deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-6360
Published: 2007-12-15
Description: Unspecified vulnerability in the Sun eXtended System Control Facility (XSCF) Control Package (XCP) firmware before 1050 on SPARC Enterprise M4000, M5000, M8000, and M9000 servers allows remote attackers to cause a denial of service (reboot) via (1) telnet, (2) ssh, or (3) http network traffic that triggers memory exhaustion.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/40842; http://osvdb.org/40843; http://osvdb.org/40844
CVE: CVE-2007-6361
Published: 2007-12-15
Description: Gekko 0.8.2 and earlier stores sensitive information under the web root with possibly insufficient access control, which might allow remote attackers to read certain files under temp/, as demonstrated by a log file that records the titles of blog entries.  NOTE: access to temp/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/44151; http://securityreason.com/securityalert/3451; http://www.securityfocus.com/archive/1/484330/100/0/threaded
CVE: CVE-2007-6362
Published: 2007-12-15
Description: SQL injection vulnerability in index.php in the RSGallery (com_rsgallery) 2.0 beta 5 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an inline page action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://advisories.echo.or.id/adv/adv86-K-159-2007.txt; http://www.securityfocus.com/archive/1/484606/100/100/threaded; http://www.securityfocus.com/bid/26704
CVE: CVE-2007-6363
Published: 2007-12-15
Description: IBM Tivoli Netcool Security Manager 1.3.0 before Interim Fix 1, when using Active Directory (AD) LDAP authentication, allows remote attackers to obtain login access via unspecified vectors without entering a password.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://osvdb.org/43718; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ04768; http://www-1.ibm.com/support/docview.wss?uid=swg24017385
CVE: CVE-2007-6364
Published: 2007-12-15
Description: Cross-site scripting (XSS) vulnerability in modificarPerfil.php in JLMForo System allows remote authenticated users to inject arbitrary web script or HTML via a signature.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/39504; http://securityreason.com/securityalert/3445; http://www.securityfocus.com/archive/1/484227/100/100/threaded
CVE: CVE-2007-6365
Published: 2007-12-15
Description: Cross-site scripting (XSS) vulnerability in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 allows remote attackers to inject arbitrary web script or HTML via the month parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: the day and year vectors are covered by CVE-2007-6274.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/26945; http://secunia.com/advisories/26945
CVE: CVE-2007-6366
Published: 2007-12-15
Description: Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to mods/Calendar/index.php, accessed through a Calendar info action to mods.php; the id parameter to admin/mods_adm.php in a (2) Guestbook modifica or (3) Calendar modify action; or the (4) mese or (5) anno parameter to admin/mods_adm.php in a Calendar action. NOTE: the component for vectors 2 through 5 might be limited to administrators.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27949; http://securityreason.com/securityalert/3444; http://www.securityfocus.com/archive/1/484648/100/0/threaded
CVE: CVE-2007-6367
Published: 2007-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username (user) or (2) comment (commento) field, different vectors than CVE-2007-2357.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27949; http://securityreason.com/securityalert/3444; http://www.securityfocus.com/archive/1/484648/100/0/threaded
CVE: CVE-2007-6368
Published: 2007-12-15
Description: Directory traversal vulnerability in index.php in ezContents 1.4.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the link parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/39505; http://securityreason.com/securityalert/3447; http://www.securityfocus.com/archive/1/484647/100/0/threaded
CVE: CVE-2007-6369
Published: 2007-12-15
Description: Multiple directory traversal vulnerabilities in resize.php in the PictPress 0.91 and earlier plugin for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) size or (2) path parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/4695; https://www.exploit-db.com/exploits/4695
CVE: CVE-2007-6370
Published: 2007-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-5583.  Reason: This candidate is a duplicate of CVE-2007-5583.  Notes: All CVE users should reference CVE-2007-5583 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CWE: CWE-119
CVE: CVE-2007-6371
Published: 2007-12-15
Description: Nokia N95 cell phone with RM-159 12.0.013 firmware allows remote attackers to cause a denial of service (device inoperability) via a SIP INVITE message accompanied by an immediately subsequent SIP CANCEL message, followed by a second SIP INVITE message in a different session.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/058839.html; http://www.securityfocus.com/bid/26726; http://www.vupen.com/english/advisories/2007/4113
CVE: CVE-2007-6372
Published: 2007-12-15
Description: Unspecified vulnerability in Juniper JUNOS 7.3 through 8.4 allows remote attackers to cause a denial of service (crash) via malformed BGP packets, possibly BGP UPDATE packets that trigger session flapping.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/28100; http://www.kb.cert.org/vuls/id/929656; http://www.osvdb.org/39157
CVE: CVE-2007-6373
Published: 2007-12-15
Description: Multiple SQL injection vulnerabilities in GestDown 1.00 Beta allow remote attackers to execute arbitrary SQL commands via the (1) categorie parameter to catdownload.php, or the id parameter to (2) download.php or (3) hitcounter.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6604&w=2; http://www.securityfocus.com/bid/26799; https://exchange.xforce.ibmcloud.com/vulnerabilities/38945
CVE: CVE-2007-6374
Published: 2007-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) users/register.php or (2) search/index.php, or an editcomments action in (3) wiki/index.php or (4) forums/index.php.  NOTE: the error parameter to users/login.php is covered by CVE-2006-3103.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/39129; http://osvdb.org/39130; http://secunia.com/advisories/28024
CVE: CVE-2007-6375
Published: 2007-12-15
Description: Multiple SQL injection vulnerabilities in Bitweaver 2.0.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) sort_mode parameter to wiki/list_pages.php and the (2) highlight parameter to search/index.php.  NOTE: the researcher also reported injection via JavaScript code in the Search box, but this is probably a forced SQL error or other separate primary issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3428; http://www.hackerscenter.com/archive/view.asp?id=28129; http://www.securityfocus.com/archive/1/484805/100/0/threaded
CVE: CVE-2007-6376
Published: 2007-12-15
Description: Directory traversal vulnerability in autohtml.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the filename parameter, a different vector than CVE-2006-4190.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/39507; http://www.securityfocus.com/bid/26807; http://osvdb.org/39507
CVE: CVE-2007-6377
Published: 2007-12-15
Description: Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attackers to execute arbitrary code via a long query string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/badblue-adv.txt; http://aluigi.altervista.org/poc/badbluebof.txt; http://osvdb.org/42416
CVE: CVE-2007-6378
Published: 2007-12-15
Description: Directory traversal vulnerability in upload.dll in BadBlue 2.72b and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/badblue-adv.txt; http://aluigi.org/testz/myhttpup.zip; http://osvdb.org/42417
CVE: CVE-2007-6379
Published: 2007-12-15
Description: BadBlue 2.72b and earlier allows remote attackers to obtain sensitive information via an invalid browse parameter, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://aluigi.altervista.org/adv/badblue-adv.txt; http://osvdb.org/42418; http://secunia.com/advisories/28031
CVE: CVE-2007-6380
Published: 2007-12-15
Description: Multiple SQL injection vulnerabilities in e-Xoops (exoops) 1.08, and 1.05 Rev 1 through 3, allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to (a) mylinks/ratelink.php, (b) adresses/ratefile.php, (c) mydownloads/ratefile.php, (d) mysections/ratefile.php, and (e) myalbum/ratephoto.php in modules/; the (2) bid parameter to (f) modules/banners/click.php; and the (3) gid parameter to (g) modules/arcade/index.php in a show_stats and play_game action, related issues to CVE-2007-5104 and CVE-2007-6266.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lostmon.blogspot.com/2007/12/e-xoops-multiple-variablescripts-sql.html; http://www.securityfocus.com/bid/26796; http://lostmon.blogspot.com/2007/12/e-xoops-multiple-variablescripts-sql.html
CVE: CVE-2007-6381
Published: 2007-12-15
Description: SQL injection vulnerability in the indexed_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457446; http://osvdb.org/39506; http://secunia.com/advisories/27969
CVE: CVE-2007-6382
Published: 2007-12-15
Description: The Event Dispatch Thread in Robocode before 1.5.1 allows remote attackers to execute arbitrary Java code by using a robot to invoke the SwingUtilities.invokeLater method.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/40473; http://secunia.com/advisories/28080; http://sourceforge.net/project/shownotes.php?release_id=561214
CVE: CVE-2007-6383
Published: 2007-12-15
Description: The DAV component in Chandler Server (Cosmo) before 0.10.1 does not check resource creation permissions, which allows remote authenticated users to create arbitrary resources in another user's home collection.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.osafoundation.org/pipermail/cosmo-dev/2007-December/005442.html; http://osvdb.org/44152; http://www.vupen.com/english/advisories/2007/4214
CVE: CVE-2007-6384
Published: 2007-12-15
Description: Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://dev2dev.bea.com/pub/advisory/255; http://osvdb.org/41880; http://secunia.com/advisories/28078
CVE: CVE-2007-6385
Published: 2007-12-15
Description: The proxy server in Kerio WinRoute Firewall before 6.4.1 does not properly enforce authentication for HTTPS pages, which has unknown impact and attack vectors.  NOTE: it is not clear whether this issue crosses privilege boundaries.
CVSS Score: 2.1 (LOW)
CWE: CWE-287
References: http://osvdb.org/42122; http://secunia.com/advisories/28072; http://www.kerio.com/kwf_history.html
CVE: CVE-2007-6386
Published: 2007-12-15
Description: Stack-based buffer overflow in PccScan.dll before build 1451 in Trend Micro AntiVirus plus AntiSpyware 2008, Internet Security 2008, and Internet Security Pro 2008 allows user-assisted remote attackers to cause a denial of service (SfCtlCom.exe crash), and allows local users to gain privileges, via a malformed .zip archive with a long name, as demonstrated by a .zip file created via format string specifiers in a crafted .uue file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://esupport.trendmicro.com/support/viewxml.do?ContentID=1036464; http://osvdb.org/39769; http://osvdb.org/39770
CVE: CVE-2007-6387
Published: 2007-12-15
Description: Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/26566; http://secunia.com/advisories/26670; http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx
CVE: CVE-2007-6389
Published: 2007-12-17
Description: The notify feature in GNOME screensaver (gnome-screensaver) 2.20.0 might allow local users to read the clipboard contents and X selection data for a locked session by using ctrl-V.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=455484; http://bugzilla.gnome.org/show_bug.cgi?id=482159; http://bugzilla.gnome.org/show_bug.cgi?id=503005
CVE: CVE-2007-6390
Published: 2007-12-17
Description: Cross-site request forgery (CSRF) vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting (XSS) attacks on the blog page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/28152; http://www.hboeck.de/archives/572-Some-XSS-issues-in-Serendipity-found.html; http://www.securityfocus.com/bid/26955
CVE: CVE-2007-6391
Published: 2007-12-17
Description: SQL injection vulnerability in patch/comments.php in SH-News 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/26778; http://www.vupen.com/english/advisories/2007/4178; https://www.exploit-db.com/exploits/4709
CVE: CVE-2007-6392
Published: 2007-12-17
Description: SQL injection vulnerability in DWdirectory 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameter to the /search URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27990; http://www.securityfocus.com/bid/26779; http://www.vupen.com/english/advisories/2007/4177
CVE: CVE-2007-6393
Published: 2007-12-17
Description: SQL injection vulnerability in albums.php in Ace Image Hosting Script allows remote authenticated users to execute arbitrary SQL commands via the id parameter in editalbum mode.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/27988; http://www.securityfocus.com/bid/26780; http://www.vupen.com/english/advisories/2007/4176
CVE: CVE-2007-6394
Published: 2007-12-17
Description: SQL injection vulnerability in index.php in Content Injector 1.53 allows remote attackers to execute arbitrary SQL commands via the id parameter in an expand action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27986; http://www.securityfocus.com/bid/26781; http://www.vupen.com/english/advisories/2007/4175
CVE: CVE-2007-6395
Published: 2007-12-17
Description: Flat PHP Board 1.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials via a direct request for the username php file for any user account in users/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/43893; http://www.securityfocus.com/archive/1/484803/100/100/threaded; http://www.securityfocus.com/bid/26782
CVE: CVE-2007-6396
Published: 2007-12-17
Description: Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP code via the (1) username, (2) password, and (3) email parameters when registering a user account, which can be executed by accessing the user's php file for this account.  NOTE: similar code injection might be possible in a user profile.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/43675; http://www.securityfocus.com/archive/1/484803/100/100/threaded; http://www.securityfocus.com/bid/26782
CVE: CVE-2007-6397
Published: 2007-12-17
Description: Multiple directory traversal vulnerabilities in index.php in Flat PHP Board 1.2 and earlier allow remote attackers to (1) create arbitrary files via a .. (dot dot) in the username parameter when registering a user account, and (2) read arbitrary PHP files via a .. (dot dot) in (a) the topic parameter in a topic action or (b) the username parameter in a viewprofile action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/43890; http://osvdb.org/43891; http://osvdb.org/43892
CVE: CVE-2007-6398
Published: 2007-12-17
Description: Flat PHP Board 1.2 and earlier allows remote attackers to bypass authentication and obtain limited access to an arbitrary user account via the fpb_username cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/43678; http://www.securityfocus.com/archive/1/484803/100/100/threaded; http://www.securityfocus.com/bid/26782
CVE: CVE-2007-6399
Published: 2007-12-17
Description: index.php in Flat PHP Board 1.2 and earlier allows remote authenticated users to obtain the password for the current user account by reading the password parameter value in the HTML source for the page generated by a profile action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: http://osvdb.org/44118; http://www.securityfocus.com/archive/1/484803/100/100/threaded; http://www.securityfocus.com/bid/26782
CVE: CVE-2007-6400
Published: 2007-12-17
Description: Directory traversal vulnerability in download_file.php in PolDoc CMS (aka PDDMS) 0.96 allows remote attackers to read arbitrary files via a .. (dot dot) or absolute pathname in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28013; http://www.securityfocus.com/bid/26775; http://www.vupen.com/english/advisories/2007/4159
CVE: CVE-2007-6401
Published: 2007-12-17
Description: Stack-based buffer overflow in mplayer2.exe in Microsoft Windows Media Player (WMP) 6.4, when used with the 3ivx 4.5.1 or 5.0.1 codec, allows remote attackers to execute arbitrary code via a certain .mp4 file, possibly a related issue to CVE-2007-6402.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/3453; http://www.securityfocus.com/archive/1/484779/100/0/threaded; http://www.securityfocus.com/bid/26773
CVE: CVE-2007-6402
Published: 2007-12-17
Description: Stack-based buffer overflow in mplayerc.exe in Media Player Classic (MPC) 6.4.9, when used with the 3ivx 4.5.1 or 5.0.1 codec, allows remote attackers to execute arbitrary code via a certain .mp4 file, possibly a related issue to CVE-2007-6401.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/484781/100/0/threaded; http://www.securityfocus.com/archive/1/484832/100/100/threaded; http://www.securityfocus.com/bid/26774
CVE: CVE-2007-6403
Published: 2007-12-17
Description: Stack-based buffer overflow in Nullsoft Winamp 5.32 allows user-assisted remote attackers to execute arbitrary code via crafted unicode in a .mp4 file, with crafted tags, contained in a certain .rar archive, a related issue to CVE-2007-2498.  NOTE: for exploitation, the victim must select a certain menu option at the time of the attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://securityreason.com/securityalert/3456; http://www.securityfocus.com/archive/1/484776/100/0/threaded; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15562
CVE: CVE-2007-6404
Published: 2007-12-17
Description: Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/shttpd-adv.txt; http://osvdb.org/44013; http://securityreason.com/securityalert/3457
CVE: CVE-2007-6405
Published: 2007-12-17
Description: Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f.  NOTE: the %20 vector is already covered by CVE-2007-3407.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://aluigi.altervista.org/adv/shttpd-adv.txt; http://osvdb.org/44119; http://securityreason.com/securityalert/3457
CVE: CVE-2007-6406
Published: 2007-12-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in CA (formerly Computer Associates) eTrust Threat Management Console allow remote attackers to inject arbitrary web script or HTML via the IP Address field and other unspecified fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3458; http://securitytracker.com/id?1019047; http://www.securityfocus.com/archive/1/484607/100/0/threaded
CVE: CVE-2007-6407
Published: 2007-12-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Provisioning Manager Express allow remote attackers to inject arbitrary web script or HTML via the (1) "assess modification," (2) user-id, and other unspecified fields to the /tpmx URI; or (3) involving unspecified vectors related to "error processing."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3458; http://securitytracker.com/id?1019045; http://www.securityfocus.com/archive/1/484607/100/0/threaded
CVE: CVE-2007-6408
Published: 2007-12-17
Description: IBM Tivoli Provisioning Manager Express provides unspecified information in error messages when (1) attempted duplication of a username occurs when creating an account or (2) when trying to login using a valid username, which makes it easier for remote attackers to enumerate usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://securityreason.com/securityalert/3458; http://www.securityfocus.com/archive/1/484607/100/0/threaded; http://www.securityfocus.com/bid/26724
CVE: CVE-2007-6409
Published: 2007-12-17
Description: The gg protocol handler in Gadu-Gadu, when this product is installed but not running, does not properly handle the skin attribute, which allows remote attackers to cause a denial of service (resource consumption) via unspecified network traffic.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16
References: http://securityreason.com/securityalert/3458; http://www.securityfocus.com/archive/1/484607/100/0/threaded; http://securityreason.com/securityalert/3458