deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0055
Published: 2007-01-04
Description: Directory traversal vulnerability in formbankcgi.exe/AbfrageForm in Formbankserver 1.9 allows remote attackers to read arbitrary files via directory traversal sequences in the Name parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32545; http://secunia.com/advisories/23539; http://www.vupen.com/english/advisories/2007/0012
CVE: CVE-2007-0056
Published: 2007-01-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) ashop/catalogue.php and (b) ashop/basket.php, the (2) exp parameter to ashop/catalogue.php, the (3) searchstring parameter to (c) ashop/search.php, the (4) checkout and (5) action parameters to (d) ashop/shipping.php, the cat parameter to (f) cart-path/admin/editcatalogue.php, and the (7) resultpage parameter to (g) cart-path/admin/salesadmin.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32553; http://osvdb.org/32554; http://osvdb.org/32555
CVE: CVE-2007-0057
Published: 2007-01-04
Description: Cisco Clean Access (CCA) 3.6.x through 3.6.4.2 and 4.0.x through 4.0.3.2 does not properly configure or allow modification of a shared secret authentication key, which causes all devices to have the same shared sercet and allows remote attackers to gain unauthorized access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://osvdb.org/32578; http://secunia.com/advisories/23617; http://securitytracker.com/id?1017465
CVE: CVE-2007-0058
Published: 2007-01-04
Description: Cisco Clean Access (CCA) 3.5.x through 3.5.9 and 3.6.x through 3.6.1.1 on the Clean Access Manager (CAM) allows remote attackers to bypass authentication and download arbitrary manual database backups by guessing the snapshot filename using brute force, then making a direct request for the file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/23556; http://securitytracker.com/id?1017465; http://www.cisco.com/warp/public/707/cisco-sa-20070103-CleanAccess.shtml
CVE: CVE-2007-0059
Published: 2007-01-05
Description: Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI, which is executed in a local zone during preview, as exploited by a MySpace worm.
CVSS Score: 6.8 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305149; http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html; http://osvdb.org/31164
CVE: CVE-2007-0075
Published: 2007-01-05
Description: AspBB stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for db/aspbb.mdb.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33364; http://securityreason.com/securityalert/2100; http://www.aria-security.com/forum/showthread.php?t=82
CVE: CVE-2007-0076
Published: 2007-01-05
Description: Openforum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for openforum.mdb.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33366; http://securityreason.com/securityalert/2099; http://www.aria-security.com/forum/showthread.php?t=80
CVE: CVE-2007-0077
Published: 2007-01-05
Description: lblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a certain file in admin/db/newFolder/.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33367; http://securityreason.com/securityalert/2098; http://securitytracker.com/id?1017462
CVE: CVE-2007-0078
Published: 2007-01-05
Description: BattleBlog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/blankmaster.mdb.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33360; http://securityreason.com/securityalert/2097; http://www.aria-security.com/forum/showthread.php?t=76
CVE: CVE-2007-0079
Published: 2007-01-05
Description: rblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) data/admin.mdb or (2) data/rblog.mdb.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/32572; http://secunia.com/advisories/23538; http://securityreason.com/securityalert/2102
CVE: CVE-2007-0080
Published: 2007-01-05
Description: Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute arbitrary code related to the server desthost field of an SMB_Handle_Type instance.  NOTE: the impact of this issue has been disputed by a reliable third party and the vendor, who states that exploitation is limited "only to local administrators who have write access to the server configuration files."  CVE concurs with the dispute
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/32082; http://securitytracker.com/id?1017463; http://www.attrition.org/pipermail/vim/2007-February/001304.html
CVE: CVE-2007-0081
Published: 2007-01-05
Description: Sunbelt Kerio Personal Firewall (SKPF) 4.3.268 and 4.3.246, and possibly other versions allows local users to provide a Trojan horse iphlpapi.dll to SKPF by placing it in the installation directory.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2095; http://www.matousec.com/info/advisories/Kerio-Fake-iphlpapi-DLL-injection.php; http://www.osvdb.org/33356
CVE: CVE-2007-0082
Published: 2007-01-05
Description: users_adm/start1.php in IMGallery 2.5 and earlier does not properly handle files with multiple extensions, which allows remote authenticated users to upload and execute arbitrary PHP scripts.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/21827; http://www.vupen.com/english/advisories/2007/0010; https://exchange.xforce.ibmcloud.com/vulnerabilities/31237
CVE: CVE-2007-0083
Published: 2007-01-05
Description: Cross-site scripting (XSS) vulnerability in Nuked Klan 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a getURL statement in a .swf file, as demonstrated by "Remote Cookie Disclosure."  NOTE: it could be argued that this is an issue in Shockwave instead of Nuked Klan.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33368; http://securityreason.com/securityalert/2101; http://www.securityfocus.com/archive/1/455726/100/0/threaded
CVE: CVE-2007-0084
Published: 2007-01-05
Description: Buffer overflow in the Windows NT Message Compiler (MC) 1.00.5239 on Microsoft Windows XP allows local users to gain privileges via a long MC-filename.  NOTE: this issue has been disputed by a reliable third party who states that the compiler is not a privileged program, so privilege boundaries cannot be crossed
CVSS Score: 6.6 (MEDIUM)
References: http://osvdb.org/37817; http://www.securityfocus.com/archive/1/455729/100/0/threaded; http://www.securityfocus.com/archive/1/455789/100/0/threaded
CVE: CVE-2007-0085
Published: 2007-01-05
Description: Unspecified vulnerability in sys/dev/pci/vga_pci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agp_ioctl NULL pointer reference.
CVSS Score: 6.0 (MEDIUM)
References: http://ilja.netric.org/files/Unusual%20bugs%2023c3.pdf; http://marc.info/?l=openbsd-cvs&m=[PII_REDACTED]6409&w=2; http://marc.info/?l=openbsd-cvs&m=[PII_REDACTED]1416&w=2
CVE: CVE-2007-0086
Published: 2007-01-05
Description: The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment.  NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
CVSS Score: 7.8 (HIGH)
CWE: CWE-400
References: http://osvdb.org/33456; http://www.securityfocus.com/archive/1/455833/100/0/threaded; http://www.securityfocus.com/archive/1/455879/100/0/threaded
CVE: CVE-2007-0087
Published: 2007-01-05
Description: Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment.  NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33457; http://www.securityfocus.com/archive/1/455833/100/0/threaded; http://www.securityfocus.com/archive/1/455879/100/0/threaded
CVE: CVE-2007-0088
Published: 2007-01-05
Description: Multiple directory traversal vulnerabilities in openmedia allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) src parameter to page.php or the (2) format parameter to search_form.php.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33370; http://osvdb.org/33371; http://securityreason.com/securityalert/2103
CVE: CVE-2007-0089
Published: 2007-01-05
Description: jgbbs stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/bbs.mdb.
CVSS Score: 7.5 (HIGH)
References: http://aria-security.com/forum/showthread.php?t=87; http://osvdb.org/33376; http://www.securityfocus.com/archive/1/455832/100/0/threaded
CVE: CVE-2007-0090
Published: 2007-01-05
Description: WineGlass stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/data.mdb.
CVSS Score: 7.5 (HIGH)
References: http://aria-security.com/forum/showthread.php?p=112; http://osvdb.org/32575; http://secunia.com/advisories/23594
CVE: CVE-2007-0091
Published: 2007-01-05
Description: newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for newsCMS.mdb.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37548; https://exchange.xforce.ibmcloud.com/vulnerabilities/31222; https://www.exploit-db.com/exploits/3066
CVE: CVE-2007-0092
Published: 2007-01-05
Description: SQL injection vulnerability in productdetail.asp in E-SMARTCART 1.0 allows remote attackers to execute arbitrary SQL commands via the product_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31679; http://secunia.com/advisories/23610; http://www.vupen.com/english/advisories/2007/0036
CVE: CVE-2007-0093
Published: 2007-01-05
Description: SQL injection vulnerability in page.php in Simple Web Content Management System allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/18070102.txt; http://osvdb.org/31657; http://secunia.com/advisories/23590
CVE: CVE-2007-0094
Published: 2007-01-05
Description: Sven Moderow GuestBook 0.3a stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for (1) gbook97.mdb or (2) gbook.mdb in ~db/.
CVSS Score: 7.5 (HIGH)
References: http://aria-security.com/forum/showthread.php?p=114; http://osvdb.org/33363; http://securityreason.com/securityalert/2105
CVE: CVE-2007-0095
Published: 2007-01-05
Description: phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0034.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051544.html; http://osvdb.org/33257
CVE: CVE-2007-0096
Published: 2007-01-05
Description: CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for DataBase/Carbon2.4d.mdb.
CVSS Score: 7.5 (HIGH)
References: http://aria-security.com/forum/showthread.php?t=85; http://osvdb.org/37549; http://www.vupen.com/english/advisories/2007/0038
CVE: CVE-2007-0097
Published: 2007-01-05
Description: Multiple stack-based buffer overflows in the (1) LoadTree and (2) ReadHeader functions in PAISO.DLL 1.7.3.0 (1.7.3 beta) in ConeXware PowerArchiver 2006 9.64.02 allow user-assisted attackers to execute arbitrary code via a crafted ISO file containing a file within several nested directories.
CVSS Score: 9.3 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5050&w=2; http://osvdb.org/32576; http://secunia.com/advisories/23559
CVE: CVE-2007-0098
Published: 2007-01-05
Description: Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32352; http://www.vupen.com/english/advisories/2007/0035; https://exchange.xforce.ibmcloud.com/vulnerabilities/31241
CVE: CVE-2007-0099
Published: 2007-01-08
Description: Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via many nested tags in an XML document in an IFRAME, when synchronous document rendering is frequently disrupted with asynchronous events, as demonstrated using a JavaScript timer, which can trigger NULL pointer dereferences or memory corruption, aka "MSXML Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0113.html; http://isc.sans.org/diary.php?storyid=2004; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1213&w=2
CVE: CVE-2007-0100
Published: 2007-01-08
Description: The Perforce client does not restrict the set of files that it overwrites upon receiving a request from the server, which allows remote attackers to overwrite arbitrary files by modifying the client config file on the server, or by operating a malicious server.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/33369; http://www.securityfocus.com/archive/1/455977/100/0/threaded; http://osvdb.org/33369
CVE: CVE-2007-0101
Published: 2007-01-08
Description: Cross-site request forgery (CSRF) vulnerability in SPINE allows remote attackers to perform unauthorized actions as administrators via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32577; http://secunia.com/advisories/23537; http://spine.sourceforge.net/changelog.html
CVE: CVE-2007-0102
Published: 2007-01-09
Description: The Adobe PDF specification 1.3, as implemented by Apple Mac OS X Preview, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://docs.info.apple.com/article.html?artnum=305214; http://osvdb.org/31221; http://projects.info-pull.com/moab/MOAB-06-01-2007.html
CVE: CVE-2007-0103
Published: 2007-01-09
Description: The Adobe PDF specification 1.3, as implemented by Adobe Acrobat before 8.0.0, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://docs.info.apple.com/article.html?artnum=305214; http://projects.info-pull.com/moab/MOAB-06-01-2007.html; http://secunia.com/advisories/24479
CVE: CVE-2007-0104
Published: 2007-01-09
Description: The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://docs.info.apple.com/article.html?artnum=305214; http://projects.info-pull.com/moab/MOAB-06-01-2007.html; http://secunia.com/advisories/23791
CVE: CVE-2007-0105
Published: 2007-01-09
Description: Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted HTTP GET request.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23629; http://securitytracker.com/id?1017475; http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml
CVE: CVE-2007-0106
Published: 2007-01-09
Description: Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33397; http://secunia.com/advisories/23595; http://securityreason.com/securityalert/2114
CVE: CVE-2007-0107
Published: 2007-01-09
Description: WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/31579; http://secunia.com/advisories/23595; http://secunia.com/advisories/23741
CVE: CVE-2007-0108
Published: 2007-01-09
Description: nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/2003 does not delete user profiles during a Terminal Service or Citrix session, which allows remote authenticated users to invoke alternate user profiles.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/31358; http://secunia.com/advisories/23619; http://securitytracker.com/id?1017471
CVE: CVE-2007-0109
Published: 2007-01-09
Description: wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/31577; http://secunia.com/advisories/23621; http://secunia.com/advisories/23741
CVE: CVE-2007-0110
Published: 2007-01-09
Description: Cross-site scripting (XSS) vulnerability in nidp/idff/sso in Novell Access Manager Identity Server before 3.0.0-1013 allows remote attackers to inject arbitrary web script or HTML via the IssueInstant parameter, which is not properly handled in the resulting error message.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/31359; http://secunia.com/advisories/23654; http://securitytracker.com/id?1017483
CVE: CVE-2007-0111
Published: 2007-01-09
Description: Buffer overflow in Resco Photo Viewer for PocketPC 4.11 and 6.01, as used in mobile devices running Windows Mobile 5.0, 2003, and 2003SE, allows remote attackers to execute arbitrary code via a crafted PNG image.
CVSS Score: 6.8 (MEDIUM)
References: http://blog.trendmicro.com/flaw-in-3rd-party-app-weakens-windows-mobile/; http://osvdb.org/32644; http://secunia.com/advisories/23658
CVE: CVE-2007-0112
Published: 2007-01-09
Description: SQL injection vulnerability in cats.asp in createauction allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33406; http://securityreason.com/securityalert/2111; http://www.securityfocus.com/archive/1/456272/100/0/threaded
CVE: CVE-2007-0113
Published: 2007-01-09
Description: Buffer overflow in Packeteer PacketShaper PacketWise 8.x allows remote authenticated users to cause a denial of service (reset or reboot) via (1) a long traffic class argument to the "class show" command or (2) a long POLICY parameter value in clastree.htm.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/31656; http://secunia.com/advisories/23685; http://securityreason.com/securityalert/2110
CVE: CVE-2007-0114
Published: 2007-01-09
Description: Sun Java System Content Delivery Server 5.0 and 5.0 PU1 allows remote attackers to obtain sensitive information regarding "content details" via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32645; http://secunia.com/advisories/23630; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102764-1
CVE: CVE-2007-0115
Published: 2007-01-09
Description: Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the Username to login.php, which is injected into an error message in security.log.php, which can then be accessed using viewlog.php.
CVSS Score: 6.0 (MEDIUM)
References: http://acid-root.new.fr/poc/19070104.txt; http://osvdb.org/33383; http://securityreason.com/securityalert/2107
CVE: CVE-2007-0116
Published: 2007-01-09
Description: Digger Solutions Intranet Open Source (IOS) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for data/intranet.mdb.
CVSS Score: 7.5 (HIGH)
References: http://aria-security.com/forum/showthread.php?goto=newpost&t=88; http://osvdb.org/33379; http://securityreason.com/securityalert/2109
CVE: CVE-2007-0117
Published: 2007-01-09
Description: DiskManagementTool in the DiskManagement.framework 92.29 on Mac OS X 10.4.8 does not properly validate Bill of Materials (BOM) files, which allows attackers to gain privileges via a BOM file under /Library/Receipts/, which triggers arbitrary file permission changes upon execution of a diskutil permission repair operation.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/31167; http://projects.info-pull.com/moab/MOAB-05-01-2007.html; http://secunia.com/advisories/23653
CVE: CVE-2007-0118
Published: 2007-01-09
Description: Multiple absolute path traversal vulnerabilities in EditTag 1.2 allow remote attackers to read arbitrary files via an absolute pathname in the file parameter to (1) edittag.cgi, (2) edittag.pl, (3) edittag_mp.cgi, or (4) edittag_mp.pl.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33393; http://osvdb.org/33394; http://osvdb.org/33395