deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0163
Published: 2007-01-10
Description: SecureKit Steganography 1.7.1 and 1.8 embeds password information in the carrier file, which allows remote attackers to bypass authentication requirements and decrypt embedded steganography by replacing the last 20 bytes of the JPEG image with alternate password information.
CVSS Score: 7.8 (HIGH)
References: http://homepage.mac.com/adonismac/Advisory/steg/steganography.html; http://osvdb.org/31244; http://secunia.com/advisories/23639
CVE: CVE-2007-0164
Published: 2007-01-10
Description: Camouflage 1.2.1 embeds password information in the carrier file, which allows remote attackers to bypass authentication requirements and decrypt embedded steganography by replacing certain bytes of the JPEG image with alternate password information.
CVSS Score: 7.8 (HIGH)
References: http://homepage.mac.com/adonismac/Advisory/steg/camouflage.html; http://osvdb.org/32651; http://secunia.com/advisories/23578
CVE: CVE-2007-0165
Published: 2007-01-10
Description: Unspecified vulnerability in libnsl in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (crash) via malformed RPC requests that trigger a crash in rpcbind.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/31576; http://secunia.com/advisories/23700; http://secunia.com/advisories/24056
CVE: CVE-2007-0167
Published: 2007-01-10
Description: Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to execute arbitrary PHP code via a URL in the INC parameter in (1) config_admin.php, (2) config_main.php, (3) config_member.php, and (4) mysql_config.php in config/; (5) admin.php and (6) index.php in admini/; (7) paypalipn/ipnprocess.php; (8) index.php and (9) registration.php in members/; and (10) ppcbannerclick.php and (11) ppcclick.php in main/.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2134; http://www.attrition.org/pipermail/vim/2007-January/001221.html; http://www.osvdb.org/33444
CVE: CVE-2007-0170
Published: 2007-01-11
Description: PHP remote file inclusion vulnerability in index.php in AllMyVisitors 0.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the AMV_serverpath parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35904; http://www.securityfocus.com/bid/21917; https://exchange.xforce.ibmcloud.com/vulnerabilities/31316
CVE: CVE-2007-0171
Published: 2007-01-11
Description: PHP remote file inclusion vulnerability in index.php in AllMyLinks 0.5.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AML_opensite parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35909; http://www.securityfocus.com/bid/21916; https://exchange.xforce.ibmcloud.com/vulnerabilities/31314
CVE: CVE-2007-0172
Published: 2007-01-11
Description: Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the AMG_serverpath parameter to (1) comments.php and (2) signin.php; and possibly via a URL in unspecified parameters to (3) include/submit.inc.php, (4) admin/index.php, (5) include/cm_submit.inc.php, and (6) index.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35915; http://osvdb.org/35916; http://osvdb.org/35917
CVE: CVE-2007-0173
Published: 2007-01-11
Description: Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enabled and magic_quotes is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35914; http://www.securityfocus.com/bid/21914; http://www.vupen.com/english/advisories/2007/0097
CVE: CVE-2007-0174
Published: 2007-01-11
Description: Multiple stack-based multiple buffer overflows in the BRWOSSRE2UC.dll ActiveX Control in Sina UC2006 and earlier allow remote attackers to execute arbitrary code via a long string in the (1) astrVerion parameter to the SendChatRoomOpt function or (2) the astrDownDir parameter to the SendDownLoadFile function.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0467&w=2; http://osvdb.org/32659; http://secunia.com/advisories/23638
CVE: CVE-2007-0175
Published: 2007-01-11
Description: Cross-site scripting (XSS) vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes in the redirect_to parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=410568; http://osvdb.org/32027; http://secunia.com/advisories/23656
CVE: CVE-2007-0176
Published: 2007-01-11
Description: Cross-site scripting (XSS) vulnerability in search/advanced_search.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/31248; http://secunia.com/advisories/23675; http://secunia.com/advisories/28598
CVE: CVE-2007-0177
Published: 2007-01-11
Description: Cross-site scripting (XSS) vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1.9.0rc2, when wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://osvdb.org/31525; http://secunia.com/advisories/23647; http://secunia.com/advisories/24889
CVE: CVE-2007-0178
Published: 2007-01-11
Description: PHP remote file inclusion vulnerability in info.php in Easy Banner Pro 2.8 allows remote attackers to execute arbitrary PHP code via a URL in the s[phppath] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33455; http://securityreason.com/securityalert/2132; http://www.securityfocus.com/archive/1/456404/100/0/threaded
CVE: CVE-2007-0179
Published: 2007-01-11
Description: SQL injection vulnerability in comment.php in PHPKIT 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via the subid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31266; http://securityreason.com/securityalert/2131; http://www.securityfocus.com/archive/1/456384/100/0/threaded
CVE: CVE-2007-0180
Published: 2007-01-11
Description: Stack-based buffer overflow in EF Commander 5.75 allows user-assisted attackers to execute arbitrary code via a crafted ISO file containing a file within several nested directories, which produces a large filename that triggers the overflow.
CVSS Score: 7.6 (HIGH)
References: http://osvdb.org/32660; http://secunia.com/advisories/23659; http://vuln.sg/efcommander575-en.html
CVE: CVE-2007-0181
Published: 2007-01-11
Description: PHP remote file inclusion vulnerability in include/common_function.php in magic photo storage website allows remote attackers to execute arbitrary PHP code via a URL in the _config[site_path] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23687; http://www.securityfocus.com/archive/1/456264/100/0/threaded; http://www.securityfocus.com/bid/21965
CVE: CVE-2007-0196
Published: 2007-01-11
Description: SQL injection vulnerability in admin_check_user.asp in Motionborg Web Real Estate 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (txtUserName parameter) and possibly other parameters.  NOTE: some details were obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/32718; http://secunia.com/advisories/23531; http://www.securityfocus.com/bid/21963
CVE: CVE-2007-0197
Published: 2007-01-11
Description: Finder 10.4.6 on Apple Mac OS X 10.4.8 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a long volume name in a DMG disk image, which results in memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-119, CWE-399
References: http://docs.info.apple.com/article.html?artnum=305102; http://lists.apple.com/archives/Security-announce/2007/Feb/msg00000.html; http://projects.info-pull.com/moab/MOAB-09-01-2007.html
CVE: CVE-2007-0198
Published: 2007-01-11
Description: The JTapi Gateway process in Cisco Unified Contact Center Enterprise, Unified Contact Center Hosted, IP Contact Center Enterprise, and Cisco IP Contact Center Hosted 5.0 through 7.1 allows remote attackers to cause a denial of service (repeated process restart) via a certain TCP session on the JTapi server port.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32682; http://secunia.com/advisories/23710; http://securitytracker.com/id?1017499
CVE: CVE-2007-0199
Published: 2007-01-11
Description: The Data-link Switching (DLSw) feature in Cisco IOS 11.0 through 12.4 allows remote attackers to cause a denial of service (device reload) via "an invalid value in a DLSw message... during the capabilities exchange."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32683; http://secunia.com/advisories/23697; http://securitytracker.com/id?1017498
CVE: CVE-2007-0200
Published: 2007-01-11
Description: PHP remote file inclusion vulnerability in template.php in Geoffrey Golliher Axiom Photo/News Gallery (axiompng) 0.8.6 allows remote attackers to execute arbitrary PHP code via a URL in the baseAxiomPath parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32716; http://secunia.com/advisories/23715; http://www.attrition.org/pipermail/vim/2007-January/001233.html
CVE: CVE-2007-0201
Published: 2007-01-11
Description: Buffer overflow in the cmd_usr function in ftp-gw in TIS Internet Firewall Toolkit (FWTK) allows remote attackers to execute arbitrary code via a long destination hostname (dest).
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35967; http://securitytracker.com/id?1017481; http://www.ranum.com/security/computer_security/editorials/codetools/
CVE: CVE-2007-0202
Published: 2007-01-11
Description: SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the lang parameter.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/20070107.txt; http://osvdb.org/31707; http://secunia.com/advisories/23637
CVE: CVE-2007-0203
Published: 2007-01-11
Description: Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/32666; http://secunia.com/advisories/23702; http://www.mandriva.com/security/advisories?name=MDKSA-2007:199
CVE: CVE-2007-0204
Published: 2007-01-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32667; http://secunia.com/advisories/23702; http://www.mandriva.com/security/advisories?name=MDKSA-2007:199
CVE: CVE-2007-0166
Published: 2007-01-11
Description: The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted, which allows local root users to overwrite arbitrary files, or mount/unmount files, outside of the jail via a symlink attack.
CVSS Score: 6.6 (MEDIUM)
References: http://osvdb.org/32726; http://secunia.com/advisories/23730; http://security.freebsd.org/advisories/FreeBSD-SA-07:01.jail.asc
CVE: CVE-2007-0168
Published: 2007-01-11
Description: The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allows remote attackers to execute arbitrary code via certain data in opnum 0xBF in an RPC request, which is directly executed.
CVSS Score: 7.5 (HIGH)
References: http://livesploit.com/advisories/LS-20061002.pdf; http://osvdb.org/31327; http://secunia.com/advisories/23648
CVE: CVE-2007-0169
Published: 2007-01-11
Description: Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allow remote attackers to execute arbitrary code via RPC requests with crafted data for opnums (1) 0x2F and (2) 0x75 in the (a) Message Engine RPC service, or opnum (3) 0xCF in the Tape Engine service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=467; http://osvdb.org/31327; http://secunia.com/advisories/23648
CVE: CVE-2007-0205
Published: 2007-01-11
Description: Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to create files in arbitrary directories via ".." sequences in the (1) aj_skin and (2) skin_edit parameters.  NOTE: this can be leveraged for file inclusion by creating a skin file in the lang directory, then referencing that file via the lang parameter to index.php, which passes a sanity check in livre_include.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://acid-root.new.fr/poc/20070107.txt; http://osvdb.org/31708; http://osvdb.org/31709
CVE: CVE-2006-6918
Published: 2007-01-11
Description: Unspecified vulnerability in the Admin login for Georgian discussion board (GeoBB) before 1.0 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/forum/forum.php?forum_id=642218; http://sourceforge.net/forum/forum.php?forum_id=642218
CVE: CVE-2006-6919
Published: 2007-01-11
Description: Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with an img tag containing the script followed by an extra trailing ">", which Sage modifies to close the img element before the malicious script.
CVSS Score: 6.8 (MEDIUM)
References: http://michaeldaw.org/md-hacks/rss-injection-in-sage-part-2/; http://secunia.com/advisories/22809; http://www.securityfocus.com/archive/1/452010/100/0/threaded
CVE: CVE-2006-6920
Published: 2007-01-11
Description: Cross-site scripting (XSS) vulnerability in Nucleus before 3.24 allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly involving (1) lib/ADMIN.php and (2) lib/SKIN.php.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/22843; http://securitytracker.com/id?1017220
CVE: CVE-2007-0206
Published: 2007-01-12
Description: Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, and 7.50 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/32729; http://securityreason.com/securityalert/2140; http://securitytracker.com/id?1017503
CVE: CVE-2007-0182
Published: 2007-01-12
Description: Multiple PHP remote file inclusion vulnerabilities in magic photo storage website allow remote attackers to execute arbitrary PHP code via a URL in the _config[site_path] parameter to (1) admin_password.php, (2) add_welcome_text.php, (3) admin_email.php, (4) add_templates.php, (5) admin_paypal_email.php, (6) approve_member.php, (7) delete_member.php, (8) index.php, (9) list_members.php, (10) membership_pricing.php, or (11) send_email.php in admin/; (12) config.php or (13) db_config.php in include/; or (14) add_category.php, (15) add_news.php, (16) change_catalog_template.php, (17) couple_milestone.php, (18) couple_profile.php, (19) delete_category.php, (20) index.php, (21) login.php, (22) logout.php, (23) register.php, (24) upload_photo.php, (25) user_catelog_password.php, (26) user_email.php, (27) user_extend.php, or (28) user_membership_password.php in user/.  NOTE: the include/common_function.php vector is already covered by another candidate from the same date.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2136; http://www.osvdb.org/32668; http://www.osvdb.org/33411
CVE: CVE-2007-0183
Published: 2007-01-12
Description: Cross-site scripting (XSS) vulnerability in /search in iPlanet Web Server 4.x allows remote attackers to inject arbitrary web script or HTML via the NS-max-records parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/32662; http://secunia.com/advisories/23605; http://www.securityfocus.com/bid/21977
CVE: CVE-2007-0184
Published: 2007-01-12
Description: Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.
CVSS Score: 7.5 (HIGH)
References: http://getahead.ltd.uk/dwr/changelog; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://osvdb.org/32657
CVE: CVE-2007-0185
Published: 2007-01-12
Description: Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unknown vectors related to a large number of calls in a batch.
CVSS Score: 5.0 (MEDIUM)
References: http://getahead.ltd.uk/dwr/changelog; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://osvdb.org/32658
CVE: CVE-2007-0186
Published: 2007-01-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an <FP_DO_NOT_TOUCH> element; and (13) the vhost parameter to my.activation.php.  NOTE: it is possible that this candidate overlaps CVE-2006-3550.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html; http://secunia.com/advisories/23627; http://secunia.com/advisories/23643
CVE: CVE-2007-0187
Published: 2007-01-12
Description: F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading slashes, (3) Unicode encoding, (4) URL-encoded directory traversal or same-directory characters, or (5) upper case letters in the domain name.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0141.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html; http://osvdb.org/39167
CVE: CVE-2007-0188
Published: 2007-01-12
Description: F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation of an IP address ("dotless IP address"), which allows remote authenticated users to connect to the FirePass administrator console and certain other network resources.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html; http://secunia.com/advisories/23640; http://www.mnin.org/advisories/2007_firepass.pdf
CVE: CVE-2007-0189
Published: 2007-01-12
Description: PHP remote file inclusion vulnerability in index.php in GeoBB Georgian Bulletin Board allows remote attackers to execute arbitrary PHP code via a URL in the action parameter.  NOTE: CVE disputes this issue, since GeoBB 1.0 sets $action to a whitelisted value
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33440; http://securityreason.com/securityalert/2141; http://www.attrition.org/pipermail/vim/2007-January/001230.html
CVE: CVE-2007-0190
Published: 2007-01-12
Description: PHP remote file inclusion vulnerability in edit_address.php in edit-x ecommerce allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2139; http://www.securityfocus.com/archive/1/456439/100/0/threaded; http://www.securityfocus.com/bid/21974
CVE: CVE-2007-0191
Published: 2007-01-12
Description: Cross-site scripting (XSS) vulnerability in admin.php in MKPortal allows remote attackers to inject arbitrary web script or HTML via two certain fields in a contents_new operation in the ad_contents section.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33399; http://securityreason.com/securityalert/2138; http://www.securityfocus.com/archive/1/456042/100/100/threaded
CVE: CVE-2007-0192
Published: 2007-01-12
Description: Cross-site request forgery (CSRF) vulnerability in the save_main operation in the ad_perms section in admin.php in MKPortal allows remote attackers to modify privilege settings, as demonstrated using a getURL of admin.php within a .swf file contained in an IFRAME element, aka the "All Guests are Admin" attack.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33400; http://securityreason.com/securityalert/2137; http://www.securityfocus.com/archive/1/455894/100/100/threaded
CVE: CVE-2007-0193
Published: 2007-01-12
Description: FON La Fonera routers do not properly limit DNS service access by unauthenticated clients, which allows remote attackers to tunnel traffic via DNS requests for hosts that should not be accessible before authentication.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33441; http://www.securityfocus.com/archive/1/456128/100/0/threaded; http://www.securityfocus.com/archive/1/456344/100/0/threaded
CVE: CVE-2007-0194
Published: 2007-01-12
Description: admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MK_PATH=1 query string, which reveals the path in an error message.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33407; http://www.securityfocus.com/archive/1/456257/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31333
CVE: CVE-2007-0195
Published: 2007-01-12
Description: my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html; http://secunia.com/advisories/23627; http://www.mnin.org/advisories/2007_firepass.pdf
CVE: CVE-2006-6921
Published: 2007-01-12
Description: Unspecified versions of the Linux kernel allow local users to cause a denial of service (unrecoverable zombie process) via a program with certain instructions that prevent init from properly reaping a child whose parent has died.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/27436; http://secunia.com/advisories/27747; http://secunia.com/advisories/29236
CVE: CVE-2006-6922
Published: 2007-01-13
Description: SQL injection vulnerability in Deadlock User Management System (phpdeadlock) 0.64 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36588; http://sourceforge.net/project/shownotes.php?release_id=474782&group_id=171803; http://www.securityfocus.com/bid/22023
CVE: CVE-2006-6923
Published: 2007-01-13
Description: SQL injection vulnerability in newsletters/edition.php in bitweaver 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the tk parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-11/0142.html; http://securityreason.com/securityalert/2144; http://www.securityfocus.com/bid/20988