deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-4447
Published: 2007-08-21
Description: Multiple buffer overflows in the client in Toribash 2.71 and earlier allow remote attackers to (1) execute arbitrary code via a long game command in a replay (.rpl) file and (2) cause a denial of service (application crash) via a long SAY command that omits a required LF character; and allow remote Toribash servers to execute arbitrary code via (3) a long game command and (4) a long SAY command that omits a required LF character.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.org/poc/toribashish.zip; http://secunia.com/advisories/26507; http://securityreason.com/securityalert/3033
CVE: CVE-2007-4448
Published: 2007-08-21
Description: The server in Toribash 2.71 and earlier does not properly handle partially joined clients that are temporarily assigned the ID of -1, which allows remote attackers to cause a denial of service (daemon crash) via a GRIP command with the ID of -1.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.org/poc/toribashish.zip; http://secunia.com/advisories/26507; http://securityreason.com/securityalert/3033
CVE: CVE-2007-4449
Published: 2007-08-21
Description: The client in Toribash 2.71 and earlier allows remote attackers to cause a denial of service (application hang) via a command without an LF character, as demonstrated by a SAY command.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.org/poc/toribashish.zip; http://secunia.com/advisories/26507; http://securityreason.com/securityalert/3033
CVE: CVE-2007-4450
Published: 2007-08-21
Description: The server in Toribash 2.71 and earlier does not properly handle long commands, which allows remote attackers to trigger a protocol violation in which data is sent to other clients without a required LF character, as demonstrated by a SAY command.  NOTE: the security impact of this violation is not clear, although it probably makes exploitation of CVE-2007-4449 easier.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.org/poc/toribashish.zip; http://secunia.com/advisories/26507; http://securityreason.com/securityalert/3033
CVE: CVE-2007-4451
Published: 2007-08-21
Description: The server in Toribash 2.71 and earlier on Windows allows remote attackers to cause a denial of service (continuous beep and server hang) via certain commands that contain many 0x07 or other invalid characters.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.org/poc/toribashish.zip; http://secunia.com/advisories/26507; http://securityreason.com/securityalert/3033
CVE: CVE-2007-4452
Published: 2007-08-21
Description: The client in Toribash 2.71 and earlier allows remote attackers to cause a denial of service (disconnection) via a long (1) emote or (2) SPEC command.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.org/poc/toribashish.zip; http://secunia.com/advisories/26507; http://securityreason.com/securityalert/3033
CVE: CVE-2007-4213
Published: 2007-08-21
Description: Palm OS on Treo 650, 680, 700p, and 755p Smart phones allows remote attackers to cause a denial of service (device reset or hang) via a flood of large ICMP echo requests.  NOTE: this is probably a different vulnerability than CVE-2003-0293.
CVSS Score: 7.1 (HIGH)
References: http://securityreason.com/securityalert/3034; http://www.securityfocus.com/archive/1/477128/100/0/threaded; http://www.securityfocus.com/archive/1/477169/100/0/threaded
CVE: CVE-2007-4216
Published: 2007-08-21
Description: vsdatant.sys 6.5.737.0 in Check Point Zone Labs ZoneAlarm before 7.0.362 allows local users to gain privileges via a crafted Interrupt Request Packet (Irp) in a METHOD_NEITHER (1) IOCTL 0x8400000F or (2) IOCTL 0x84000013 request, which can be used to overwrite arbitrary memory locations.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=585; http://secunia.com/advisories/26513; http://securitytracker.com/id?1018589
CVE: CVE-2007-4453
Published: 2007-08-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the (1) s parameter to index.php, and the (2) q parameter to (a) faq.php, (b) member.php, (c) memberlist.php, (d) calendar.php, (e) search.php, (f) forumdisplay.php, (g) showgroups.php, (h) online.php, and (i) sendmessage.php.  NOTE: these issues have been disputed by the vendor, stating "I can't reproduce a single one of these".  The researcher is known to be unreliable
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/476924/100/0/threaded; http://www.securityfocus.com/archive/1/476940/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/36084
CVE: CVE-2007-4454
Published: 2007-08-21
Description: Eval injection vulnerability in environment.php in Olate Download (od) 3.4.1 allows context-dependent attackers to execute arbitrary code via a crafted version string, as referenced by the (1) PDO::ATTR_SERVER_VERSION or (2) PDO::ATTR_CLIENT_VERSION attribute.
CVSS Score: 6.8 (MEDIUM)
References: http://myimei.com/security/2007-08-17/olate-download-341-environmentphpphp-code-execution.html; http://securityreason.com/securityalert/3038; http://sourceforge.net/project/shownotes.php?group_id=188052&release_id=533628
CVE: CVE-2007-3618
Published: 2007-08-21
Description: Stack-based buffer overflow in the NetWorker Remote Exec Service (nsrexecd.exe) in EMC Software NetWorker 7.x.x allows remote attackers to execute arbitrary code via a (1) poll or (2) kill request with a "long invalid subcmd."
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/39744; http://secunia.com/advisories/26517; http://securityreason.com/securityalert/3043
CVE: CVE-2007-4456
Published: 2007-08-21
Description: SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component for Mambo allows remote attackers to execute arbitrary SQL commands via the aid parameter.  NOTE: it was later reported that 2.40 is also affected, and that the component can be used in Joomla! in addition to Mambo.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/26556; http://securityreason.com/securityalert/3041; http://www.securityfocus.com/archive/1/477174/100/0/threaded
CVE: CVE-2007-4457
Published: 2007-08-21
Description: Directory traversal vulnerability in forumreply.php in Dalai Forum 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the chemin parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/37831; http://www.securityfocus.com/archive/1/477238/100/0/threaded; http://www.securityfocus.com/bid/25361
CVE: CVE-2007-4458
Published: 2007-08-21
Description: PHP remote file inclusion vulnerability in includes/class/class_tpl.php in Firesoft allows remote attackers to execute arbitrary PHP code via a URL in the cache_file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/37699; http://www.securityfocus.com/archive/1/477243/100/0/threaded; http://www.securityfocus.com/bid/25366
CVE: CVE-2007-4459
Published: 2007-08-21
Description: Cisco IP Phone 7940 and 7960 with P0S3-08-6-00 firmware, and other SIP firmware before 8.7(0), allows remote attackers to cause a denial of service (device reboot) via (1) a certain sequence of 10 invalid SIP INVITE and OPTIONS messages; or (2) a certain invalid SIP INVITE message that contains a remote tag, followed by a certain set of two related SIP OPTIONS messages.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065401.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065402.html; http://secunia.com/advisories/26547
CVE: CVE-2007-4460
Published: 2007-08-21
Description: The RenderV2ToFile function in tag_file.cpp in id3lib (aka libid3) 3.8.3 allows local users to overwrite arbitrary files via a symlink attack on a temporary file whose name is constructed from the name of a file being tagged.
CVSS Score: 7.2 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=438540; http://secunia.com/advisories/26536; http://secunia.com/advisories/26646
CVE: CVE-2007-4461
Published: 2007-08-21
Description: NuFW 2.2.3, and certain other versions after 2.0, allows remote attackers to bypass time-based packet filtering rules via certain "out of period" choices of packet transmission time.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/39725; http://secunia.com/advisories/26546; http://www.nufw.org/+NuFW-2-2-4%2C201+.html
CVE: CVE-2007-4462
Published: 2007-08-21
Description: lib/Locale/Po4a/Po.pm in po4a before 0.32 allows local users to overwrite arbitrary files via a symlink attack on the gettextization.failed.po temporary file.
CVSS Score: 3.3 (LOW)
References: http://alioth.debian.org/frs/shownotes.php?release_id=1019; http://bugs.gentoo.org/show_bug.cgi?id=189440; http://secunia.com/advisories/26492
CVE: CVE-2007-4463
Published: 2007-08-21
Description: The Fileinfo 2.0.9 plugin for Total Commander allows user-assisted remote attackers to cause a denial of service (unhandled exception) via an invalid RVA address function pointer in (1) an IMAGE_THUNK_DATA structure, involving the (a) OriginalFirstThunk and (b) FirstThunk IMAGE_IMPORT_DESCRIPTOR fields, or (2) the AddressOfNames IMAGE_EXPORT_DIRECTORY field in a PE file.
CVSS Score: 5.0 (MEDIUM)
References: http://blog.hispasec.com/lab/230; http://blog.hispasec.com/lab/advisories/adv_Fileinfo-2_09_multiple_vulnerabilities.txt; http://osvdb.org/46835
CVE: CVE-2007-4464
Published: 2007-08-21
Description: CRLF injection vulnerability in the Fileinfo 2.0.9 plugin for Total Commander allows user-assisted remote attackers to spoof the information in the Image File Header tab via strings with CRLF sequences in the IMAGE_EXPORT_DIRECTORY array in a PE file, which could complicate forensics investigations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://blog.hispasec.com/lab/230; http://blog.hispasec.com/lab/advisories/adv_Fileinfo-2_09_multiple_vulnerabilities.txt; http://osvdb.org/46834
CVE: CVE-2007-4455
Published: 2007-08-22
Description: The SIP channel driver (chan_sip) in Asterisk Open Source 1.4.x before 1.4.11, AsteriskNOW before beta7, Asterisk Appliance Developer Kit 0.x before 0.8.0, and s800i (Asterisk Appliance) 1.x before 1.0.3 allows remote attackers to cause a denial of service (memory exhaustion) via a SIP dialog that causes a large number of history entries to be created.
CVSS Score: 5.0 (MEDIUM)
References: http://downloads.digium.com/pub/asa/AST-2007-020.html; http://seclists.org/fulldisclosure/2007/Aug/0393.html; http://secunia.com/advisories/26553
CVE: CVE-2007-3873
Published: 2007-08-22
Description: Stack-based buffer overflow in vstlib32.dll 1.2.0.1012 in the SSAPI Engine 5.0.0.1066 through 5.2.0.1012 in Trend Micro AntiSpyware 3.5 and PC-Cillin Internet Security 2007 15.0 through 15.3, when the Venus Spy Trap (VST) feature is enabled, allows local users to cause a denial of service (service crash) or execute arbitrary code via a file with a long pathname, which triggers the overflow during a ReadDirectoryChangesW callback notification.
CVSS Score: 6.9 (MEDIUM)
References: http://esupport.trendmicro.com/support/consumer/search.do?cmd=displayKC&externalId=PUB-en-1035845; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=586; http://secunia.com/advisories/26557
CVE: CVE-2007-4218
Published: 2007-08-22
Description: Multiple buffer overflows in the ServerProtect service (SpntSvc.exe) in Trend Micro ServerProtect for Windows before 5.58 Security Patch 4 allow remote attackers to execute arbitrary code via certain RPC requests to certain TCP ports that are processed by the (1) RPCFN_ENG_NewManualScan, (2) RPCFN_ENG_TimedNewManualScan, and (3) RPCFN_SetComputerName functions in (a) StRpcSrv.dll; the (4) RPCFN_CMON_SetSvcImpersonateUser and (5) RPCFN_OldCMON_SetSvcImpersonateUser functions in (b) Stcommon.dll; the (6) RPCFN_ENG_TakeActionOnAFile and (7) RPCFN_ENG_AddTaskExportLogItem functions in (c) Eng50.dll; the (8) NTF_SetPagerNotifyConfig function in (d) Notification.dll; or the (9) RPCFN_CopyAUSrc function in the (e) ServerProtect Agent service.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20, CWE-119, CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=587; http://secunia.com/advisories/26523; http://securityreason.com/securityalert/3052
CVE: CVE-2007-4219
Published: 2007-08-22
Description: Integer overflow in the RPCFN_SYNC_TASK function in StRpcSrv.dll, as used by the ServerProtect service (SpntSvc.exe), in Trend Micro ServerProtect for Windows before 5.58 Security Patch 4 allows remote attackers to execute arbitrary code via a certain integer field in a request packet to TCP port 5168, which triggers a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=588; http://secunia.com/advisories/26523; http://securityreason.com/securityalert/3052
CVE: CVE-2007-4477
Published: 2007-08-22
Description: The administration interface in the Planet VC-200M VDSL2 router allows remote attackers to cause a denial of service (administration interface outage) via an HTTP request without a Host header.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/26559; http://securityvulns.com/news/Planet/VC-200M/DoS.html; http://securityvulns.ru/Rdocument847.html
CVE: CVE-2007-4478
Published: 2007-08-22
Description: Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6.0 and 7 allows user-assisted remote attackers to inject arbitrary web script or HTML in the local zone via a URI, when the document at the associated URL is saved to a local file, which then contains the URI string along with the document's original content.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/45826; http://securityvulns.com/news/Microsoft/IE/saved-css.html; http://securityvulns.ru/Rdocument865.html
CVE: CVE-2007-4479
Published: 2007-08-22
Description: Cross-site scripting (XSS) vulnerability in search.html in Search Engine Builder allows remote attackers to inject arbitrary web script or HTML via the searWords parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37097; http://secunia.com/advisories/26560; http://securityvulns.ru/Rdocument843.html
CVE: CVE-2007-4480
Published: 2007-08-22
Description: Cross-site scripting (XSS) vulnerability in index.php in the Sirius 1.0 theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38326; http://securityvulns.ru/Rdocument839.html; http://websecurity.com.ua/1252/
CVE: CVE-2007-4481
Published: 2007-08-22
Description: Cross-site scripting (XSS) vulnerability in index.php in the (1) Blix 0.9.1 and (2) Blix 0.9.1 Rus themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
CVSS Score: 4.3 (MEDIUM)
References: http://securityvulns.ru/Rdocument825.html; http://websecurity.com.ua/1248/; http://www.securityfocus.com/archive/1/477253/100/0/threaded
CVE: CVE-2007-4482
Published: 2007-08-22
Description: Cross-site scripting (XSS) vulnerability in index.php in the Pool 1.0.7 theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37299; http://secunia.com/advisories/26563; http://securityvulns.ru/Rdocument771.html
CVE: CVE-2007-4483
Published: 2007-08-22
Description: Cross-site scripting (XSS) vulnerability in index.php in the WordPress Classic 1.5 theme in WordPress before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38450; http://securityvulns.ru/Rdocument751.html; http://websecurity.com.ua/1234/
CVE: CVE-2007-4484
Published: 2007-08-22
Description: PHP remote file inclusion vulnerability in login.php in My_REFERER 1.08 allows remote attackers to execute arbitrary PHP code via a URL in the value parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38332; http://securityvulns.com/Rdocument846.html; http://securityvulns.com/source13951.html
CVE: CVE-2007-4485
Published: 2007-08-22
Description: PHP remote file inclusion vulnerability in visitor.php in Butterfly online visitors counter 1.08, when used with certain older versions of PHP with improper SERVER superglobal handling, allows remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter.  NOTE: it could be argued that this vulnerability is caused by a problem in PHP and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Butterfly online visitors counter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/38327; http://securityvulns.com/Rdocument845.html; http://securityvulns.com/source26994.html
CVE: CVE-2007-4486
Published: 2007-08-22
Description: Multiple PHP remote file inclusion vulnerabilities in index.php in Linkliste 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) styl[top], (2) url_eintrag, or (3) styl[themen] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38330; http://securityvulns.com/Rdocument752.html; http://securityvulns.com/source26994.html
CVE: CVE-2007-4487
Published: 2007-08-22
Description: Cross-site scripting (XSS) vulnerability in D22-Shoutbox for Invision Power Board (IPB or IP.Board) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/38356; http://securityreason.com/securityalert/3051; http://www.hackerscenter.com/Archive/view.asp?id=27873
CVE: CVE-2007-4488
Published: 2007-08-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Siemens Gigaset SE361 WLAN router with firmware 1.00.0 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI immediately following the filename for (1) a GIF filename, which triggers display of the GIF file in text format and an unspecified denial of service (crash); or (2) the login.tri filename, which triggers a continuous loop of the browser attempting to visit the login page.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/45841; http://osvdb.org/45842; http://securityreason.com/securityalert/3050
CVE: CVE-2007-4489
Published: 2007-08-22
Description: Buffer overflow in the IUAComFormX ActiveX control in uacomx.ocx 2.0.1 in the eCentrex VOIP Client module allows remote attackers to execute arbitrary code via a long Username argument to the ReInit method.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/37738; http://secunia.com/advisories/26525; http://www.securityfocus.com/bid/25383
CVE: CVE-2007-4490
Published: 2007-08-22
Description: Multiple buffer overflows in EarthAgent.exe in Trend Micro ServerProtect 5.58 for Windows before Security Patch 4 allow remote attackers to have an unknown impact via certain RPC function calls to (1) RPCFN_EVENTBACK_DoHotFix or (2) CMD_CHANGE_AGENT_REGISTER_INFO.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/26523; http://securityreason.com/securityalert/3052; http://www.trendmicro.com/ftp/documentation/readme/spnt_558_win_en_securitypatch4_readme.txt
CVE: CVE-2007-4491
Published: 2007-08-23
Description: SQL injection vulnerability in uyeler2.php in Gurur haber 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/38333; http://securityreason.com/securityalert/3049; http://www.securityfocus.com/archive/1/477121/100/0/threaded
CVE: CVE-2007-4492
Published: 2007-08-23
Description: Multiple unspecified vulnerabilities in the ata disk driver in Sun Solaris 8, 9, and 10 on the x86 platform before 20070821 allow local users to cause a denial of service (system panic) via unspecified ioctl functions, aka Bug 6433123.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/26558; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102988-1; http://www.securityfocus.com/bid/25389
CVE: CVE-2007-4493
Published: 2007-08-23
Description: eZ publish before 3.8.9, and 3.9 before 3.9.3, does not properly check permissions on module views that lack a policy function, which has unknown impact and attack vectors, as demonstrated by a vulnerability in the discount functionality in the shop module.
CVSS Score: 10.0 (HIGH)
References: http://ez.no/community/news/ez_publish_security_fixes_3_9_3_and_3_8_9; http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_8_to_3_8_9; http://ez.no/download/ez_publish/changelogs/ez_publish_3_9/changelog_3_9_2_to_3_9_3
CVE: CVE-2007-4494
Published: 2007-08-23
Description: The tipafriend function in eZ publish before 3.8.9, and 3.9 before 3.9.3, does not limit access by anonymous users, which allows remote attackers to conduct spam attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://ez.no/community/news/ez_publish_security_fixes_3_9_3_and_3_8_9; http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_8_to_3_8_9; http://ez.no/download/ez_publish/changelogs/ez_publish_3_9/changelog_3_9_2_to_3_9_3
CVE: CVE-2007-4495
Published: 2007-08-23
Description: Unspecified vulnerability in the ata disk driver in Sun Solaris 10 on the x86 platform before 20070821 allows local users to cause a denial of service (system panic) via an unspecified ioctl function, aka Bug 6433124.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/36615; http://secunia.com/advisories/26558; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102988-1
CVE: CVE-2007-4498
Published: 2007-08-23
Description: The Grandstream SIP Phone GXV-3000 with firmware 1.0.1.7, Loader 1.0.0.6, and Boot 1.0.0.18 allows remote attackers to force silent call completion, eavesdrop on the phone's local environment, and cause a denial of service (blocked call reception) via a certain SIP INVITE message followed by a certain "SIP/2.0 183 Session Progress" message.
CVSS Score: 7.8 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065417.html; http://osvdb.org/40185; http://secunia.com/advisories/26568
CVE: CVE-2007-4499
Published: 2007-08-23
Description: Unrestricted file upload vulnerability in output.php in American Financing eMail Image Upload 4.1 allows remote attackers to upload and execute arbitrary code via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/45827; http://www.securityfocus.com/bid/25404; http://osvdb.org/45827
CVE: CVE-2007-4500
Published: 2007-08-23
Description: Unspecified vulnerability in TunnelRunner in SSHKeychain before 0.8.2 beta, and possibly later versions, allows local users to gain privileges via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/26617; http://www.securityfocus.com/bid/25409; http://www.securitytracker.com/id?1018630
CVE: CVE-2007-4501
Published: 2007-08-23
Description: Unspecified vulnerability in PassphraseRequester in SSHKeychain before 0.8.2 beta allows attackers to obtain sensitive information (passwords) via unknown vectors, related to "poor protection."
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/26617; http://www.securityfocus.com/bid/25409; http://www.securitytracker.com/id?1018632
CVE: CVE-2007-4502
Published: 2007-08-23
Description: SQL injection vulnerability in index.php in the BibTeX component (com_jombib) 1.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the afilter parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38357; https://exchange.xforce.ibmcloud.com/vulnerabilities/36225; https://www.exploit-db.com/exploits/4310
CVE: CVE-2007-4503
Published: 2007-08-23
Description: SQL injection vulnerability in index.php in the Nice Talk component (com_nicetalk) 0.9.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the tagid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/26576; http://www.osvdb.org/36587; http://www.securityfocus.com/bid/31818