deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0445
Published: 2007-04-06
Description: Heap-based buffer overflow in the arj.ppl module in the OnDemand Scanner in Kaspersky Anti-Virus, Anti-Virus for Workstations, and Anti-Virus for File Servers 6.0, and Internet Security 6.0 before Maintenance Pack 2 build 6.0.2.614 allows remote attackers to execute arbitrary code via crafted ARJ archives.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24778; http://www.kaspersky.com/technews?id=203038693; http://www.kaspersky.com/technews?id=203038694
CVE: CVE-2007-1001
Published: 2007-04-06
Description: Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?r1=1.2.4.1&r2=1.2.4.1.8.1; http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?revision=1.2.4.1.8.1&view=markup; http://docs.info.apple.com/article.html?artnum=306172
CVE: CVE-2007-1112
Published: 2007-04-06
Description: Kaspersky Anti-Virus 6.0 and Internet Security 6.0 exposes unsafe methods in the (a) AXKLPROD60Lib.KAV60Info (AxKLProd60.dll) and (b) AXKLSYSINFOLib.SysInfo (AxKLSysInfo.dll) ActiveX controls, which allows remote attackers to "download" or delete arbitrary files via crafted arguments to the (1) DeleteFile, (2) StartBatchUploading, (3) StartStrBatchUploading, or (4) StartUploading methods.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24778; http://www.kaspersky.com/technews?id=203038694; http://www.securityfocus.com/archive/1/464882/100/0/threaded
CVE: CVE-2007-1270
Published: 2007-04-06
Description: Double free vulnerability in VMware ESX Server 3.0.0 and 3.0.1 allows attackers to cause a denial of service (crash), obtain sensitive information, or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://osvdb.org/35268; http://secunia.com/advisories/24788; http://securityreason.com/securityalert/2524
CVE: CVE-2007-1271
Published: 2007-04-06
Description: Buffer overflow in VMware ESX Server 3.0.0 and 3.0.1 might allow attackers to gain privileges or cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 6.6 (MEDIUM)
References: http://secunia.com/advisories/24788; http://securityreason.com/securityalert/2524; http://www.securityfocus.com/archive/1/464745/100/0/threaded
CVE: CVE-2007-1878
Published: 2007-04-06
Description: Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.03 for Mozilla Firefox allows remote attackers to bypass zone restrictions, read arbitrary file:// URIs, or execute arbitrary code in the browser chrome, as demonstrated via the runFile function, related to lack of HTML escaping in the property name.
CVSS Score: 6.8 (MEDIUM)
References: http://larholm.com/2007/04/06/0day-vulnerability-in-firebug/; http://secunia.com/advisories/24743; http://securityreason.com/securityalert/2525
CVE: CVE-2007-1879
Published: 2007-04-06
Description: The StartUploading function in KL.SysInfo ActiveX control (AxKLSysInfo.dll) in Kaspersky Anti-Virus 6.0 and Internet Security 6.0 before Maintenance Pack 2 build 6.0.2.614 allows remote attackers to read arbitrary files by triggering an outbound anonymous FTP session that invokes the PUT command.  NOTE: this issue might be related to CVE-2007-1112.
CVSS Score: 9.3 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=504; http://secunia.com/advisories/24778; http://www.kaspersky.com/technews?id=203038694
CVE: CVE-2007-1880
Published: 2007-04-06
Description: Integer overflow in the _NtSetValueKey function in klif.sys in Kaspersky Anti-Virus, Anti-Virus for Workstations, Anti-Virus for File Server 6.0, and Internet Security 6.0 before Maintenance Pack 2 build 6.0.2.614 allows context-dependent attackers to execute arbitrary code via a large, unsigned "data size argument," which results in a heap overflow.
CVSS Score: 6.6 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=505; http://secunia.com/advisories/24778; http://www.kaspersky.com/technews?id=203038693
CVE: CVE-2007-1881
Published: 2007-04-06
Description: Unspecified vulnerability in KLIF (klif.sys) in Kaspersky Anti-Virus, Anti-Virus for Workstations, and Anti-Virus for File Servers 6.0, and Internet Security 6.0 before Maintenance Pack 2 build 6.0.2.614 allows local users to gain Ring-0 privileges via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24778; http://www.kaspersky.com/technews?id=203038693; http://www.kaspersky.com/technews?id=203038694
CVE: CVE-2007-0956
Published: 2007-04-06
Description: The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882.
CVSS Score: 10.0 (HIGH)
CWE: CWE-306
References: ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc; http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html; http://secunia.com/advisories/24706
CVE: CVE-2007-0957
Published: 2007-04-06
Description: Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers.
CVSS Score: 9.0 (HIGH)
CWE: CWE-787
References: ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc; http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html
CVE: CVE-2007-1003
Published: 2007-04-06
Description: Integer overflow in ALLOCATE_LOCAL in the ProcXCMiscGetXIDList function in the XC-MISC extension in the X.Org X11 server (xserver) 7.1-1.1.0, and other versions before 20070403, allows remote authenticated users to execute arbitrary code via a large expression, which results in memory corruption.
CVSS Score: 9.0 (HIGH)
References: http://issues.foresightlinux.org/browse/FL-223; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=503; http://lists.freedesktop.org/archives/xorg-announce/2007-April/000286.html
CVE: CVE-2007-1216
Published: 2007-04-06
Description: Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding".
CVSS Score: 9.0 (HIGH)
CWE: CWE-415
References: ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc; http://docs.info.apple.com/article.html?artnum=305391; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056923
CVE: CVE-2007-1351
Published: 2007-04-06
Description: Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.
CVSS Score: 8.5 (HIGH)
CWE: CWE-189
References: http://issues.foresightlinux.org/browse/FL-223; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=501; http://lists.apple.com/archives/Security-announce/2007/Nov/msg00003.html
CVE: CVE-2007-1352
Published: 2007-04-06
Description: Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.
CVSS Score: 3.8 (LOW)
References: http://issues.foresightlinux.org/browse/FL-223; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=502; http://lists.apple.com/archives/Security-announce/2007/Nov/msg00003.html
CVE: CVE-2007-1680
Published: 2007-04-06
Description: Stack-based buffer overflow in the createAndJoinConference function in the AudioConf ActiveX control (yacscom.dll) in Yahoo! Messenger before 20070313 allows remote attackers to execute arbitrary code via long (1) socksHostname and (2) hostname properties.
CVSS Score: 9.3 (HIGH)
References: http://messenger.yahoo.com/security_update.php?id=031207; http://osvdb.org/34319; http://secunia.com/advisories/24742
CVE: CVE-2007-1684
Published: 2007-04-06
Description: The Run function in SolidWorks sldimdownload ActiveX control in sldimdownload.dll before 16.0.0.6 allows remote attackers to execute arbitrary commands via the (1) installerpath and (2) applicationarguments arguments.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/34320; http://secunia.com/advisories/24762; http://www.kb.cert.org/vuls/id/556801
CVE: CVE-2007-1882
Published: 2007-04-06
Description: qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment in HP Mercury Quality Center 9.0 build 9.1.0.4352 allows remote authenticated users to execute arbitrary SQL commands via the RunQuery method.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053406.html; http://osvdb.org/34630; http://secunia.com/advisories/24730
CVE: CVE-2007-1883
Published: 2007-04-06
Description: PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to read arbitrary memory locations via an interruption that triggers a user space error handler that changes a parameter to an arbitrary pointer, as demonstrated via the iptcembed function, which calls certain convert_to_* functions with its input parameters.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24542; http://secunia.com/advisories/27102; http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml
CVE: CVE-2007-1884
Published: 2007-04-06
Description: Multiple integer signedness errors in the printf function family in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 on 64 bit machines allow context-dependent attackers to execute arbitrary code via (1) certain negative argument numbers that arise in the php_formatted_print function because of 64 to 32 bit truncation, and bypass a check for the maximum allowable value; and (2) a width and precision of -1, which make it possible for the php_sprintf_appendstring function to place an internal buffer at an arbitrary memory location.
CVSS Score: 6.8 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137; http://secunia.com/advisories/25423
CVE: CVE-2007-1885
Published: 2007-04-06
Description: Integer overflow in the str_replace function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via a single character search string in conjunction with a long replacement string, which overflows a 32 bit length counter.  NOTE: this is probably the same issue as CVE-2007-0906.6.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137; http://secunia.com/advisories/25423
CVE: CVE-2007-1886
Published: 2007-04-06
Description: Integer overflow in the str_replace function in PHP 4.4.5 and PHP 5.2.1 allows context-dependent attackers to have an unknown impact via a single character search string in conjunction with a single character replacement string, which causes an "off by one overflow."
CVSS Score: 6.8 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137; http://secunia.com/advisories/25423
CVE: CVE-2007-1887
Published: 2007-04-06
Description: Buffer overflow in the sqlite_decode_binary function in the bundled sqlite library in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter, as demonstrated by calling the sqlite_udf_decode_binary function with a 0x01 character.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795; http://secunia.com/advisories/24909; http://secunia.com/advisories/25057
CVE: CVE-2007-1888
Published: 2007-04-06
Description: Buffer overflow in the sqlite_decode_binary function in src/encode.c in SQLite 2, as used by PHP 4.x through 5.x and other applications, allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter.  NOTE: some PHP installations use a bundled version of sqlite without this vulnerability.  The SQLite developer has argued that this issue could be due to a misuse of the sqlite_decode_binary() API.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/39177; http://secunia.com/advisories/25057; http://www.attrition.org/pipermail/vim/2007-April/001540.html
CVE: CVE-2007-1889
Published: 2007-04-06
Description: Integer signedness error in the _zend_mm_alloc_int function in the Zend Memory Manager in PHP 5.2.0 allows remote attackers to execute arbitrary code via a large emalloc request, related to an incorrect signed long cast, as demonstrated via the HTTP SOAP client in PHP, and via a call to msg_receive with the largest positive integer value of maxsize.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/25056; http://secunia.com/advisories/25062; http://www.debian.org/security/2007/dsa-1283
CVE: CVE-2007-1890
Published: 2007-04-06
Description: Integer overflow in the msg_receive function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1, on FreeBSD and possibly other platforms, allows context-dependent attackers to execute arbitrary code via certain maxsize values, as demonstrated by 0xffffffff.
CVSS Score: 7.5 (HIGH)
References: http://www.php-security.org/MOPB/MOPB-43-2007.html; http://www.securityfocus.com/bid/23236; https://exchange.xforce.ibmcloud.com/vulnerabilities/33775
CVE: CVE-2007-1893
Published: 2007-04-09
Description: xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/24751; http://secunia.com/advisories/25108; http://trac.wordpress.org/ticket/4091
CVE: CVE-2007-1894
Published: 2007-04-09
Description: Cross-site scripting (XSS) vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the year parameter in the wp_title function.
CVSS Score: 4.3 (MEDIUM)
References: http://chxsecurity.org/advisories/adv-1-mid.txt; http://secunia.com/advisories/24485; http://secunia.com/advisories/25108
CVE: CVE-2007-1895
Published: 2007-04-09
Description: PHP remote file inclusion vulnerability in chat.php in Sky GUNNING MySpeach 3.0.7 and earlier, when used with PHP 5, allows remote attackers to execute arbitrary PHP code via an ftp URL in a my_ms[root] cookie, a different vector than CVE-2007-0491 and CVE-2006-4630.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34145; http://secunia.com/advisories/24760; http://www.vupen.com/english/advisories/2007/1261
CVE: CVE-2007-1896
Published: 2007-04-09
Description: Directory traversal vulnerability in chat.php in Sky GUNNING MySpeach 3.0.7 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) and trailing %00 (NULL) in a my_ms[root] cookie.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/34146; http://secunia.com/advisories/24760; http://secunia.com/advisories/24766
CVE: CVE-2007-1897
Published: 2007-04-09
Description: SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the post_id variable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/24751; http://secunia.com/advisories/25108; http://trac.wordpress.org/ticket/4091
CVE: CVE-2006-4250
Published: 2007-04-10
Description: Buffer overflow in man and mandb (man-db) 2.4.3 and earlier allows local users to execute arbitrary code via crafted arguments to the -H flag.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/24801; http://secunia.com/advisories/24828; http://secunia.com/advisories/24995
CVE: CVE-2007-1687
Published: 2007-04-10
Description: Multiple buffer overflows in the Internet Pictures Corporation iPIX Image Well ActiveX control (iPIX-ImageWell-ipix.dll) allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34321; http://secunia.com/advisories/24816; http://www.kb.cert.org/vuls/id/958609
CVE: CVE-2007-1900
Published: 2007-04-10
Description: CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to inject arbitrary e-mail headers via an e-mail address with a '\n' character, which causes a regular expression to ignore the subsequent part of the address string.
CVSS Score: 5.0 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795; http://secunia.com/advisories/24824; http://secunia.com/advisories/25056
CVE: CVE-2007-0938
Published: 2007-04-10
Description: Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 does not properly handle certain characters in a crafted HTTP GET request, which allows remote attackers to execute arbitrary code, aka the "CMS Memory Corruption Vulnerability."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24819; http://www.kb.cert.org/vuls/id/434137; http://www.osvdb.org/34006
CVE: CVE-2007-0939
Published: 2007-04-10
Description: Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving HTML redirection queries, aka "Cross-site Scripting and Spoofing Vulnerability."
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/24819; http://www.osvdb.org/34007; http://www.securityfocus.com/archive/1/466331/100/200/threaded
CVE: CVE-2007-1204
Published: 2007-04-10
Description: Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in Microsoft Windows XP SP2 allows remote attackers on the same subnet to execute arbitrary code via crafted HTTP headers in request or notification messages, which trigger memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=509; http://secunia.com/advisories/24822; http://www.osvdb.org/34010
CVE: CVE-2007-1205
Published: 2007-04-10
Description: Unspecified vulnerability in Microsoft Agent (msagent\agentsvr.exe) in Windows 2000 SP4, XP SP2, and Server 2003, 2003 SP1, and 2003 SP2 allows remote attackers to execute arbitrary code via crafted URLs, which result in memory corruption.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/22896; http://secunia.com/secunia_research/2006-74/advisory/; http://www.kb.cert.org/vuls/id/728057
CVE: CVE-2007-1206
Published: 2007-04-10
Description: The Virtual DOS Machine (VDM) in the Windows Kernel in Microsoft Windows NT 4.0; 2000 SP4; XP SP2; Server 2003, 2003 SP1, and 2003 SP2; and Windows Vista before June 2006; uses insecure permissions (PAGE_READWRITE) for a physical memory view, which allows local users to gain privileges by modifying the "zero page" during a race condition before the view is unmapped.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://research.eeye.com/html/advisories/published/AD20070410a.html; http://secunia.com/advisories/24834; http://securitytracker.com/id?1017898
CVE: CVE-2007-1209
Published: 2007-04-10
Description: Use-after-free vulnerability in the Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista does not properly handle connection resources when starting and stopping processes, which allows local users to gain privileges by opening and closing multiple ApiPort connections, which leaves a "dangling pointer" to a process data structure.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://research.eeye.com/html/advisories/published/AD20070410b.html; http://secunia.com/advisories/24823; http://securityreason.com/securityalert/2531
CVE: CVE-2006-7192
Published: 2007-04-10
Description: Microsoft ASP .NET Framework 2.0.50727.42 does not properly handle comment (/* */) enclosures, which allows remote attackers to bypass request filtering and conduct cross-site scripting (XSS) attacks, or cause a denial of service, as demonstrated via an xss:expression STYLE attribute in a closing XSS HTML tag.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35269; http://securityreason.com/securityalert/2530; http://www.cpni.gov.uk/docs/re-20[PII_REDACTED]0.pdf
CVE: CVE-2007-0734
Published: 2007-04-10
Description: fsck, as used by the AirPort Disk feature of the AirPort Extreme Base Station with 802.11n before Firmware Update 7.1, and by Apple Mac OS X 10.3.9 through 10.4.9, does not properly enforce password protection of a USB hard drive, which allows context-dependent attackers to list arbitrary directories or execute arbitrary code, resulting from memory corruption.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=305366; http://docs.info.apple.com/article.html?artnum=305391; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html
CVE: CVE-2007-1841
Published: 2007-04-10
Description: The isakmp_info_recv function in src/racoon/isakmp_inf.c in racoon in Ipsec-tools before 0.6.7 allows remote attackers to cause a denial of service (tunnel crash) via crafted (1) DELETE (ISAKMP_NPTYPE_D) and (2) NOTIFY (ISAKMP_NPTYPE_N) messages.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/24815; http://secunia.com/advisories/24826; http://secunia.com/advisories/24833
CVE: CVE-2007-1904
Published: 2007-04-10
Description: Directory traversal vulnerability in AOL Instant Messenger (AIM) 5.9 and earlier, and ICQ 5.1 and probably earlier, allows user-assisted remote attackers to write files to arbitrary locations via a .. (dot dot) in a filename in a file transfer operation.
CVSS Score: 4.3 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=508; http://secunia.com/advisories/24747; http://secunia.com/advisories/24803
CVE: CVE-2007-1905
Published: 2007-04-10
Description: Cross-site scripting (XSS) vulnerability in auth.php in Pineapple Technologies QuizShock 1.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via encoded special characters in the forward_to parameter, as demonstrated using "&lt;&quot;&lt;".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2007-04/0144.html; http://john-martinelli.com/work/quizshock.txt; http://secunia.com/advisories/24831
CVE: CVE-2007-1906
Published: 2007-04-10
Description: Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor (Hot Editor) 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the first parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34776; http://secunia.com/advisories/24825; http://securityreason.com/securityalert/2533