Server (aka IMserve or IMserver) 2.0.5.30 and probably earlier in Ipswitch Instant Messaging before 2.07 in Ipswitch Collaboration Suite (ICS) allows remote attackers to cause a denial of service (daemon crash) via certain data to TCP port 5179 that overwrites a destructor, as reachable by the (1) DoAttachVideoSender, (2) DoAttachVideoReceiver, (3) DoAttachAudioSender, and (4) DoAttachAudioReceiver functions.
CVSS Score: 5.0 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=566; http://secunia.com/advisories/26154; http://www.ipswitch.com/support/instant_messaging/patch-upgrades.asp
CVE: CVE-2007-3960
Published: 2007-07-24
Description: Multiple unspecified vulnerabilities in IBM WebSphere Application Server (WAS) before Fix Pack 21 (6.0.2.21) have unknown impact and attack vectors, aka (1) PK33799, or (2) a "Potential security exposure" in the Samples component (PK40213).
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/41615; http://osvdb.org/44217; http://secunia.com/advisories/26183
CVE: CVE-2006-7221
Published: 2007-07-25
Description: Multiple off-by-one errors in fsplib.c in fsplib before 0.8 allow attackers to cause a denial of service via unspecified vectors involving the (1) name and (2) d_name entry attributes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: http://fsp.cvs.sourceforge.net/fsp/fsplib/ChangeLog?revision=1.17&view=markup; https://bugzilla.novell.com/show_bug.cgi?id=150399; http://fsp.cvs.sourceforge.net/fsp/fsplib/ChangeLog?revision=1.17&view=markup
CVE: CVE-2007-3026
Published: 2007-07-25
Description: Integer overflow in Panda Software AdminSecure allows remote attackers to execute arbitrary code via crafted packets with modified length values to TCP ports 19226 or 19227, resulting in a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/38614; http://secunia.com/advisories/26157; http://securityreason.com/securityalert/2917
CVE: CVE-2007-3383
Published: 2007-07-25
Description: Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://osvdb.org/39000; http://seclists.org/fulldisclosure/2007/Jul/0448.html
CVE: CVE-2007-3531
Published: 2007-07-25
Description: The set_default_speeds function in backend/backend.c in NVidia NVClock before 0.8b2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/nvclock temporary file.
CVSS Score: 6.6 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=184071; http://osvdb.org/38573; http://secunia.com/advisories/26200
CVE: CVE-2007-3679
Published: 2007-07-25
Description: The Citrix EPA ActiveX control (aka the "endpoint checking control" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows remote attackers to download and execute arbitrary programs onto a client system.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37845; http://secunia.com/advisories/26143; http://securityreason.com/securityalert/2916
CVE: CVE-2007-3961
Published: 2007-07-25
Description: Off-by-one error in the fsp_readdir_r function in fsplib.c in fsplib before 0.9 allows remote attackers to cause a denial of service via a directory entry whose length is exactly MAXNAMELEN, which prevents a terminating null byte from being added.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=188252; http://fsp.cvs.sourceforge.net/fsp/fsplib/ChangeLog?revision=1.17&view=markup; http://fsp.cvs.sourceforge.net/fsp/fsplib/fsplib.c?r1=1.19&r2=1.20
CVE: CVE-2007-3962
Published: 2007-07-25
Description: Multiple stack-based buffer overflows in fsplib.c in fsplib before 0.9 might allow remote attackers to execute arbitrary code via (1) a long filename that is not properly handled by the fsp_readdir_native function when MAXNAMLEN is greater than 255, or (2) a long d_name directory (dirent) field in the fsp_readdir function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=188252; http://fsp.cvs.sourceforge.net/fsp/fsplib/ChangeLog?revision=1.17&view=markup; http://fsp.cvs.sourceforge.net/fsp/fsplib/fsplib.c?r1=1.17&r2=1.18
CVE: CVE-2007-3963
Published: 2007-07-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in UseBB 1.0.7, and possibly other 1.0.x versions, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF) to (1) upgrade-0-2-3.php, (2) upgrade-0-3.php, or (3) upgrade-0-4.php in install/, a different vulnerability than CVE-2005-4193.
CVSS Score: 9.3 (HIGH)
References: http://securityreason.com/securityalert/2915; http://www.securityfocus.com/archive/1/474256/100/0/threaded; http://www.securityfocus.com/bid/24990
CVE: CVE-2007-3964
Published: 2007-07-25
Description: Itaka before 0.2.1, when using Authentication mode, allows remote attackers to bypass authentication and obtain sensitive information by downloading screenshots via a direct request for /screenshot.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/38278; http://secunia.com/advisories/26146; http://www.jardinpresente.com.ar/trac/itaka/ticket/20
CVE: CVE-2007-3965
Published: 2007-07-25
Description: Unspecified vulnerability in uFMOD before 1.2.5 has unknown impact and attack vectors, possibly related to malformed files, and possibly an integer signedness error for relative note instruments.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/38275; http://secunia.com/advisories/26111; http://sourceforge.net/project/shownotes.php?group_id=158498&release_id=523791
CVE: CVE-2007-3966
Published: 2007-07-25
Description: SQL injection vulnerability in Munch Pro allows remote attackers to execute arbitrary SQL commands via the login field to /admin, a different vulnerability than CVE-2006-5880.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/39001; http://securityreason.com/securityalert/2921; http://www.securityfocus.com/archive/1/474323/100/0/threaded
CVE: CVE-2007-3967
Published: 2007-07-25
Description: Directory traversal vulnerability in index.php in PHP Directory Lister (dirLIST) before 0.1.1 allows remote attackers to list the contents of a parent directory via a .. (dot dot) in the folder parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://secunia.com/advisories/26144; http://sourceforge.net/project/shownotes.php?release_id=524378; http://www.securityfocus.com/bid/24987
CVE: CVE-2007-3968
Published: 2007-07-25
Description: index.php in dirLIST before 0.1.1 allows remote attackers to list the contents of an excluded folder via a modified URL containing the folder name.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264, CWE-863
References: http://secunia.com/advisories/26144; http://sourceforge.net/project/shownotes.php?release_id=524378; http://www.securityfocus.com/bid/24987
CVE: CVE-2007-3969
Published: 2007-07-25
Description: Buffer overflow in Panda Antivirus before 20070720 allows remote attackers to execute arbitrary code via a crafted EXE file, resulting from an "Integer Cast Around."
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/26171; http://securityreason.com/securityalert/2920; http://www.nruns.com/%5Bn.runs-SA-2007.019%5D%20-%20Panda%20Antivirus%20EXE%20parsing%20Arbitrary%20Code%20Execution%20Advisory.pdf
CVE: CVE-2007-3970
Published: 2007-07-25
Description: Race condition in ESET NOD32 Antivirus before 2.2289 allows remote attackers to execute arbitrary code via a crafted CAB file, which triggers heap corruption.
CVSS Score: 7.6 (HIGH)
CWE: CWE-362
References: http://osvdb.org/37976; http://secunia.com/advisories/26124; http://securityreason.com/securityalert/2922
CVE: CVE-2007-3971
Published: 2007-07-25
Description: Integer overflow in ESET NOD32 Antivirus before 2.2289 allows remote attackers to cause a denial of service (CPU and disk consumption) via a crafted ASPACK packed file, which triggers an infinite loop.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/37977; http://secunia.com/advisories/26124; http://securityreason.com/securityalert/2923
CVE: CVE-2007-3972
Published: 2007-07-25
Description: ESET NOD32 Antivirus before 2.2289 allows remote attackers to cause a denial of service via a crafted (1) ASPACK or (2) FSG packed file, which triggers a divide-by-zero error.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/37978; http://secunia.com/advisories/26124; http://securityreason.com/securityalert/2924
CVE: CVE-2007-3973
Published: 2007-07-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in JBlog 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) index.php, or the (2) search parameter or (3) theme cookie to (b) recherche.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/38557; http://osvdb.org/38558; http://secunia.com/advisories/26165
CVE: CVE-2007-3974
Published: 2007-07-25
Description: admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accounts via modified mot and droit parameters.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38561; http://secunia.com/advisories/26165; http://securityreason.com/securityalert/2919
CVE: CVE-2007-3975
Published: 2007-07-25
Description: Cross-site scripting (XSS) vulnerability in index.php in Elite Forum 1.0.0.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter in a ptopic action, a different vulnerability than CVE-2005-3412.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38998; http://securityreason.com/securityalert/2933; http://www.securityfocus.com/archive/1/474228/100/0/thread
CVE: CVE-2007-3976
Published: 2007-07-25
Description: SQL injection vulnerability in index.php in bwired allows remote attackers to execute arbitrary SQL commands via the newsID parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/39135; http://www.vupen.com/english/advisories/2007/2612; https://exchange.xforce.ibmcloud.com/vulnerabilities/35540
CVE: CVE-2007-3977
Published: 2007-07-25
Description: Cross-site scripting (XSS) vulnerability in bwired allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/39136; https://www.exploit-db.com/exploits/4213; http://osvdb.org/39136
CVE: CVE-2007-3978
Published: 2007-07-25
Description: Session fixation vulnerability in bwired allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://osvdb.org/39137; https://www.exploit-db.com/exploits/4213; http://osvdb.org/39137
CVE: CVE-2007-3979
Published: 2007-07-25
Description: SQL injection vulnerability in index.php in BlogSite Professional (aka Blog System) 1.x allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36278; http://secunia.com/advisories/26170; http://www.securityfocus.com/bid/24976
CVE: CVE-2007-3980
Published: 2007-07-25
Description: PHP remote file inclusion vulnerability in page.php in RCMS Pro RGameScript Pro allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/39108; http://www.securityfocus.com/bid/24995; http://www.vupen.com/english/advisories/2007/2614
CVE: CVE-2007-3981
Published: 2007-07-25
Description: SQL injection vulnerability in index.php in WSN Links Basic Edition allows remote attackers to execute arbitrary SQL commands via the catid parameter in a displaycat action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36270; http://secunia.com/advisories/26246; http://www.securityfocus.com/bid/24996