deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-6118
Published: 2007-11-23
Description: The MEGACO dissector in Wireshark (formerly Ethereal) 0.9.14 to 0.99.6 allows remote attackers to cause a denial of service (long loop and resource consumption) via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=199958; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html; http://secunia.com/advisories/27777
CVE: CVE-2007-6119
Published: 2007-11-23
Description: The DCP ETSI dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (long loop and resource consumption) via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=199958; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html; http://secunia.com/advisories/27777
CVE: CVE-2007-6120
Published: 2007-11-23
Description: The Bluetooth SDP dissector Wireshark (formerly Ethereal) 0.99.2 to 0.99.6 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=199958; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html; http://secunia.com/advisories/27777
CVE: CVE-2007-6121
Published: 2007-11-23
Description: Wireshark (formerly Ethereal) 0.8.16 to 0.99.6 allows remote attackers to cause a denial of service (crash) via a malformed RPC Portmap packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=199958; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html; http://secunia.com/advisories/27777
CVE: CVE-2007-6122
Published: 2007-11-26
Description: The default_encrypt function in encrypt.c in IRC Services before 5.0.63, and 5.1.x before 5.1.7, allows remote attackers to cause a denial of service (daemon crash) via a long password.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=199897; http://lists.ircservices.za.net/pipermail/ircservices/2007/005558.html; http://lists.ircservices.za.net/pipermail/ircservices/2007/005564.html
CVE: CVE-2007-6123
Published: 2007-11-26
Description: Unspecified vulnerability in IRC Services 5.1.8 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.ircservices.za.net/pipermail/ircservices/2007/005560.html; http://secunia.com/advisories/27761; http://www.ircservices.za.net/Changes.txt
CVE: CVE-2007-6124
Published: 2007-11-26
Description: Cross-site scripting (XSS) vulnerability in signin.php in Softbiz Freelancers Script 1 allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27808; http://www.securityfocus.com/bid/26569; https://exchange.xforce.ibmcloud.com/vulnerabilities/38615
CVE: CVE-2007-6125
Published: 2007-11-26
Description: SQL injection vulnerability in search_form.php in Softbiz Freelancers Script 1 allows remote attackers to execute arbitrary SQL commands via the sb_protype parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/38908; http://secunia.com/advisories/27808; http://www.securityfocus.com/bid/26569
CVE: CVE-2007-6126
Published: 2007-11-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the year parameter to (1) xml/index.php; or (2) the year parameter to view.page.inc.php, which is reachable through a view action to the top-level index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27820; http://www.securityfocus.com/bid/26565; http://www.vupen.com/english/advisories/2007/3999
CVE: CVE-2007-6127
Published: 2007-11-26
Description: Multiple SQL injection vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the year parameter to (1) view.page.inc.php, which is reachable through a view action to index.php; or (2) the year parameter to news.page.inc.php, which is reachable through a news action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27820; http://www.securityfocus.com/bid/26564; http://www.vupen.com/english/advisories/2007/3999
CVE: CVE-2007-6128
Published: 2007-11-26
Description: SQL injection vulnerability in events.php in WorkingOnWeb 2.0.1400 allows remote attackers to execute arbitrary SQL commands via the idevent parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/26563; http://www.vupen.com/english/advisories/2007/3998; https://exchange.xforce.ibmcloud.com/vulnerabilities/38612
CVE: CVE-2007-6129
Published: 2007-11-26
Description: Directory traversal vulnerability in scripts/include/show_content.php in Amber Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/38814; http://secunia.com/advisories/27815; http://www.securityfocus.com/archive/1/484154/100/0/threaded
CVE: CVE-2007-6130
Published: 2007-11-26
Description: gnump3d 2.9final does not apply password protection to its plugins, which might allow remote attackers to bypass intended access restrictions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/27848; http://secunia.com/advisories/27965; http://www.gnu.org/software/gnump3d/ChangeLog
CVE: CVE-2007-6131
Published: 2007-11-26
Description: buttonpressed.sh in scanbuttond 0.2.3 allows local users to overwrite arbitrary files via a symlink attack on the (1) scan.pnm and (2) scan.jpg temporary files.
CVSS Score: 2.1 (LOW)
CWE: CWE-16
References: http://osvdb.org/42422; http://secunia.com/advisories/27847; http://securitytracker.com/id?1019007
CVE: CVE-2007-5959
Published: 2007-11-26
Description: Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
References: http://browser.netscape.com/releasenotes/; http://bugs.gentoo.org/show_bug.cgi?id=198965; http://bugs.gentoo.org/show_bug.cgi?id=200909
CVE: CVE-2007-5960
Published: 2007-11-26
Description: Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://browser.netscape.com/releasenotes/; http://bugs.gentoo.org/show_bug.cgi?id=198965; http://bugs.gentoo.org/show_bug.cgi?id=200909
CVE: CVE-2006-2938
Published: 2007-11-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-2937.  Reason: This candidate was withdrawn by its CNA.  it was incorrectly used to identify CVE-2006-2937.  Notes: none
CVE: CVE-2006-2939
Published: 2007-11-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Notes: none
CVE: CVE-2007-6132
Published: 2007-11-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2007-6133
Published: 2007-11-27
Description: PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the kfm_base_path parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/38809; http://secunia.com/advisories/27765; http://www.securityfocus.com/bid/26538
CVE: CVE-2007-6134
Published: 2007-11-27
Description: SQL injection vulnerability in pkinc/public/article.php in PHPKIT 1.6.4pl1 allows remote attackers to execute arbitrary SQL commands via the contentid parameter in an article action to include.php, a different vector than CVE-2006-1773.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27791; http://www.securityfocus.com/bid/26546; http://www.vupen.com/english/advisories/2007/3995
CVE: CVE-2007-6135
Published: 2007-11-27
Description: Cross-site scripting (XSS) vulnerability in phpslideshow.php in PHPSlideShow 0.9.9.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the directory parameter. NOTE: this issue was originally reported for toonchapter8.php, but this is probably a site-specific name, since the PHPSlideShow distribution does not contain that file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27809; http://www.packetstormsecurity.org/0711-exploits/phpslideshow-xss.txt; http://www.securityfocus.com/archive/1/484192/100/0/threaded
CVE: CVE-2007-6136
Published: 2007-11-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in M2Scripts MySpace Scripts Poll Creator allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) intro, and (3) question parameters, and (4) unspecified answer parameters, in a create_new action. NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38800; http://secunia.com/advisories/27778; http://www.securityfocus.com/archive/1/484073/100/0/threaded
CVE: CVE-2007-6137
Published: 2007-11-27
Description: SQL injection vulnerability in news.php in Content Injector 1.52 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/38801; http://secunia.com/advisories/27792; http://www.securityfocus.com/bid/26547
CVE: CVE-2007-6138
Published: 2007-11-27
Description: SQL injection vulnerability in redir.asp in VU Mass Mailer allows remote attackers to execute arbitrary SQL commands via the password parameter to Default.asp (aka the Login Page).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://aria-security.net/forum/showthread.php?t=447; http://osvdb.org/38807; http://secunia.com/advisories/27758
CVE: CVE-2007-6139
Published: 2007-11-27
Description: PHP remote file inclusion vulnerability in index.php in Mp3 ToolBox 1.0 beta 5 allows remote attackers to execute arbitrary PHP code via a URL in the skin_file parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/484121/100/0/threaded; http://www.vupen.com/english/advisories/2007/3997; https://exchange.xforce.ibmcloud.com/vulnerabilities/38598
CVE: CVE-2007-6140
Published: 2007-11-27
Description: Multiple SQL injection vulnerabilities in Dora Emlak 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) emlak_detay.asp and (b) haber_detay.asp, the (2) kategori parameter to (c) kategorisirala.asp, and the (3) tip parameter to (d) tipsirala.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/38820; http://osvdb.org/38821; http://osvdb.org/38822
CVE: CVE-2007-6141
Published: 2007-11-27
Description: Cross-site scripting (XSS) vulnerability in vBTube.php in vBTube 1.1 Beta allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27814; http://www.securityfocus.com/archive/1/484155/100/0/threaded; http://www.securityfocus.com/bid/26566
CVE: CVE-2007-6142
Published: 2007-11-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) show parameter to index.php and the (2) print parameter to print.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27807; http://www.securityfocus.com/bid/26581; https://exchange.xforce.ibmcloud.com/vulnerabilities/38637
CVE: CVE-2007-6143
Published: 2007-11-27
Description: SQL injection vulnerability in default.asp (aka the Login Page) in VU Case Manager allows remote attackers to execute arbitrary SQL commands via the password parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://aria-security.net/forum/showthread.php?t=448; http://secunia.com/advisories/27779; http://www.securityfocus.com/archive/1/484019/100/0/threaded
CVE: CVE-2007-6144
Published: 2007-11-27
Description: Heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control in pplayer.dll_1_work in Xunlei Thunder 5.7.4.401 allows remote attackers to execute arbitrary code via a long string in a FlvPlayerUrl property value.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/39680; http://secunia.com/advisories/27795; http://www.nohack.cn/hacknews/20071119/1916.html
CVE: CVE-2007-6145
Published: 2007-11-27
Description: Unspecified vulnerability in Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-01 allows remote attackers to bypass authentication and "view files" via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/42353; http://secunia.com/advisories/27735; http://www.hitachi-support.com/security_e/vuls_e/HS07-037_e/index-e.html
CVE: CVE-2007-6146
Published: 2007-11-27
Description: Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-02 on Windows might allow remote attackers to cause a denial of service (service stop) via a "specific file" argument to an FTP command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/42354; http://secunia.com/advisories/27735; http://www.hitachi-support.com/security_e/vuls_e/HS07-038_e/index-e.html
CVE: CVE-2007-6147
Published: 2007-11-27
Description: Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the (a) php_root_path and sometimes the (b) privilege_root_path parameter to various PHP scripts under (1) admin/includes/, (2) admin/phase/, (3) includes/, (4) includes/page_includes/, (5) reviewer/includes/, (6) reviewer/phase/, and (7) user/phase/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/27788; http://www.securityfocus.com/bid/26570; https://exchange.xforce.ibmcloud.com/vulnerabilities/38641
CVE: CVE-2007-4674
Published: 2007-11-27
Description: An "integer arithmetic" error in Apple QuickTime 7.2 allows remote attackers to execute arbitrary code via a crafted movie file containing a movie atom with a large size value, which triggers a stack-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=306896; http://dvlabs.tippingpoint.com/advisory/TPTI-07-20; http://lists.apple.com/archives/security-announce/2008/Oct/msg00000.html
CVE: CVE-2007-6156
Published: 2007-11-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in base_qry_main.php in Base Analysis and Security Engine (BASE) before 1.3.9 allow remote attackers to inject arbitrary web script or HTML via the (1) sig[0] and (2) sig[1] parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27834; http://sourceforge.net/project/shownotes.php?group_id=103348&release_id=555614; http://sourceforge.net/tracker/index.php?func=detail&aid=1801192&group_id=103348&atid=635582
CVE: CVE-2007-6157
Published: 2007-11-29
Description: Cross-site scripting (XSS) vulnerability in index.php in SimpleGallery 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the album parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3400; http://www.securityfocus.com/archive/1/484202/100/0/threaded; http://www.securityfocus.com/bid/26585
CVE: CVE-2007-6158
Published: 2007-11-29
Description: Multiple SQL injection vulnerabilities in caladmin.inc.php in Proverbs Web Calendar 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) loginname (aka Username) and (2) loginpass (aka Password) parameters to caladmin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3401; http://www.securityfocus.com/archive/1/484193/100/0/threaded; http://www.securityfocus.com/bid/26584
CVE: CVE-2007-6159
Published: 2007-11-29
Description: SQL injection vulnerability in index.php in Tilde CMS 4.x and earlier allows remote attackers to execute arbitrary SQL commands via the aarstal parameter in a yeardetail action, a different vector than CVE-2006-1500.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3402; http://www.securityfocus.com/archive/1/484206/100/0/threaded; http://www.securityfocus.com/bid/26591
CVE: CVE-2007-6160
Published: 2007-11-29
Description: Cross-site scripting (XSS) vulnerability in index.php in Tilde CMS 4.x and earlier allows remote attackers to inject arbitrary web script or HTML via the aarstal parameter in a yeardetail action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3402; http://www.securityfocus.com/archive/1/484206/100/0/threaded; http://www.securityfocus.com/bid/26592
CVE: CVE-2007-6161
Published: 2007-11-29
Description: index.php in Tilde CMS 4.x and earlier allows remote attackers to obtain sensitive information via a certain search parameter value in a search action, which reveals the path.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://securityreason.com/securityalert/3402; http://www.securityfocus.com/archive/1/484206/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/38649
CVE: CVE-2007-6162
Published: 2007-11-29
Description: Cross-site scripting (XSS) vulnerability in index.php in FMDeluxe 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a category action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27826; http://securityreason.com/securityalert/3403; http://www.securityfocus.com/archive/1/484191/100/0/threaded
CVE: CVE-2007-6163
Published: 2007-11-29
Description: SQL injection vulnerability in admin/index2.asp in GOUAE DWD Realty allows remote attackers to execute arbitrary SQL commands via the pword (aka Password) parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://aria-security.net/forum/showthread.php?p=1116; http://secunia.com/advisories/27822; http://www.securityfocus.com/archive/1/484181/100/0/threaded
CVE: CVE-2007-6164
Published: 2007-11-29
Description: Multiple SQL injection vulnerabilities in Eurologon CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) reviews.php, (2) links.php and (3) articles.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/484275/100/0/threaded; http://www.securityfocus.com/bid/26599; https://exchange.xforce.ibmcloud.com/vulnerabilities/38656
CVE: CVE-2007-6165
Published: 2007-11-29
Description: Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment containing an apparently-safe file type and script in a resource fork, which does not warn the user that a separate program is going to be executed.  NOTE: this is a regression error related to CVE-2006-0395.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20, CWE-264
References: http://docs.info.apple.com/article.html?artnum=307179; http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html; http://secunia.com/advisories/27785
CVE: CVE-2007-6166
Published: 2007-11-29
Description: Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307176; http://lists.apple.com/archives/Security-announce/2007/Dec/msg00000.html; http://secunia.com/advisories/27755
CVE: CVE-2007-6167
Published: 2007-11-29
Description: Untrusted search path vulnerability in yast2-core in SUSE Linux might allow local users to execute arbitrary code by creating a malicious yast2 module in the current working directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/44158; http://secunia.com/advisories/27756; http://www.novell.com/linux/security/advisories/2007_24_sr.html
CVE: CVE-2007-6168
Published: 2007-11-29
Description: SQL injection vulnerability in default.asp in VU Case Manager allows remote attackers to execute arbitrary SQL commands via the username parameter, a different vector than CVE-2007-6143.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27779; http://www.securityfocus.com/archive/1/484019; http://www.securityfocus.com/bid/26643
CVE: CVE-2007-6169
Published: 2007-11-29
Description: SQL injection vulnerability in admin/index2.asp in GOUAE DWD Realty allows remote attackers to execute arbitrary SQL commands via the uname parameter, a different vector than CVE-2007-6163.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27822; https://exchange.xforce.ibmcloud.com/vulnerabilities/38651; http://secunia.com/advisories/27822
CVE: CVE-2007-4346
Published: 2007-11-29
Description: The Job Engine (bengine.exe) service in Symantec Backup Exec for Windows Servers (BEWS) 11d build 11.0.7170 and 11.0.6.6235 allows remote attackers to cause a denial of service (NULL dereference and service crash) via a crafted packet to port 5633/tcp.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/26975; http://secunia.com/secunia_research/2007-74/advisory/; http://securityresponse.symantec.com/avcenter/security/Content/2007.11.27.html
CVE: CVE-2007-4347
Published: 2007-11-29
Description: Multiple integer overflows in the Job Engine (bengine.exe) service in Symantec Backup Exec for Windows Servers (BEWS) 11d build 11.0.7170 and 11.0.6.6235 allow remote attackers to cause a denial of service (CPU and memory consumption) via a crafted packet to port 5633/tcp, which triggers an infinite loop.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/26975; http://secunia.com/secunia_research/2007-74/advisory/; http://securityresponse.symantec.com/avcenter/security/Content/2007.11.27.html
CVE: CVE-2007-6172
Published: 2007-11-30
Description: Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewimage.php and (2) comments.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27843; http://www.securityfocus.com/bid/26611; http://www.securityfocus.com/bid/26621