deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2771
Published: 2007-05-21
Description: Stack-based buffer overflow in the LEAD Technologies LeadTools JPEG 2000 LEADJ2K.LEADJ2K.140 ActiveX control (LTJ2K14.ocx) 14.5.0.35 allows remote attackers to execute arbitrary code via a long BitmapDataPath property.
CVSS Score: 9.3 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-18-leadtools-jpeg-2000-com.html; http://osvdb.org/36026; http://secunia.com/advisories/25313
CVE: CVE-2007-2772
Published: 2007-05-21
Description: (1) caloggerd.exe (camt70.dll) and (2) mediasvr.exe (catirpc.dll and rwxdr.dll) in CA BrightStor Backup 11.5.2.0 SP2 allow remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted RPC packet.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35327; http://osvdb.org/35328; http://secunia.com/advisories/25300
CVE: CVE-2007-2773
Published: 2007-05-21
Description: SQL injection vulnerability in plugins/mp3playlist/mp3playlist.php in Zomplog 3.8 and earlier allows remote attackers to execute arbitrary SQL commands via the speler parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35017; http://www.securityfocus.com/bid/24064; http://www.vupen.com/english/advisories/2007/1892
CVE: CVE-2007-2774
Published: 2007-05-21
Description: Multiple PHP remote file inclusion vulnerabilities in SunLight CMS 5.3 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to (1) _connect.php or (2) modules/startup.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36227; http://osvdb.org/36228; http://secunia.com/advisories/25366
CVE: CVE-2007-2775
Published: 2007-05-21
Description: AlstraSoft Live Support 1.21 sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to obtain administrative access via a direct request to admin/managesettings.php.
CVSS Score: 10.0 (HIGH)
References: http://itablackhawk.altervista.org/exploit/alsoft_exploit_pack; http://osvdb.org/36638; http://secunia.com/advisories/25337
CVE: CVE-2007-2776
Published: 2007-05-21
Description: AlstraSoft Template Seller Pro 3.25 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject a credential variable setting and obtain administrative access via a direct request to admin/changeinfo.php.
CVSS Score: 10.0 (HIGH)
References: http://itablackhawk.altervista.org/exploit/alsoft_exploit_pack; http://osvdb.org/40422; http://www.securityfocus.com/bid/24068
CVE: CVE-2007-2777
Published: 2007-05-21
Description: Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary .php filename in the zip parameter, which is created under sptemplates/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/40423; http://www.securityfocus.com/bid/24068; https://exchange.xforce.ibmcloud.com/vulnerabilities/34398
CVE: CVE-2007-2778
Published: 2007-05-21
Description: Multiple directory traversal vulnerabilities in MolyX BOARD 2.5.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to index.php and other unspecified PHP scripts.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/36508; http://secunia.com/advisories/25341; http://www.securityfocus.com/bid/24046
CVE: CVE-2007-2779
Published: 2007-05-21
Description: PHP remote file inclusion vulnerability in template_csv.php in Libstats 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rInfo[content] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36233; http://secunia.com/advisories/25342; http://www.securityfocus.com/bid/24047
CVE: CVE-2007-2780
Published: 2007-05-21
Description: PsychoStats 3.0.6b and earlier allows remote attackers to obtain sensitive information via a request for server.php with a missing or invalid newtheme parameter, which reveals a path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8273&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8148&w=2; http://osvdb.org/36582
CVE: CVE-2007-2781
Published: 2007-05-21
Description: Cross-site scripting (XSS) vulnerability in include/sessionRegister.php in WikyBlog before 1.4.13 allows remote attackers to inject arbitrary web script or HTML, probably via vectors related to a certain data2 array element.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36076; http://secunia.com/advisories/25308; http://sourceforge.net/project/shownotes.php?release_id=509254
CVE: CVE-2007-2782
Published: 2007-05-21
Description: Packeteer PacketShaper uses fixed increments in TCP initial sequence number (ISN) values, which allows remote attackers to predict the ISN value, and perform session hijacking or disruption.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36226; http://secunia.com/advisories/25344; http://securityreason.com/securityalert/2726
CVE: CVE-2007-2783
Published: 2007-05-21
Description: Unspecified vulnerability in Rational Soft Hidden Administrator 1.7 and earlier allows remote attackers to bypass authentication and execute arbitrary code via unspecified vectors.  NOTE: this issue has no actionable information, and perhaps should not be included in CVE.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/37522; http://securityreason.com/securityalert/2723; http://www.securityfocus.com/archive/1/468975/100/0/threaded
CVE: CVE-2007-2784
Published: 2007-05-21
Description: Unspecified vulnerability in globus-job-manager in Globus Toolkit 4.1.1 and earlier (globus_nexus-6.6 and earlier) allows remote attackers to cause a denial of service (resource exhaustion and system crash) via certain requests to temporary TCP ports for a GRAM2 job or its MPICH-G2 applications.
CVSS Score: 7.8 (HIGH)
References: http://bugzilla.globus.org/globus/show_bug.cgi?id=5297; http://osvdb.org/36094; http://secunia.com/advisories/25323
CVE: CVE-2007-2785
Published: 2007-05-21
Description: manage-admins.php in eSyndiCat Pro 1.x allows remote attackers to create additional administrative accounts, and have other unspecified impact, via modified username, new_pass, new_pass2, status, super, and certain other parameters in an add action.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37521; http://securityreason.com/securityalert/2729; http://www.securityfocus.com/archive/1/468966/100/0/threaded
CVE: CVE-2007-2786
Published: 2007-05-21
Description: Ratbox IRC Daemon (aka ircd-ratbox) 2.2.5 and earlier allows remote attackers to cause a denial of service (resource exhaustion) by making many requests from a single client.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.ratbox.org/pipermail/ircd-ratbox/2007-May/000759.html; http://osvdb.org/36238; http://secunia.com/advisories/25332
CVE: CVE-2007-2787
Published: 2007-05-21
Description: Stack-based buffer overflow in the BrowseDir function in the (1) lttmb14E.ocx or (2) LTRTM14e.DLL ActiveX control in LeadTools Raster Thumbnail Object Library 14.5.0.44 allows remote attackers to execute arbitrary code via a long argument.
CVSS Score: 7.5 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-19-leadtools-thumbnail-browser.html; http://moaxb.blogspot.com/2007/05/moaxb-20-leadtools-raster-thumbnail.html; http://osvdb.org/36028
CVE: CVE-2007-2788
Published: 2007-05-22
Description: Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://dev2dev.bea.com/pub/advisory/248; http://docs.info.apple.com/article.html?artnum=307177; http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
CVE: CVE-2007-2789
Published: 2007-05-22
Description: The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://dev2dev.bea.com/pub/advisory/248; http://docs.info.apple.com/article.html?artnum=307177; http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
CVE: CVE-2007-2790
Published: 2007-05-22
Description: Cross-site scripting (XSS) vulnerability in shopcontent.asp in VP-ASP Shopping Cart 6.50, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the type parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36095; http://redlevel.org/wp-content/uploads/vpasp-650.txt; http://secunia.com/advisories/25314
CVE: CVE-2007-2791
Published: 2007-05-22
Description: Unspecified vulnerability in the Secure Shell (SSH) in HP Tru64 UNIX 5.1B-4 and 5.1B-3 allows remote attackers to identify valid users via unspecified vectors, probably related to timing attacks and AuthInteractiveFailureRandomTimeout.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01007552; http://osvdb.org/36204; http://secunia.com/advisories/24036
CVE: CVE-2007-2792
Published: 2007-05-22
Description: SQL injection vulnerability in the Yet another Newsletter Component (aka YaNC or com_yanc) component before 1.5 beta 3 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter to index.php. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37948; http://osvdb.org/62620; http://packetstormsecurity.org/0806-exploits/joomlayanc-sql.txt
CVE: CVE-2007-2793
Published: 2007-05-22
Description: PHP remote file inclusion vulnerability in ImageImageMagick.php in Geeklog 2.x allows remote attackers to execute arbitrary PHP code via a URL in the glConf[path_system] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37947; http://www.securityfocus.com/bid/24031; https://exchange.xforce.ibmcloud.com/vulnerabilities/34351
CVE: CVE-2006-3894
Published: 2007-05-22
Description: The RSA Crypto-C before 6.3.1 and Cert-C before 2.8 libraries, as used by RSA BSAFE, multiple Cisco products, and other products, allows remote attackers to cause a denial of service via malformed ASN.1 objects.
CVSS Score: 5.0 (MEDIUM)
References: http://jvn.jp/cert/JVNVU%23754281/index.html; http://osvdb.org/35338; http://secunia.com/advisories/25343
CVE: CVE-2006-7204
Published: 2007-05-22
Description: The imap_body function in PHP before 4.4.4 does not implement safemode or open_basedir checks, which allows local users to read arbitrary files or list arbitrary directory contents.
CVSS Score: 2.1 (LOW)
References: http://bugs.php.net/bug.php?id=37265; http://secunia.com/advisories/21546; http://us2.php.net/ChangeLog-4.php#4.4.4
CVE: CVE-2007-2519
Published: 2007-05-22
Description: Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0.  NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/42108; http://pear.php.net/advisory-20070507.txt; http://pear.php.net/news/vulnerability2.php
CVE: CVE-2007-2686
Published: 2007-05-22
Description: Cross-site scripting (XSS) vulnerability in index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter in a sendpwd task.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1135&w=2; http://www.netvigilance.com/advisory0029; http://www.osvdb.org/34791
CVE: CVE-2007-2802
Published: 2007-05-22
Description: Cross-site scripting (XSS) vulnerability in cp/ps/Main/login/Login in RM EasyMail Plus allows remote attackers to inject arbitrary web script or HTML via the d parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36254; http://redlevel.org/wp-content/uploads/2007/05/rmeasymail.txt; http://secunia.com/advisories/25326
CVE: CVE-2007-2803
Published: 2007-05-22
Description: SQL injection vulnerability in default.asp in Vizayn Urun Tanitim Sitesi 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a haberdetay action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/36232; http://secunia.com/advisories/25348; http://www.securityfocus.com/bid/24079
CVE: CVE-2007-2804
Published: 2007-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in scripts/prodList.asp in CandyPress Store 3.5.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) brand and (2) Msg parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36234; http://pridels-team.blogspot.com/2007/05/candypress-store-xss-vuln.html; http://secunia.com/advisories/25370
CVE: CVE-2007-2805
Published: 2007-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in ClientExec (CE) 3.0 beta2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) ticketID, (2) view, and (3) fuse parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37526; http://pridels-team.blogspot.com/2007/05/clientexec-xss-vuln.html; http://www.securityfocus.com/bid/24061
CVE: CVE-2007-2806
Published: 2007-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in GaliX 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) galix_cat_detail, (2) galix_gal_detail, and (3) galix_cat_detail_sort parameters.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/36253; http://redlevel.org/wp-content/uploads/2007/05/galix.txt; http://secunia.com/advisories/25324
CVE: CVE-2007-2807
Published: 2007-05-22
Description: Stack-based buffer overflow in mod/server.mod/servrmsg.c in Eggdrop 1.6.18, and possibly earlier, allows user-assisted, remote IRC servers to execute arbitrary code via a long private message.
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=427157; http://osvdb.org/36237; http://secunia.com/advisories/25276
CVE: CVE-2007-2808
Published: 2007-05-22
Description: Cross-site scripting (XSS) vulnerability in gnatsweb.pl in Gnatsweb 4.00 and Gnats 4.1.99 allows remote attackers to inject arbitrary web script or HTML via the database parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36224; http://pridels-team.blogspot.com/2007/05/blog-post.html; http://secunia.com/advisories/25333
CVE: CVE-2007-2809
Published: 2007-05-22
Description: Buffer overflow in the transfer manager in Opera before 9.21 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted torrent file.  NOTE: due to the lack of details, it is not clear if this is the same issue as CVE-2007-2274.
CVSS Score: 9.3 (HIGH)
CWE: CWE-120
References: http://isc.sans.org/diary.html?storyid=2823; http://osvdb.org/36229; http://secunia.com/advisories/25278
CVE: CVE-2007-2810
Published: 2007-05-22
Description: SQL injection vulnerability in down_indir.asp in Gazi Download Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/25347; http://securityreason.com/securityalert/2715; http://www.securityfocus.com/bid/23714
CVE: CVE-2007-2811
Published: 2007-05-22
Description: Cross-site scripting (XSS) vulnerability in OSK Advance-Flow 4.41 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/36256; http://secunia.com/advisories/25338
CVE: CVE-2007-2812
Published: 2007-05-22
Description: Cross-site scripting (XSS) vulnerability in hlstats.php in HLstats 1.35, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO or (2) the action parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36215; http://secunia.com/advisories/25340; http://securityreason.com/securityalert/2724
CVE: CVE-2007-2813
Published: 2007-05-22
Description: Cisco IOS 12.4 and earlier, when using the crypto packages and SSL support is enabled, allows remote attackers to cause a denial of service via a malformed (1) ClientHello, (2) ChangeCipherSpec, or (3) Finished message during an SSL session.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/25361; http://www.cisco.com/en/US/products/products_security_advisory09186a0080847c49.shtml; http://www.osvdb.org/35339
CVE: CVE-2007-2814
Published: 2007-05-22
Description: Multiple stack-based buffer overflows in the Pegasus ImagN' ActiveX control (IMW32O40.OCX) 4.00.041 allow remote attackers to execute arbitrary code via (1) a long FileName parameter, or unspecified vectors involving the (2) BeginReport, (3) CreatePictureExA, (4) DefineImage, (5) DefineImageEx, (6) DefineImageFox, (7) CopyBufToClipExA, (8) LoadEx, (9) LoadFox, and other functions.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36518; http://retrogod.altervista.org/IE_pegasus_imagn_bof.html; http://secunia.com/advisories/25351
CVE: CVE-2007-2815
Published: 2007-05-22
Description: The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/41091; http://securityreason.com/securityalert/2725; http://support.microsoft.com/kb/328832
CVE: CVE-2007-2816
Published: 2007-05-22
Description: Multiple PHP remote file inclusion vulnerabilities in ol'bookmarks 0.7.4 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to (1) test1.php, (2) blackorange.php, (3) default.php, (4) frames1.php, (5) frames1_top.php, (7) test2.php, (8) test3.php, (9) test4.php, (10) test5.php, (11) test6.php, (12) frames1_left.php, and (13) frames1_center.php in themes/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/36493; http://osvdb.org/36494; http://osvdb.org/36495
CVE: CVE-2007-2817
Published: 2007-05-22
Description: SQL injection vulnerability in read/index.php in ol'bookmarks 0.7.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36492; http://secunia.com/advisories/25356; http://www.securityfocus.com/bid/24085
CVE: CVE-2007-2818
Published: 2007-05-22
Description: Cross-site scripting (XSS) vulnerability in cand_login.asp in CactuSoft Parodia 6.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the strJobIDs parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37523; http://pridels-team.blogspot.com/2007/05/parodia-xss-vuln.html; http://www.securityfocus.com/bid/24078
CVE: CVE-2007-2819
Published: 2007-05-22
Description: Cross-site scripting (XSS) vulnerability in reportItem.do in Track+ 3.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the projId parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37525; http://pridels-team.blogspot.com/2007/05/track-xss-vuln.html; http://www.securityfocus.com/bid/24060
CVE: CVE-2007-2820
Published: 2007-05-22
Description: Multiple stack-based buffer overflows in the KSign KSignSWAT ActiveX Control (AxKSignSWAT.dll) 2.0.3.3 allow remote attackers to execute arbitrary code via long arguments to the (1) SWAT_Init, (2) SWAT_InitEx, (3) SWAT_InitEx2, (4) SWAT_InitEx3, and (5) SWAT_Login functions.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2669&w=2; http://osvdb.org/36517; http://secunia.com/advisories/25357
CVE: CVE-2007-2821
Published: 2007-05-22
Description: SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36311; http://secunia.com/advisories/25345; http://secunia.com/advisories/29014
CVE: CVE-2007-2822
Published: 2007-05-22
Description: TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the (1) loggedIn and (2) activated parameters to (a) login.php, (b) headerLinks.php, (c) submit1.php, (d) myFav.php, and (e) userCP.php.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/36520; http://secunia.com/advisories/25358; http://www.vupen.com/english/advisories/2007/1903
CVE: CVE-2007-2823
Published: 2007-05-22
Description: Multiple buffer overflows in HT Editor before 2.0.6 might allow remote attackers to execute arbitrary code via unspecified vectors, possibly involving the editor display width.  NOTE: some of the details were obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://hte.cvs.sourceforge.net/hte/HT%20Editor/ChangeLog?revision=1.104; http://osvdb.org/36514; http://secunia.com/advisories/25363
CVE: CVE-2007-2824
Published: 2007-05-22
Description: SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute arbitrary SQL commands via the pack parameter in a paypal action for index.php.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/38056; http://www.securityfocus.com/bid/24067; https://exchange.xforce.ibmcloud.com/vulnerabilities/34400
CVE: CVE-2007-2825
Published: 2007-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in ReadMsg.php in @Mail 5.02 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) links and (2) images.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36826; http://secunia.com/advisories/25506; http://terra.calacode.com/mail/docs/changelog.html
CVE: CVE-2007-2826
Published: 2007-05-22
Description: PHP remote file inclusion vulnerability in lib/addressbook.php in Madirish Webmail 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[basedir] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/36802; http://secunia.com/advisories/25475; http://securityreason.com/securityalert/2718
CVE: CVE-2007-2827
Published: 2007-05-22
Description: Heap-based buffer overflow in LEAD Technologies LEADTOOLS ISIS ActiveX Control (ltisi14E.ocx) 14.5.0.44 and earlier allows remote attackers to execute arbitrary code via a long DriverName property.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://moaxb.blogspot.com/2007/05/moaxb-22-leadtools-isis-control.html; http://osvdb.org/36032; http://secunia.com/advisories/25349
CVE: CVE-2007-2828
Published: 2007-05-22
Description: Cross-site request forgery (CSRF) vulnerability in adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for WordPress allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://michaeldaw.org/alerts/alerts-200507/; http://osvdb.org/37291; http://secunia.com/advisories/25335