deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-3075
Published: 2007-06-06
Description: Directory traversal vulnerability in Microsoft Internet Explorer allows remote attackers to read arbitrary files via directory traversal sequences in a URI with a certain scheme, possibly related to "..%5C" (encoded backslash) sequences.
CVSS Score: 7.8 (HIGH)
References: http://ha.ckers.org/blog/20070516/read-firefox-settings-poc/#comment-35888; http://osvdb.org/45436; http://ha.ckers.org/blog/20070516/read-firefox-settings-poc/#comment-35888
CVE: CVE-2007-3076
Published: 2007-06-06
Description: A certain ActiveX control in sasatl.dll in Zenturi ProgramChecker allows remote attackers to download arbitrary files to the client system via the DownloadFile function.
CVSS Score: 7.8 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-30-zenturi-programchecker-activex.html; http://osvdb.org/36046; http://secunia.com/advisories/25468
CVE: CVE-2007-3077
Published: 2007-06-06
Description: SQL injection vulnerability in listmembers.php in EQdkp 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the rank parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36410; http://secunia.com/advisories/25548; http://www.securityfocus.com/bid/24294
CVE: CVE-2007-3078
Published: 2007-06-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Aigaion before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via the title parameter (Authors and Publication titles) to (1) authoractions.php or (2) publicationactions.php.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36897; http://osvdb.org/36898; http://secunia.com/advisories/25503
CVE: CVE-2007-3079
Published: 2007-06-06
Description: listmembers.php in EQdkp 1.3.2c and earlier allows remote attackers to obtain sensitive information via an invalid compare parameter, which reveals the path.
CVSS Score: 7.1 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4372&w=2; http://osvdb.org/38363; https://exchange.xforce.ibmcloud.com/vulnerabilities/34694
CVE: CVE-2007-3080
Published: 2007-06-06
Description: SQL injection vulnerability in haberoku.asp in Hunkaray Okul Portaly 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38802; http://securityreason.com/securityalert/2766; http://www.securityfocus.com/bid/24288
CVE: CVE-2007-3081
Published: 2007-06-06
Description: PHP remote file inclusion vulnerability in sampleecommerce.php in Comdev eCommerce 4.1 allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38362; http://securityreason.com/securityalert/2779; http://www.securityfocus.com/archive/1/470435/100/0/threaded
CVE: CVE-2007-3082
Published: 2007-06-06
Description: Directory traversal vulnerability in sendcard.php in Sendcard 3.4.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sc_language parameter.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35741; http://www.securityfocus.com/bid/24308; http://www.vupen.com/english/advisories/2007/2058
CVE: CVE-2007-3083
Published: 2007-06-06
Description: Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/39739; http://securityreason.com/securityalert/2776; http://www.securityfocus.com/archive/1/470238/100/0/threaded
CVE: CVE-2007-3084
Published: 2007-06-06
Description: PHP remote file inclusion vulnerability in sampleblogger.php in Comdev Web Blogger 4.1 allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter, a different vector than CVE-2006-5441.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38361; http://www.securityfocus.com/archive/1/470437/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/34683
CVE: CVE-2007-3085
Published: 2007-06-06
Description: Multiple PHP remote file inclusion vulnerabilities in PBSite allow remote attackers to execute arbitrary PHP code via a URL in the (1) dbpath parameter to (a) useronline.php, (b) ucp.php, (c) setcookie.php, (d) sendpm.php, (e) search.php, (f) register.php, (g) profile.php, (h) post.php, (i) pmpshow.php, (j) pm.php, (k) ntopic.php, (l) nreply.php, (m) news.php, (n) memberslist.php, (o) logout.php, (p) login.php, (q) index.php, (r) help.php, (s) forum.php, (t) error.php, (u) editpost.php, (v) delpost.php, (w) delpm.php, (x) confirm.php, (y) board.php, (z) admin2.php, (aa) admin.php, or (bb) templates/pb/css/formstyles.php; or the (2) temppath parameter to (a) useronline.php, (c) setcookie.php, (e) search.php, (f) register.php, (h) post.php, (l) nreply.php, (m) news.php, (o) logout.php, (p) login.php, (q) index.php, (r) help.php, (s) forum.php, (t) error.php, (w) delpm.php, (x) confirm.php, or (y) board.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38759; http://osvdb.org/38760; http://osvdb.org/38761
CVE: CVE-2007-3086
Published: 2007-06-06
Description: Unrestricted critical resource lock in Agnitum Outpost Firewall PRO 4.0 1007.591.145 and earlier allows local users to cause a denial of service (system hang) by capturing the outpost_ipc_hdr mutex.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/42038; http://securityreason.com/securityalert/2775; http://www.matousec.com/info/advisories/Outpost-Enforcing-system-reboot-with-outpost_ipc_hdr-mutex.php
CVE: CVE-2007-3087
Published: 2007-06-06
Description: Peercast places a cleartext password in a query string, which might allow attackers to obtain sensitive information by sniffing the network, or obtaining Referer or browser history information.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/42055; http://securityreason.com/securityalert/2774; http://www.securityfocus.com/archive/1/470455/100/0/threaded
CVE: CVE-2007-3088
Published: 2007-06-06
Description: SQL injection vulnerability in index.php in Comicsense allows remote attackers to execute arbitrary SQL commands via the epi parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38370; http://securityreason.com/securityalert/2778; http://www.securityfocus.com/archive/1/470598/100/0/threaded
CVE: CVE-2007-2237
Published: 2007-06-06
Description: Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, which triggers a divide-by-zero error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://osvdb.org/38494; http://www.csis.dk/dk/forside/GdiPlus.pdf; http://www.kb.cert.org/vuls/id/290961
CVE: CVE-2007-0068
Published: 2007-06-06
Description: IBM Lotus Domino 7.0.x before 7.0.3 does not revalidate the signature on a signed scheduled agent after the agent is modified, which allows remote authenticated users to gain privileges via a modified agent in a server database.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35765; http://secunia.com/advisories/25520; http://www-1.ibm.com/support/docview.wss?uid=swg21258784
CVE: CVE-2007-2863
Published: 2007-06-06
Description: Stack-based buffer overflow in the Anti-Virus engine before content update 30.6 in multiple CA (formerly Computer Associates) products allows remote attackers to execute arbitrary code via a long filename in a .CAB file.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/25570; http://securityreason.com/securityalert/2790; http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-securitynotice.asp
CVE: CVE-2007-2864
Published: 2007-06-06
Description: Stack-based buffer overflow in the Anti-Virus engine before content update 30.6 in multiple CA (formerly Computer Associates) products allows remote attackers to execute arbitrary code via a large invalid value of the coffFiles field in a .CAB file.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/25570; http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-securitynotice.asp; http://www.kb.cert.org/vuls/id/105105
CVE: CVE-2007-3089
Published: 2007-06-06
Description: Mozilla Firefox before 2.0.0.5 does not prevent use of document.write to replace an IFRAME (1) during the load stage or (2) in the case of an about:blank frame, which allows remote attackers to display arbitrary HTML or execute certain JavaScript code, as demonstrated by code that intercepts keystroke values from window.event, aka the "promiscuous IFRAME access bug," a related issue to CVE-2006-4568.
CVSS Score: 4.3 (MEDIUM)
References: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt; ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc; http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html
CVE: CVE-2007-3090
Published: 2007-06-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-0591.  Reason: This candidate is a duplicate of CVE-2008-0591.  Notes: All CVE users should reference CVE-2008-0591 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-3091
Published: 2007-06-06
Description: Race condition in Microsoft Internet Explorer 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code or perform other actions upon a page transition, with the permissions of the old page and the content of the new page, as demonstrated by setInterval functions that set location.href within a try/catch expression, aka the "bait & switch vulnerability" or "Race Condition Cross-Domain Information Disclosure Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html; http://lcamtuf.coredump.cx/ierace/; http://osvdb.org/38497
CVE: CVE-2007-3092
Published: 2007-06-06
Description: Microsoft Internet Explorer 6 allows remote attackers to spoof the URL bar, and page properties including SSL certificates, by interrupting page loading through certain use of location DOM objects and setTimeout calls.  NOTE: this issue can be leveraged for phishing and other attacks.
CVSS Score: 9.3 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html; http://lcamtuf.coredump.cx/ietrap2/; http://osvdb.org/45437
CVE: CVE-2007-3093
Published: 2007-06-06
Description: Unspecified vulnerability in the logging mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 allows remote attackers to execute arbitrary code via unspecified vectors, related to the WBEM server.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/36590; http://secunia.com/advisories/25566; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102903-1
CVE: CVE-2007-3094
Published: 2007-06-06
Description: Unspecified vulnerability in the authentication mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 allows remote authenticated users to execute arbitrary code via unspecified vectors, related to the WBEM server.
CVSS Score: 9.0 (HIGH)
References: http://osvdb.org/36591; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102902-1; http://www.securityfocus.com/bid/24326
CVE: CVE-2007-2919
Published: 2007-06-06
Description: Multiple stack-based buffer overflows in the FViewerLoading ActiveX control (FlipViewerX.dll) in E-Book Systems FlipViewer before 4.1 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via long (1) UID, (2) Opf, (3) PAGENO, (4) LaunchMode, (5) SubID, (6) BookID, (7) LibraryID, (8) SubURL, and (9) LoadOpf properties.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/37042; http://secunia.com/advisories/25568; http://www.kb.cert.org/vuls/id/449089
CVE: CVE-2007-3095
Published: 2007-06-06
Description: Unspecified vulnerability in Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition (SAV CE) 10.1 and later, allows attackers to "disable the authentication system" and bypass authentication via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://osvdb.org/36107; http://secunia.com/advisories/25543; http://www.securityfocus.com/bid/24325
CVE: CVE-2007-3096
Published: 2007-06-06
Description: Directory traversal vulnerability in login.php in PBLang (PBL) 4.67.16.a and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36985; http://secunia.com/advisories/25572; http://www.securityfocus.com/bid/24340
CVE: CVE-2007-3097
Published: 2007-06-06
Description: my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/25563; http://www.osvdb.org/35246; http://www.s21sec.com/avisos/s21sec-035-en.txt
CVE: CVE-2007-3098
Published: 2007-06-06
Description: The SNMPc Server (crserv.exe) process in Castle Rock Computing SNMPc before 7.0.19 allows remote attackers to cause a denial of service (crash) via a crafted packet to port 165/TCP.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/36916; http://secunia.com/advisories/25485; http://www.securityfocus.com/bid/24292
CVE: CVE-2007-2512
Published: 2007-06-07
Description: Alcatel-Lucent IP-Touch Telephone running OmniPCX Enterprise 7.0 and later enables the mini switch by default, which allows attackers to gain access to the voice VLAN via daisy-chained systems.
CVSS Score: 7.5 (HIGH)
References: http://cert.uni-stuttgart.de/advisories/al-ip-touch-vlan-filtering.php; http://osvdb.org/38526; http://www.securityfocus.com/archive/1/470742/100/0/threaded
CVE: CVE-2007-2948
Published: 2007-06-07
Description: Multiple stack-based buffer overflows in stream/stream_cddb.c in MPlayer before 1.0rc1try3 allow remote attackers to execute arbitrary code via a CDDB entry with a long (1) album title or (2) category.
CVSS Score: 9.3 (HIGH)
References: http://lists.mplayerhq.hu/pipermail/mplayer-announce/2007-June/000066.html; http://osvdb.org/36991; http://secunia.com/advisories/24302
CVE: CVE-2007-3023
Published: 2007-06-07
Description: unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://kolab.org/security/kolab-vendor-notice-15.txt; http://lurker.clamav.net/message/20[PII_REDACTED]18.5c64abc4.en.html; http://osvdb.org/36908
CVE: CVE-2007-3109
Published: 2007-06-07
Description: The CERN Image Map Dispatcher (htimage.exe) in Microsoft FrontPage allows remote attackers to determine the existence, and possibly partial contents, of arbitrary files under the web root via a relative pathname in the PATH_INFO.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/42058; http://securityreason.com/securityalert/2784; http://www.securityfocus.com/archive/1/470458/100/0/threaded
CVE: CVE-2007-3110
Published: 2007-06-07
Description: Cross-site scripting (XSS) vulnerability in the Andy Frank Beatnik 1.0 extension for Firefox allows remote attackers to inject arbitrary web script or HTML via an RSS feed.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36982; http://secunia.com/advisories/25549; http://www.securityfocus.com/bid/24324
CVE: CVE-2007-3111
Published: 2007-06-07
Description: Buffer overflow in the Provideo Camimage ActiveX control in ISSCamControl.dll 1.0.1.5, when Internet Explorer 6 is used on Windows 2000 SP4, allows remote attackers to execute arbitrary code via a long URL property value.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/36962; http://secunia.com/advisories/25479; http://www.securityfocus.com/bid/24279
CVE: CVE-2007-3112
Published: 2007-06-07
Description: graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter, different vectors than CVE-2007-3113.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0074.html; http://bugs.cacti.net/view.php?id=955; http://fedoranews.org/updates/FEDORA-2007-219.shtml
CVE: CVE-2007-3113
Published: 2007-06-07
Description: Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_height or (2) graph_width parameter, different vectors than CVE-2007-3112.
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.cacti.net/view.php?id=955; http://fedoranews.org/updates/FEDORA-2007-219.shtml; http://mdessus.free.fr/?p=15
CVE: CVE-2007-3114
Published: 2007-06-07
Description: Memory leak in server/MaraDNS.c in MaraDNS before 1.2.12.05, and 1.3.x before 1.3.03, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, a different set of affected versions than CVE-2007-3115 and CVE-2007-3116.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/37018; http://secunia.com/advisories/25406; http://secunia.com/advisories/25767
CVE: CVE-2007-3115
Published: 2007-06-07
Description: Multiple memory leaks in server/MaraDNS.c in MaraDNS before 1.2.12.06, and 1.3.x before 1.3.05, allow remote attackers to cause a denial of service (memory consumption) via (1) reverse lookups or (2) requests for records in a class other than Internet (IN), a different set of affected versions than CVE-2007-3114 and CVE-2007-3116.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/37017; http://secunia.com/advisories/25406; http://secunia.com/advisories/25767
CVE: CVE-2007-3116
Published: 2007-06-07
Description: Memory leak in server/MaraDNS.c in MaraDNS 1.2.12.06 and 1.3.05 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, a different set of affected versions than CVE-2007-3114 and CVE-2007-3115.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://maradns.blogspot.com/search/label/MaraDNS; http://osvdb.org/37016; http://secunia.com/advisories/25767
CVE: CVE-2007-3117
Published: 2007-06-07
Description: Cross-site scripting (XSS) vulnerability in the SEO module in ADPLAN 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to HTTP headers.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/37080; http://secunia.com/advisories/25527
CVE: CVE-2007-3118
Published: 2007-06-07
Description: Multiple PHP remote file inclusion vulnerabilities in Kravchuk letter (K-letter) 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the scdir parameter to (1) action.php, (2) subs.php, or (3) unsubs.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38797; http://osvdb.org/38798; http://osvdb.org/38799
CVE: CVE-2007-3119
Published: 2007-06-07
Description: SQL injection vulnerability in news.asp in Kartli Alisveris Sistemi (aka Free-PayPal-Shopping-Cart) 1.0 allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/37170; http://secunia.com/advisories/25565; http://www.securityfocus.com/bid/24362
CVE: CVE-2007-3120
Published: 2007-06-07
Description: Cross-site scripting (XSS) vulnerability in public/code/cp_dpage.php in All In One Control Panel (AIOCP) before 1.3.017 allows remote attackers to inject arbitrary web script or HTML via the aiocp_dp parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35533; http://secunia.com/advisories/25584; http://sourceforge.net/project/shownotes.php?release_id=514035
CVE: CVE-2007-3121
Published: 2007-06-07
Description: Buffer overflow in the CCdecode function in contrib/ntsc-cc.c in the zvbi-ntsc-cc tool in Zapping VBI Library (ZVBI) before 0.2.25 allows attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long data during a reception error.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/43454; http://sourceforge.net/project/shownotes.php?release_id=492374&group_id=2599; http://www.vupen.com/english/advisories/2007/2088
CVE: CVE-2007-3122
Published: 2007-06-07
Description: The parsing engine in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to bypass scanning via a RAR file with a header flag value of 10, which can be processed by WinRAR.
CVSS Score: 5.0 (MEDIUM)
References: http://kolab.org/security/kolab-vendor-notice-15.txt; http://lurker.clamav.net/message/20[PII_REDACTED]18.5c64abc4.en.html; http://osvdb.org/45392
CVE: CVE-2007-3123
Published: 2007-06-07
Description: unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial of service (core dump) via a crafted RAR file with a modified vm_codesize value, which triggers a heap-based buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://kolab.org/security/kolab-vendor-notice-15.txt; http://lurker.clamav.net/message/20[PII_REDACTED]18.5c64abc4.en.html; http://osvdb.org/35522
CVE: CVE-2007-3024
Published: 2007-06-07
Description: libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the cli_gentempstream function in clamd/clamdscan, which might allow local users to read sensitive files.
CVSS Score: 2.1 (LOW)
References: http://kolab.org/security/kolab-vendor-notice-15.txt; http://lurker.clamav.net/message/20[PII_REDACTED]18.5c64abc4.en.html; http://secunia.com/advisories/25523
CVE: CVE-2007-3025
Published: 2007-06-07
Description: Unspecified vulnerability in libclamav/phishcheck.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1, when running on Solaris, allows remote attackers to cause a denial of service (hang) via unknown vectors related to the isURL function and regular expressions.
CVSS Score: 5.0 (MEDIUM)
References: http://kolab.org/security/kolab-vendor-notice-15.txt; http://lurker.clamav.net/message/20[PII_REDACTED]18.5c64abc4.en.html; http://secunia.com/advisories/25525
CVE: CVE-2007-3124
Published: 2007-06-07
Description: Buffer overflow in backup/src/vmsbackup.c (aka the backup utility) in FreeVMS before 0.3.6 might allow local users to gain privileges via a long string in response to an "extract [ny]" prompt.
CVSS Score: 4.6 (MEDIUM)
References: ftp://freevms.nvg.org/pub/vms/freevms/freevms-0_3_6.tgz; http://osvdb.org/35521; http://www.securityfocus.com/bid/24333
CVE: CVE-2007-3125
Published: 2007-06-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-6772.  Reason: This candidate is a duplicate of CVE-2006-6772.  Notes: All CVE users should reference CVE-2006-6772 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-3126
Published: 2007-06-08
Description: Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/43453; http://www.securityfocus.com/archive/1/470751/100/0/threaded; https://bugzilla.gnome.org/show_bug.cgi?id=778604