deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-5554
Published: 2007-10-18
Description: Oracle allows remote attackers to obtain server memory contents via crafted packets, aka Oracle reference number 7892711.  NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://www.irmplc.com/index.php/111-Vendor-Alerts; http://www.irmplc.com/index.php/111-Vendor-Alerts
CVE: CVE-2007-5555
Published: 2007-10-18
Description: Unspecified vulnerability in Symantec Altiris Deployment Solution allows attackers to obtain authentication credentials via unknown vectors, aka "Authentication Credentials Information Leakage in Altiris Deployment Solution."  NOTE: this description is based on a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-200
References: http://www.irmplc.com/index.php/111-Vendor-Alerts; http://www.irmplc.com/index.php/111-Vendor-Alerts
CVE: CVE-2007-5556
Published: 2007-10-18
Description: Unspecified vulnerability in the Avaya VoIP Handset allows remote attackers to cause a denial of service (reboot) via crafted packets. NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.irmplc.com/index.php/111-Vendor-Alerts; http://www.irmplc.com/index.php/111-Vendor-Alerts
CVE: CVE-2007-5557
Published: 2007-10-18
Description: Unspecified vulnerability in the NEC mobile handset allows remote attackers to cause a denial of service (reboot) via crafted packets. NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.irmplc.com/index.php/111-Vendor-Alerts; http://www.irmplc.com/index.php/111-Vendor-Alerts
CVE: CVE-2007-5558
Published: 2007-10-18
Description: Integer overflow in the LG Mobile handset allows remote attackers to cause a denial of service (reboot) via a crafted HTTP packet.  NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://www.irmplc.com/index.php/111-Vendor-Alerts; http://www.irmplc.com/index.php/111-Vendor-Alerts
CVE: CVE-2007-5559
Published: 2007-10-18
Description: Heap-based buffer overflow in the IBM ThinkVantage TPM Service allows remote attackers to execute arbitrary code via a crafted HTTP packet. NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.irmplc.com/index.php/111-Vendor-Alerts; http://www.irmplc.com/index.php/111-Vendor-Alerts
CVE: CVE-2007-5560
Published: 2007-10-18
Description: Heap-based buffer overflow in the Juniper HTTP Service allows remote attackers to execute arbitrary code via a crafted HTTP packet.  NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.irmplc.com/index.php/111-Vendor-Alerts; http://www.irmplc.com/index.php/111-Vendor-Alerts
CVE: CVE-2007-5561
Published: 2007-10-18
Description: Format string vulnerability in the logging function in the Oracle OPMN daemon, as used on Oracle Enterprise Grid Console server 10.2.0.1, allows remote attackers to execute arbitrary code via format string specifiers in the URI in an HTTP request to port 6003, aka Oracle reference number 6296175.  NOTE: this might be the same issue as CVE-2007-0282 or CVE-2007-0280, but there are insufficient details to be sure.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://www.irmplc.com/index.php/111-Vendor-Alerts; http://www.irmplc.com/index.php/142-Advisory-021; http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html
CVE: CVE-2007-5562
Published: 2007-10-18
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/welcome (aka the login page) in Netgear SSL312 PROSAFE SSL VPN-Concentrator 25 allows remote attackers to inject arbitrary web script or HTML via the err parameter in the context of an error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-10/0358.html; http://secunia.com/advisories/27238; http://securitytracker.com/id?1018817
CVE: CVE-2007-5563
Published: 2007-10-18
Description: Unspecified vulnerability in VirtueMart before 1.0.13 allows remote attackers to execute arbitrary PHP code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/41758; http://secunia.com/advisories/27250; http://virtuemart.net/index.php?option=com_content&task=view&id=260&Itemid=57
CVE: CVE-2007-5564
Published: 2007-10-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in NSSboard (formerly Simple PHP Forum) 6.1 allow remote attackers to inject arbitrary web script or HTML via (1) HTML tags when BBcode is disabled; or the (2) user, (3) email, or (4) Real Name fields in a profile.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://securityreason.com/securityalert/3246; http://www.securityfocus.com/archive/1/482312/100/0/threaded; http://www.securityfocus.com/bid/26081
CVE: CVE-2007-5565
Published: 2007-10-18
Description: PHP remote file inclusion vulnerability in includes/functions.php in phpSCMS 0.0.1-Alpha1 allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter.  NOTE: this issue is disputed by CVE because the identified code is in a function that is not accessible via direct request
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://arfis.wordpress.com/2007/09/13/rfi-02-phpscms/; http://arfis.wordpress.com/2007/09/13/rfi-02-phpscms/
CVE: CVE-2007-5566
Published: 2007-10-18
Description: Multiple PHP remote file inclusion vulnerabilities in PHPBlog 0.1 Alpha allow remote attackers to execute arbitrary PHP code via a URL in the blog_localpath parameter to (1) includes/functions.php or (2) includes/email.php.  NOTE: this issue is disputed by CVE because the identified code is in functions that are not accessible via direct request
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/13/rfi-02-phpblog/; http://osvdb.org/39392; http://arfis.wordpress.com/2007/09/13/rfi-02-phpblog/
CVE: CVE-2007-5567
Published: 2007-10-18
Description: PHP remote file inclusion vulnerability in _lib/fckeditor/upload_config.php in Galmeta Post 0.11 allows remote attackers to execute arbitrary PHP code via a URL in the DDS parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/13/rfi-02-galmeta-post/; http://www.attrition.org/pipermail/vim/2007-October/001836.html; http://www.securityfocus.com/bid/26329
CVE: CVE-2007-5568
Published: 2007-10-18
Description: Cisco PIX and ASA appliances with 7.0 through 8.0 software, and Cisco Firewall Services Module (FWSM) 3.1(5) and earlier, allow remote attackers to cause a denial of service (device reload) via a crafted MGCP packet, aka CSCsi90468 (appliance) and CSCsi00694 (FWSM).
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/27193; http://secunia.com/advisories/27236; http://www.cisco.com/en/US/products/products_security_advisory09186a00808dda56.shtml
CVE: CVE-2007-5569
Published: 2007-10-18
Description: Cisco PIX and ASA appliances with 7.1 and 7.2 software, when configured for TLS sessions to the device, allow remote attackers to cause a denial of service (device reload) via a crafted TLS packet, aka CSCsg43276 and CSCsh97120.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/27193; http://www.cisco.com/en/US/products/products_security_advisory09186a00808dda56.shtml; http://www.securityfocus.com/bid/26104
CVE: CVE-2007-5570
Published: 2007-10-18
Description: Cisco Firewall Services Module (FWSM) 3.2(1), and 3.1(5) and earlier, allows remote attackers to cause a denial of service (device reload) via a crafted HTTPS request, aka CSCsi77844.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/27236; http://www.cisco.com/en/US/products/products_security_advisory09186a00808dda61.shtml; http://www.securityfocus.com/bid/26109
CVE: CVE-2007-5571
Published: 2007-10-18
Description: Cisco Firewall Services Module (FWSM) 3.1(6), and 3.2(2) and earlier, does not properly enforce edited ACLs, which might allow remote attackers to bypass intended restrictions on network traffic, aka CSCsj52536.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/27236; http://www.cisco.com/en/US/products/products_security_advisory09186a00808dda61.shtml; http://www.securityfocus.com/bid/26109
CVE: CVE-2007-5572
Published: 2007-10-18
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Blog (SPHPBlog) 0.4.9 allow remote attackers to perform delete actions as administrators via (1) the block_id parameter to add_block.php or (2) the link_id parameter to add_link.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://hackish.altervista.org/forum/viewtopic.php?t=221; http://secunia.com/advisories/27264; http://www.securityfocus.com/archive/1/482422/100/0/threaded
CVE: CVE-2007-5573
Published: 2007-10-18
Description: PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/27288; http://www.securityfocus.com/bid/26110; https://exchange.xforce.ibmcloud.com/vulnerabilities/37270
CVE: CVE-2007-5574
Published: 2007-10-18
Description: PHP remote file inclusion vulnerability in djpage.php in PHPDJ 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/26112; https://exchange.xforce.ibmcloud.com/vulnerabilities/37262; https://www.exploit-db.com/exploits/4543
CVE: CVE-2007-5575
Published: 2007-10-18
Description: Cross-site request forgery (CSRF) vulnerability in 1024 CMS 1.2.5 allows remote attackers to perform some actions as administrators, as demonstrated by (1) an unspecified action that creates a file containing PHP code and (2) unspecified use of the forum component. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/27259; https://exchange.xforce.ibmcloud.com/vulnerabilities/37267; http://secunia.com/advisories/27259
CVE: CVE-2007-5576
Published: 2007-10-18
Description: BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://dev2dev.bea.com/pub/advisory/226; http://osvdb.org/45478; http://www.vupen.com/english/advisories/2007/1813
CVE: CVE-2007-5577
Published: 2007-10-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.13 (aka Sunglow) allow remote attackers to inject arbitrary web script or HTML via the (1) Title or (2) Section Name form fields in the Section Manager component, or (3) multiple unspecified fields in New Menu Item.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=5654; http://osvdb.org/37173; http://secunia.com/advisories/25804
CVE: CVE-2007-5578
Published: 2007-10-18
Description: Basic Analysis and Security Engine (BASE) before 1.3.8 sends a redirect to the web browser but does not exit, which allows remote attackers to bypass authentication via (1) base_main.php, (2) base_qry_alert.php, and possibly other vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0031.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063767.html; http://secunia.com/advisories/25518
CVE: CVE-2007-5579
Published: 2007-10-18
Description: login.php in Pligg CMS 9.5 uses a guessable confirmation code when resetting a forgotten password, which allows remote attackers with knowledge of a username to reset that user's password by calculating the confirmationcode parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2007-05/0383.html; http://osvdb.org/42031; http://www.securityfocus.com/bid/24158
CVE: CVE-2007-5585
Published: 2007-10-19
Description: xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras (GL extras) installed, crashes when /usr/bin/xscreensaver-gl-helper does not exist and a user attempts to unlock the screen, which allows attackers with physical access to gain access to the locked session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/27392; http://www.securityfocus.com/bid/26204; https://bugzilla.redhat.com/show_bug.cgi?id=336331
CVE: CVE-2007-5586
Published: 2007-10-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-5587.  Reason: This candidate is a duplicate of CVE-2007-5587.  Notes: All CVE users should reference CVE-2007-5587 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-5587
Published: 2007-10-19
Description: Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argument to a METHOD_NEITHER IOCTL, as originally discovered in the wild.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119, CWE-264
References: http://blog.48bits.com/?p=172; http://osvdb.org/41429; http://secunia.com/advisories/27285
CVE: CVE-2007-5379
Published: 2007-10-19
Description: Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://bugs.gentoo.org/show_bug.cgi?id=195315; http://dev.rubyonrails.org/ticket/8453; http://docs.info.apple.com/article.html?artnum=307179
CVE: CVE-2007-5380
Published: 2007-10-19
Description: Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=195315; http://docs.info.apple.com/article.html?artnum=307179; http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
CVE: CVE-2007-5588
Published: 2007-10-19
Description: Cross-site scripting (XSS) vulnerability in mnoGoSearch before 3.2.43 allows remote attackers to inject arbitrary web script or HTML via the t parameter in search.cgi, as reachable from search.htm-dist.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37929; http://secunia.com/advisories/27263; http://www.mnogosearch.org/doc/msearch-changelog.html
CVE: CVE-2007-5589
Published: 2007-10-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. NOTE: there might also be other vectors related to (3) REQUEST_URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html; http://osvdb.org/37939; http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10796&r2=10795&pathrev=10796
CVE: CVE-2007-5590
Published: 2007-10-19
Description: Multiple buffer overflows in Miranda before 0.7.1 allow remote attackers to execute arbitrary code via unspecified vectors involving (1) IRC options, (2) Jabber forms, and unspecified aspects of the (3) ICQ and (4) Yahoo! instant messaging functionality.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/41804; http://osvdb.org/41805; http://osvdb.org/41806
CVE: CVE-2007-5591
Published: 2007-10-19
Description: The CS1000 signaling server in Nortel Enterprise VoIP-Core-CS 1000M Chassis/Cabinet, Enterprise VoIP-Core-CS 1000E and 1000S, Meridian-Core-Option 11C Chassis and Cabinet, and Meridian-Core-Option 51C, 61C, and 81C allows remote attackers to cause a denial of service (telephony application outage) via a flood of packets to Embedded LAN (ELAN) ports.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/41799; http://secunia.com/advisories/27282; http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=655204
CVE: CVE-2007-5592
Published: 2007-10-19
Description: Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the Setting[OPT_includepath] parameter to (1) adminhelp.php; and (2) admin.incl.php, (3) reg.incl.php, (4) help.incl.php, (5) gbook.incl.php, and (6) core/core.incl.php in modules/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/26116; http://www.vupen.com/english/advisories/2007/3569; https://exchange.xforce.ibmcloud.com/vulnerabilities/37272
CVE: CVE-2007-5593
Published: 2007-10-19
Description: install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://drupal.org/files/sa-2007-025/SA-2007-025-5.2.patch; http://drupal.org/node/184316; http://osvdb.org/39648
CVE: CVE-2007-5594
Published: 2007-10-19
Description: Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/184348; http://secunia.com/advisories/27290; http://secunia.com/advisories/27352
CVE: CVE-2007-5595
Published: 2007-10-19
Description: CRLF injection vulnerability in the drupal_goto function in includes/common.inc Drupal 4.7.x before 4.7.8 and 5.x before 5.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-113
References: http://drupal.org/node/184315; http://secunia.com/advisories/27292; http://secunia.com/advisories/27352
CVE: CVE-2007-5596
Published: 2007-10-19
Description: The core Upload module in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 places the .html extension on a whitelist, which allows remote attackers to conduct cross-site scripting (XSS) attacks by uploading .html files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/184320; http://secunia.com/advisories/27292; http://secunia.com/advisories/27352
CVE: CVE-2007-5597
Published: 2007-10-19
Description: The hook_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypass access restrictions and trigger e-mail with unpublished comments from some modules, as demonstrated by (1) Organic groups and (2) Subscriptions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/184354; http://secunia.com/advisories/27292; http://secunia.com/advisories/27352
CVE: CVE-2007-5598
Published: 2007-10-19
Description: Cross-site scripting (XSS) vulnerability in Weblinks for Drupal 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/184323; http://osvdb.org/37904; http://secunia.com/advisories/27289
CVE: CVE-2007-5599
Published: 2007-10-19
Description: Multiple PHP remote file inclusion vulnerabilities in awrate 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to (1) 404.php or (2) topbar.php, different vectors than CVE-2006-6368.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://arfis.wordpress.com/2007/09/13/rfi-02-awratecom-message-board/; http://osvdb.org/45528; http://osvdb.org/45529
CVE: CVE-2007-5600
Published: 2007-10-19
Description: Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftps, (3) ssh2.sftp, or (4) ssh2.scp URL, in the page parameter, for which PHP remote file inclusion is blocked only for http, https, and ftp URLs.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://www.exploit-db.com/exploits/4538; https://www.exploit-db.com/exploits/4538
CVE: CVE-2007-5601
Published: 2007-10-20
Description: Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain playlist names, as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27248; http://service.real.com/realplayer/security/191007_player/en/; http://www.infosecblog.org/2007/10/nasa-bans-ie.html
CVE: CVE-2007-5339
Published: 2007-10-21
Description: Multiple vulnerabilities in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption or assert errors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=196481; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579
CVE: CVE-2007-5340
Published: 2007-10-21
Description: Multiple vulnerabilities in the Javascript engine in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=196481; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579