deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-5931
Published: 2007-11-10
Description: The reDirect function in lib/controllers/RepViewController.php in OrangeHRM before 2.2.2 does not verify the privileges of a user, which allows remote attackers to obtain access to data via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/45295; http://sourceforge.net/project/shownotes.php?release_id=550550&group_id=156477; http://www.securityfocus.com/bid/26351
CVE: CVE-2007-5932
Published: 2007-11-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Fatwire Content Server (CS) CMS 6.3.0 allow remote attackers to inject arbitrary web script or HTML via unspecified form fields related to the (1) search function, (2) advanced search function, and possibly other components.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38703; http://osvdb.org/38704; http://secunia.com/advisories/27663
CVE: CVE-2007-5933
Published: 2007-11-13
Description: Pioneers (formerly gnocatan) before 0.11.3 allows remote attackers to cause a denial of service (crash) by triggering a delete operation while the Session object is still being used, as demonstrated by causing a "Broken pipe" error.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449541; http://bugs.gentoo.org/show_bug.cgi?id=198807; http://secunia.com/advisories/27522
CVE: CVE-2007-5934
Published: 2007-11-13
Description: The LOB functionality in PEAR MDB2 before 2.5.0a1 interprets a request to store a URL string as a request to retrieve and store the contents of the URL, which might allow remote attackers to use MDB2 as an indirect proxy or obtain sensitive information via a URL into a form field in an MDB2 application, as demonstrated by a file:// URL or a URL for an intranet web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://bugs.gentoo.org/show_bug.cgi?id=198446; http://marc.info/?l=pear-cvs&m=[PII_REDACTED]9114&w=2; http://osvdb.org/42107
CVE: CVE-2007-5935
Published: 2007-11-13
Description: Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447081; http://bugs.gentoo.org/show_bug.cgi?id=198238; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html
CVE: CVE-2007-5936
Published: 2007-11-13
Description: dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk, which can then be read or modified in place.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://bugs.gentoo.org/attachment.cgi?id=135423; http://bugs.gentoo.org/show_bug.cgi?id=198238; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html
CVE: CVE-2007-5937
Published: 2007-11-13
Description: Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and earlier might allow user-assisted attackers to execute arbitrary code via a crafted DVI input file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.gentoo.org/attachment.cgi?id=135423; http://bugs.gentoo.org/show_bug.cgi?id=198238; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html
CVE: CVE-2007-5794
Published: 2007-11-13
Description: Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453868; http://bugs.gentoo.org/show_bug.cgi?id=198390; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
CVE: CVE-2007-5940
Published: 2007-11-13
Description: feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-59
References: http://bugs.gentoo.org/show_bug.cgi?id=198231; http://osvdb.org/42397; http://secunia.com/advisories/27737
CVE: CVE-2007-4136
Published: 2007-11-14
Description: The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.
CVSS Score: 5.0 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2007-0640.html; http://secunia.com/advisories/27611; http://securitytracker.com/id?1018921
CVE: CVE-2007-3880
Published: 2007-11-14
Description: Format string vulnerability in srsexec in Sun Remote Services (SRS) Net Connect 3.2.3 and 3.2.4, as distributed in the SRS Proxy Core (SUNWsrspx) package, allows local users to gain privileges via format string specifiers in unspecified input that is logged through syslog.
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=610; http://osvdb.org/40836; http://secunia.com/advisories/27512
CVE: CVE-2007-3898
Published: 2007-11-14
Description: The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-16
References: http://secunia.com/advisories/27584; http://securityreason.com/securityalert/3373; http://www.kb.cert.org/vuls/id/484649
CVE: CVE-2007-5667
Published: 2007-11-14
Description: NWFILTER.SYS in Novell Client 4.91 SP 1 through SP 4 for Windows 2000, XP, and Server 2003 makes the \.\nwfilter device available for arbitrary user-mode input via METHOD_NEITHER IOCTLs, which allows local users to gain privileges by passing a kernel address as an argument and overwriting kernel memory locations.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=626; http://osvdb.org/40867; http://secunia.com/advisories/27678
CVE: CVE-2007-5755
Published: 2007-11-14
Description: Multiple stack-based buffer overflows in the AOL AmpX ActiveX control in AmpX.dll 2.6.1.11 in AOL Radio allow remote attackers to execute arbitrary code via long arguments to unspecified methods.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=623; http://osvdb.org/38705; http://secunia.com/advisories/27622
CVE: CVE-2007-5756
Published: 2007-11-14
Description: Multiple array index errors in the bpf_filter_init function in NPF.SYS in WinPcap before 4.0.2, when run in monitor mode (aka Table Management Extensions or TME), and as used in Wireshark and possibly other products, allow local users to gain privileges via crafted IOCTL requests.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-129
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=625; http://secunia.com/advisories/27676; http://www.securityfocus.com/bid/26409
CVE: CVE-2007-5770
Published: 2007-11-14
Description: The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site, different components than CVE-2007-5162.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://docs.info.apple.com/article.html?artnum=307179; http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html; http://secunia.com/advisories/26985
CVE: CVE-2007-5941
Published: 2007-11-14
Description: Stack-based buffer overflow in the SWCtl.SWCtl ActiveX control in Adobe Shockwave allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument to the ShockwaveVersion method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/26388; https://exchange.xforce.ibmcloud.com/vulnerabilities/38359; https://www.exploit-db.com/exploits/4613
CVE: CVE-2007-5942
Published: 2007-11-14
Description: Bandersnatch 0.4 allows remote attackers to obtain sensitive information via a malformed request for index.php with (1) a certain func parameter value; or (2) certain func, jid, page, and limit parameter values; which reveals the path in various error messages.
CVSS Score: 4.0 (MEDIUM)
References: http://www.portcullis-security.com/175.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/38308; http://www.portcullis-security.com/175.php
CVE: CVE-2007-5943
Published: 2007-11-14
Description: Simple Machines Forum (SMF) 1.1.4 allows remote attackers to read a message in private forums by using the advanced search module with the "show results as messages" option, then searching for possible keywords contained in that message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://www.securityfocus.com/archive/1/483437/100/0/threaded; http://www.securityfocus.com/bid/26508; http://www.securityfocus.com/archive/1/483437/100/0/threaded
CVE: CVE-2007-5944
Published: 2007-11-14
Description: Cross-site scripting (XSS) vulnerability in Servlet Engine / Web Container in IBM WebSphere Application Server (WAS) 5.1.1.4 through 5.1.1.16 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header.  NOTE: this might be the same issue as CVE-2006-3918, but there are insufficient details to be sure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38700; http://secunia.com/advisories/27674; http://www-1.ibm.com/support/docview.wss?uid=swg1PK51068
CVE: CVE-2007-5945
Published: 2007-11-14
Description: USVN before 0.6.5 allows remote attackers to obtain a list of repository contents via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://forum.usvn.info/viewtopic.php?f=4&t=320; http://osvdb.org/39862; http://secunia.com/advisories/27521
CVE: CVE-2007-5946
Published: 2007-11-14
Description: Unspecified vulnerability in the Aries PA-RISC emulator on HP-UX B.11.23 and B.11.31 on the IA-64 platform allows local users to obtain unspecified access.
CVSS Score: 7.2 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01241483; http://secunia.com/advisories/27606; http://securitytracker.com/id?1018925
CVE: CVE-2007-5947
Published: 2007-11-14
Description: The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://browser.netscape.com/releasenotes/; http://bugs.gentoo.org/show_bug.cgi?id=198965; http://bugs.gentoo.org/show_bug.cgi?id=200909
CVE: CVE-2007-5948
Published: 2007-11-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in main.php in SF-Shoutbox 1.2.1 through 1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) nick (aka Name) and (2) shout (aka Shout) parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38401; http://secunia.com/advisories/27487; http://www.securityfocus.com/bid/26320
CVE: CVE-2007-5949
Published: 2007-11-14
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/38394; http://secunia.com/advisories/27472; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06387
CVE: CVE-2007-5950
Published: 2007-11-14
Description: Cross-site scripting (XSS) vulnerability in NetCommons before 1.0.11, and 1.1.x before 1.1.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2006-4165.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/27484; http://www.netcommons.org/modules/journal/journal_detail.php?block_id=2121&news_id=316&op=comment#2121
CVE: CVE-2007-5951
Published: 2007-11-14
Description: SQL injection vulnerability in articles.php in E-Vendejo 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/38405; http://secunia.com/advisories/27517; http://www.ihteam.net/exploits/e-vendejo-0.2.txt
CVE: CVE-2007-5952
Published: 2007-11-14
Description: Cross-site scripting (XSS) vulnerability in admin/index.php in Helios Calendar 1.2.1 Beta allows remote attackers to inject arbitrary web script or HTML via the username parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38408; http://secunia.com/advisories/27490; http://securityreason.com/securityalert/3337
CVE: CVE-2007-5953
Published: 2007-11-14
Description: Unspecified vulnerability in Really Simple CalDAV Store (RSCDS) before 0.9.0 allows attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/39865; http://sourceforge.net/project/shownotes.php?release_id=549414&group_id=179845; http://www.securityfocus.com/bid/26352
CVE: CVE-2007-5954
Published: 2007-11-14
Description: Cross-site scripting (XSS) vulnerability in buscador.php in JLMForo System allows remote attackers to inject arbitrary web script or HTML via the clave parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/26331; http://www.securityfocus.com/bid/26331
CVE: CVE-2007-5955
Published: 2007-11-14
Description: Cross-site scripting (XSS) vulnerability in updir.php in UPDIR.NET before 2.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/38787; http://secunia.com/advisories/27581
CVE: CVE-2007-5956
Published: 2007-11-14
Description: Directory traversal vulnerability in IBM Informix Dynamic Server (IDS) before 10.00.xC7W1 allows local users to gain privileges by referencing modified NLS message files through directory traversal sequences in the DBLANG environment variable.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=624; http://secunia.com/advisories/27542; http://www-1.ibm.com/support/docview.wss?uid=swg1IC54252
CVE: CVE-2007-5957
Published: 2007-11-14
Description: Unspecified vulnerability in IBM Informix Dynamic Server (IDS) 10.00.TC3TL and 11.10.TB4TL on Windows allows attackers to cause a denial of service (application crash) via unspecified SQ_ONASSIST requests.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/41621; http://secunia.com/advisories/27542; http://www-1.ibm.com/support/docview.wss?uid=swg1IC53588
CVE: CVE-2006-7227
Published: 2007-11-14
Description: Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow.  NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=198976; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html; http://scary.beasts.org/security/CESA-2007-006.html
CVE: CVE-2006-7228
Published: 2007-11-14
Description: Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 might allow context-dependent attackers to execute arbitrary code via a regular expression that involves large (1) min, (2) max, or (3) duplength values that cause an incorrect length calculation and trigger a buffer overflow, a different vulnerability than CVE-2006-7227.  NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=198976; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html; http://lists.vmware.com/pipermail/security-announce/2008/000005.html
CVE: CVE-2007-3694
Published: 2007-11-14
Description: Cross-site scripting (XSS) vulnerability in login.php in Miro Project Broadcast Machine 0.9.9.9 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3363; http://www.int21.de/cve/CVE-2007-3694-bm.html; http://www.securityfocus.com/archive/1/483575/100/0/threaded
CVE: CVE-2006-7229
Published: 2007-11-15
Description: The skge driver 1.5 in Linux kernel 2.6.15 on Ubuntu does not properly use the spin_lock and spin_unlock functions, which allows remote attackers to cause a denial of service (machine crash) via a flood of network traffic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-400
References: http://secunia.com/advisories/28971; http://www.securityfocus.com/bid/26511; http://www.ubuntu.com/usn/usn-578-1
CVE: CVE-2007-4692
Published: 2007-11-15
Description: The tabbed browsing feature in Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attackers to spoof HTTP authentication for other sites and possibly conduct phishing attacks by causing an authentication sheet to be displayed for a tab that is not active, which makes it appear as if it is associated with the active tab.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2007/Nov/msg00003.html
CVE: CVE-2007-4698
Published: 2007-11-15
Description: Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attackers to conduct cross-site scripting (XSS) attacks by causing JavaScript events to be associated with the wrong frame.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2007/Nov/msg00003.html
CVE: CVE-2007-5973
Published: 2007-11-15
Description: SQL injection vulnerability in articles.php in JPortal 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/38750; http://www.securityfocus.com/bid/26395; https://exchange.xforce.ibmcloud.com/vulnerabilities/38363
CVE: CVE-2007-5974
Published: 2007-11-15
Description: SQL injection vulnerability in mailer.php in JPortal 2 allows remote attackers to execute arbitrary SQL commands via the to parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/38749; http://www.securityfocus.com/bid/26360; https://exchange.xforce.ibmcloud.com/vulnerabilities/38293
CVE: CVE-2007-5975
Published: 2007-11-15
Description: SQL injection vulnerability in index.php in TBSource, as used in (1) TBDev and (2) TorrentStrike 0.4, allows remote authenticated users to execute arbitrary SQL commands via the choice parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1280&w=2; http://osvdb.org/38667; http://secunia.com/advisories/27566
CVE: CVE-2007-5976
Published: 2007-11-15
Description: SQL injection vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to execute arbitrary SQL commands via the db parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/27630; http://secunia.com/advisories/27753; http://sourceforge.net/project/shownotes.php?release_id=553333
CVE: CVE-2007-5977
Published: 2007-11-15
Description: Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/27630; http://secunia.com/advisories/27753; http://sourceforge.net/project/shownotes.php?release_id=553333
CVE: CVE-2007-5978
Published: 2007-11-15
Description: SQL injection vulnerability in brokenlink.php in the mylinks module for XOOPS allows remote attackers to execute arbitrary SQL commands via the lid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/38747; http://securityreason.com/securityalert/3362; http://www.securityfocus.com/archive/1/483525/100/0/threaded
CVE: CVE-2007-5979
Published: 2007-11-15
Description: Cross-site scripting (XSS) vulnerability in download_plugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38665; http://secunia.com/advisories/27647; http://securityreason.com/securityalert/3364
CVE: CVE-2007-5980
Published: 2007-11-15
Description: Cross-site scripting (XSS) vulnerability in home/rss.php in eggblog before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27668; http://securityreason.com/securityalert/3361; http://sourceforge.net/project/shownotes.php?group_id=155425&release_id=553433
CVE: CVE-2007-5981
Published: 2007-11-15
Description: Lantronix SCS3200 does not properly handle public-key requests, which allows remote attackers to cause a denial of service (unresponsive device) via unspecified keyscan requests.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 3.3 (LOW)
References: http://secunia.com/advisories/26276; http://www.securityfocus.com/bid/26404; https://exchange.xforce.ibmcloud.com/vulnerabilities/38405
CVE: CVE-2007-5982
Published: 2007-11-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in X7 Chat 2.0.4, 2.0.5, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) room parameter to sources/frame.php, the (2) theme_c parameter to help/index.php, or the (3) INSTALL_X7CHATVERSION parameter to upgradev1.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38745; http://osvdb.org/38746; http://packetstorm.linuxsecurity.com/0711-exploits/x7-xss.txt
CVE: CVE-2007-5983
Published: 2007-11-15
Description: Cross-site scripting (XSS) vulnerability in index.php in Justin Hagstrom AutoIndex PHP Script before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://autoindex.sourceforge.net/change_log.html; http://osvdb.org/38664; http://secunia.com/advisories/27671