deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6984
Published: 2007-02-09
Description: Cross-domain vulnerability in GreenBrowser 3.4.0622 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html; http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
CVE: CVE-2006-6985
Published: 2007-02-09
Description: Cross-domain vulnerability in Maxthon 1.5.6 build 42 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html; http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
CVE: CVE-2006-6986
Published: 2007-02-09
Description: Cross-domain vulnerability in PhaseOut 5.4.4 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html; http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
CVE: CVE-2006-6987
Published: 2007-02-09
Description: Cross-domain vulnerability in FineBrowser Freeware 3.2.2 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html; http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
CVE: CVE-2006-6988
Published: 2007-02-09
Description: Cross-domain vulnerability in Slim Browser 4.07 build 100 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html; http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
CVE: CVE-2006-6989
Published: 2007-02-09
Description: Cross-domain vulnerability in NetCaptor 4.5.7 Personal Edition allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html; http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
CVE: CVE-2006-6990
Published: 2007-02-09
Description: Cross-domain vulnerability in Enigma Browser 3.8.8 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html; http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
CVE: CVE-2006-6991
Published: 2007-02-09
Description: Cross-domain vulnerability in Fast Browser Pro 8.1 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html; http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
CVE: CVE-2006-6992
Published: 2007-02-09
Description: Cross-domain vulnerability in GoSuRF Browser 2.62 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html; http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
CVE: CVE-2007-0860
Published: 2007-02-09
Description: Multiple PHP remote file inclusion vulnerabilities in local Calendar System 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) TEMPLATE_DIR parameter to (a) showinvoices.php, (b) showmonth.php, (c) showevents.php, (d) retrieveinvoice.php, (e) modifyitem.php, and (f) lookup_userid.php; or the LIBDIR parameter to (g) editevent.php, (h) resetpassword.php, (i) signup.php, showmonth.php, (j) showday.php, showevents.php, and lookup_userid.php. NOTE: this issue has been disputed by a third party, who states that the associated variables are set in config.php before use
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/458312/100/100/threaded; http://www.securityfocus.com/archive/1/458457/100/100/threaded; http://www.securityfocus.com/archive/1/458312/100/100/threaded
CVE: CVE-2007-0861
Published: 2007-02-09
Description: PHP remote file inclusion vulnerability in modules/mail/index.php in phpCOIN RC-1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _CCFG['_PKG_PATH_MDLS'] parameter.  NOTE: this issue has been disputed by a reliable third party, who states that a fatal error occurs before the relevant code is reached
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33591; http://securityreason.com/securityalert/2230; http://www.securityfocus.com/archive/1/458064/100/200/threaded
CVE: CVE-2007-0862
Published: 2007-02-09
Description: PHP remote file inclusion vulnerability in index.php in gnopaste 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code via the GNP_REAL_PATH parameter.  NOTE: CVE and a third party dispute this issue, since GNP_REAL_PATH is a constant, not a variable
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/458460/100/100/threaded; http://www.securityfocus.com/archive/1/458559/100/100/threaded; http://www.securityfocus.com/archive/1/458460/100/100/threaded
CVE: CVE-2007-0863
Published: 2007-02-09
Description: PHP remote file inclusion vulnerability in Trevorchan 0.7 and earlier allows remote attackers to execute arbitrary code via the tc_config[rootdir] parameter to (1) upgrade.php, (2) paint_save.php, (3) menu.php, (4) manage.php, and (5) banned.php.  NOTE: his issue has been disputed by reliable third parties, who state that the variable is set before use in config.php
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/33475; http://securitytracker.com/id?1017512; http://www.attrition.org/pipermail/vim/2007-January/001241.html
CVE: CVE-2007-0864
Published: 2007-02-09
Description: SQL injection vulnerability in register.php in LushiWarPlaner 1.0 allows remote attackers to inject arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33167; http://secunia.com/advisories/24079; http://www.securityfocus.com/bid/22470
CVE: CVE-2007-0865
Published: 2007-02-09
Description: SQL injection vulnerability in comments.php in LushiNews 1.01 and earlier allows remote authenticated users to inject arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33134; http://secunia.com/advisories/24081; http://www.securityfocus.com/bid/22469
CVE: CVE-2007-0866
Published: 2007-02-09
Description: Unspecified vulnerability in HP OpenView Storage Data Protector on HP-UX B.11.00, B.11.11, or B.11.23 allows local users to execute arbitrary code via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33164; http://secunia.com/advisories/24113; http://securitytracker.com/id?1017614
CVE: CVE-2007-0867
Published: 2007-02-09
Description: PHP remote file inclusion vulnerability in classes/menu.php in Site-Assistant 0990 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the paths[version] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34695; http://www.securityfocus.com/bid/22467; http://www.vupen.com/english/advisories/2007/0541
CVE: CVE-2007-0868
Published: 2007-02-09
Description: Unspecified vulnerability in the Chat Room functionality in Yahoo! Messenger 8.1.0.239 and earlier allows remote attackers to cause a denial of service via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34696; http://www.securityfocus.com/bid/22407; http://osvdb.org/34696
CVE: CVE-2007-0869
Published: 2007-02-09
Description: Cross-site scripting (XSS) vulnerability in the Attachment Manager (admincp/attachment.php) in Jelsoft vBulletin 3.6.4 allows remote attackers to inject arbitrary web script or HTML via the Extension field.  NOTE: this might be a duplicate of CVE-2007-0830.5.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33129; http://secunia.com/advisories/24085; http://www.securityfocus.com/bid/22466
CVE: CVE-2007-0870
Published: 2007-02-11
Description: Unspecified vulnerability in Microsoft Word 2000 allows remote attackers to cause a denial of service (crash) via unknown vectors, a different vulnerability than CVE-2006-5994, CVE-2006-6456, CVE-2006-6561, and CVE-2007-0515, a variant of Exploit-MS06-027.
CVSS Score: 7.6 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0370.html; http://osvdb.org/33196; http://secunia.com/advisories/24122
CVE: CVE-2006-6993
Published: 2007-02-12
Description: Multiple SQL injection vulnerabilities in pages/addcomment2.php in Neuron Blog 1.1 allow remote attackers to inject arbitrary SQL commands via the (1) commentname, (2) commentmail, (3) commentwebsite, and (4) comment parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19703; http://www.vupen.com/english/advisories/2006/1406; http://secunia.com/advisories/19703
CVE: CVE-2006-6994
Published: 2007-02-12
Description: Unrestricted file upload vulnerability in add.asp in OzzyWork Gallery, possibly 2.0 and earlier, allows remote attackers to upload and execute arbitrary ASP files by removing the client-side security checks.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-434
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7299&w=2; http://secunia.com/advisories/20049; http://www.osvdb.org/25427
CVE: CVE-2006-6995
Published: 2007-02-12
Description: mycontacts.php in V3 Chat allows remote authenticated users to gain privileges as other users via a modified membername parameter.
CVSS Score: 6.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/437755/100/200/threaded; http://www.securityfocus.com/bid/18543; http://www.vupen.com/english/advisories/2006/2474
CVE: CVE-2006-6996
Published: 2007-02-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary HTML and web script via the (1) title and (2) newspost parameters to (a) newsadd.php, and the (3) name, title, and (4) comment parameters to (b) news.php, a different set of vectors than CVE-2006-1818.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19697; https://exchange.xforce.ibmcloud.com/vulnerabilities/25901; http://secunia.com/advisories/19697
CVE: CVE-2006-6997
Published: 2007-02-12
Description: Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 leads to "weakened authentication security" with unknown impact and attack vectors.  NOTE: due to lack of details, it is not clear whether this is the same as CVE-2006-1792.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1359.html; http://www.mailenable.com/enterprisehistory.asp; http://www.mailenable.com/professionalhistory.asp
CVE: CVE-2006-6998
Published: 2007-02-12
Description: install/loader_help.php in Headstart Solutions DeskPRO allows remote attackers to obtain configuration information via a q=phpinfo QUERY_STRING, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt; http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt
CVE: CVE-2006-6999
Published: 2007-02-12
Description: attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt; http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt
CVE: CVE-2006-7000
Published: 2007-02-12
Description: Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to (1) email/mail.php, (2) includes/init.php, (3) certain files in includes/cron/, and (4) jpgraph.php, (5) jpgraph_bar.php, (6) jpgraph_pie.php, and (7) jpgraph_pie3d.php in includes/graph/, which leaks the path in error messages.
CVSS Score: 5.0 (MEDIUM)
References: http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt; http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt
CVE: CVE-2006-7001
Published: 2007-02-12
Description: Directory traversal vulnerability in avatar.php in PhpMyChat Plus 1.9 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the L parameter, a different issue than CVE-2006-5897. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/22782; http://secunia.com/advisories/22782
CVE: CVE-2006-7002
Published: 2007-02-12
Description: Cross-site scripting (XSS) vulnerability in add_comment.php in Wheatblog (wB) 1.1 allows remote attackers to inject arbitrary web script or HTML via the Email field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this issue may overlap CVE-2006-5195.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38097; http://secunia.com/advisories/22783; http://osvdb.org/38097
CVE: CVE-2007-0871
Published: 2007-02-12
Description: Unrestricted file upload vulnerability in eXtremePow eXtreme File Hosting allows remote attackers to upload arbitrary PHP code via a filename with a double extension such as (1) .rar.php or (2) .zip.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33181; http://secunia.com/advisories/24088; http://securityreason.com/securityalert/2231
CVE: CVE-2007-0872
Published: 2007-02-12
Description: Directory traversal vulnerability in the Plain Old Webserver (POW) add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33174; http://seclists.org/fulldisclosure/2007/Feb/0196.html; http://seclists.org/fulldisclosure/2007/Feb/0210.html
CVE: CVE-2007-0873
Published: 2007-02-12
Description: nabopoll 1.1.2 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for (1) config_edit.php, (2) template_edit.php, or (3) survey_edit.php in admin/.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-February/001341.html; http://forums.avenir-geopolitique.net/viewtopic.php?t=2643; http://osvdb.org/33692
CVE: CVE-2007-0874
Published: 2007-02-12
Description: Allons_voter 1.0 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for (1) admin_ajouter.php or (2) admin_supprimer.php.  NOTE: this could be leveraged to conduct cross-site scripting (XSS) attacks.
CVSS Score: 6.8 (MEDIUM)
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2641; http://osvdb.org/33690; http://osvdb.org/33691
CVE: CVE-2007-0875
Published: 2007-02-12
Description: SQL injection vulnerability in install.php in mcRefer allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this issue has been disputed by a third party, stating that the file does not use a SQL database
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2642; http://osvdb.org/33675; http://securityreason.com/securityalert/2235
CVE: CVE-2007-0876
Published: 2007-02-12
Description: Cross-site scripting (XSS) vulnerability in Quick Digital Image Gallery (Qdig) 1.2.9.3 and devel-20060624 allows remote attackers to inject arbitrary web script or HTML via the Qwd parameter to the top-level URI.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/32194; http://secunia.com/advisories/24110; http://sourceforge.net/project/shownotes.php?group_id=69837&release_id=485558
CVE: CVE-2007-0877
Published: 2007-02-12
Description: Unspecified vulnerability in March Networks DVR 3000 and 4000 Digital Video Recorders allows attackers to cause an unspecified denial of service.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/38098; http://www.securityfocus.com/bid/22497; http://osvdb.org/38098
CVE: CVE-2007-0770
Published: 2007-02-12
Description: Buffer overflow in GraphicsMagick and ImageMagick allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c. NOTE: this issue is due to an incomplete patch for CVE-2006-5456.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/24167; http://secunia.com/advisories/24196; http://www.debian.org/security/2007/dsa-1260
CVE: CVE-2007-0878
Published: 2007-02-12
Description: Unspecified vulnerability in Microsoft Internet Explorer on Windows Mobile 5.0 allows remote attackers to cause a denial of service (loss of browser and other device functionality) via a malformed WML page, related to an "overflow state." NOTE: it is possible that this issue is related to CVE-2007-0685.
CVSS Score: 7.8 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052293.html; http://osvdb.org/32629; http://www.securityfocus.com/archive/1/459571/100/0/threaded
CVE: CVE-2007-0879
Published: 2007-02-12
Description: Buffer overflow in SmidgeonSoft PEBrowse Professional 8.2.1.0 allows user-assisted remote attackers to execute arbitrary code via certain executable files in PE format.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/38134; http://www.securityfocus.com/bid/22501; http://www.vupen.com/english/advisories/2007/0665
CVE: CVE-2007-0880
Published: 2007-02-12
Description: Capital Request Forms stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request for inc/common_db.inc.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33682; http://www.securityfocus.com/archive/1/459574/100/0/threaded; http://osvdb.org/33682
CVE: CVE-2007-0881
Published: 2007-02-12
Description: PHP remote file inclusion vulnerability in the Seitenschutz plugin for OPENi-CMS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the (1) config[oi_dir] and possibly (2) config[openi_dir] parameters to open-admin/plugins/site_protection/index.php.  NOTE: vector 2 might be the same as CVE-2006-4750.
CVSS Score: 6.8 (MEDIUM)
References: http://echo.or.id/adv/adv64-y3dips-2007.txt; http://osvdb.org/33175; http://secunia.com/advisories/24119
CVE: CVE-2007-0882
Published: 2007-02-12
Description: Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.
CVSS Score: 10.0 (HIGH)
CWE: CWE-88
References: http://erratasec.blogspot.com/2007/02/trivial-remote-solaris-0day-disable.html; http://isc.sans.org/diary.html?storyid=2220; http://osvdb.org/31881
CVE: CVE-2007-0883
Published: 2007-02-12
Description: Directory traversal vulnerability in portalgroups/portalgroups/getfile.cgi in IP3 NetAccess before firmware 4.1.9.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0235.html; http://osvdb.org/31912; http://secunia.com/advisories/24118
CVE: CVE-2007-0884
Published: 2007-02-12
Description: Buffer overflow in Roaring Penguin MIMEDefang 2.59 and 2.60 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.roaringpenguin.com/pipermail/mimedefang/2007-February/032011.html; http://osvdb.org/33171; http://secunia.com/advisories/24133
CVE: CVE-2007-0885
Published: 2007-02-12
Description: Cross-site scripting (XSS) vulnerability in jira/secure/BrowseProject.jspa in Rainbow with the Zen (Rainbow.Zen) extension allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33683; http://www.securityfocus.com/archive/1/459590/100/0/threaded; http://www.securityfocus.com/bid/22503
CVE: CVE-2006-7003
Published: 2007-02-12
Description: PHP remote file inclusion vulnerability in admin/index.php in Fusion Polls allows remote attackers to execute arbitrary PHP code via a URL in the xtrphome parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/437127/30/4380/threaded; http://www.securityfocus.com/archive/1/441493/30/4380/threaded; http://www.securityfocus.com/archive/1/437127/30/4380/threaded