deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0691
Published: 2007-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-2066.  Reason: This candidate is a duplicate of CVE-2007-2066.  Notes: All CVE users should reference CVE-2007-2066 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-2521
Published: 2007-05-08
Description: PHP remote file inclusion vulnerability in common.php in E-GADS! before 2.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the locale parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/35773; http://secunia.com/advisories/25104; http://www.securityfocus.com/bid/23817
CVE: CVE-2007-0035
Published: 2007-05-08
Description: Word (or Word Viewer) in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly handle data in a certain array, which allows user-assisted remote attackers to execute arbitrary code, aka the "Word Array Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/260777; http://www.osvdb.org/34387; http://www.securityfocus.com/archive/1/468871/100/200/threaded
CVE: CVE-2007-0215
Published: 2007-05-08
Description: Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a .XLS BIFF file with a malformed Named Graph record, which results in memory corruption.
CVSS Score: 7.6 (HIGH)
References: http://secunia.com/advisories/25150; http://www.osvdb.org/34393; http://www.securityfocus.com/archive/1/467988/100/0/threaded
CVE: CVE-2007-1203
Published: 2007-05-08
Description: Unspecified vulnerability in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2003 Viewer, 2004 for Mac, and 2007 allows user-assisted remote attackers to execute arbitrary code via a crafted set font value in an Excel file, which results in memory corruption.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/25150; http://www.osvdb.org/34394; http://www.securityfocus.com/archive/1/468871/100/200/threaded
CVE: CVE-2007-1214
Published: 2007-05-08
Description: Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2003 Viewer, and 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted AutoFilter filter record in an Excel BIFF8 format XLS file, which triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=527; http://secunia.com/advisories/25150; http://www.kb.cert.org/vuls/id/253825
CVE: CVE-2007-0039
Published: 2007-05-08
Description: The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063232.html; http://secunia.com/advisories/25183; http://www.determina.com/security.research/vulnerabilities/exchange-ical-modprops.html
CVE: CVE-2007-0213
Published: 2007-05-08
Description: Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/153533/Microsoft-Exchange-2003-base64-MIME-Remote-Code-Execution.html; http://secunia.com/advisories/25183; http://www.kb.cert.org/vuls/id/343145
CVE: CVE-2007-0220
Published: 2007-05-08
Description: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/25183; http://www.kb.cert.org/vuls/id/124113; http://www.osvdb.org/34389
CVE: CVE-2007-0221
Published: 2007-05-08
Description: Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service (service hang) via crafted literals in an IMAP command, aka the "IMAP Literal Processing Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=526; http://secunia.com/advisories/25183; http://www.osvdb.org/34392
CVE: CVE-2007-0323
Published: 2007-05-08
Description: Buffer overflow in the SetLanguage function in Research In Motion (RIM) TeamOn Import Object ActiveX control (TOImport.dll) allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35873; http://secunia.com/advisories/25218; http://www.blackberry.com/btsc/articles/74/KB13142_f.SAL_Public.html
CVE: CVE-2007-0940
Published: 2007-05-08
Description: Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control (CAPICOM.dll) in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2 allows remote attackers to execute arbitrary code via unspecified vectors, aka the "CAPICOM.Certificates Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/25185; http://www.kb.cert.org/vuls/id/866305; http://www.osvdb.org/34397
CVE: CVE-2007-0942
Published: 2007-05-08
Description: Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; and possibly 7 on Windows Vista does not properly "instantiate certain COM objects as ActiveX controls," which allows remote attackers to execute arbitrary code via a crafted COM object from chtskdic.dll.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/23769; http://www.osvdb.org/34399; http://www.securityfocus.com/archive/1/468871/100/200/threaded
CVE: CVE-2007-0944
Published: 2007-05-08
Description: Unspecified vulnerability in the CTableCol::OnPropertyChange method in Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; and 6 on Windows XP SP2, or Windows Server 2003 SP1 or SP2 allows remote attackers to execute arbitrary code by calling deleteCell on a named table row in a named table column, then accessing the column, which causes Internet Explorer to access previously deleted objects, aka the "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/23769; http://www.osvdb.org/34400; http://www.securityfocus.com/archive/1/467989/100/0/threaded
CVE: CVE-2007-0945
Published: 2007-05-08
Description: Microsoft Internet Explorer 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; and 7 on Windows Vista allows remote attackers to execute arbitrary code via certain property methods that may trigger memory corruption, aka "Property Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/23769; http://www.osvdb.org/34401; http://www.securityfocus.com/archive/1/468871/100/200/threaded
CVE: CVE-2007-0946
Published: 2007-05-08
Description: Unspecified vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, which results in memory corruption, aka the first of two "HTML Objects Memory Corruption Vulnerabilities" and a different issue than CVE-2007-0947.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/23769; http://www.osvdb.org/34402; http://www.securityfocus.com/archive/1/468871/100/200/threaded
CVE: CVE-2007-0947
Published: 2007-05-08
Description: Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, resulting in accessing deallocated memory of CMarkup objects, aka the second of two "HTML Objects Memory Corruption Vulnerabilities" and a different issue than CVE-2007-0946.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/23769; http://secunia.com/secunia_research/2007-36/advisory/; http://www.osvdb.org/34403
CVE: CVE-2007-1202
Published: 2007-05-08
Description: Word (or Word Viewer) in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly parse certain rich text "property strings of certain control words," which allows user-assisted remote attackers to trigger heap corruption and execute arbitrary code, aka the "Word RTF Parsing Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=525; http://www.kb.cert.org/vuls/id/555489; http://www.osvdb.org/34388
CVE: CVE-2007-1747
Published: 2007-05-08
Description: Unspecified vulnerability in MSO.dll in Microsoft Office 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and 2007 allows user-assisted remote attackers to execute arbitrary code via a malformed drawing object, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/25178; http://www.kb.cert.org/vuls/id/853184; http://www.osvdb.org/34396
CVE: CVE-2007-2221
Published: 2007-05-08
Description: Unspecified vulnerability in the mdsauth.dll COM object in Microsoft Windows Media Server in the Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; or 7 on Windows Vista allows remote attackers to overwrite arbitrary files via unspecified vectors, aka the "Arbitrary File Rewrite Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/23769; http://www.fortiguardcenter.com/advisory/FGA-2007-07.html; http://www.kb.cert.org/vuls/id/500753
CVE: CVE-2007-2508
Published: 2007-05-08
Description: Multiple stack-based buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2 Build 1174 allow remote attackers to execute arbitrary code via crafted data to (1) TCP port 5168, which triggers an overflow in the CAgRpcClient::CreateBinding function in the AgRpcCln.dll library in SpntSvc.exe; or (2) TCP port 3628, which triggers an overflow in EarthAgent.exe.  NOTE: both issues are reachable via TmRpcSrv.dll.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/35789; http://osvdb.org/35790; http://secunia.com/advisories/25186
CVE: CVE-2007-2524
Published: 2007-05-08
Description: Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action.  NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/35821; http://osvdb.org/35822; http://secunia.com/advisories/25205
CVE: CVE-2007-2525
Published: 2007-05-08
Description: Memory leak in the PPP over Ethernet (PPPoE) socket implementation in the Linux kernel before 2.6.21-git8 allows local users to cause a denial of service (memory consumption) by creating a socket using connect, and releasing it before the PPPIOCGCHAN ioctl is initialized.
CVSS Score: 4.9 (MEDIUM)
References: http://kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.21-git8.log; http://rhn.redhat.com/errata/RHSA-2007-0488.html; http://secunia.com/advisories/25163
CVE: CVE-2007-2526
Published: 2007-05-08
Description: Heap-based buffer overflow in the ConnectAsyncEx function in VNC Viewer ActiveX control (scvncctrl.dll) in the SmartCode VNC Manager 3.6 allows remote attackers to execute arbitrary code via a long argument.
CVSS Score: 9.3 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-08-smartcode-vnc-manager-36.html; http://osvdb.org/34340; http://secunia.com/advisories/25203
CVE: CVE-2007-2527
Published: 2007-05-08
Description: Multiple PHP remote file inclusion vulnerabilities in DynamicPAD before 1.03.31 allow remote attackers to execute arbitrary PHP code via a URL in the HomeDir parameter to (1) dp_logs.php or (2) index.php.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-May/001591.html; http://attrition.org/pipermail/vim/2007-May/001593.html; http://dynamicpad.org/
CVE: CVE-2007-2528
Published: 2007-05-08
Description: Buffer overflow in AgRpcCln.dll for Trend Micro ServerProtect 5.58 for Windows before Security Patch 3 Build 1176 allows remote attackers to execute arbitrary code via unknown vectors related to RPC requests. NOTE: this is probably a different vulnerability than CVE-2007-2508.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35793; http://www.trendmicro.com/ftp/documentation/readme/spnt_558_win_en_securitypatch3_readme.txt; http://osvdb.org/35793
CVE: CVE-2007-1669
Published: 2007-05-09
Description: zoo decoder 2.10 (zoo-2.10), as used in multiple products including (1) Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, (2) Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o, and (3) AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/25122; http://secunia.com/advisories/25315; http://securityreason.com/securityalert/2680
CVE: CVE-2007-1670
Published: 2007-05-09
Description: Panda Software Antivirus before 20070402 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35845; http://secunia.com/advisories/25152; http://www.securityfocus.com/archive/1/467646/100/0/threaded
CVE: CVE-2007-1671
Published: 2007-05-09
Description: avpack32.dll before 7.3.0.6 in Avira AntiVir allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35911; http://secunia.com/advisories/25140; http://securityreason.com/securityalert/2680
CVE: CVE-2007-1672
Published: 2007-05-09
Description: avast! antivirus before 4.7.981 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35794; http://secunia.com/advisories/25137; http://securityreason.com/securityalert/2680
CVE: CVE-2007-1864
Published: 2007-05-09
Description: Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html; http://osvdb.org/34674; http://secunia.com/advisories/25187
CVE: CVE-2007-2509
Published: 2007-05-09
Description: CRLF injection vulnerability in the ftp_putcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html; http://rhn.redhat.com/errata/RHSA-2007-0889.html; http://secunia.com/advisories/25187
CVE: CVE-2007-2510
Published: 2007-05-09
Description: Buffer overflow in the make_http_soap_request function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" (slash) characters.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html; http://osvdb.org/34675; http://secunia.com/advisories/25187
CVE: CVE-2007-2511
Published: 2007-05-09
Description: Buffer overflow in the user_filter_factory_create function in PHP before 5.2.2 has unknown impact and local attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html; http://osvdb.org/34676; http://secunia.com/advisories/25191
CVE: CVE-2007-2529
Published: 2007-05-09
Description: Integer signedness error in the acl (facl) system call in Solaris 10 before 20070507 allows local users to cause a denial of service (kernel panic) and possibly gain privileges via a certain argument, related to ACE_SETACL.
CVSS Score: 7.2 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=524; http://osvdb.org/34906; http://secunia.com/advisories/25162
CVE: CVE-2007-2530
Published: 2007-05-09
Description: Multiple PHP remote file inclusion vulnerabilities in Tropicalm Crowell Resource 4.5.2 allow remote attackers to execute arbitrary PHP code via a URL in the RESPATH parameter to (1) dosearch.php or (2) printfriendly.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35823; http://osvdb.org/35824; http://secunia.com/advisories/25179
CVE: CVE-2007-2531
Published: 2007-05-09
Description: PHP remote file inclusion vulnerability in berylium-classes.php in Berylium2 2003-08-18 allows remote attackers to execute arbitrary PHP code via a URL in the beryliumroot parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35844; http://secunia.com/advisories/25164; http://www.securityfocus.com/bid/23882
CVE: CVE-2007-2532
Published: 2007-05-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Minh Nguyen Duong Obie Website Mini Web Shop 2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) to (1) sendmail.php or (2) order_form.php, different vectors than CVE-2006-6734.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36248; http://osvdb.org/36249; http://securityreason.com/securityalert/2666
CVE: CVE-2007-2533
Published: 2007-05-09
Description: Multiple buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2- Build 1174 allow remote attackers to execute arbitrary code via a crafted RPC message processed by the (1) the RPCFN_ActiveRollback function in (a) stcommon.dll, or the (2) ENG_SetRealTimeScanConfigInfo or (3) ENG_SendEmail functions in (b) eng50.dll.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35791; http://osvdb.org/35792; http://www.trendmicro.com/download_beta/product.asp?productid=17
CVE: CVE-2007-2534
Published: 2007-05-09
Description: Multiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arbitrary SQL commands via the (1) ADMIN_USER (USER) and (2) ADMIN_PASS (PASS) parameters during a login. NOTE: CVE disputes this vulnerability, since ADMIN_USER/ADMIN_PASS are initialized before use
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://osvdb.org/36180; http://securityreason.com/securityalert/2669; http://www.attrition.org/pipermail/vim/2007-May/001597.html
CVE: CVE-2007-1673
Published: 2007-05-09
Description: unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/36208; http://secunia.com/advisories/25315; http://securityreason.com/securityalert/2680
CVE: CVE-2007-2535
Published: 2007-05-09
Description: WinAce allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/41750; http://securityreason.com/securityalert/2680; http://www.securityfocus.com/archive/1/467646/100/0/threaded
CVE: CVE-2007-2536
Published: 2007-05-09
Description: PicoZip allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/41751; http://securityreason.com/securityalert/2680; http://www.securityfocus.com/archive/1/467646/100/0/threaded
CVE: CVE-2007-2537
Published: 2007-05-09
Description: Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via a (1) nickname or (2) Id in a cookie, or (3) the X-Forwarded-For (X_FORWARDED_FOR) HTTP header.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/36195; http://securityreason.com/securityalert/2670; http://www.aeroxteam.fr/exploit-NPDS-5.10.txt
CVE: CVE-2007-2538
Published: 2007-05-09
Description: SQL injection vulnerability in class/debug/debug_show.php in RunCms 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the executed_queries array parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35782; http://retrogod.altervista.org/runcms_152_sql.html; http://secunia.com/advisories/25154
CVE: CVE-2007-2539
Published: 2007-05-09
Description: The show_files function in RunCms 1.5.2 and earlier allows remote attackers to obtain sensitive information (file existence and file metadata) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35783; http://retrogod.altervista.org/runcms_152_sql.html; http://securityreason.com/securityalert/2671
CVE: CVE-2007-2540
Published: 2007-05-09
Description: Multiple PHP remote file inclusion vulnerabilities in PMECMS 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config[pathMod] parameter to index.php in (1) mod/image/, (2) mod/liens/, (3) mod/liste/, (4) mod/special/, or (5) mod/texte/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35777; http://osvdb.org/35778; http://osvdb.org/35779
CVE: CVE-2007-2541
Published: 2007-05-09
Description: PHP remote file inclusion vulnerability in includes/ajax_listado.php in Versado CMS 1.07 allows remote attackers to execute arbitrary PHP code via a URL in the urlModulo parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35772; http://secunia.com/advisories/25103; http://www.securityfocus.com/bid/23815
CVE: CVE-2007-2542
Published: 2007-05-09
Description: PHP remote file inclusion vulnerability in header.php in workbench survival guide 0.11 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37682; http://www.securityfocus.com/bid/23821; http://www.vupen.com/english/advisories/2007/1667
CVE: CVE-2007-2543
Published: 2007-05-09
Description: SQL injection vulnerability in game.php in the Flashgames 1.0.1 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the lid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34472; http://secunia.com/advisories/25155; http://www.securityfocus.com/bid/23820
CVE: CVE-2007-2544
Published: 2007-05-09
Description: PHP remote file inclusion vulnerability in templates/default/tpl_message.php in PHP TopTree BBS 2.0.1a and earlier allows remote attackers to execute arbitrary PHP code via a URL in the right_file parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35787; http://secunia.com/advisories/25175; http://www.securityfocus.com/bid/23867