deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-6218
Published: 2007-12-04
Description: Multiple PHP remote file inclusion vulnerabilities in Ossigeno CMS 2.2 pre1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) level parameter to (a) install_module.php and (b) uninstall_module.php in upload/xax/admin/modules/, (c) upload/xax/admin/patch/index.php, and (d) install_module.php and (e) uninstall_module.php in upload/xax/ossigeno/admin/; and the (2) ossigeno parameter to (f) ossigeno_modules/ossigeno-catalogo/xax/ossigeno/catalogo/common.php, different vectors than CVE-2007-5234.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/44312; http://osvdb.org/44313; http://osvdb.org/44314
CVE: CVE-2007-6219
Published: 2007-12-04
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Netcool Security Manager 1.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27900; http://www-1.ibm.com/support/docview.wss?uid=swg1IY95615; http://www-1.ibm.com/support/docview.wss?uid=swg24017385
CVE: CVE-2007-6220
Published: 2007-12-04
Description: typespeed before 0.6.4 allows remote attackers to cause a denial of service (application crash) via unspecified network behavior that triggers a divide-by-zero error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/27905; http://tobias.eyedacor.org/typespeed/#News; http://tobias.eyedacor.org/typespeed/ChangeLog
CVE: CVE-2007-6221
Published: 2007-12-04
Description: TuMusika Evolution 1.7R5 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/27866; https://exchange.xforce.ibmcloud.com/vulnerabilities/38724; http://secunia.com/advisories/27866
CVE: CVE-2007-6222
Published: 2007-12-04
Description: The CheckCustomerAccess function in functions.php in CRM-CTT Interleave before 4.2.0 (formerly CRM-CTT) does not properly verify user privileges, which allows remote authenticated users with the LIMITTOCUSTOMERS privilege to bypass intended access restrictions and edit non-active user settings.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/27874; http://sourceforge.net/project/shownotes.php?release_id=558602&group_id=61096; http://www.securityfocus.com/bid/26685
CVE: CVE-2007-6223
Published: 2007-12-04
Description: SQL injection vulnerability in garage.php in phpBB Garage 1.2.0 Beta3 allows remote attackers to execute arbitrary SQL commands via the make_id parameter in a search action in browse mode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/26683; https://exchange.xforce.ibmcloud.com/vulnerabilities/38832; https://www.exploit-db.com/exploits/4686
CVE: CVE-2007-6224
Published: 2007-12-04
Description: The RealNetworks RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll, as shipped with RealPlayer 11, allows remote attackers to cause a denial of service (browser crash) via a certain argument to the GetSourceTransport method.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/3415; http://www.safehack.com/Advisory/realpdos.txt; http://www.securityfocus.com/archive/1/484401/100/0/threaded
CVE: CVE-2007-6225
Published: 2007-12-04
Description: Unspecified vulnerability in Sun Solaris 10, when 64bit mode is used on the x86 platform, allows local users in a Linux (lx) branded zone to cause a denial of service (panic) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/40828; http://secunia.com/advisories/27877; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103153-1
CVE: CVE-2007-6226
Published: 2007-12-04
Description: The American Power Conversion (APC) AP7932 0u 30amp Switched Rack Power Distribution Unit (PDU), with rpdu 3.5.5 and aos 3.5.6, allows remote attackers to bypass authentication and obtain login access by making a login attempt while a different client is logged in, and then resubmitting the login attempt once the other client exits.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/3418; http://securitytracker.com/id?1019018; http://www.securityfocus.com/archive/1/484363/100/0/threaded
CVE: CVE-2007-6227
Published: 2007-12-04
Description: QEMU 0.9.0 allows local users of a Windows XP SP2 guest operating system to overwrite the TranslationBlock (code_gen_buffer) buffer, and probably have unspecified other impacts related to an "overflow," via certain Windows executable programs, as demonstrated by qemu-dos.com.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29129; http://www.mandriva.com/security/advisories?name=MDVSA-2008:162; http://www.securityfocus.com/archive/1/484429/100/0/threaded
CVE: CVE-2007-6228
Published: 2007-12-04
Description: Stack-based buffer overflow in the Helper class in the yt.ythelper.2 ActiveX control in Yahoo! Toolbar 1.4.1 allows remote attackers to cause a denial of service (browser crash) via a long argument to the c method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/058725.html; http://www.securityfocus.com/bid/26656; https://exchange.xforce.ibmcloud.com/vulnerabilities/38769
CVE: CVE-2007-6229
Published: 2007-12-04
Description: PHP remote file inclusion vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the CFG[site][project_path] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/26681; https://exchange.xforce.ibmcloud.com/vulnerabilities/38802; https://www.exploit-db.com/exploits/4685
CVE: CVE-2007-6230
Published: 2007-12-04
Description: Directory traversal vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the CFG[site][project_path] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/39694; https://exchange.xforce.ibmcloud.com/vulnerabilities/38802; https://www.exploit-db.com/exploits/4685
CVE: CVE-2007-6231
Published: 2007-12-04
Description: Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the tm_includepath parameter to (1) Classes.inc.php, (2) statistic.inc.php, (3) status.inc.php, (4) status_top_x.inc.php, or (5) libchart-1.1/libchart.php in include/.  NOTE: access to include/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/39689; http://osvdb.org/39692; http://secunia.com/advisories/27895
CVE: CVE-2007-6232
Published: 2007-12-04
Description: Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web script or HTML via the error parameter in an error page action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27875; https://exchange.xforce.ibmcloud.com/vulnerabilities/38780; https://www.exploit-db.com/exploits/4681
CVE: CVE-2007-6233
Published: 2007-12-04
Description: Directory traversal vulnerability in index.php in FTP Admin 0.1.0 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the page parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/27875; https://exchange.xforce.ibmcloud.com/vulnerabilities/38779; https://www.exploit-db.com/exploits/4681
CVE: CVE-2007-6234
Published: 2007-12-04
Description: index.php in FTP Admin 0.1.0 allows remote attackers to bypass authentication and obtain administrative access via a loggedin parameter with a value of true, as demonstrated by adding a user account.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/27875; https://exchange.xforce.ibmcloud.com/vulnerabilities/38782; https://www.exploit-db.com/exploits/4681
CVE: CVE-2007-6235
Published: 2007-12-04
Description: A certain ActiveX control in RealNetworks RealPlayer 11 allows remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error.  NOTE: this might be related to CVE-2007-4904.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.safehack.com/Advisory/realpdos_au.txt; http://www.securityfocus.com/archive/1/484449/100/0/threaded; https://www.exploit-db.com/exploits/4683
CVE: CVE-2007-6236
Published: 2007-12-04
Description: Microsoft Windows Media Player (WMP) allows remote attackers to cause a denial of service (application crash) via a certain AIFF file that triggers a divide-by-zero error, as demonstrated by kr.aiff.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://osvdb.org/43715; http://www.securityfocus.com/bid/26648; https://exchange.xforce.ibmcloud.com/vulnerabilities/38797
CVE: CVE-2007-6237
Published: 2007-12-04
Description: cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, which allows remote authenticated users to change the e-mail addresses of arbitrary accounts via a modified membercookie parameter, a different vector than CVE-2006-4078.  NOTE: this can be leveraged for administrative access by requesting password-reset e-mail through a lostpw action to misc.php.
CVSS Score: 9.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/27794; http://securityreason.com/securityalert/3416; http://www.securityfocus.com/archive/1/484205/100/0/threaded
CVE: CVE-2007-6238
Published: 2007-12-04
Description: Unspecified vulnerability in Apple QuickTime 7.2 on Windows XP allows remote attackers to execute arbitrary code via unknown attack vectors, probably a different vulnerability than CVE-2007-6166.  NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release advisories with actionable information.  A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.  However, the organization has stated that this is different than CVE-2007-6166.
CVSS Score: 10.0 (HIGH)
References: http://wabisabilabi.blogspot.com/2007/11/quicktime-zeroday-vulnerability-still.html; http://wslabi.com/wabisabilabi/showBidInfo.do?code=ZD-00000185; http://www.securityfocus.com/bid/26682
CVE: CVE-2007-6239
Published: 2007-12-04
Description: The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=201209; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html; http://secunia.com/advisories/27910
CVE: CVE-2007-5355
Published: 2007-12-05
Description: The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7, when a primary DNS suffix with three or more components is configured, resolves an unqualified wpad hostname in a second-level domain outside this configured DNS domain, which allows remote WPAD servers to conduct man-in-the-middle (MITM) attacks.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/27901; http://support.microsoft.com/kb/945713; http://www.microsoft.com/technet/security/advisory/945713.mspx
CVE: CVE-2007-5613
Published: 2007-12-05
Description: Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jira.codehaus.org/browse/JETTY-452; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://osvdb.org/42497
CVE: CVE-2007-5614
Published: 2007-12-05
Description: Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/42496; http://secunia.com/advisories/27925; http://secunia.com/advisories/30941
CVE: CVE-2007-5615
Published: 2007-12-05
Description: CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://osvdb.org/42495; http://secunia.com/advisories/27925
CVE: CVE-2007-6014
Published: 2007-12-05
Description: SQL injection vulnerability in post.php in Beehive Forum 0.7.1 and earlier allows remote attackers to execute arbitrary SQL commands via the t_dedupe parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27909; http://securityreason.com/securityalert/3417; http://sourceforge.net/project/shownotes.php?group_id=50772&release_id=551758
CVE: CVE-2007-6240
Published: 2007-12-05
Description: SQL injection vulnerability in active.asp in Snitz Forums 2000 3.4.06 allows remote attackers to execute arbitrary SQL commands via the BuildTime parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39002; http://secunia.com/advisories/27911; http://www.securityfocus.com/archive/1/484541/100/0/threaded
CVE: CVE-2007-6241
Published: 2007-12-05
Description: Multiple unspecified vulnerabilities in Beehive Forum 0.7.1 have unknown "critical" impact and attack vectors, different issues than CVE-2007-6014.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/27909; http://www.beehiveforum.net/news.php; http://secunia.com/advisories/27909
CVE: CVE-2007-4575
Published: 2007-12-06
Description: HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows user-assisted remote attackers to execute arbitrary Java code via crafted database documents, related to "exposing static java methods."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://bugs.gentoo.org/show_bug.cgi?id=200771; http://bugs.gentoo.org/show_bug.cgi?id=201799; http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00005.html
CVE: CVE-2007-5894
Published: 2007-12-06
Description: The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.
CVSS Score: 9.3 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=199205; http://osvdb.org/44333; http://seclists.org/fulldisclosure/2007/Dec/0176.html
CVE: CVE-2007-5901
Published: 2007-12-06
Description: Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.  NOTE: this might be the result of a typo in the source code.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-399
References: http://bugs.gentoo.org/show_bug.cgi?id=199214; http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2007-5902
Published: 2007-12-06
Description: Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=199214; http://osvdb.org/44748; http://seclists.org/fulldisclosure/2007/Dec/0176.html
CVE: CVE-2007-5971
Published: 2007-12-06
Description: Double free vulnerability in the gss_krb5int_make_seal_token_v3 function in lib/gssapi/krb5/k5sealv3.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-399
References: http://bugs.gentoo.org/show_bug.cgi?id=199212; http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2007-5972
Published: 2007-12-06
Description: Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors.  NOTE: the free operations occur in code that stores the krb5kdc master key, and so the attacker must have privileges to store this key.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=199211; http://osvdb.org/44747; http://seclists.org/fulldisclosure/2007/Dec/0176.html
CVE: CVE-2007-6194
Published: 2007-12-06
Description: Unspecified vulnerability in HP Select Identity 4.01 before 4.01.012 and 4.1x before 4.13.003 allows remote attackers to obtain unspecified access via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01293337; http://osvdb.org/40143; http://secunia.com/advisories/27924
CVE: CVE-2007-6260
Published: 2007-12-06
Description: The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to obtain login access by connecting to the Listener.  NOTE: at the end of the installation, if performed using the Database Configuration Assistant (DBCA), most accounts are disabled or their passwords are changed.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-255
References: http://osvdb.org/43673; http://securityreason.com/securityalert/3419; http://www.davidlitchfield.com/blog/archives/00000030.htm
CVE: CVE-2007-6261
Published: 2007-12-06
Description: Integer overflow in the load_threadstack function in the Mach-O loader (mach_loader.c) in the xnu kernel in Apple Mac OS X 10.4 through 10.5.1 allows local users to cause a denial of service (infinite loop) via a crafted Mach-O binary.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/27884; http://www.digit-labs.org/files/exploits/xnu-macho-dos.c; http://www.securityfocus.com/bid/26700
CVE: CVE-2007-6262
Published: 2007-12-06
Description: A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary code via crafted arguments to the (1) addTarget, (2) getVariable, or (3) setVariable function, resulting from a "bad initialized pointer," aka a "recursive plugin release vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/27878; http://securityreason.com/securityalert/3420; http://www.coresecurity.com/?action=item&id=2035
CVE: CVE-2007-5769
Published: 2007-12-06
Description: Double free vulnerability in the getreply function in ftp.c in netkit ftp (netkit-ftp) 0.17 20040614 and later allows remote FTP servers to cause a denial of service (application crash) and possibly have unspecified other impact via some types of FTP protocol behavior. NOTE: the netkit-ftpd issue is covered by CVE-2007-6263.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=199206; http://cvs.fedora.redhat.com/viewcvs/rpms/ftp/F-8/netkit-ftp-0.17-sigseg.patch?view=auto; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3382&w=2
CVE: CVE-2007-5938
Published: 2007-12-06
Description: The iwl_set_rate function in compatible/iwl3945-base.c in iwlwifi 1.1.21 and earlier dereferences an iwl_get_hw_mode return value without checking for NULL, which might allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors during module initialization.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://article.gmane.org/gmane.linux.drivers.ipw3945.devel/1618; http://bugs.gentoo.org/show_bug.cgi?id=199209; http://osvdb.org/44749
CVE: CVE-2007-5939
Published: 2007-12-06
Description: The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to have an unknown impact via an invalid username.  NOTE: the vulnerability was originally reported for ftpd.c, but this is incorrect.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=199207; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3699&w=2; http://osvdb.org/44750
CVE: CVE-2007-6263
Published: 2007-12-06
Description: The dataconn function in ftpd.c in netkit ftpd (netkit-ftpd) 0.17, when certain modifications to support SSL have been introduced, calls fclose on an uninitialized file stream, which allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via some types of FTP over SSL protocol behavior, as demonstrated by breaking a passive FTP DATA connection in a way that triggers an error in the server's SSL_accept function. NOTE: the netkit ftp issue is covered by CVE-2007-5769.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=199206; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3382&w=2; http://osvdb.org/41191
CVE: CVE-2007-5497
Published: 2007-12-07
Description: Multiple integer overflows in libext2fs in e2fsprogs before 1.40.3 allow user-assisted remote attackers to execute arbitrary code via a crafted filesystem image.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-189
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083; http://lists.vmware.com/pipermail/security-announce/2008/000007.html; http://secunia.com/advisories/27889
CVE: CVE-2007-6109
Published: 2007-12-07
Description: Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a large precision value in an integer format string specifier to the format function, as demonstrated via a certain "emacs -batch -eval" command line.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=200297; http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2007-6265
Published: 2007-12-07
Description: Unspecified vulnerability in avast! 4 Home and Professional Editions before 4.7.1098 allows remote attackers to have an unknown impact via a crafted TAR archive.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/27929; http://www.avast.com/eng/avast-4-home_pro-revision-history.html; http://www.securityfocus.com/bid/26702
CVE: CVE-2007-6266
Published: 2007-12-07
Description: Multiple SQL injection vulnerabilities in bcoos 1.0.10 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to modules/arcade/index.php in a show_stats action, or the lid parameter to (2) modules/myalbum/ratephoto.php or (3) modules/mylinks/ratelink.php, different vectors than CVE-2007-5104.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lostmon.blogspot.com/2007/11/bcoops-sql-injection-and-cross-site.html; http://secunia.com/advisories/26945; http://www.securityfocus.com/bid/26629