deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2963
Published: 2007-05-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board (IPB or IP.Board) 2.2.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via (1) module_bbcodeloader.php, (2) module_div.php, (3) module_email.php, (4) module_image.php, (5) module_link.php, or (6) the editorid parameter to module_table.php in jscripts/folder_rte_files/.  NOTE: some details were obtained from third party sources.
CVSS Score: 4.3 (MEDIUM)
References: http://forums.invisionpower.com/index.php?showtopic=235069; http://osvdb.org/35430; http://osvdb.org/35431
CVE: CVE-2007-2964
Published: 2007-05-31
Description: The fsmsh.dll host module in F-Secure Policy Manager Server 7.00 and earlier allows remote attackers to cause a denial of service (application crash) via NTFS reserved words in filenames in URLs.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/36723; http://secunia.com/advisories/25449; http://www.f-secure.com/security/fsc-2007-4.shtml
CVE: CVE-2007-2965
Published: 2007-05-31
Description: Unspecified vulnerability in the Real-time Scanning component in multiple F-Secure products, including Internet Security 2005, 2006 and 2007; Anti-Virus 2005, 2006 and 2007; and Solutions based on F-Secure Protection Service for Consumers 6.40 and earlier allows local users to gain privileges via a crafted I/O request packet (IRP), related to IOCTL (Input/Output Control) and "access validation of the address space."
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/36727; http://secunia.com/advisories/25439; http://www.f-secure.com/security/fsc-2007-2.shtml
CVE: CVE-2007-2966
Published: 2007-05-31
Description: Buffer overflow in the LHA decompression component in F-Secure anti-virus products for Microsoft Windows and Linux before 20070529 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted LHA archive, related to an integer wrap, a similar issue to CVE-2006-4335.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/36724; http://secunia.com/advisories/25426; http://securitytracker.com/id?1018147
CVE: CVE-2007-2967
Published: 2007-05-31
Description: Multiple F-Secure anti-virus products for Microsoft Windows and Linux before 20070522 allow remote attackers to cause a denial of service (file scanning infinite loop) via certain crafted (1) ARJ archives or (2) FSG packed files.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063714.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063715.html; http://osvdb.org/36725
CVE: CVE-2007-0328
Published: 2007-06-01
Description: The DWUpdateService ActiveX control in the agent (agent.exe) in Macrovision FLEXnet Connect 6.0 and Update Service 3.x to 5.x allows remote attackers to execute arbitrary commands via (1) the Execute method, and obtain the exit status using (2) the GetExitCode method.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/36896; http://secunia.com/advisories/25501; http://secunia.com/advisories/32842
CVE: CVE-2007-1362
Published: 2007-06-01
Description: Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to cause a denial of service via (1) a large cookie path parameter, which triggers memory consumption, or (2) an internal delimiter within cookie path or name values, which could trigger a misinterpretation of cookie data, aka "Path Abuse in Cookies."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://osvdb.org/35140; http://secunia.com/advisories/25476
CVE: CVE-2007-2867
Published: 2007-06-01
Description: Multiple vulnerabilities in the layout engine for Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2 allow remote attackers to cause a denial of service (crash) via vectors related to dangling pointers, heap corruption, signed/unsigned, and other issues.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://fedoranews.org/cms/node/2747; http://fedoranews.org/cms/node/2749; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
CVE: CVE-2007-2868
Published: 2007-06-01
Description: Multiple vulnerabilities in the JavaScript engine for Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://fedoranews.org/cms/node/2747; http://fedoranews.org/cms/node/2749; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
CVE: CVE-2007-2869
Published: 2007-06-01
Description: The form autocomplete feature in Mozilla Firefox 1.5.x before 1.5.0.12, 2.x before 2.0.0.4, and possibly earlier versions, allows remote attackers to cause a denial of service (persistent temporary CPU consumption) via a large number of characters in a submitted form.
CVSS Score: 4.3 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://osvdb.org/35135; http://secunia.com/advisories/25476
CVE: CVE-2007-2870
Published: 2007-06-01
Description: Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to bypass the same-origin policy and conduct cross-site scripting (XSS) and other attacks by using the addEventListener method to add an event listener for a site, which is executed in the context of that site.
CVSS Score: 4.3 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://osvdb.org/35136; http://secunia.com/advisories/25469
CVE: CVE-2007-2871
Published: 2007-06-01
Description: Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to spoof or hide the browser chrome, such as the location bar, by placing XUL popups outside of the browser's content pane.  NOTE: this issue can be leveraged for phishing and other attacks.
CVSS Score: 4.3 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://osvdb.org/35137; http://secunia.com/advisories/25469
CVE: CVE-2007-2917
Published: 2007-06-01
Description: Multiple buffer overflows in a certain ActiveX control in odapi.dll in Authentium Command Antivirus before 4.93.8 allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/36801; http://secunia.com/advisories/25500; http://www.kb.cert.org/vuls/id/563401
CVE: CVE-2007-2918
Published: 2007-06-01
Description: Multiple stack-based buffer overflows in ActiveX controls (1) VibeC in (a) vibecontrol.dll, (2) CallManager and (3) ViewerClient in (b) StarClient.dll, (4) ComLink in (c) uicomlink.dll, and (5) WebCamXMP in (d) wcamxmp.dll in Logitech VideoCall allow remote attackers to cause a denial of service (browser crash) and execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36820; http://osvdb.org/36821; http://osvdb.org/36822
CVE: CVE-2007-2968
Published: 2007-06-01
Description: Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field).
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36697; http://secunia.com/advisories/25424; http://securityreason.com/securityalert/2761
CVE: CVE-2007-2969
Published: 2007-06-01
Description: PHP remote file inclusion vulnerability in newsletter.php in WAnewsletter 2.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the waroot parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38812; http://www.securityfocus.com/bid/24177; https://www.exploit-db.com/exploits/4000
CVE: CVE-2007-2970
Published: 2007-06-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in cgi/block.cgi in 8e6 R3000 Internet Filter allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) CAT, and (3) USER parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36706; http://secunia.com/advisories/25448; http://www.securityfocus.com/bid/24206
CVE: CVE-2007-2971
Published: 2007-06-01
Description: SQL injection vulnerability in getnewsitem.php in gCards 1.46 and earlier allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5213&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9066&w=2; http://osvdb.org/36317
CVE: CVE-2007-2972
Published: 2007-06-01
Description: The file parsing engine in Avira Antivir Antivirus before 7.04.00.24 allows remote attackers to cause a denial of service (application crash) via a crafted UPX compressed file, which triggers a divide-by-zero error.
CVSS Score: 7.8 (HIGH)
References: http://forum.antivir-pe.de/thread.php?threadid=22528; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8045&w=2; http://osvdb.org/36710
CVE: CVE-2007-2973
Published: 2007-06-01
Description: Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed TAR archive.
CVSS Score: 7.8 (HIGH)
References: http://forum.antivir-pe.de/thread.php?threadid=22528; http://osvdb.org/36711; http://secunia.com/advisories/25417
CVE: CVE-2007-2974
Published: 2007-06-01
Description: Buffer overflow in the file parsing engine in Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to execute arbitrary code via a crafted LZH archive file, resulting from an "integer cast around."
CVSS Score: 10.0 (HIGH)
References: http://forum.antivir-pe.de/thread.php?threadid=22528; http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063624.html; http://osvdb.org/36712
CVE: CVE-2007-2975
Published: 2007-06-01
Description: The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://blogs.reucon.com/srt/2007/05/11/openfire_3_3_1_fixes_critical_security_issue.html; http://secunia.com/advisories/25427; http://www.igniterealtime.org/issues/browse/JM-1049
CVE: CVE-2007-2976
Published: 2007-06-01
Description: Centrinity FirstClass 8.3 and earlier, and Server and Internet Services 8.0 and earlier, do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS) attacks.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36415; http://secunia.com/advisories/25447; http://www.securityfocus.com/bid/24204
CVE: CVE-2007-2977
Published: 2007-06-01
Description: Buffer overflow in the receive function in submit/submitcommon.c in the submit daemon in DOMjudge before 2.0.0RC1 allows remote attackers to cause a denial of service or have other unspecified impact.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/36704; http://secunia.com/advisories/25435; http://sourceforge.net/project/shownotes.php?release_id=511778
CVE: CVE-2007-2978
Published: 2007-06-01
Description: Session fixation vulnerability in eggblog 3.1.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-59
References: http://osvdb.org/36734; http://secunia.com/advisories/25443; http://securityreason.com/securityalert/2756
CVE: CVE-2007-2979
Published: 2007-06-01
Description: Techno Dreams Web Directory / Search Engine 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database.mdb.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/36274; http://secunia.com/advisories/25436; http://securityreason.com/securityalert/2755
CVE: CVE-2007-2980
Published: 2007-06-01
Description: Heap-based buffer overflow in a certain ActiveX control in LEADTOOLS LEAD Raster ISIS Object (LTRIS14e.DLL) 14.5.0.44 allows remote attackers to cause a denial of service (Internet Explorer crash) or execute arbitrary code via a long DriverName property, a different ActiveX control than CVE-2007-2827.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://moaxb.blogspot.com/2007/05/moaxb-27-leadtools-raster-isis-object.html; http://osvdb.org/36043; http://secunia.com/advisories/25433
CVE: CVE-2007-2981
Published: 2007-06-01
Description: Buffer overflow in a certain ActiveX control in LEAD Technologies LEADTOOLS Raster OCR Document Object Library (ltrdc14e.dll) 14.5.0.44 allows remote attackers to execute arbitrary code via a long DictionaryFileName property.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://moaxb.blogspot.com/2007/05/moaxb-26-leadtools-raster-ocr-document.html; http://osvdb.org/36042; http://secunia.com/advisories/25444
CVE: CVE-2007-2982
Published: 2007-06-01
Description: Multiple buffer overflows in the British Telecommunications Business Connect webhelper ActiveX control before 1.0.0.7 in btbconnectwebcontrol.dll allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/36718; http://secunia.com/advisories/25472; http://www.kb.cert.org/vuls/id/210257
CVE: CVE-2007-2984
Published: 2007-06-01
Description: Multiple stack-based buffer overflows in the Media Technology Group CDPass ActiveX control in CDPass.dll allow remote attackers to execute arbitrary code via unspecified vectors, possibly involving the GetTOC2 method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/36717; http://secunia.com/advisories/25471; http://www.kb.cert.org/vuls/id/933353
CVE: CVE-2007-2985
Published: 2007-06-01
Description: Pheap 2.0 allows remote attackers to bypass authentication by setting a pheap_login cookie value to the administrator's username, which can be used to (1) obtain sensitive information, including the administrator password, via settings.php or (2) upload and execute arbitrary PHP code via an update_doc action in edit.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/36737; http://secunia.com/advisories/25460; https://exchange.xforce.ibmcloud.com/vulnerabilities/34592
CVE: CVE-2007-2986
Published: 2007-06-01
Description: PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the ROOT parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38364; http://www.attrition.org/pipermail/vim/2007-June/001638.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/34580
CVE: CVE-2007-2987
Published: 2007-06-01
Description: Multiple buffer overflows in certain ActiveX controls in sasatl.dll in Zenturi ProgramChecker allow remote attackers to execute arbitrary code via unspecified vectors, possibly involving the (1) DebugMsgLog or (2) DoFileProperties methods.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/36715; http://secunia.com/advisories/25473; http://www.kb.cert.org/vuls/id/603529
CVE: CVE-2007-2988
Published: 2007-06-01
Description: A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/create_engine.php followed by a request to admin/generate_tabs.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/42034; http://securityreason.com/securityalert/2763; http://www.securityfocus.com/archive/1/469808/100/0/threaded
CVE: CVE-2007-2989
Published: 2007-06-01
Description: The libike library in Sun Solaris 9 before 20070529 contains a logic error related to a certain pointer, which allows remote attackers to cause a denial of service (in.iked daemon crash) by sending certain UDP packets with a source port different from 500.  NOTE: this issue might overlap CVE-2006-2298.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/36584; http://secunia.com/advisories/25465; http://secunia.com/advisories/25661
CVE: CVE-2007-2990
Published: 2007-06-01
Description: Unspecified vulnerability in inetd in Sun Solaris 10 before 20070529 allows local users to cause a denial of service (daemon termination) via unspecified manipulations of the /var/run/.inetd.uds Unix domain socket file.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/36585; http://secunia.com/advisories/25450; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102921-1
CVE: CVE-2007-1593
Published: 2007-06-04
Description: The administrative service in Symantec Veritas Volume Replicator (VVR) for Windows 3.1 through 4.3, and VVR for Unix 3.5 through 5.0, in Symantec Storage Foundation products allows remote attackers to cause a denial of service (memory consumption and service crash) via a crafted packet to the service port (8199/tcp) that triggers a request for more memory than available, which causes the service to write to an invalid pointer.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cirt.dk/advisories/cirt-53-advisory.txt; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=539; http://osvdb.org/36102
CVE: CVE-2007-2279
Published: 2007-06-04
Description: The Scheduler Service (VxSchedService.exe) in Symantec Storage Foundation for Windows 5.0 allows remote attackers to bypass authentication and execute arbitrary code via certain requests to the service socket that create (1) PreScript or (2) PostScript registry values under Veritas\VxSvc\CurrentVersion\Schedules specifying future command execution.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://osvdb.org/36104; http://secunia.com/advisories/25537; http://seer.entsupport.symantec.com/docs/288627.htm
CVE: CVE-2007-2452
Published: 2007-06-04
Description: Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036.
CVSS Score: 6.0 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083; http://osvdb.org/36827; http://secunia.com/advisories/25477
CVE: CVE-2007-2513
Published: 2007-06-04
Description: Novell GroupWise 7 before SP2 20070524, and GroupWise 6 before 6.5 post-SP6 20070522, allows remote attackers to obtain credentials via a man-in-the-middle attack.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35942; http://secunia.com/advisories/25498; http://securitytracker.com/id?1018180
CVE: CVE-2007-2991
Published: 2007-06-04
Description: Cross-site scripting (XSS) vulnerability in includes/send.inc.php in Evenzia CMS allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38373; http://securityreason.com/securityalert/2757; http://www.securityfocus.com/archive/1/470280/100/0/threaded
CVE: CVE-2007-2992
Published: 2007-06-04
Description: Multiple SQL injection vulnerabilities in OmegaMw7.asp in OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) allow remote attackers to execute arbitrary SQL commands via (1) user-created text fields; the (2) F05003, (3) F05005, and (4) F05015 fields; and other unspecified standard fields.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0003.html; http://osvdb.org/37020; http://secunia.com/advisories/25545
CVE: CVE-2007-2993
Published: 2007-06-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in OmegaMw7.asp in OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) allow remote attackers to inject arbitrary web script or HTML via (1) user-created text fields; the (2) F05003, (3) F05005, and (4) F05015 fields; and other unspecified standard fields.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0003.html; http://osvdb.org/37021; http://secunia.com/advisories/25545
CVE: CVE-2007-2387
Published: 2007-06-04
Description: Apple Xserve Lights-Out Management before Firmware Update 1.0 on Intel hardware does not require a password for remote access to IPMI, which allows remote attackers to gain administrative access via unspecified requests with ipmitool.
CVSS Score: 10.0 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=305571; http://lists.apple.com/archives/security-announce/2007/May/msg00006.html; http://osvdb.org/36128
CVE: CVE-2007-2872
Published: 2007-06-04
Description: Multiple integer overflows in the chunk_split function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501; http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html
CVE: CVE-2007-2994
Published: 2007-06-04
Description: SQL injection vulnerability in news.php in DGNews 2.1 allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a fullnews action, a different vector than CVE-2007-0693.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/25438; http://securityreason.com/securityalert/2762; http://www.securityfocus.com/archive/1/469881/100/0/threaded
CVE: CVE-2007-2995
Published: 2007-06-04
Description: Unspecified vulnerability in sysmgt.websm.rte in IBM AIX 5.2.0 and 5.3.0 has unknown impact and attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36741; http://secunia.com/advisories/25458; http://www-1.ibm.com/support/docview.wss?uid=isg1IY95526
CVE: CVE-2007-2996
Published: 2007-06-04
Description: Unspecified vulnerability in perl.rte 5.8.0.10 through 5.8.0.95 on IBM AIX 5.2, and 5.8.2.10 through 5.8.2.50 on AIX 5.3, allows local users to gain privileges via unspecified vectors related to the installation and "waiting for a legitimate user to execute a binary that ships with Perl."
CVSS Score: 6.6 (MEDIUM)
References: ftp://aix.software.ibm.com/aix/efixes/security/perl_ifix.tar.Z; http://osvdb.org/36754; http://secunia.com/advisories/25478
CVE: CVE-2007-2997
Published: 2007-06-04
Description: Multiple SQL injection vulnerabilities in cgi-bin/reorder2.asp in SalesCart Shopping Cart allow remote attackers to execute arbitrary SQL commands via the password field and other unspecified vectors. NOTE: the vendor disputes this issue, stating "We were able to reproduce this sql injection on an old out-of-date demo on the website but not on the released product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/40145; http://securityreason.com/securityalert/2758; http://www.securityfocus.com/archive/1/469900/100/0/threaded
CVE: CVE-2007-2998
Published: 2007-06-04
Description: The Pascal run-time library (PAS$RTL.EXE) before 20070418 on OpenVMS for Integrity Servers 8.3, and PAS$RTL.EXE before 20070419 on OpenVMS Alpha 8.3, does not properly restore PC and PSL values, which allows local users to cause a denial of service (system crash) via certain Pascal code.
CVSS Score: 4.9 (MEDIUM)
References: http://mail.openvms.org:8100/Lists/alerts/Message/503.html; http://mail.openvms.org:8100/Lists/alerts/Message/504.html; http://osvdb.org/36800