deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1382
Published: 2007-03-10
Description: The PHP COM extensions for PHP on Windows systems allow context-dependent attackers to execute arbitrary code via a WScript.Shell COM object, as demonstrated by using the Run method of this object to execute cmd.exe, which bypasses PHP's safe mode.
CVSS Score: 6.8 (MEDIUM)
References: https://www.exploit-db.com/exploits/3429; https://www.exploit-db.com/exploits/3429
CVE: CVE-2007-1383
Published: 2007-03-10
Description: Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this counter, which causes the same variable to be destroyed twice, a related issue to CVE-2007-1286.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-189, CWE-190
References: http://secunia.com/advisories/24606; http://secunia.com/advisories/25056; http://security.gentoo.org/glsa/glsa-200703-21.xml
CVE: CVE-2007-1384
Published: 2007-03-10
Description: Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.2 allows remote attackers to overwrite arbitrary files via ".." sequences in a torrent filename.
CVSS Score: 6.4 (MEDIUM)
References: http://ktorrent.org/forum/viewtopic.php?t=1401; http://lists.kde.org/?l=kde-announce&m=[PII_REDACTED]1140&w=2; http://secunia.com/advisories/24459
CVE: CVE-2007-1385
Published: 2007-03-10
Description: chunkcounter.cpp in KTorrent before 2.1.2 allows remote attackers to cause a denial of service (crash) and heap corruption via a negative or large idx value.
CVSS Score: 7.5 (HIGH)
References: http://ktorrent.org/forum/viewtopic.php?t=1401; http://lists.kde.org/?l=kde-announce&m=[PII_REDACTED]1140&w=2; http://secunia.com/advisories/24459
CVE: CVE-2007-0999
Published: 2007-03-10
Description: Format string vulnerability in Ekiga 2.0.3, and probably other versions, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2007-1006.
CVSS Score: 9.3 (HIGH)
References: http://www.mandriva.com/security/advisories?name=MDKSA-2007:058; http://www.redhat.com/support/errata/RHSA-2007-0087.html; http://www.ubuntu.com/usn/usn-434-1
CVE: CVE-2007-1345
Published: 2007-03-10
Description: Unspecified vulnerability in cube.exe in the GINA component for CA (Computer Associates) eTrust Admin 8.1.0 through 8.1.2 allows attackers with physical interactive or Remote Desktop access to bypass authentication and gain privileges via the password reset interface.
CVSS Score: 4.1 (MEDIUM)
References: http://secunia.com/advisories/24441; http://securityreason.com/securityalert/2404; http://www.osvdb.org/32722
CVE: CVE-2007-1388
Published: 2007-03-10
Description: The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c in Linux kernel before 2.6.20, and possibly other versions, allows local users to cause a denial of service (oops) by calling setsockopt with the IPV6_RTHDR option name and possibly a zero option length or invalid option value, which triggers a NULL pointer dereference.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-399
References: http://bugzilla.kernel.org/show_bug.cgi?id=8155; http://lists.suse.com/archive/suse-security-announce/2007-May/0001.html; http://secunia.com/advisories/24777
CVE: CVE-2007-1273
Published: 2007-03-10
Description: Integer overflow in the ktruser function in NetBSD-current before 20061022, NetBSD 3 and 3-0 before 20061024, and NetBSD 2 before 20070209, when the kernel is built with the COMPAT_FREEBSD or COMPAT_DARWIN option, allows local users to cause a denial of service and possibly gain privileges.
CVSS Score: 6.9 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-001.txt.asc; http://osvdb.org/35453; http://www.securityfocus.com/bid/22878
CVE: CVE-2007-1365
Published: 2007-03-10
Description: Buffer overflow in kern/uipc_mbuf2.c in OpenBSD 3.9 and 4.0 allows remote attackers to execute arbitrary code via fragmented IPv6 packets due to "incorrect mbuf handling for ICMP6 packets."  NOTE: this was originally reported as a denial of service.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=openbsd-cvs&m=[PII_REDACTED]3868&w=2; http://secunia.com/advisories/24490; http://securitytracker.com/id?1017735
CVE: CVE-2007-1389
Published: 2007-03-10
Description: dynaliens 2.0 and 2.1 allows remote attackers to bypass authentication and perform certain privileged actions via a direct request for (1) validlien.php3 (2) supprlien.php3 (3) supprub.php3 (4) validlien.php3 (5) confsuppr.php3 (6) modiflien.php3, or (7) confmodif.php3 in admin/.
CVSS Score: 7.5 (HIGH)
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2722; http://securityreason.com/securityalert/2403; http://www.securityfocus.com/archive/1/462221/100/0/threaded
CVE: CVE-2007-1390
Published: 2007-03-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in dynaliens 2.0 and 2.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) recherche.php3 or (2) ajouter.php3.
CVSS Score: 4.3 (MEDIUM)
References: http://forums.avenir-geopolitique.net/viewtopic.php?t=2722; http://securityreason.com/securityalert/2403; http://www.securityfocus.com/archive/1/462221/100/0/threaded
CVE: CVE-2007-1391
Published: 2007-03-10
Description: PHP remote file inclusion vulnerability in modules/abook/foldertree.php in Leo West WEBO (aka weborganizer) 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the baseDir parameter.
CVSS Score: 10.0 (HIGH)
References: http://advisories.echo.or.id/adv/adv67-K-159-2007.txt; http://www.securityfocus.com/archive/1/462294/100/0/threaded; http://www.securityfocus.com/bid/22877
CVE: CVE-2007-1392
Published: 2007-03-10
Description: Directory traversal vulnerability in down.php in netForo! 0.1g allows remote attackers to read arbitrary files via a .. (dot dot) in the file_to_download parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24449; http://www.securityfocus.com/bid/22875; http://www.vupen.com/english/advisories/2007/0884
CVE: CVE-2007-1393
Published: 2007-03-10
Description: PHP remote file inclusion vulnerability in mysave.php in Magic CMS 4.2.747 allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/33893; http://secunia.com/advisories/24439; http://www.securityfocus.com/bid/22162
CVE: CVE-2007-1394
Published: 2007-03-10
Description: Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/33890; http://secunia.com/advisories/24433; http://www.securityfocus.com/bid/22865
CVE: CVE-2007-1395
Published: 2007-03-10
Description: Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase </SCRIPT> end tag, which bypasses the protection against lowercase </script>.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35048; http://secunia.com/advisories/26733; http://securityreason.com/securityalert/2402
CVE: CVE-2007-1396
Published: 2007-03-10
Description: The import_request_variables function in PHP 4.0.7 through 4.4.6, and 5.x before 5.2.2, when called without a prefix, does not prevent the (1) GET, (2) POST, (3) COOKIE, (4) FILES, (5) SERVER, (6) SESSION, and other superglobals from being overwritten, which allows remote attackers to spoof source IP address and Referer data, and have other unspecified impact.  NOTE: it could be argued that this is a design limitation of PHP and that only the misuse of this feature, i.e. implementation bugs in applications, should be included in CVE. However, it has been fixed by the vendor.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html; http://secunia.com/advisories/26048; http://securityreason.com/securityalert/2406
CVE: CVE-2007-1397
Published: 2007-03-10
Description: Multiple stack-based buffer overflows in the (1) ExtractRnick and (2) decrypt_topic_332 functions in FiSH allow remote attackers to execute arbitrary code via long strings.
CVSS Score: 10.0 (HIGH)
References: http://blogs.23.nu/ilja/stories/14493/; http://secunia.com/advisories/24495; http://securityreason.com/securityalert/8216
CVE: CVE-2007-1398
Published: 2007-03-10
Description: The frag3 preprocessor in Snort 2.6.1.1, 2.6.1.2, and 2.7.0 beta, when configured for inline use on Linux without the ip_conntrack module loaded, allows remote attackers to cause a denial of service (segmentation fault and application crash) via certain UDP packets produced by send_morefrag_packet and send_overlap_packet.
CVSS Score: 7.1 (HIGH)
References: http://www.osvdb.org/33024; http://www.securityfocus.com/bid/22872; http://www.snort.org/docs/release_notes/release_notes_2613.txt
CVE: CVE-2007-1399
Published: 2007-03-10
Description: Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote attackers to execute arbitrary code via a long zip:// URL, as demonstrated by actively triggering URL access from a remote PHP interpreter via avatar upload or blog pingback.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html; http://secunia.com/advisories/24471; http://secunia.com/advisories/24514
CVE: CVE-2007-1400
Published: 2007-03-10
Description: Plash permits sandboxed processes to open /dev/tty, which allows local users to escape sandbox restrictions and execute arbitrary commands by sending characters to a shell process on the same termimal via the TIOCSTI ioctl.
CVSS Score: 6.9 (MEDIUM)
References: http://lists.gnu.org/archive/html/plash/2007-03/msg00000.html; http://plash.beasts.org/wiki/PlashIssues/TtyVulnerability; http://secunia.com/advisories/24498
CVE: CVE-2007-1401
Published: 2007-03-10
Description: Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allow local users to gain privileges via a long argument to the crack_opendict function.
CVSS Score: 6.9 (MEDIUM)
References: http://retrogod.altervista.org/php_446_crack_opendict_local_bof.html; http://securityreason.com/securityalert/2405; http://www.securityfocus.com/archive/1/462226/100/0/threaded
CVE: CVE-2007-1402
Published: 2007-03-10
Description: The Rediff Toolbar 2.0 ActiveX control in redifftoolbar.dll allows remote attackers to cause a denial of service via unspecified manipulations, possibly involving improper initialization or blank arguments.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/21924.html; http://osvdb.org/36899; http://www.securityfocus.com/bid/21924
CVE: CVE-2007-1403
Published: 2007-03-10
Description: Multiple stack-based buffer overflows in an ActiveX control in SwDir.dll 10.1.4.20 in Macromedia Shockwave allow remote attackers to cause a denial of service (Internet Explorer 7 crash) and possibly execute arbitrary code via a long (1) BGCOLOR, (2) SRC, (3) AutoStart, (4) Sound, (5) DrawLogo, or (6) DrawProgress property value, different vectors than CVE-2006-6885.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36005; http://www.securityfocus.com/bid/22842; https://www.exploit-db.com/exploits/3421
CVE: CVE-2007-1404
Published: 2007-03-10
Description: tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 allows remote attackers to cause a denial of service via a long UDP packet that is not properly handled in a recv_from call.  NOTE: this issue might be related to CVE-2006-4948.
CVSS Score: 7.3 (HIGH)
References: http://osvdb.org/33919; http://secunia.com/advisories/24452; https://exchange.xforce.ibmcloud.com/vulnerabilities/32886
CVE: CVE-2007-1405
Published: 2007-03-10
Description: Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/24470; http://trac.edgewall.org/wiki/ChangeLog; http://www.securityfocus.com/bid/22888
CVE: CVE-2007-1406
Published: 2007-03-10
Description: Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://trac.edgewall.org/wiki/ChangeLog; http://trac.edgewall.org/wiki/ChangeLog
CVE: CVE-2007-1407
Published: 2007-03-10
Description: Unspecified vulnerability in OpenSolution Quick.Cart before 2.1 has unknown impact and attack vectors, related to a "low critical exploit."
CVSS Score: 7.5 (HIGH)
References: http://opensolution.org/Quick.Cart/forum/?p=readTopic&nr=3878; http://opensolution.org/download/Quick.Cart/changeLog.txt; http://opensolution.org/Quick.Cart/forum/?p=readTopic&nr=3878
CVE: CVE-2007-1408
Published: 2007-03-10
Description: Multiple vulnerabilities in (1) bank.php, (2) landfill.php, (3) outposts.php, (4) tribes.php, (5) house.php, (6) tribearmor.php, (7) tribeastral.php, (8) tribeware.php, and (9) includes/head.php in Bartek Jasicki Vallheru before 1.3 beta have unknown impact and remote attack vectors, probably related to large integer values containing more than 15 digits.  NOTE: the original vendor report is for integer overflows, but this is probably an incorrect usage of the term.
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/forum/forum.php?forum_id=672237; http://sourceforge.net/project/shownotes.php?release_id=491871&group_id=118350; http://vallheru.svn.sourceforge.net/viewvc/vallheru/vallheru2/bank.php?r1=910&r2=918
CVE: CVE-2007-1409
Published: 2007-03-10
Description: WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/24566; http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml; http://www.securityfocus.com/archive/1/462230/100/0/threaded
CVE: CVE-2007-1410
Published: 2007-03-10
Description: SQL injection vulnerability in kategori.asp in GaziYapBoz Game Portal allows remote attackers to execute arbitrary SQL commands via the kategori parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35600; http://www.securityfocus.com/bid/22871; http://www.vupen.com/english/advisories/2007/0882
CVE: CVE-2007-1411
Published: 2007-03-10
Description: Buffer overflow in PHP 4.4.6 and earlier, and unspecified PHP 5 versions, allows local and possibly remote attackers to execute arbitrary code via long server name arguments to the (1) mssql_connect and (2) mssql_pconnect functions.
CVSS Score: 6.8 (MEDIUM)
References: http://retrogod.altervista.org/php_446_mssql_connect_bof.html; http://secunia.com/advisories/24353; http://securityreason.com/securityalert/2407
CVE: CVE-2007-1000
Published: 2007-03-12
Description: The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference.
CVSS Score: 7.2 (HIGH)
References: http://bugzilla.kernel.org/show_bug.cgi?id=8134; http://fedoranews.org/cms/node/2787; http://fedoranews.org/cms/node/2788
CVE: CVE-2007-1412
Published: 2007-03-12
Description: The cpdf_open function in the ClibPDF (cpdf) extension in PHP 4.4.6 allows context-dependent attackers to obtain sensitive information (script source code) via a long string in the second argument.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/22897; https://exchange.xforce.ibmcloud.com/vulnerabilities/32986; https://www.exploit-db.com/exploits/3442
CVE: CVE-2007-1413
Published: 2007-03-12
Description: Buffer overflow in the snmpget function in the snmp extension in PHP 5.2.3 and earlier, including PHP 4.4.6 and probably other PHP 4 versions, allows context-dependent attackers to execute arbitrary code via a long value in the third argument (object id).
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://retrogod.altervista.org/php_446_snmpget_local_bof.html; http://secunia.com/advisories/24440; http://www.securityfocus.com/bid/22893
CVE: CVE-2007-1414
Published: 2007-03-12
Description: Multiple PHP remote file inclusion vulnerabilities in Coppermine Photo Gallery (CPG) allow remote attackers to execute arbitrary PHP code via a URL in the (1) cmd parameter to (a) image_processor.php or (b) picmgmt.inc.php, or the (2) path parameter to (c) include/functions.php, (d) include/plugin_api.inc.php, (e) index.php, or (f) pluginmgr.php.
CVSS Score: 10.0 (HIGH)
References: http://securityreason.com/securityalert/2416; http://www.osvdb.org/35065; http://www.osvdb.org/35066
CVE: CVE-2007-1415
Published: 2007-03-12
Description: Multiple PHP remote file inclusion vulnerabilities in PMB Services 3.0.13 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) class_path parameter to (a) includes/resa_func.inc.php (b) admin/notices/perso.inc.php, or (c) admin/quotas/main.inc.php; the (2) base_path parameter to (d) opac_css/rec_panier.php or (e) opac_css/includes/author_see.inc.php; or the (3) include_path parameter to (f) bull_info.inc.php or (g) misc.inc.php in includes/; (h) options_date_box.php, (i) options_file_box.php, (j) options_list.php, (k) options_query_list.php, or (l) options_text.php in includes/options/; (m) options.php, (n) options_comment.php, (o) options_date_box.php, (p) options_list.php, (q) options_query_list.php, or (r) options_text.php in includes/options_empr/; or (s) admin/import/iimport_expl.php, (t) admin/netbase/clean.php, (u) admin/param/param_func.inc.php, (v) admin/sauvegarde/lieux.inc.php, (w) autorites.php, (x) account.php, (y) cart.php, or (z) edit.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://advisories.echo.or.id/adv/adv68-K-159-2007.txt; http://www.osvdb.org/35101; http://www.osvdb.org/35102
CVE: CVE-2007-1416
Published: 2007-03-12
Description: PHP remote file inclusion vulnerability in createurl.php in JCcorp (aka James Coyle) URLshrink allows remote attackers to execute arbitrary PHP code via a URL in the formurl parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/33982; http://secunia.com/advisories/24340; http://securityreason.com/securityalert/2415
CVE: CVE-2007-1417
Published: 2007-03-12
Description: SQL injection vulnerability in index.php in HC NEWSSYSTEM 1.0-4 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a komm aktion.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33976; http://secunia.com/advisories/24477; http://securityreason.com/securityalert/2414
CVE: CVE-2007-1418
Published: 2007-03-12
Description: Cross-site scripting (XSS) vulnerability in skins/ace/popup-notopic.php in MindTouch OpenGarden DekiWiki before Gooseberry++ allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/24453; http://sourceforge.net/project/shownotes.php?group_id=173074&release_id=492249; http://www.securityfocus.com/bid/22891
CVE: CVE-2007-1419
Published: 2007-03-12
Description: The Java Management Extensions Remote API Remote Method Invocation over Internet Inter-ORB Protocol (JMX RMI-IIOP) API in Java Dynamic Management Kit 5.1 before 20070309 does not properly enforce the java.policy, which allows local users to obtain certain MBeans data access by operating a server application accessed by a privileged remote authenticated user.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/34018; http://secunia.com/advisories/24497; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102835-1
CVE: CVE-2007-1420
Published: 2007-03-12
Description: MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function.
CVSS Score: 2.1 (LOW)
References: http://bugs.mysql.com/bug.php?id=24630; http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-36.html; http://secunia.com/advisories/24483
CVE: CVE-2007-1421
Published: 2007-03-13
Description: Multiple PHP remote file inclusion vulnerabilities in Premod SubDog 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) functions_kb.php, (2) themen_portal_mitte.php, or (3) logger_engine.php in includes/.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35079; http://osvdb.org/35080; http://osvdb.org/35081
CVE: CVE-2007-1422
Published: 2007-03-13
Description: SQL injection vulnerability in goster.asp in fystyq Duyuru Scripti allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-0688.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34087; http://www.securityfocus.com/archive/1/462448/100/0/threaded; http://www.securityfocus.com/bid/22910
CVE: CVE-2007-1423
Published: 2007-03-13
Description: Multiple PHP remote file inclusion vulnerabilities in WORK system e-commerce 3.0.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the g_include parameter to include/include_top.php and certain other PHP scripts.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/33973; http://secunia.com/advisories/24476; http://www.securityfocus.com/bid/22908
CVE: CVE-2007-1424
Published: 2007-03-13
Description: Multiple PHP remote file inclusion vulnerabilities in Softnews Media Group DataLife Engine allow remote attackers to execute arbitrary PHP code via a URL in the root_dir parameter to (1) init.php and (2) Ajax/editnews.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35712; http://securityreason.com/securityalert/2411; http://www.securityfocus.com/archive/1/462445/100/0/threaded
CVE: CVE-2007-1425
Published: 2007-03-13
Description: SQL injection vulnerability in index.php in Triexa SonicMailer Pro 3.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the list parameter in an archive action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33986; http://secunia.com/advisories/24474; http://www.securityfocus.com/bid/22920
CVE: CVE-2007-1426
Published: 2007-03-13
Description: The web interface in AstroCam 2.0.0 through 2.6.5 allows remote attackers to cause a denial of service (daemon shutdown) via requests that contain a large amount of data in the "a" variable, which "fills up the message queue."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://astrocam.svn.sourceforge.net/viewvc/astrocam/BUGS?view=markup; http://secunia.com/advisories/24480; http://sourceforge.net/project/shownotes.php?group_id=85523&release_id=492572
CVE: CVE-2007-1427
Published: 2007-03-13
Description: Directory traversal vulnerability in download_pdf.php in AssetMan 2.4a and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the pdf_file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/2410; http://www.securityfocus.com/archive/1/462577/100/0/threaded; http://www.securityfocus.com/bid/22921
CVE: CVE-2007-1428
Published: 2007-03-13
Description: SQL injection vulnerability in search.php in PHP Labs JobSitePro 1.0 allows remote attackers to execute arbitrary SQL commands via the salary parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33985; http://secunia.com/advisories/24454; http://www.securityfocus.com/bid/22916