deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2342
Published: 2007-04-27
Description: SQL injection vulnerability in error.asp in CreaScripts CreaDirectory 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2006-6083.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35638; http://www.securityfocus.com/bid/23564; http://www.vupen.com/english/advisories/2007/1476
CVE: CVE-2007-2343
Published: 2007-04-27
Description: Stack-based buffer overflow in the TFTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1, and possibly earlier, allows remote attackers to execute arbitrary code via crafted request packets that contain long file names.
CVSS Score: 7.5 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=506; http://osvdb.org/34627; http://secunia.com/advisories/24764
CVE: CVE-2007-2344
Published: 2007-04-27
Description: The BOOTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1, and possibly earlier, on Windows allows remote attackers to cause a denial of service (daemon crash) via a UDP packet that contains an invalid "packet type" field.
CVSS Score: 7.8 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=506; http://osvdb.org/34628; http://secunia.com/advisories/24764
CVE: CVE-2007-2345
Published: 2007-04-27
Description: PHP remote file inclusion vulnerability in include/include_stream.inc.php in CodeWand phpBrowse allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/23329; http://www.vupen.com/english/advisories/2007/1273; https://www.exploit-db.com/exploits/3668
CVE: CVE-2007-2346
Published: 2007-04-27
Description: Multiple PHP remote file inclusion vulnerabilities in PHP-Generics 1.0 beta allow remote attackers to execute arbitrary PHP code via a URL in the _APP_RELATIVE_PATH parameter to (1) include.php, (2) dbcommon/include.php, and (3) exception/include.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35603; http://osvdb.org/35604; http://osvdb.org/35605
CVE: CVE-2007-2347
Published: 2007-04-27
Description: PHP remote file inclusion vulnerability in main/forum/komentar.php in OneClick CMS (aka Sisplet CMS) 05.10 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the site_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35618; http://www.securityfocus.com/bid/23334; http://www.vupen.com/english/advisories/2007/1281
CVE: CVE-2007-2348
Published: 2007-04-27
Description: mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script.  NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=173524; http://lftp.yar.ru/news.html; http://rhn.redhat.com/errata/RHSA-2009-1278.html
CVE: CVE-2006-4520
Published: 2007-04-30
Description: ncp in Novell eDirectory before 8.7.3 SP9, and 8.8.x before 8.8.1 FTF2, does not properly handle NCP fragments with a negative length, which allows remote attackers to cause a denial of service (daemon crash) when the heap is written to a log file.
CVSS Score: 7.8 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=518; http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=3924657&sliceId=SAL_Public; http://www.securityfocus.com/bid/23685
CVE: CVE-2006-7198
Published: 2007-04-30
Description: Unspecified vulnerability in IBM WebSphere Application Server (WAS) before 5.1.1.14, and WAS for z/OS 601 before 6.0.2.13, has unknown impact and attack vectors, related to a "Potential security exposure," aka PK26123.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/25045; http://securitytracker.com/id?1017976; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006879
CVE: CVE-2007-2029
Published: 2007-04-30
Description: File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service via a crafted PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/34916; http://secunia.com/advisories/25028; http://secunia.com/advisories/25189
CVE: CVE-2007-2053
Published: 2007-04-30
Description: Multiple stack-based buffer overflows in AFFLIB before 2.2.6 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) a long LastModified value in an S3 XML response in lib/s3.cpp; (2) a long (a) path or (b) bucket in an S3 URL in lib/vnode_s3.cpp; or (3) a long (c) EFW, (d) AFD, or (c) aimage file path.  NOTE: the aimage vector (3c) has since been recalled from the researcher's original advisory, since the code is not called in any version of AFFLIB.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35613; http://osvdb.org/35614; http://osvdb.org/35615
CVE: CVE-2007-2054
Published: 2007-04-30
Description: Multiple format string vulnerabilities in AFFLIB before 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, which are used in (1) warn and (2) err calls in (a) lib/s3.cpp, (b) tools/afconvert.cpp, (c) tools/afcopy.cpp, (d) tools/afinfo.cpp, (e) aimage/aimage.cpp, (f) aimage/imager.cpp, and (g) tools/afxml.cpp.  NOTE: the aimage.cpp vector (e) has since been recalled from the researcher's original advisory, since the code is not called in any version of AFFLIB.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2657; http://www.securityfocus.com/archive/1/467040/100/0/threaded; http://www.vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt
CVE: CVE-2007-2055
Published: 2007-04-30
Description: AFFLIB 2.2.8 and earlier allows attackers to execute arbitrary commands via shell metacharacters involving (1) certain command line parameters in tools/afconvert.cpp and (2) arguments to the get_parameter function in aimage/ident.cpp.  NOTE: it is unknown if the get_parameter vector (2) is ever called.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35608; http://securityreason.com/securityalert/2656; http://www.securityfocus.com/archive/1/467041/100/0/threaded
CVE: CVE-2007-2056
Published: 2007-04-30
Description: Rejected reason: The getlock function in aimage/aimage.cpp in AFFLIB 2.2.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary lock files (aka "time-of-check-time-of-use file race"). NOTE: the researcher has retracted the original advisory, stating that "the portion of vulnerable code is not called in any current version of AFFLIB and is therefore not exploitable.
CVE: CVE-2007-2349
Published: 2007-04-30
Description: Cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) 2.1.x and 2.2.x allows remote attackers to inject arbitrary web script or HTML by uploading crafted images or PDF files.
CVSS Score: 5.8 (MEDIUM)
References: http://forums.invisionpower.com/index.php?showtopic=234377; http://osvdb.org/35427; http://secunia.com/advisories/25021
CVE: CVE-2007-2350
Published: 2007-04-30
Description: admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053915.html; http://osvdb.org/35316; http://secunia.com/advisories/24935
CVE: CVE-2007-2351
Published: 2007-04-30
Description: Unspecified vulnerability in the HP Power Manager Remote Agent (RA) 4.0Build10 and earlier in HP-UX B.11.11 and B.11.23 allows local users to execute arbitrary code via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00819543; http://secunia.com/advisories/25066; http://www.securityfocus.com/bid/23703
CVE: CVE-2007-2352
Published: 2007-04-30
Description: Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, which are used in (1) warn and (2) err calls, possibly involving (a) lib/s3.cpp, (b) tools/afconvert.cpp, (c) tools/afcopy.cpp, (d) tools/afinfo.cpp, (e) aimage/imager.cpp, and (f) tools/afxml.cpp.  NOTE: this identifier is intended to address the vectors that were not fixed in CVE-2007-2054, but the unfixed vectors were not explicitly listed.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/2657; http://www.securityfocus.com/archive/1/467040/100/0/threaded; http://www.vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt
CVE: CVE-2007-2353
Published: 2007-04-30
Description: Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://attrition.org/pipermail/vim/2007-April/001562.html; http://www.osvdb.org/34154; http://www.securityfocus.com/bid/23687
CVE: CVE-2007-2354
Published: 2007-04-30
Description: Progress Webspeed Messenger allows remote attackers to obtain sensitive information via a WService parameter containing "wsbroker1/webutil/about.r", which reveals the operating system and product information.
CVSS Score: 7.8 (HIGH)
References: http://www.ishare.nl/; http://www.securityfocus.com/archive/1/467184/100/0/threaded; http://www.ishare.nl/
CVE: CVE-2007-2355
Published: 2007-04-30
Description: The get_url function in DODS_Dispatch.pm for the CGI_server in OPeNDAP 3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/25060; http://www.kb.cert.org/vuls/id/857153; http://www.opendap.org/
CVE: CVE-2007-2356
Published: 2007-04-30
Description: Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://lists.suse.com/archive/suse-security-announce/2007-May/0005.html; http://secunia.com/advisories/25012; http://secunia.com/advisories/25111
CVE: CVE-2007-2357
Published: 2007-04-30
Description: Cross-site scripting (XSS) vulnerability in mods/Core/result.php in SineCms 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the stringa parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34172; http://secunia.com/advisories/25014; http://securityreason.com/securityalert/2649
CVE: CVE-2007-2358
Published: 2007-04-30
Description: Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the (1) inc_path parameter to (a) a_noskin.php, (b) a_stub.php, (c) admin.php, (d) contact.php, (e) default.php, (f) index.php, and (g) multiblogs.php in blogs/; the (2) view_path and (3) control_path parameters to blogs/admin.php; and the (4) skins_path parameter to (h) blogs/contact.php and (i) blogs/multiblogs.php.  NOTE: this issue is disputed by CVE, since the inc_path, view_path, control_path, and skins_path variables are all initialized in conf/_advanced.php before they are used
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-April/001566.html; http://osvdb.org/35609; http://www.osvdb.org/34152
CVE: CVE-2007-2359
Published: 2007-04-30
Description: Buffer overflow in Ghost Service Manager, as used in Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, allows local users to gain privileges via a long string.
CVSS Score: 7.2 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=519; http://secunia.com/advisories/25013; http://www.securitytracker.com/id?1017971
CVE: CVE-2007-2360
Published: 2007-04-30
Description: Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore point images are configured, encrypt network share credentials with a key formed by a hash of the username, which allows local users to obtain the credentials by calculating the key.
CVSS Score: 6.8 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=520; http://secunia.com/advisories/25013; http://www.securitytracker.com/id?1017971
CVE: CVE-2007-2361
Published: 2007-04-30
Description: Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore points images are configured, uses weak permissions (world readable) for a configuration file with network share credentials, which allows local users to obtain the credentials by reading the file.
CVSS Score: 4.9 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=520; http://secunia.com/advisories/25013; http://www.securitytracker.com/id?1017971
CVE: CVE-2007-2362
Published: 2007-04-30
Description: Multiple buffer overflows in MyDNS 1.1.0 allow remote attackers to (1) cause a denial of service (daemon crash) and possibly execute arbitrary code via a certain update, which triggers a heap-based buffer overflow in update.c; and (2) cause a denial of service (daemon crash) via unspecified vectors that trigger an off-by-one stack-based buffer overflow in update.c.
CVSS Score: 9.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/054024.html; http://osvdb.org/35438; http://osvdb.org/35439
CVE: CVE-2007-2363
Published: 2007-04-30
Description: Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted .IFF file.
CVSS Score: 8.5 (HIGH)
References: http://osvdb.org/35463; http://secunia.com/advisories/25052; http://www.securityfocus.com/bid/23692
CVE: CVE-2007-2364
Published: 2007-04-30
Description: Multiple PHP remote file inclusion vulnerabilities in burnCMS 0.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to (1) mysql.class.php or (2) postgres.class.php in lib/db/; or (3) authuser.php, (4) misc.php, or (5) connect.php in lib/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35617; http://www.securityfocus.com/bid/23691; http://www.vupen.com/english/advisories/2007/1557
CVE: CVE-2007-2365
Published: 2007-04-30
Description: Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assisted remote attackers to execute arbitrary code via a crafted .PNG file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/35465; http://osvdb.org/38063; http://secunia.com/advisories/25044
CVE: CVE-2007-2366
Published: 2007-04-30
Description: Buffer overflow in Corel Paint Shop Pro 11.20 allows user-assisted remote attackers to execute arbitrary code via a crafted .PNG file.
CVSS Score: 7.4 (HIGH)
References: http://osvdb.org/35467; http://secunia.com/advisories/25034; http://www.securityfocus.com/bid/23698
CVE: CVE-2006-7199
Published: 2007-04-30
Description: EMC RSA Security SiteKey allows remote attackers to display the correct image via a man-in-the-middle (MITM) attack in which an attacker-controlled server proxies authentication data to and from a legitimate SiteKey server.  NOTE: the vendor disputes the severity of the issue, stating that it is easier to monitor this attack than "attacks against static web pages."
CVSS Score: 8.5 (HIGH)
References: http://www.cr-labs.com/publications/SiteKey-20060718.pdf; http://www.cr-labs.com/publications/WhySiteKey-20060824.pdf; http://www.networkworld.com/newsletters/sec/2007/0402sec2.html
CVE: CVE-2006-7200
Published: 2007-04-30
Description: EMC RSA Security SiteKey issues challenge-bypass tokens that persist forever without a cancellation interface for end users, which makes it easier for attackers to bypass one stage of authentication by stealing and replaying a token.
CVSS Score: 9.0 (HIGH)
References: http://www.cr-labs.com/publications/SiteKey-20060718.pdf; http://www.cr-labs.com/publications/WhySiteKey-20060824.pdf; http://www.cr-labs.com/publications/SiteKey-20060718.pdf
CVE: CVE-2006-7201
Published: 2007-04-30
Description: EMC RSA Security SiteKey does not set the secure qualifier on the SiteKey Flash token (aka the PassMark Flash shared object), which might allow remote attackers to obtain the token via HTTP.
CVSS Score: 9.3 (HIGH)
References: http://www.cr-labs.com/publications/SiteKey-20060718.pdf; http://www.cr-labs.com/publications/WhySiteKey-20060824.pdf; http://www.cr-labs.com/publications/SiteKey-20060718.pdf
CVE: CVE-2007-2367
Published: 2007-04-30
Description: Buffer overflow in wserve_console.exe in Wserve HTTP Server (whttp) 4.6 allows remote attackers to cause a denial of service (forced application exit) via a long directory name in the URI.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/2647; http://www.securityfocus.com/archive/1/464819/100/0/threaded; http://www.securityfocus.com/bid/23341
CVE: CVE-2007-2368
Published: 2007-04-30
Description: picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://www.vupen.com/english/advisories/2007/1274; https://www.exploit-db.com/exploits/3673; http://www.vupen.com/english/advisories/2007/1274
CVE: CVE-2007-2369
Published: 2007-04-30
Description: Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34638; http://www.vupen.com/english/advisories/2007/1274; https://www.exploit-db.com/exploits/3673
CVE: CVE-2007-2370
Published: 2007-04-30
Description: SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in a jobsview action. NOTE: the module name was originally reported as Job Listings.
CVSS Score: 7.5 (HIGH)
References: http://www.attrition.org/pipermail/vim/2007-April/001494.html; https://www.exploit-db.com/exploits/3672; http://www.attrition.org/pipermail/vim/2007-April/001494.html
CVE: CVE-2007-2371
Published: 2007-04-30
Description: admin/index.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier provides access to configuration modification before login, which allows remote attackers to cause a denial of service (loss of configuration data), and possibly perform direct static code injection, via a saveGlobalconfig action.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/bid/23342; https://www.exploit-db.com/exploits/3671; http://www.securityfocus.com/bid/23342
CVE: CVE-2007-2372
Published: 2007-04-30
Description: admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and list_id fields; and send the message via a direct request for the MsgId value under admin/.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/bid/23342; https://www.exploit-db.com/exploits/3671; http://www.securityfocus.com/bid/23342
CVE: CVE-2007-2373
Published: 2007-04-30
Description: SQL injection vulnerability in viewcat.php in the WF-Links (wflinks) 1.03 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.org/0704-exploits/xoopswflinks-sql.txt; http://www.securityfocus.com/archive/1/488316/100/0/threaded; http://www.securityfocus.com/archive/1/488375/100/0/threaded
CVE: CVE-2007-2374
Published: 2007-04-30
Description: Unspecified vulnerability in Microsoft Windows 2000, XP, and Server 2003 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors.  NOTE: this information is based upon a vague pre-advisory with no actionable information. However, the advisory is from a reliable source.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35637; http://research.eeye.com/html/advisories/upcoming/20070327.html; http://www.securityfocus.com/bid/23332
CVE: CVE-2007-2375
Published: 2007-04-30
Description: The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24767; http://www.securityfocus.com/bid/23287; http://www.securitytracker.com/id?1017881
CVE: CVE-2007-2376
Published: 2007-04-30
Description: The Dojo framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/43323; http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf; http://osvdb.org/43323
CVE: CVE-2007-2377
Published: 2007-04-30
Description: The Getahead Direct Web Remoting (DWR) framework 1.1.4 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://osvdb.org/43322; http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf
CVE: CVE-2007-2378
Published: 2007-04-30
Description: The Google Web Toolkit (GWT) framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/43321; http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf; http://osvdb.org/43321
CVE: CVE-2007-2379
Published: 2007-04-30
Description: The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/43320; http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2007-2380
Published: 2007-04-30
Description: The Microsoft Atlas framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/43325; http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf; http://osvdb.org/43325