deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1821
Published: 2007-04-02
Description: Sprint Nextel Sprint voice mail systems allow remote attackers to retrieve or remove messages, or reconfigure mailboxes, by spoofing Calling Number Identification (CNID, aka Caller ID).
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34984; http://www.kb.cert.org/vuls/id/726548; http://osvdb.org/34984
CVE: CVE-2007-1822
Published: 2007-04-02
Description: Alcatel-Lucent Lucent Technologies voice mail systems allow remote attackers to retrieve or remove messages, or reconfigure mailboxes, by spoofing Calling Number Identification (CNID, aka Caller ID).
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34985; http://www.kb.cert.org/vuls/id/726548; http://osvdb.org/34985
CVE: CVE-2007-1823
Published: 2007-04-02
Description: T-Mobile voice mail systems allow remote attackers to retrieve or remove messages, or reconfigure mailboxes, by spoofing Calling Number Identification (CNID, aka Caller ID).
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34986; http://www.kb.cert.org/vuls/id/726548; http://osvdb.org/34986
CVE: CVE-2007-1824
Published: 2007-04-02
Description: Buffer overflow in the php_stream_filter_create function in PHP 5 before 5.2.1 allows remote attackers to cause a denial of service (application crash) via a php://filter/ URL that has a name ending in the '.' character.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/25056; http://secunia.com/advisories/25057; http://secunia.com/advisories/25062
CVE: CVE-2007-1825
Published: 2007-04-02
Description: Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1, and PHP 4 before 4.4.5, allows remote attackers to execute arbitrary code via a long boundary string in a type.parameters field. NOTE: as of 20070411, it appears that this issue might be subsumed by CVE-2007-0906.3.
CVSS Score: 7.5 (HIGH)
References: http://www.php-security.org/MOPB/MOPB-40-2007.html; http://www.securityfocus.com/bid/23234; https://exchange.xforce.ibmcloud.com/vulnerabilities/33534
CVE: CVE-2007-1826
Published: 2007-04-02
Description: Unspecified vulnerability in the IPSec Manager Service for Cisco Unified CallManager (CUCM) 5.0 before 5.0(4a)SU1 and Cisco Unified Presence Server (CUPS) 1.0 before 1.0(3) allows remote attackers to cause a denial of service (loss of cluster services) via a "specific UDP packet" to UDP port 8500, aka bug ID CSCsg60949.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/34919; http://secunia.com/advisories/24690; http://securitytracker.com/id?1017826
CVE: CVE-2006-7186
Published: 2007-04-03
Description: cgi-lib/subs.pl in web-app.net WebAPP before 0.9.9.3.5 allows attackers to open list files in "profile and other functions," a different vulnerability than CVE-2005-0927.
CVSS Score: 5.0 (MEDIUM)
References: http://www.bantychick.com/live/?action=forum&board=shootbreeze&op=display&num=19&start=15; http://www.bantychick.com/live/?action=forum&board=shootbreeze&op=display&num=19&start=15
CVE: CVE-2006-7187
Published: 2007-04-03
Description: Cross-site scripting (XSS) vulnerability in the show_recent_searches function in cgi-lib/user-lib/search.pl in web-app.net WebAPP before 20060909 allows remote attackers to inject arbitrary web script or HTML via the srch variable.
CVSS Score: 4.3 (MEDIUM)
References: http://www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=security&id=1; http://www.web-app.net/cgi-bin/index.cgi?action=redirectd&cat=security&id=1; http://www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=security&id=1
CVE: CVE-2006-7188
Published: 2007-04-03
Description: The search function in cgi-lib/user-lib/search.pl in web-app.net WebAPP before 20060909 allows remote attackers to read internal forum posts via certain requests, possibly related to the $info{'forum'} variable.
CVSS Score: 5.0 (MEDIUM)
References: http://www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=security&id=1; http://www.web-app.net/cgi-bin/index.cgi?action=redirectd&cat=security&id=1; http://www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=security&id=1
CVE: CVE-2006-7189
Published: 2007-04-03
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/admin/logs.cgi in web-app.net WebAPP before 20060403 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the Statistics Log Viewer.
CVSS Score: 4.3 (MEDIUM)
References: http://www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=pastversions&id=1; http://www.web-app.net/cgi-bin/index.cgi?action=redirectd&cat=pastversions&id=1; http://www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=pastversions&id=1
CVE: CVE-2006-7190
Published: 2007-04-03
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/user-lib/topics.pl in web-app.net WebAPP before 20060515 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the viewnews function, related to use of doubbctopic instead of doubbc.
CVSS Score: 4.3 (MEDIUM)
References: http://www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=pastversions&id=1; http://www.web-app.net/cgi-bin/index.cgi?action=redirectd&cat=pastversions&id=1; http://www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=pastversions&id=1
CVE: CVE-2006-7191
Published: 2007-04-03
Description: Untrusted search path vulnerability in lamdaemon.pl in LDAP Account Manager (LAM) before 1.0.0 allows local users to gain privileges via a modified PATH that points to a malicious rm program.
CVSS Score: 7.2 (HIGH)
References: http://lam.cvs.sourceforge.net/lam/lam/lib/lamdaemon.pl; http://lam.cvs.sourceforge.net/lam/lam/lib/lamdaemon.pl?r1=1.32&r2=1.33; http://lam.sourceforge.net/changelog/index.htm
CVE: CVE-2007-1827
Published: 2007-04-03
Description: Multiple unspecified vulnerabilities in form input validation in web-app.org WebAPP before 0.9.9.6 allow remote authenticated users to corrupt data files, gain access to private files, and execute arbitrary code via "certain characters."
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/45396; http://secunia.com/advisories/24227; http://www.attrition.org/pipermail/vim/2007-March/001455.html
CVE: CVE-2007-1828
Published: 2007-04-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in web-app.org WebAPP before 0.9.9.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the QUERY_STRING corresponding to drop downs or (2) various forms.
CVSS Score: 3.5 (LOW)
References: http://osvdb.org/35214; http://osvdb.org/35215; http://secunia.com/advisories/24227
CVE: CVE-2007-1829
Published: 2007-04-03
Description: Multiple unspecified vulnerabilities in web-app.net WebAPP have unknown impact and attack vectors, described as "[having] other [security] issues too, not as bad as letting users take over your admin account, but bad too."
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35213; http://www.web-app.net/cgi-bin/index.cgi?action=forum&board=public_security&op=display&num=10380; http://osvdb.org/35213
CVE: CVE-2007-1830
Published: 2007-04-03
Description: Unspecified vulnerability in the Username Hijacking Patch 20070312 for web-app.org WebAPP 0.9.9.6 allows remote attackers to obtain administrative access via unknown vectors, related to "something overlooked in the original that was still overlooked in the patch", and possibly related to copying files to the user-lib and the "XSS and cookies exploit."
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35212; http://www.web-app.net/cgi-bin/index.cgi?action=viewnews&id=20; http://www.web-app.org/cgi-bin/index.cgi?action=viewnews&id=259
CVE: CVE-2007-1831
Published: 2007-04-03
Description: web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to open files and write "wrong data" via a crafted QUERY_STRING.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/45395; http://secunia.com/advisories/24227; http://www.attrition.org/pipermail/vim/2007-March/001455.html
CVE: CVE-2007-1832
Published: 2007-04-03
Description: web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to upload certain files (1) via a crafted filename or (2) by "using percent encoding in forms."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24227; http://www.attrition.org/pipermail/vim/2007-March/001455.html; http://www.vupen.com/english/advisories/2007/0720
CVE: CVE-2007-1833
Published: 2007-04-03
Description: The Skinny Call Control Protocol (SCCP) implementation in Cisco Unified CallManager (CUCM) 3.3 before 3.3(5)SR2a, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3)SR1, and 5.0 before 5.0(4a)SU1 allows remote attackers to cause a denial of service (loss of voice services) by sending crafted packets to the (1) SCCP (2000/tcp) or (2) SCCPS (2443/tcp) port.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24665; http://securitytracker.com/id?1017826; http://www.cisco.com/warp/public/707/cisco-sa-20070328-voip.shtml
CVE: CVE-2007-1834
Published: 2007-04-03
Description: Cisco Unified CallManager (CUCM) 5.0 before 5.0(4a)SU1 and Cisco Unified Presence Server (CUPS) 1.0 before 1.0(3) allow remote attackers to cause a denial of service (loss of voice services) via a flood of ICMP echo requests, aka bug ID CSCsf12698.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24690; http://securitytracker.com/id?1017826; http://www.cisco.com/warp/public/707/cisco-sa-20070328-voip.shtml
CVE: CVE-2007-1835
Published: 2007-04-03
Description: PHP 4 before 4.4.5 and PHP 5 before 5.2.1, when using an empty session save path (session.save_path), uses the TMPDIR default after checking the restrictions, which allows local users to bypass open_basedir restrictions.
CVSS Score: 4.6 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137; http://secunia.com/advisories/25423
CVE: CVE-2007-1836
Published: 2007-04-03
Description: The command line administration interface in Data Domain OS before 4.0.3.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in certain arguments to various commands, as demonstrated by the interface argument to the (1) ifconfig and (2) ping commands.
CVSS Score: 9.0 (HIGH)
References: http://osvdb.org/34537; http://secunia.com/advisories/24666; http://securityreason.com/securityalert/2516
CVE: CVE-2007-1837
Published: 2007-04-03
Description: Multiple PHP remote file inclusion vulnerabilities in MangoBery CMS 0.5.5 allow remote attackers to execute arbitrary PHP code via a URL in the Site_Path parameter to (1) boxes/quotes.php or (2) templates/mangobery/footer.sample.php.
CVSS Score: 7.5 (HIGH)
References: http://mangobery.svn.sourceforge.net/viewvc/mangobery?view=rev&revision=70; http://osvdb.org/34509; http://osvdb.org/34510
CVE: CVE-2007-1838
Published: 2007-04-03
Description: SQL injection vulnerability in view.php in the Friendfinder 3.3 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/464153/100/0/threaded; http://www.securityfocus.com/bid/23184; http://www.vupen.com/english/advisories/2007/1146
CVE: CVE-2007-1839
Published: 2007-04-03
Description: Multiple PHP remote file inclusion vulnerabilities in CodeBB 1.1b3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) pass_code.php or (2) lang_select.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35422; http://osvdb.org/35423; http://www.securityfocus.com/bid/23185
CVE: CVE-2007-1840
Published: 2007-04-03
Description: lib/modules.inc in LDAP Account Manager (LAM) before 1.3.0 does not escape HTML special characters in LDAP data, which allows remote attackers to have an unknown impact, probably cross-site scripting (XSS).
CVSS Score: 4.3 (MEDIUM)
References: http://lam.cvs.sourceforge.net/lam/lam/lib/modules.inc?r1=1.173&r2=1.174; http://lam.sourceforge.net/changelog/index.htm; http://secunia.com/advisories/24687
CVE: CVE-2007-0242
Published: 2007-04-03
Description: The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.
CVSS Score: 4.3 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20070901-01-P.asc; http://fedoranews.org/updates/FEDORA-2007-703.shtml; http://rhn.redhat.com/errata/RHSA-2011-1324.html
CVE: CVE-2007-1842
Published: 2007-04-03
Description: Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the table parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, a related issue to CVE-2006-2019.
CVSS Score: 7.5 (HIGH)
References: http://kldp.net/plugins/scmcvs/cvsweb.php/jsboard-2/login.php.diff?r1=1.8%3Br2=1.9%3Bcvsroot=jsboard; http://osvdb.org/37365; http://www.securityfocus.com/bid/23223
CVE: CVE-2007-1843
Published: 2007-04-03
Description: PHP remote file inclusion vulnerability in gmapfactory/params.php in MapLab 2.2.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the gszAppPath parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/34620; http://secunia.com/advisories/24715; http://www.securityfocus.com/archive/1/464462/100/0/threaded
CVE: CVE-2007-1844
Published: 2007-04-03
Description: Multiple PHP remote file inclusion vulnerabilities in Aardvark Topsites PHP 5 allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) button/settings_sql.php, (2) settings_sql.php, and (3) sources/misc/new_day.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35223; http://osvdb.org/35224; http://osvdb.org/35225
CVE: CVE-2007-1845
Published: 2007-04-03
Description: SQL injection vulnerability in show_event.php in the Expanded Calendar (calendar_panel) 2.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the m_month parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36310; http://secunia.com/advisories/24718; http://securityreason.com/securityalert/2514
CVE: CVE-2007-1846
Published: 2007-04-03
Description: SQL injection vulnerability in index.php in the MyAds 2.04jp and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter, different vectors than CVE-2006-3341.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37372; http://www.securityfocus.com/bid/23212; https://exchange.xforce.ibmcloud.com/vulnerabilities/33334
CVE: CVE-2007-1847
Published: 2007-04-03
Description: SQL injection vulnerability in viewcat.php in the Repository module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37373; http://www.securityfocus.com/bid/23221; https://exchange.xforce.ibmcloud.com/vulnerabilities/33344
CVE: CVE-2007-1848
Published: 2007-04-03
Description: Cross-site scripting (XSS) vulnerability in admin/classes/ui.dta.php in Drake CMS allows remote attackers to inject arbitrary web script or HTML via the desc[][title] field.  NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports valid until the first official release of Drake CMS."
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/2522; http://www.securityfocus.com/archive/1/464272/100/0/threaded; http://www.securityfocus.com/bid/23216
CVE: CVE-2007-1849
Published: 2007-04-03
Description: Directory traversal vulnerability in 404.php in Drake CMS allows remote attackers to include and execute arbitrary local arbitrary files via a .. (dot dot) in the d_private parameter.  NOTE: some of these details are obtained from third party information.  NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports valid until the first official release of Drake CMS."
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/464272; http://www.securityfocus.com/bid/23215; https://exchange.xforce.ibmcloud.com/vulnerabilities/33331
CVE: CVE-2007-1850
Published: 2007-04-03
Description: Directory traversal vulnerability in classes/captcha/captcha.jpg.php in Drake CMS allows remote attackers to read arbitrary files or list arbitrary directories, and obtain the installation path, via a .. (dot dot) in the d_private parameter.  NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports valid until the first official release of Drake CMS."
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/2522; http://www.securityfocus.com/archive/1/464272/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33333
CVE: CVE-2007-1851
Published: 2007-04-03
Description: Multiple directory traversal vulnerabilities in Really Simple PHP and Ajax (RSPA) 2007-03-23 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the __class parameter to (1) Controller_v4.php or (2) Controller_v5.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24671; http://www.bugtraq.ir/articles/advisory/RSPA_File_Inclusion/6; http://www.vupen.com/english/advisories/2007/1190
CVE: CVE-2007-1852
Published: 2007-04-03
Description: Multiple PHP remote file inclusion vulnerabilities in 2BGal 3.1.1 allow remote attackers to execute arbitrary PHP code via a URL in the lang_filename parameter to (1) index.php or (2) backupdb.inc.php in admin/, or other unspecified files, different vectors than CVE-2006-5505. NOTE: this issue has been disputed by CVE, since the lang_filename variable is defined before it is used
CVSS Score: 6.8 (MEDIUM)
References: http://attrition.org/pipermail/vim/2007-April/001565.html; http://securityreason.com/securityalert/2517; http://www.securityfocus.com/archive/1/464458/100/0/threaded
CVE: CVE-2007-1853
Published: 2007-04-03
Description: Unspecified vulnerability in Hitachi JP1/HiCommand DeviceManager, Global Link Availability Manager, Replication Monitor, Tiered Storage Manager, and Tuning Manager allows local users to obtain authentication information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34590; http://secunia.com/advisories/24684; http://www.hitachi-support.com/security_e/vuls_e/HS07-007_e/index-e.html
CVE: CVE-2007-1854
Published: 2007-04-03
Description: Unspecified vulnerability in Hitachi Cosminexus Component Container 07-00 through 07-00-10, and 07-10 through 07-10-03, as used in uCosminexus Application Server Enterprise and Standard; uCosminexus Service Platform; uCosminexus Developer Standard and Professional; uCosminexus Service Architect; Electronic Form Workflow Standard Set, Professional Library Set, and Developer Client Set; and uCosminexus ERP Integrator, does not properly manage session information, which has an unspecified impact related to "unintended other requests."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34768; http://secunia.com/advisories/24683; http://www.hitachi-support.com/security_e/vuls_e/HS07-006_e/index-e.html
CVE: CVE-2007-1855
Published: 2007-04-03
Description: Multiple PHP remote file inclusion vulnerabilities in smarty/smarty_class.php in Shop-Script FREE allow remote attackers to execute arbitrary PHP code via a URL in the (1) _smarty_compile_path, (2) smarty_compile_path, (3) get_plugin_filepath, (4) smarty_dir, and (5) filename parameters.  NOTE: this issue might be related to CVE-2006-7105.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35222; http://securityreason.com/securityalert/2520; http://www.securityfocus.com/archive/1/464350/100/0/threaded
CVE: CVE-2006-5586
Published: 2007-04-04
Description: The Graphics Rendering Engine in Microsoft Windows 2000 SP4 and XP SP2 allows local users to gain privileges via "invalid application window sizes" in layered application windows, aka the "GDI Invalid Window Size Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/archive/1/466186/100/200/threaded; http://www.securityfocus.com/bid/23277; http://www.securitytracker.com/id?1017846
CVE: CVE-2007-1211
Published: 2007-04-04
Description: Unspecified kernel GDI functions in Microsoft Windows 2000 SP4; XP SP2; and Server 2003 Gold, SP1, and SP2 allows user-assisted remote attackers to cause a denial of service (possibly persistent restart) via a crafted Windows Metafile (WMF) image that causes an invalid dereference of an offset in a kernel structure, a related issue to CVE-2005-4560.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=499; http://www.securityfocus.com/archive/1/466186/100/200/threaded; http://www.securityfocus.com/bid/23275
CVE: CVE-2007-1212
Published: 2007-04-04
Description: Buffer overflow in the Graphics Device Interface (GDI) in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local users to gain privileges via a crafted Enhanced Metafile (EMF) image format file.
CVSS Score: 6.6 (MEDIUM)
References: http://www.securityfocus.com/archive/1/466186/100/200/threaded; http://www.securityfocus.com/bid/23278; http://www.securitytracker.com/id?1017844
CVE: CVE-2007-1213
Published: 2007-04-04
Description: The TrueType Fonts rasterizer in Microsoft Windows 2000 SP4 allows local users to gain privileges via crafted TrueType fonts, which result in an uninitialized function pointer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-824
References: http://www.securityfocus.com/archive/1/466186/100/200/threaded; http://www.securityfocus.com/bid/23276; http://www.securitytracker.com/id?1017845
CVE: CVE-2007-1215
Published: 2007-04-04
Description: Buffer overflow in the Graphics Device Interface (GDI) in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local users to gain privileges via certain "color-related parameters" in crafted images.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/archive/1/466186/100/200/threaded; http://www.securityfocus.com/bid/23273; http://www.securitytracker.com/id?1017847
CVE: CVE-2007-1866
Published: 2007-04-04
Description: Stack-based buffer overflow in the dns_decode_reverse_name function in dns_decode.c in dproxy-nexgen allows remote attackers to execute arbitrary code by sending a crafted packet to port 53/udp, a different issue than CVE-2007-1465.
CVSS Score: 10.0 (HIGH)
References: http://dproxy.cvs.sourceforge.net/dproxy/dproxy-nexgen/dns_decode.c?revision=1.10&view=markup; http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053289.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053302.html
CVE: CVE-2007-1867
Published: 2007-04-04
Description: Buffer overflow in IrfanView 3.99 allows remote attackers to execute arbitrary code via a crafted animated cursor (ANI) file.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24725; http://www.securityfocus.com/bid/23262; http://www.vupen.com/english/advisories/2007/1210
CVE: CVE-2007-1868
Published: 2007-04-04
Description: The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly handle multipart/form-data in HTTP POST requests, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via crafted POST requests to port 8080/tcp or 443/tcp.
CVSS Score: 10.0 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=498; http://secunia.com/advisories/24717; http://www-1.ibm.com/support/docview.wss?uid=swg24015347