deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1683
Published: 2007-04-26
Description: Stack-based buffer overflow in the DoWebMenuAction function in the IncrediMail IMMenuShellExt ActiveX control (ImShExt.dll) allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34331; http://secunia.com/advisories/25051; http://www.kb.cert.org/vuls/id/906777
CVE: CVE-2007-2291
Published: 2007-04-26
Description: CRLF injection vulnerability in the Digest Authentication support for Microsoft Internet Explorer 7.0.5730.11 allows remote attackers to conduct HTTP response splitting attacks via a LF (%0a) in the username attribute.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2654; http://www.securityfocus.com/archive/1/466906/100/0/threaded; http://www.securityfocus.com/bid/23668
CVE: CVE-2007-2292
Published: 2007-04-26
Description: CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://secunia.com/advisories/27276; http://secunia.com/advisories/27298
CVE: CVE-2007-2293
Published: 2007-04-26
Description: Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long (1) T38FaxRateManagement or (2) T38FaxUdpEC SDP parameter in an SIP message, as demonstrated using SIP INVITE.
CVSS Score: 7.6 (HIGH)
References: http://secunia.com/advisories/24977; http://securityreason.com/securityalert/2645; http://www.asterisk.org/files/ASA-2007-010.pdf
CVE: CVE-2007-2294
Published: 2007-04-26
Description: The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (crash) by using MD5 authentication to authenticate a user that does not have a password defined in manager.conf, resulting in a NULL pointer dereference.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24977; http://secunia.com/advisories/25582; http://securityreason.com/securityalert/2646
CVE: CVE-2007-2295
Published: 2007-04-26
Description: Heap-based buffer overflow in the JVTCompEncodeFrame function in Apple Quicktime 7.1.5 and other versions before 7.2 allows remote attackers to execute arbitrary code via a crafted H.264 MOV file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=305947; http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.html; http://secunia.com/advisories/26034
CVE: CVE-2007-2296
Published: 2007-04-26
Description: Integer overflow in the FlipFileTypeAtom_BtoN function in Apple Quicktime 7.1.5, and other versions before 7.2, allows remote attackers to execute arbitrary code via a crafted M4V (MP4) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=305947; http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.html; http://secunia.com/advisories/26034
CVE: CVE-2007-2297
Published: 2007-04-26
Description: The SIP channel driver (chan_sip) in Asterisk before 1.2.18 and 1.4.x before 1.4.3 does not properly parse SIP UDP packets that do not contain a valid response code, which allows remote attackers to cause a denial of service (crash).
CVSS Score: 7.8 (HIGH)
References: http://bugs.digium.com/view.php?id=9313; http://secunia.com/advisories/25582; http://securityreason.com/securityalert/2644
CVE: CVE-2007-2298
Published: 2007-04-26
Description: Multiple PHP remote file inclusion vulnerabilities in Garennes 0.6.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the repertoire_config parameter to index.php in (1) cpe/, (2) direction/, or (3) professeurs/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35771; http://www.securityfocus.com/bid/23479; http://www.vupen.com/english/advisories/2007/1389
CVE: CVE-2007-2299
Published: 2007-04-26
Description: Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) dzial parameter to (a) katalog.php, or the (2) t parameter to (b) forum.php or (c) forum/viewtopic.php, different vectors than CVE-2006-4536.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35526; http://osvdb.org/35527; http://osvdb.org/35528
CVE: CVE-2007-2300
Published: 2007-04-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Endy Kristanto Surat kabar / News Management Online (aka phpwebnews) 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the m_txt parameter to (1) iklan.php, (2) index.php, or (3) bukutamu.php.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/2643; http://www.osvdb.org/35365; http://www.osvdb.org/35366
CVE: CVE-2007-2301
Published: 2007-04-26
Description: Multiple PHP remote file inclusion vulnerabilities in audioCMS arash 0.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the arashlib_dir parameter to (1) edit.inc.php and (2) list_features.inc.php in arash_lib/include, and (3) arash_gadmin.class.php and (4) arash_sadmin.class.php in arash_lib/class/.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/23496; http://www.vupen.com/english/advisories/2007/1396; https://www.exploit-db.com/exploits/3744
CVE: CVE-2007-2302
Published: 2007-04-26
Description: PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the cfg_file parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35731; http://www.securityfocus.com/bid/23464; https://exchange.xforce.ibmcloud.com/vulnerabilities/33619
CVE: CVE-2007-2303
Published: 2007-04-26
Description: Directory traversal vulnerability in includes/footer.php in News Manager Deluxe (NMDeluxe) 1.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the template parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34997; http://secunia.com/advisories/24896; http://www.vupen.com/english/advisories/2007/1395
CVE: CVE-2007-2304
Published: 2007-04-26
Description: Multiple directory traversal vulnerabilities in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter to categories.php and other unspecified files.
CVSS Score: 7.5 (HIGH)
References: http://www.attrition.org/pipermail/vim/2007-April/001544.html; http://www.securityfocus.com/bid/23485; http://www.vupen.com/english/advisories/2007/1387
CVE: CVE-2007-2305
Published: 2007-04-26
Description: Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35746; http://www.securityfocus.com/bid/23485; http://www.vupen.com/english/advisories/2007/1387
CVE: CVE-2007-2306
Published: 2007-04-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Virtual War (VWar) 1.5.0 R15 and earlier module for PHP-Nuke, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) memberlist parameter to extra/login.php and the (2) title parameter to extra/today.php.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/2642; http://www.securityfocus.com/archive/1/465612/100/0/threaded; http://www.securityfocus.com/bid/23478
CVE: CVE-2007-2307
Published: 2007-04-26
Description: PHP remote file inclusion vulnerability in engine/engine.inc.php in WebKalk2 1.9.0 allows remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35747; http://www.securityfocus.com/bid/23451; http://www.vupen.com/english/advisories/2007/1385
CVE: CVE-2007-2308
Published: 2007-04-26
Description: Cross-site scripting (XSS) vulnerability in cas.php in FloweRS 2.0 allows remote attackers to inject arbitrary web script or HTML via the rok parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/2639; http://www.securityfocus.com/archive/1/465730/100/0/threaded; http://www.securityfocus.com/bid/23488
CVE: CVE-2007-2309
Published: 2007-04-26
Description: Cross-site scripting (XSS) vulnerability in cas.php in FloweRS 2.0 allows remote attackers to inject arbitrary web script or HTML via the den parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35759; http://www.vupen.com/english/advisories/2007/1402; http://osvdb.org/35759
CVE: CVE-2007-2310
Published: 2007-04-26
Description: Cross-site scripting (XSS) vulnerability in plugins/spaw/img_popup.php in BloofoxCMS 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the img_url parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/2640; http://www.securityfocus.com/archive/1/465719/100/0/threaded; http://www.securityfocus.com/bid/23487
CVE: CVE-2007-2311
Published: 2007-04-26
Description: PHP remote file inclusion vulnerability in install/index.php in BlooFoxCMS 0.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the content_php parameter.  NOTE: this issue has been disputed by a reliable third party, stating that content_php is initialized before use
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2641; http://www.attrition.org/pipermail/vim/2007-April/001526.html; http://www.securityfocus.com/archive/1/465739/100/0/threaded
CVE: CVE-2007-2312
Published: 2007-04-26
Description: Multiple SQL injection vulnerabilities in the Virtual War (VWar) 1.5.0 R15 module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the n parameter to extra/online.php and other unspecified scripts in extra/.  NOTE: this might be same vulnerability as CVE-2006-4142; however, there is an intervening vendor fix announcement.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2642; http://www.attrition.org/pipermail/vim/2007-April/001519.html; http://www.securityfocus.com/archive/1/465612/100/0/threaded
CVE: CVE-2007-2313
Published: 2007-04-26
Description: PHP remote file inclusion vulnerability in getinfo1.php in the Shotcast 1.0 RC2 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/23444; http://www.vupen.com/english/advisories/2007/1384; https://exchange.xforce.ibmcloud.com/vulnerabilities/33599
CVE: CVE-2007-2314
Published: 2007-04-26
Description: Multiple SQL injection vulnerabilities in Crea-Book 1.0, and possibly earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) pseudo or (2) passe parameter to (a) configurer.php, (b) connect.php, (c) delete.php, (d) delete2.php, (e) index.php, (f) infos.php, (g) membres.php, (h) modif-infos.php, (i) modif-message.php, (j) modif.php, (k) uninstall.php, or (l) uninstall_table.php in admin/, different vectors than CVE-2007-2000.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24862; http://www.osvdb.org/34818; http://www.osvdb.org/34819
CVE: CVE-2007-2315
Published: 2007-04-26
Description: MiniShare 1.5.4, and possibly earlier, allows remote attackers to cause a denial of service (application crash) via a flood of requests for new connections.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24898; http://sourceforge.net/forum/forum.php?forum_id=685448; http://sourceforge.net/project/shownotes.php?group_id=109595&release_id=500854
CVE: CVE-2007-2316
Published: 2007-04-26
Description: Unspecified vulnerability in the admin script in Open Business Management (OBM) before 2.0.0 allows remote attackers to have an unknown impact by calling the script "in txt mode from a browser."
CVSS Score: 10.0 (HIGH)
References: http://obm.aliasource.org/changelogs/changelog-2.0.html; http://osvdb.org/34899; http://secunia.com/advisories/24775
CVE: CVE-2007-2317
Published: 2007-04-26
Description: Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier, as used by TOSMO/Mambo 4.0.12 and probably other products, allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to bb_plugins.php in (1) components/minibb/ or (2) components/com_minibb, or (3) configuration.php.  NOTE: the com_minibb.php vector is already covered by CVE-2006-3690.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35761; http://osvdb.org/35762; http://www.attrition.org/pipermail/vim/2007-April/001518.html
CVE: CVE-2007-2318
Published: 2007-04-26
Description: Multiple format string vulnerabilities in FileZilla before 2.2.32 allow remote attackers to execute arbitrary code via format string specifiers in (1) FTP server responses or (2) data sent by an FTP server.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/34436; http://osvdb.org/34437; http://secunia.com/advisories/24894
CVE: CVE-2007-2319
Published: 2007-04-26
Description: PHP remote file inclusion vulnerability in the AutoStand 1.1 and earlier module for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to mod_as_category.php in (1) modules/mod_as_category/ or (2) modules/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/35753; http://www.securityfocus.com/bid/23490; http://www.vupen.com/english/advisories/2007/1392
CVE: CVE-2007-2320
Published: 2007-04-26
Description: SQL injection vulnerability in kontakt.php in Papoo 3.02 and earlier allows remote attackers to execute arbitrary SQL commands via the menuid parameter, a different vector than CVE-2005-4478.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35477; http://osvdb.org/35834; http://secunia.com/advisories/25071
CVE: CVE-2007-2321
Published: 2007-04-27
Description: Unspecified vulnerability in the search functionality in SilverStripe 2.0.0 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35323; http://secunia.com/advisories/24936; http://www.silverstripe.com/silverstripe-2-0-1-released/
CVE: CVE-2007-2322
Published: 2007-04-27
Description: NMMediaServer.exe in Nero MediaHome 2.5.5.0 and CE 1.3.0.4 allows remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted packet that contains two CRLF sequences.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/35321; http://secunia.com/advisories/24724; http://www.securityfocus.com/bid/23640
CVE: CVE-2007-2323
Published: 2007-04-27
Description: Multiple buffer overflows in the WinDVDX ActiveX control in InterVideo Home Theater 2.1.13.0 and 2.5.13.58 allow remote attackers to execute arbitrary code via a long string argument to the (1) GetDiscType or (2) AddFileList method.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34330; http://secunia.com/advisories/24710; http://www.securityfocus.com/bid/23637
CVE: CVE-2007-2324
Published: 2007-04-27
Description: Directory traversal vulnerability in file.php in JulmaCMS 1.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35387; http://secunia.com/advisories/25053; http://www.securityfocus.com/bid/23642
CVE: CVE-2007-2325
Published: 2007-04-27
Description: PHP remote file inclusion vulnerability in include.php in MyNewsGroups :) allows remote attackers to execute arbitrary PHP code via a URL in the myng_root parameter.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/archive/1/466836/100/0/threaded; http://www.securityfocus.com/bid/23646; https://exchange.xforce.ibmcloud.com/vulnerabilities/33867
CVE: CVE-2007-2326
Published: 2007-04-27
Description: Multiple PHP remote file inclusion vulnerabilities in HYIP Manager Pro allow remote attackers to execute arbitrary PHP code via a URL in the plugin_file parameter to (1) Smarty.class.php and (2) Smarty_Compiler.class.php in inc/libs/; (3) core.display_debug_console.php, (4) core.load_plugins.php, (5) core.load_resource_plugin.php, (6) core.process_cached_inserts.php, (7) core.process_compiled_include.php, and (8) core.read_cache_file.php in inc/libs/core/; and other unspecified files.  NOTE: (1) and (2) might be incorrectly reported vectors in Smarty.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2634; http://www.securityfocus.com/archive/1/466837/100/0/threaded; http://www.securityfocus.com/bid/23663
CVE: CVE-2007-2327
Published: 2007-04-27
Description: PHP remote file inclusion vulnerability in _editor.php in HTMLeditbox 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the settings[app_dir] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35525; http://securityreason.com/securityalert/2635; http://www.securityfocus.com/archive/1/466841/100/0/threaded
CVE: CVE-2007-2328
Published: 2007-04-27
Description: PHP remote file inclusion vulnerability in addvip.php in phpMYTGP 1.4b allows remote attackers to execute arbitrary PHP code via a URL in the msetstr[PROGSDIR] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34161; http://securityreason.com/securityalert/2636; http://www.securityfocus.com/archive/1/466845/100/0/threaded
CVE: CVE-2007-2329
Published: 2007-04-27
Description: PHP remote file inclusion vulnerability in searchbot.php in Searchactivity allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34167; http://securityreason.com/securityalert/2637; http://www.securityfocus.com/archive/1/466846/100/0/threaded
CVE: CVE-2007-2330
Published: 2007-04-27
Description: PHP remote file inclusion vulnerability in includes_handler.php in DynaTracker 151 allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34159; http://osvdb.org/34160; http://securityreason.com/securityalert/2638
CVE: CVE-2007-2331
Published: 2007-04-27
Description: PHP remote file inclusion vulnerability in cart.php in Shop-Script 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the lang_list parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34162; http://securityreason.com/securityalert/2633; http://www.securityfocus.com/archive/1/466851/100/0/threaded
CVE: CVE-2007-2332
Published: 2007-04-27
Description: Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 6_05.140 uses a fixed DES key to encrypt passwords, which allows remote authenticated users to obtain a password via a brute force attack on a hash from the LDAP store.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/24962; http://www.securityfocus.com/bid/23562; http://www.vupen.com/english/advisories/2007/1464
CVE: CVE-2007-2333
Published: 2007-04-27
Description: Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 5_05.149, 5_05.3xx before 5_05.304, and 6.x before 6_05.140 includes the FIPSecryptedtest1219 and FIPSunecryptedtest1219 default accounts in the LDAP template, which might allow remote attackers to access the private network.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35055; http://secunia.com/advisories/24962; http://www.securityfocus.com/bid/23562
CVE: CVE-2007-2334
Published: 2007-04-27
Description: Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 5_05.149, 5_05.3xx before 5_05.304, and 6.x before 6_05.140 has two template HTML files lacking certain verification tags, which allows remote attackers to access the administration interface and change the device configuration via certain requests.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35056; http://secunia.com/advisories/24962; http://www.securityfocus.com/bid/23562
CVE: CVE-2007-2335
Published: 2007-04-27
Description: Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://lunapedia.lunascape.jp/index.php?title=Lunascape_4#2007.2F04.2F25_ver_4.2.0; http://osvdb.org/35364
CVE: CVE-2007-2336
Published: 2007-04-27
Description: Unspecified vulnerability in InterVations NaviCOPA Web Server 2.01 20070323 allows remote attackers to cause a denial of service (daemon crash) via crafted HTTP requests, as demonstrated by long requests containing '\A' characters, probably a different issue than CVE-2006-5112 and CVE-2007-1733.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/34504; http://secunia.com/advisories/25049; https://exchange.xforce.ibmcloud.com/vulnerabilities/33903
CVE: CVE-2007-2337
Published: 2007-04-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS 0.96.6 Alpha and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (b) magpie_simple.php in external/magpierss/scripts/, the (2) rss_url parameter to (c) magpie_slashbox.php in external/magpierss/scripts/, and the (3) body parameter to the (d) weblogmodule (aka Weblog Comments) module.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/35640; http://osvdb.org/35641; http://osvdb.org/35642
CVE: CVE-2007-2338
Published: 2007-04-27
Description: Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist deletions as an administrator via the delete parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35061; http://secunia.com/advisories/24932; http://securityreason.com/securityalert/2617
CVE: CVE-2007-2339
Published: 2007-04-27
Description: Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the "Edit groups / Add group" field in the (d) groups module in admin.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35062; http://osvdb.org/35063; http://osvdb.org/35064
CVE: CVE-2007-2340
Published: 2007-04-27
Description: Multiple PHP remote file inclusion vulnerabilities in inc/include_all.inc.php in phporacleview allow remote attackers to execute arbitrary PHP code via a URL in the (1) page_dir or (2) inc_dir parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/34300; http://secunia.com/advisories/25035; http://www.securityfocus.com/bid/23672
CVE: CVE-2007-2341
Published: 2007-04-27
Description: PHP remote file inclusion vulnerability in suite/index.php in phpBandManager 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35606; http://www.securityfocus.com/bid/23673; http://www.vupen.com/english/advisories/2007/1556