deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2002
Published: 2007-04-12
Description: InoutMailingListManager 3.1 and earlier allows remote attackers to access certain restricted functionality, and upload and execute arbitrary PHP code, by setting an arbitrary admin cookie.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24842; http://www.vupen.com/english/advisories/2007/1345; https://www.exploit-db.com/exploits/3702
CVE: CVE-2007-2003
Published: 2007-04-12
Description: InoutMailingListManager 3.1 and earlier sends a Location redirect header but does not exit after an authorization check fails, which allows remote attackers to access certain restricted functionality, and upload and execute arbitrary PHP code, by ignoring the redirect.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24842; http://www.vupen.com/english/advisories/2007/1345; https://www.exploit-db.com/exploits/3702
CVE: CVE-2007-2004
Published: 2007-04-12
Description: Multiple SQL injection vulnerabilities in InoutMailingListManager 3.1 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to changename.php and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24842; http://www.vupen.com/english/advisories/2007/1345; https://www.exploit-db.com/exploits/3702
CVE: CVE-2007-2005
Published: 2007-04-12
Description: Multiple PHP remote file inclusion vulnerabilities in the Taskhopper 1.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) contact_type.php, (2) itemstatus_type.php, (3) projectstatus_type.php, (4) request_type.php, (5) responses_type.php, (6) timelog_type.php, or (7) urgency_type.php in inc/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://attrition.org/pipermail/vim/2007-April/001504.html; http://www.osvdb.org/34795; http://www.osvdb.org/34796
CVE: CVE-2007-2006
Published: 2007-04-12
Description: Multiple SQL injection vulnerabilities in login.php in pL-PHP beta 0.9 allow remote attackers to execute arbitrary SQL commands via the (1) login or (2) pass parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/465340/100/0/threaded; http://www.vupen.com/english/advisories/2007/1352; https://www.exploit-db.com/exploits/3704
CVE: CVE-2007-2007
Published: 2007-04-12
Description: admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the is_admin parameter to 1.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/465340/100/0/threaded; http://www.vupen.com/english/advisories/2007/1352; https://www.exploit-db.com/exploits/3704
CVE: CVE-2007-2008
Published: 2007-04-12
Description: Directory traversal vulnerability in admin.php in pL-PHP beta 0.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/465340/100/0/threaded; http://www.vupen.com/english/advisories/2007/1352; https://www.exploit-db.com/exploits/3704
CVE: CVE-2007-2009
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in index.php in SimpCMS Light 04.10.2007 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the site parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24851; http://www.attrition.org/pipermail/vim/2007-April/001513.html; http://www.securityfocus.com/archive/1/465343/100/100/threaded
CVE: CVE-2007-2010
Published: 2007-04-12
Description: Double free vulnerability in bftpd before 1.8 allows remote authenticated users to cause a denial of service (daemon crash) via a (1) get or (2) mget command.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bftpd.sourceforge.net/; http://bftpd.sourceforge.net/downloads/CHANGELOG; http://osvdb.org/34889
CVE: CVE-2007-2011
Published: 2007-04-12
Description: Cross-site scripting (XSS) vulnerability in login.php in DeskPro 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://john-martinelli.com/work/deskpro.txt; http://osvdb.org/34721; http://secunia.com/advisories/24844
CVE: CVE-2007-2012
Published: 2007-04-12
Description: Multiple directory traversal vulnerabilities in MimarSinan CompreXX 4.1 allow remote attackers to create files in arbitrary directories via a .. (dot dot) in a (1) .rar, (2) .jar or (3) .zip archive.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/24840; http://www.bugtraq.ir/articles/advisory/comprexx_directory_traversal/7; http://www.securityfocus.com/bid/23362
CVE: CVE-2007-2013
Published: 2007-04-12
Description: Cross-site scripting (XSS) vulnerability in index.php in JEx-Treme Einfacher Passworschutz allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://hackberry.ath.cx/research/1.txt; http://osvdb.org/35000; http://secunia.com/advisories/24922
CVE: CVE-2007-2014
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in include/blocks/week_events.php in MyNews 4.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the myNewsConf[path][sys][index] parameter, a different vector than CVE-2007-0633.
CVSS Score: 7.5 (HIGH)
References: http://hackberry.ath.cx/research/3.txt; http://osvdb.org/37425; http://www.vupen.com/english/advisories/2007/1317
CVE: CVE-2007-2015
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in index.php in Request It 1.0b allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://hackberry.ath.cx/research/2.txt; http://osvdb.org/34722; http://secunia.com/advisories/24832
CVE: CVE-2007-2016
Published: 2007-04-12
Description: Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang[] parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35049; http://securityreason.com/securityalert/2560; http://www.securityfocus.com/archive/1/465082/100/0/threaded
CVE: CVE-2007-2017
Published: 2007-04-12
Description: siteadmin/useredit.php in AlstraSoft Video Share Enterprise does not check authentication, which allows remote attackers to obtain or modify user information via a direct request.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2007/03/alstrasoft-video-share-enterprise.html; http://secunia.com/advisories/24836; http://www.alstrasoft.com/videoshare_fix.zip
CVE: CVE-2007-2018
Published: 2007-04-12
Description: SQL injection vulnerability in msg.php in AlstraSoft Video Share Enterprise allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.5 (MEDIUM)
References: http://pridels0.blogspot.com/2007/03/alstrasoft-video-share-enterprise.html; http://secunia.com/advisories/24836; http://www.securityfocus.com/bid/23409
CVE: CVE-2007-2019
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in init.gallery.php in phpGalleryScript 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the include_class parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34811; http://secunia.com/advisories/24860; http://securityreason.com/securityalert/2566
CVE: CVE-2007-2020
Published: 2007-04-12
Description: Unspecified vulnerability in administration.php in xodagallery allows remote attackers to execute arbitrary code via the cmd parameter. NOTE: CVE disputes this vulnerability because administration.php does not use the cmd parameter for inclusion
CVSS Score: 9.8 (CRITICAL)
References: http://osvdb.org/35291; http://securityreason.com/securityalert/2561; http://www.attrition.org/pipermail/vim/2007-April/001516.html
CVE: CVE-2007-2021
Published: 2007-04-12
Description: Multiple PHP remote file inclusion vulnerabilities in Pineapple Technologies Lore 1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang_path parameter to third_party/phpmailer/class.phpmailer.php or the (2) get_plugin_file_path parameter to third_party/smarty/libs/plugins/function.html_checkboxes.php.  NOTE: the affected files might be from other software packages, so this might not be a vulnerability in Lore itself.  NOTE: (1) might be the same issue as CVE-2006-5734.4.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2565; http://www.securityfocus.com/archive/1/465086/100/0/threaded; http://securityreason.com/securityalert/2565
CVE: CVE-2007-1741
Published: 2007-04-13
Description: Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511; http://marc.info/?l=apache-httpd-dev&m=[PII_REDACTED]9063&w=2; http://marc.info/?l=apache-httpd-dev&m=[PII_REDACTED]2138&w=2
CVE: CVE-2007-1742
Published: 2007-04-13
Description: suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
CVSS Score: 3.7 (LOW)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511; http://marc.info/?l=apache-httpd-dev&m=[PII_REDACTED]9063&w=2; http://marc.info/?l=apache-httpd-dev&m=[PII_REDACTED]2138&w=2
CVE: CVE-2007-1743
Published: 2007-04-13
Description: suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."  In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.
CVSS Score: 4.4 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511; http://marc.info/?l=apache-httpd-dev&m=[PII_REDACTED]9063&w=2; http://marc.info/?l=apache-httpd-dev&m=[PII_REDACTED]2138&w=2
CVE: CVE-2007-1748
Published: 2007-04-13
Description: Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Server 2003 SP 1, and Server 2003 SP 2 allows remote attackers to execute arbitrary code via a long zone name containing character constants represented by escape sequences.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blogs.technet.com/msrc/archive/2007/04/12/microsoft-security-advisory-935964-posted.aspx; http://metasploit.com/svn/framework3/trunk/modules/exploits/windows/dcerpc/msdns_zonename.rb; http://secunia.com/advisories/24871
CVE: CVE-2007-1871
Published: 2007-04-13
Description: Cross-site scripting (XSS) vulnerability in chcounter 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the login_name parameter to /stats/.
CVSS Score: 4.3 (MEDIUM)
References: http://int21.de/cve/CVE-2007-1871-chcounter.txt; http://osvdb.org/34910; http://secunia.com/advisories/24879
CVE: CVE-2007-1872
Published: 2007-04-13
Description: Cross-site scripting (XSS) vulnerability in toendaCMS 1.5.3 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search id.
CVSS Score: 4.3 (MEDIUM)
References: http://int21.de/cve/CVE-2007-1872-toendacms.txt; http://osvdb.org/34898; http://secunia.com/advisories/24869
CVE: CVE-2007-1873
Published: 2007-04-13
Description: Cross-site scripting (XSS) vulnerability in Mephisto 0.7.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter to the search script.
CVSS Score: 4.3 (MEDIUM)
References: http://int21.de/cve/CVE-2007-1873-mephisto.txt; http://osvdb.org/34911; http://secunia.com/advisories/24870
CVE: CVE-2007-2022
Published: 2007-04-13
Description: Adobe Macromedia Flash Player 7 and 9, when used with Opera before 9.20 or Konqueror before 20070613, allows remote attackers to obtain sensitive information (browser keystrokes), which are leaked to the Flash Player applet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://secunia.com/advisories/24877; http://secunia.com/advisories/25027
CVE: CVE-2007-2023
Published: 2007-04-13
Description: USB20.dll in Secustick USB flash drive decouples the authorization and file access routines, which allows local users to bypass authentication requirements by altering the return value of the VerifyPassWord function.
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/41592; http://tweakers.net/reviews/682; http://tweakers.net/reviews/683
CVE: CVE-2007-2024
Published: 2007-04-13
Description: Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.x allows remote attackers to upload arbitrary PHP files with a (1) php3, (2) php4, or (3) php5 extension.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24888; http://secunia.com/advisories/25307; http://secunia.com/advisories/26784
CVE: CVE-2007-2025
Published: 2007-04-13
Description: Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extension, as demonstrated by .php.3, which is interpreted by Apache as being a valid PHP file.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/25307; http://secunia.com/advisories/26784; http://www.debian.org/security/2007/dsa-1371
CVE: CVE-2007-2026
Published: 2007-04-13
Description: The gnu regular expression code in file 4.20 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted document with a large number of line feed characters, which is not well handled by OS/2 REXX regular expressions that use wildcards, as originally reported for AMaViS.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24918; http://secunia.com/advisories/25394; http://secunia.com/advisories/25544
CVE: CVE-2007-2027
Published: 2007-04-13
Description: Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a "../po" directory, which can be leveraged to conduct format string attacks.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-134
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=417789; http://osvdb.org/35668; http://secunia.com/advisories/25169
CVE: CVE-2007-2028
Published: 2007-04-13
Description: Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.
CVSS Score: 5.0 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2007-0338.html; http://secunia.com/advisories/24849; http://secunia.com/advisories/24907
CVE: CVE-2007-2030
Published: 2007-04-16
Description: lharc.c in lha does not securely create temporary files, which might allow local users to read or write files by creating a file before LHA is invoked.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/37049; http://secunia.com/advisories/25519; http://www.mandriva.com/security/advisories?name=MDKSA-2007:117
CVE: CVE-2007-1745
Published: 2007-04-16
Description: The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.1 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://osvdb.org/34913
CVE: CVE-2007-1997
Published: 2007-04-16
Description: Integer signedness error in the (1) cab_unstore and (2) cab_extract functions in libclamav/cab.c in Clam AntiVirus (ClamAV) before 0.90.2 allow remote attackers to execute arbitrary code via a crafted CHM file that contains a negative integer, which passes a signed comparison and leads to a stack-based buffer overflow.
CVSS Score: 7.5 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=307562; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=513; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2007-2031
Published: 2007-04-16
Description: Buffer overflow in the HTTP proxy service for 3proxy 0.5 to 0.5.3g, and 0.6b-devel before 20070413, might allow remote attackers to execute arbitrary code via crafted transparent requests.
CVSS Score: 10.0 (HIGH)
References: http://3proxy.ru/0.5.3h/Changelog.txt; http://secunia.com/advisories/24961; http://secunia.com/advisories/25001
CVE: CVE-2007-2032
Published: 2007-04-16
Description: Cisco Wireless Control System (WCS) before 4.0.96.0 has a hard-coded FTP username and password for backup operations, which allows remote attackers to read and modify arbitrary files via unspecified vectors related to "properties of the FTP server," aka Bug ID CSCse93014.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24865; http://securitytracker.com/id?1017907; http://www.cisco.com/warp/public/707/cisco-sa-20070412-wcs.shtml
CVE: CVE-2007-2033
Published: 2007-04-16
Description: Unspecified vulnerability in Cisco Wireless Control System (WCS) before 4.0.81.0 allows remote authenticated users to read any configuration page by changing the group membership of user accounts, aka Bug ID CSCse78596.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/24865; http://securitytracker.com/id?1017907; http://www.cisco.com/warp/public/707/cisco-sa-20070412-wcs.shtml
CVE: CVE-2007-2034
Published: 2007-04-16
Description: Unspecified vulnerability in Cisco Wireless Control System (WCS) before 4.0.87.0 allows remote authenticated users to gain the privileges of the SuperUsers group, and manage the application and its networks, related to the group membership of user accounts, aka Bug ID CSCsg05190.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/24865; http://securitytracker.com/id?1017907; http://www.cisco.com/warp/public/707/cisco-sa-20070412-wcs.shtml
CVE: CVE-2007-2035
Published: 2007-04-16
Description: Cisco Wireless Control System (WCS) before 4.0.66.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain network organization data via a direct request for files in certain directories, aka Bug ID CSCsg04301.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24865; http://securitytracker.com/id?1017907; http://www.cisco.com/warp/public/707/cisco-sa-20070412-wcs.shtml
CVE: CVE-2007-2036
Published: 2007-04-16
Description: The SNMP implementation in the Cisco Wireless LAN Controller (WLC) before 20070419 uses the default read-only community public, and the default read-write community private, which allows remote attackers to read and modify SNMP variables, aka Bug ID CSCse02384.
CVSS Score: 10.0 (HIGH)
References: http://securitytracker.com/id?1017908; http://www.cisco.com/warp/public/707/cisco-sa-20070412-wlc.shtml; http://www.osvdb.org/34134
CVE: CVE-2007-2037
Published: 2007-04-16
Description: Cisco Wireless LAN Controller (WLC) before 3.2.116.21, and 4.0.x before 4.0.155.0, allows remote attackers on a local network to cause a denial of service (device crash) via malformed Ethernet traffic.
CVSS Score: 2.9 (LOW)
CWE: CWE-399
References: http://securitytracker.com/id?1017908; http://www.cisco.com/warp/public/707/cisco-sa-20070412-wlc.shtml; http://www.osvdb.org/34135
CVE: CVE-2007-2038
Published: 2007-04-16
Description: The Network Processing Unit (NPU) in the Cisco Wireless LAN Controller (WLC) before 3.2.193.5, 4.0.x before 4.0.206.0, and 4.1.x allows remote attackers on a local wireless network to cause a denial of service (loss of packet forwarding) via (1) crafted SNAP packets, (2) malformed 802.11 traffic, or (3) packets with certain header length values, aka Bug ID CSCsg36361.
CVSS Score: 6.1 (MEDIUM)
References: http://securitytracker.com/id?1017908; http://www.cisco.com/warp/public/707/cisco-sa-20070412-wlc.shtml; http://www.osvdb.org/34136
CVE: CVE-2007-2039
Published: 2007-04-16
Description: The Network Processing Unit (NPU) in the Cisco Wireless LAN Controller (WLC) before 3.2.171.5, 4.0.x before 4.0.206.0, and 4.1.x allows remote attackers on a local wireless network to cause a denial of service (loss of packet forwarding) via (1) crafted SNAP packets, (2) malformed 802.11 traffic, or (3) packets with certain header length values, aka Bug IDs CSCsg15901 and CSCsh10841.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://securitytracker.com/id?1017908; http://www.cisco.com/warp/public/707/cisco-sa-20070412-wlc.shtml; http://www.osvdb.org/34137
CVE: CVE-2007-2040
Published: 2007-04-16
Description: Cisco Aironet 1000 Series and 1500 Series Lightweight Access Points before 3.2.185.0, and 4.0.x before 4.0.206.0, have a hard-coded password, which allows attackers with physical access to perform arbitrary actions on the device, aka Bug ID CSCsg15192.
CVSS Score: 6.2 (MEDIUM)
References: http://securitytracker.com/id?1017908; http://www.cisco.com/warp/public/707/cisco-sa-20070412-wlc.shtml; http://www.osvdb.org/34133
CVE: CVE-2007-2041
Published: 2007-04-16
Description: Cisco Wireless LAN Controller (WLC) before 4.0.206.0 saves the WLAN ACL configuration with an invalid checksum, which prevents WLAN ACLs from being loaded at boot time, and might allow remote attackers to bypass intended access restrictions, aka Bug ID CSCse58195.
CVSS Score: 4.0 (MEDIUM)
References: http://securitytracker.com/id?1017908; http://www.cisco.com/warp/public/707/cisco-sa-20070412-wlc.shtml; http://www.osvdb.org/34138
CVE: CVE-2007-1558
Published: 2007-04-16
Description: The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions.  NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.
CVSS Score: 2.6 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://balsa.gnome.org/download.html; http://docs.info.apple.com/article.html?artnum=305530