deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0266
Published: 2007-01-16
Description: SQL injection vulnerability in boxx/ShowAppendix.asp in Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the iid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32825; http://osvdb.org/33466; http://secunia.com/advisories/23759
CVE: CVE-2006-6936
Published: 2007-01-17
Description: Cross-site scripting (XSS) vulnerability in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary HTML or web script via (1) the catname parameter to displaypic.asp or (2) the search field. NOTE: vector 1 likely overlaps CVE-2006-3032.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2148; http://www.securityfocus.com/archive/1/451786/100/0/threaded; http://www.securityfocus.com/bid/21138
CVE: CVE-2006-6937
Published: 2007-01-17
Description: SQL injection vulnerability in displaypic.asp in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary SQL commands via the sortorder parameter.
CVSS Score: 7.5 (HIGH)
References: http://aria-security.net/advisory/xtremeg.txt; http://securityreason.com/securityalert/2148; http://www.osvdb.org/31507
CVE: CVE-2006-6938
Published: 2007-01-17
Description: Directory traversal vulnerability in includes/common.php in NitroTech 0.0.3a, as distributed before 2006, allows remote attackers to include arbitrary files via ".." sequences in the root parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/20810; https://exchange.xforce.ibmcloud.com/vulnerabilities/29904; https://www.exploit-db.com/exploits/2685
CVE: CVE-2006-6939
Published: 2007-01-17
Description: GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
CVSS Score: 4.6 (MEDIUM)
References: http://fedoranews.org/cms/node/2449; http://fedoranews.org/cms/node/2450; http://freshmeat.net/projects/ed/?branch_id=17855&release_id=240890
CVE: CVE-2007-0014
Published: 2007-01-17
Description: ChainKey Java Code Protection allows attackers to decompile Java class files via a Java class loader with a modified defineClass method that saves the bytecode to a file before it is passed to the JVM.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-310
References: http://osvdb.org/33473; http://www.securityfocus.com/archive/1/456712/100/0/threaded; http://www.securityfocus.com/archive/1/456734/100/0/threaded
CVE: CVE-2007-0234
Published: 2007-01-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-0243.  Reason: This candidate is a duplicate of CVE-2007-0243.  Notes: All CVE users should reference CVE-2007-0243 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-0267
Published: 2007-01-17
Description: The ufs_lookup function in the Mac OS X 10.4.8 and FreeBSD 6.1 kernels allows local users to cause a denial of service (kernel panic) and possibly corrupt other filesystems by mounting a crafted UNIX File System (UFS) DMG image that contains a corrupted directory entry (struct direct), related to the ufs_dirbad function.  NOTE: a third party states that the FreeBSD issue does not cross privilege boundaries.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-399
References: http://docs.info.apple.com/article.html?artnum=305214; http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html; http://lists.freebsd.org/pipermail/freebsd-security/2007-January/004218.html
CVE: CVE-2007-0222
Published: 2007-01-17
Description: Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to read arbitrary files via unknown vectors, probably "\.." sequences in the beanId parameter.  NOTE: this is likely a duplicate of another CVE that Oracle addressed in CPU Jan 2007, but due to lack of details by Oracle, it is unclear which BugID this issue is associated with, so the other CVE cannot be determined.  Possibilities include EM02 (CVE-2007-0292) or EM05 (CVE-2007-0293).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522; http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html
CVE: CVE-2007-0268
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unknown impact and attack vectors related to (1) the Advanced Queuing component and sys.dbms_aqsys.dbms_aq privileges (DB01), (2) Advanced Replication and sys.dbms_repcat_untrusted (DB07), and (3) Oracle Text and ctxload (DB15).  NOTE: Oracle has not publicly claims by reliable researchers that DB01 is for SQL injection in the SYS.DBMS_AQ_INV package, and DB07 is for a buffer overflow in the UNREGISTER_SNAPSHOT procedure in the DBMS_REPCAT_UNTRUSTED package.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/32907; http://osvdb.org/32913; http://osvdb.org/32921
CVE: CVE-2007-0269
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and attack vectors related to the Change Data Capture and sys.dbms_cdc_subscribe privileges, aka DB02.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/32908; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0270
Published: 2007-01-17
Description: Buffer overflow in SYS.DBMS_DRS in Oracle Database 9.2.0.7 and 10.1.0.4 allows remote authenticated users to cause a denial of service (crash) or execute arbitrary code via the GET_PROPERTY function in SYS.DBMS_DRS, aka DB03.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/32909; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0271
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle Database 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors related to the Log Miner component and sys.dbms_log_mnr privileges, aka DB04.  NOTE: Oracle has not disputed a reliable researcher claim that this is a buffer overflow in the ADD_LOGFILE procedure for the SYS.DBMS_LOGMNR package that allows code execution.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/32910; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0272
Published: 2007-01-17
Description: Multiple buffer overflows in MDSYS.MD in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 allows remote authenticated users to cause a denial of service (crash) or execute arbitrary code via unspecified vectors involving certain public procedures, aka DB05.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/32911; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0273
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and attack vectors related to XMLDB, aka DB06.  NOTE: as of 20070123, Oracle has not disputed claims by a reliable researcher that DB06 is for multiple cross-site scripting (XSS) vulnerabilities.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/32912; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0274
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle Database 9.2.0.7 and 10.1.0.5 have unknown impact and attack vectors related to (1) Export and sys.dbms_logrep_util (DB08), and (2) Oracle Streams and sys.dbms_capture_adm_internal privileges (DB09).  NOTE: Oracle has not disputed reliable researcher claims that DB08 is for a buffer overflow in the GET_OBJECT_NAME procedure in the DBMS_LOGREP_UTIL package, and DB09 is for buffer overflows in the CREATE_CAPTURE, ALTER_CAPTURE, and ABORT_TABLE_INSTANTIATION procedures in SYS.DBMS_CAPTURE_ADM_INTERNAL.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/32914; http://osvdb.org/32915; http://secunia.com/advisories/23794
CVE: CVE-2007-0275
Published: 2007-01-17
Description: Cross-site scripting (XSS) vulnerability in Oracle Reports Web Cartridge (RWCGI60) in the Workflow Cartridge component, as used in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 10.1.2; and Oracle E-Business Suite and Applications 11.5.10CU2; allows remote authenticated users to inject arbitrary HTML or web script via the genuser parameter to rwcgi60, aka OWF01.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/32906; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0276
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle Database 8.1.7.4 and 9.0.1.5 have unknown impact and attack vectors related to (1) Advanced Security Option and oklist or okdstry (DB10), (2) Oracle Net Services (DB13), and (3) Recovery Manager and oklist (DB16).
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32916; http://osvdb.org/32919; http://osvdb.org/32922
CVE: CVE-2007-0277
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle Database client-only 10.1.0.4 has unknown impact and attack vectors related to the Export component and expdp or impdp, aka DB11.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32917; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0278
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unknown impact and attack vectors related to (1) NLS Runtime and lmsgen (DB12), and (2) Oracle Text and ctxkbtc (DB14).
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32918; http://osvdb.org/32920; http://secunia.com/advisories/23794
CVE: CVE-2007-0279
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle HTTP Server 9.2.0.8 and Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, aka (1) OHS01, (2) OHS02, (3) OHS05, (4) OHS06, and (5) OHS07.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32881; http://osvdb.org/32882; http://osvdb.org/32885
CVE: CVE-2007-0280
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle HTTP Server 9.0.1.5, Application Server 9.0.4.3, 10.1.2.0.0, 10.1.2.0.2, and 10.1.2.2; and Collaboration Suite 9.0.4.2 and 10.1.2; has unknown impact and attack vectors related to the Oracle Process Mgmt & Notification component, aka OPMN01.   NOTE: as of 20070123, Oracle has not disputed claims by a reliable researcher that OPMN01 is for a buffer overflow in Oracle Notification Service (ONS).
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32905; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0281
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle HTTP Server 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.0, 10.1.2.0.1, 10.1.2.0.2, 10.1.2.1, and 10.1.3.0; and Collaboration Suite 9.0.4.2 and 10.1.2; have unknown impact and attack vectors related to the Oracle HTTP Server, aka (1) OHS03 and (2) OHS04.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32883; http://osvdb.org/32884; http://secunia.com/advisories/23794
CVE: CVE-2007-0282
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle HTTP Server 9.0.1.5, Application Server 9.0.4.2 and 10.1.2.0.0, and Collaboration Suite 9.0.4.2 has unknown impact and attack vectors related to the Oracle Process Mgmt & Notification component, aka OPMN02.
CVSS Score: 3.2 (LOW)
References: http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522; http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html
CVE: CVE-2007-0283
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle Application Server 9.0.4.3 and Collaboration Suite 9.0.4.2 has unknown impact and attack vectors related to Oracle Containers for J2EE, aka OC4J02.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/32896; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0284
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle Application Server 9.0.4.3 and 10.1.2.0.0, and Collaboration Suite 9.0.4.2, have unknown impact and attack vectors related to Oracle Containers for J2EE, aka (1) OC4J03 and (2) OC4J04.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/32897; http://osvdb.org/32898; http://secunia.com/advisories/23794
CVE: CVE-2007-0285
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 9.0.4.2 and 10.1.2; and E-Business Suite and Applications 11.5.10CU2 has unknown impact and attack vectors related to Oracle Reports Developer, aka REP01.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32894; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0286
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle Application Server 10.1.2.0.2 and 10.1.3.0, and Collaboration Suite 10.1.2, has unknown impact and attack vectors related to Containers for J2EE, aka OC4J07.
CVSS Score: 2.6 (LOW)
References: http://osvdb.org/32901; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0287
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle Application Server 9.0.4.3, 10.1.2.0.0, and 10.1.2.0.2; and Collaboration Suite 9.0.4.2 and 10.1.2; has unknown impact and attack vectors related to Containers for J2EE, aka OC4J08.
CVSS Score: 1.7 (LOW)
References: http://osvdb.org/32902; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0288
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle Application Server 10.1.4.0 has unknown impact and attack vectors related to Oracle Internet Directory, aka OID01.
CVSS Score: 1.7 (LOW)
References: http://osvdb.org/32903; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0289
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle Collaboration Suite 9.0.4.2 have unknown impact and attack vectors related to Oracle Containers for J2EE, aka (1) OC4J01, (2) OC4J05, and (3) OC4J06.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/32895; http://osvdb.org/32899; http://osvdb.org/32900
CVE: CVE-2007-0290
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors related to (1) Application Object Library (APPS01), (2) Human Resources (APPS03), (3) Payables (APPS04), (4) Trading Community Architecture (APPS05), and (5) Web Applications Desktop Integrator (APPS06).
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/32888; http://osvdb.org/32890; http://osvdb.org/32891
CVE: CVE-2007-0291
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle E-Business Suite and Applications 6.2.3 has unknown impact and attack vectors related to Oracle Exchange, aka APPS02.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/32889; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0292
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle Enterprise Manager 10.1.0.5 have unknown impact and attack vectors related to Oracle Agent, aka (1) EM01 and (2) EM02.  NOTE: EM05 might be related to CVE-2007-0222.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32875; http://osvdb.org/32876; http://secunia.com/advisories/23794
CVE: CVE-2007-0293
Published: 2007-01-17
Description: Multiple unspecified vulnerabilities in Oracle Enterprise Manager 10.1.0.5 and 10.2.0.1 have unknown impact and attack vectors related to (1) Oracle Agent (EM03) and (2) EM04 and (3) EM05 in Enterprise Manager Console.  NOTE: EM05 might be related to CVE-2007-0222.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/32877; http://osvdb.org/32878; http://osvdb.org/32879
CVE: CVE-2007-0294
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle Enterprise Manager 10.2.0.1 has unknown impact and attack vectors related to Database Cloning & Data Guard Management, aka EM06.
CVSS Score: 1.7 (LOW)
References: http://osvdb.org/32880; http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522
CVE: CVE-2007-0295
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.22.13 and 8.47.11 has unknown impact and attack vectors in PeopleTools, aka PSE01.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522; http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html
CVE: CVE-2007-0296
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.22.13, 8.47.11, and 8.48.06 has unknown impact and attack vectors in PeopleTools, aka PSE02.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522; http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html
CVE: CVE-2007-0297
Published: 2007-01-17
Description: Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.47.11 and 8.48.06 has unknown impact and attack vectors in PeopleTools, aka PSE03.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/23794; http://securitytracker.com/id?1017522; http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html
CVE: CVE-2006-6940
Published: 2007-01-17
Description: Buffer overflow in the ParseHeader function in clsOWA.cls in POP3/SMTP to OWA (pop2owa) 1.1.3 allows remote attackers to execute arbitrary code via a long header in an e-mail message.
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=473941&group_id=152204; http://sourceforge.net/tracker/index.php?func=detail&aid=1621688&group_id=152204&atid=783596; http://www.vupen.com/english/advisories/2007/0160
CVE: CVE-2007-0298
Published: 2007-01-17
Description: PHP remote file inclusion vulnerability in show.php in LunarPoll, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the PollDir parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://attrition.org/pipermail/vim/2007-January/001236.html; http://osvdb.org/31639; http://secunia.com/advisories/23760
CVE: CVE-2007-0299
Published: 2007-01-17
Description: Integer overflow in the byte_swap_sbin function in bsd/ufs/ufs/ufs_byte_order.c in Mac OS X 10.4.8 allows user-assisted remote attackers to cause a denial of service (kernel panic) by mounting a crafted Unix File System (UFS) DMG image, which triggers an invalid pointer dereference.
CVSS Score: 7.1 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305214; http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html; http://projects.info-pull.com/moab/MOAB-11-01-2007.html
CVE: CVE-2007-0243
Published: 2007-01-17
Description: Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://dev2dev.bea.com/pub/advisory/242; http://docs.info.apple.com/article.html?artnum=307177; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00876579
CVE: CVE-2007-0300
Published: 2007-01-18
Description: PHP remote file inclusion vulnerability in i-accueil.php in TLM CMS 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://attrition.org/pipermail/vim/2007-January/001238.html; http://osvdb.org/32814; http://secunia.com/advisories/23722
CVE: CVE-2007-0301
Published: 2007-01-18
Description: PHP remote file inclusion vulnerability in _admin/admin_menu.php in FdWeB Espace Membre 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32824; http://secunia.com/advisories/23743; http://www.securityfocus.com/bid/22040
CVE: CVE-2007-0302
Published: 2007-01-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to (a) Logon.aspx, and the (2) Username and (3) Update parameters to (b) Members1.aspx.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32852; http://osvdb.org/32853; http://secunia.com/advisories/23787
CVE: CVE-2007-0303
Published: 2007-01-18
Description: Multiple unspecified vulnerabilities in Zina 1.0rc1 and earlier have unknown impact and attack vectors related to "Potential security bugs."
CVSS Score: 10.0 (HIGH)
References: http://www.pancake.org/zina-changelog-12; http://www.securityfocus.com/bid/22049; http://www.vupen.com/english/advisories/2007/0181
CVE: CVE-2007-0304
Published: 2007-01-18
Description: SQL injection vulnerability in duyuru.asp in MiNT Haber Sistemi 2.7 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32820; http://secunia.com/advisories/23756; http://www.vupen.com/english/advisories/2007/0175
CVE: CVE-2007-0305
Published: 2007-01-18
Description: SQL injection vulnerability in etkinlikbak.asp in Okul Web Otomasyon Sistemi 4.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32819; http://secunia.com/advisories/23755; http://securityreason.com/securityalert/2151
CVE: CVE-2007-0306
Published: 2007-01-18
Description: SQL injection vulnerability in visu_user.asp in Digiappz DigiAffiliate 1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32818; http://secunia.com/advisories/23744; http://www.securityfocus.com/bid/22039
CVE: CVE-2007-0307
Published: 2007-01-18
Description: PHP remote file inclusion vulnerability in include/common.php in Poplar Gedcom Viewer 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the env[rootPath] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32807; http://secunia.com/advisories/23761; http://www.securityfocus.com/bid/22038
CVE: CVE-2007-0308
Published: 2007-01-18
Description: Cross-site scripting (XSS) vulnerability in Plain Black WebGUI before 7.3.4 (beta) allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32813; http://secunia.com/advisories/23718; http://www.plainblack.com/getwebgui/advisories/webgui-7_3_4-beta-released#BUeIjcWiQasypsJxD-YwgQ
CVE: CVE-2007-0309
Published: 2007-01-18
Description: SQL injection vulnerability in blocks/block-Old_Articles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32863; http://secunia.com/advisories/23748; http://securityreason.com/securityalert/2153
CVE: CVE-2007-0310
Published: 2007-01-18
Description: BMC Remedy Action Request System 5.01.02 Patch 1267 generates different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to determine valid account names.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/31658; http://secunia.com/advisories/23775; http://securityreason.com/securityalert/2162