deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2381
Published: 2007-04-30
Description: The MochiKit framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/43326; http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf; http://osvdb.org/43326
CVE: CVE-2007-2382
Published: 2007-04-30
Description: The Moo.fx framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/43327; http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf; http://osvdb.org/43327
CVE: CVE-2007-2383
Published: 2007-04-30
Description: The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS Score: 5.0 (MEDIUM)
References: http://dev.rubyonrails.org/ticket/7910; http://prototypejs.org/2007/4/24/release-candidate-3; http://secunia.com/advisories/37677
CVE: CVE-2007-2384
Published: 2007-04-30
Description: The Script.aculo.us framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/43319; http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf; http://osvdb.org/43319
CVE: CVE-2007-2385
Published: 2007-04-30
Description: The Yahoo! UI framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/43324; http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf; http://osvdb.org/43324
CVE: CVE-2007-2411
Published: 2007-05-01
Description: PHP remote file inclusion vulnerability in index.php in Sphider 1.2.x allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter.  NOTE: a third party disputes this vulnerability, stating that "the application is not vulnerable to this issue.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34174; http://securityreason.com/securityalert/2648; http://www.securityfocus.com/archive/1/467102/100/0/threaded
CVE: CVE-2007-2412
Published: 2007-05-01
Description: Directory traversal vulnerability in modules/file.php in Seir Anphin allows remote attackers to obtain sensitive information via a .. (dot dot) in the a[filepath] parameter.  NOTE: a third party has disputed this issue because the a array is populated by a database query before use
CVSS Score: 7.8 (HIGH)
References: http://securityreason.com/securityalert/2651; http://www.attrition.org/pipermail/vim/2007-April/001567.html; http://www.securityfocus.com/archive/1/467103/100/0/threaded
CVE: CVE-2007-2413
Published: 2007-05-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-2459.  Reason: This candidate is a duplicate of CVE-2007-2459.  Notes: All CVE users should reference CVE-2007-2459 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-2414
Published: 2007-05-01
Description: MyServer before 0.8.8 allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35469; http://secunia.com/advisories/25026; http://sourceforge.net/project/shownotes.php?release_id=504709&group_id=63119
CVE: CVE-2007-2415
Published: 2007-05-01
Description: Pi3Web Web Server 2.0.3 PL1 allows remote attackers to cause a denial of service (application exit) via a long URI.  NOTE: this issue was originally reported as a crash, but the vendor states that the impact is a "clean" exit in which "the server I/O loop finishes and the process exits normally."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/25009; http://sourceforge.net/forum/forum.php?thread_id=1725156&forum_id=131392; http://www.securityfocus.com/bid/23713
CVE: CVE-2007-2416
Published: 2007-05-01
Description: SQL injection vulnerability in home.php in E-Annu allows remote attackers to execute arbitrary SQL commands via the a parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35619; http://securityreason.com/securityalert/2650; http://www.securityfocus.com/archive/1/467230/100/0/threaded
CVE: CVE-2007-2420
Published: 2007-05-02
Description: SQL injection vulnerability in bry.asp in Burak Yilmaz Blog 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35666; http://secunia.com/advisories/25158; http://www.securityfocus.com/archive/1/466967/100/0/threaded
CVE: CVE-2007-2421
Published: 2007-05-02
Description: Buffer overflow in Hitachi Groupmax Mobile Option for Mobile-Phone 07-00 through 07-30, 5 for i-mode 05-11 through 05-23, and 6 for EZweb 06-00 through 06-04 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35437; http://secunia.com/advisories/25020; http://www.hitachi-support.com/security_e/vuls_e/HS07-009_e/index-e.html
CVE: CVE-2007-2422
Published: 2007-05-02
Description: Multiple PHP remote file inclusion vulnerabilities in Modules Builder (modbuild) 4.1 for Comdev One Admin allow remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter to (1) config-bak.php or (2) config.php.  NOTE: CVE disputes this vulnerability because the unmodified scripts set the applicable variable to the empty string; reasonable modified copies would use a fixed pathname string
CVSS Score: 9.8 (CRITICAL)
References: http://securityreason.com/securityalert/2659; http://www.securityfocus.com/archive/1/466953/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33917
CVE: CVE-2007-2423
Published: 2007-05-02
Description: Cross-site scripting (XSS) vulnerability in index.php in MoinMoin 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the do parameter in an AttachFile action, a different vulnerability than CVE-2007-0857.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/36567; http://secunia.com/advisories/29262; http://www.debian.org/security/2008/dsa-1514
CVE: CVE-2007-2424
Published: 2007-05-02
Description: PHP remote file inclusion vulnerability in help/index.php in The Merchant (themerchant) 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the show parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35503; http://secunia.com/advisories/24883; http://www.securityfocus.com/bid/23707
CVE: CVE-2007-2425
Published: 2007-05-02
Description: Directory traversal vulnerability in fileview.php in Imageview 5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the album parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/35476; http://secunia.com/advisories/25040; http://www.securityfocus.com/bid/23710
CVE: CVE-2007-2426
Published: 2007-05-02
Description: PHP remote file inclusion vulnerability in myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the myPath parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34356; http://secunia.com/advisories/25042; http://www.securityfocus.com/bid/23702
CVE: CVE-2007-2427
Published: 2007-05-02
Description: SQL injection vulnerability in index.php in the pnFlashGames 1.5 module for PostNuke allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35474; http://secunia.com/advisories/25043; http://www.securityfocus.com/bid/23701
CVE: CVE-2007-2428
Published: 2007-05-02
Description: Multiple PHP remote file inclusion vulnerabilities in page.php in Ahhp-Portal allow remote attackers to execute arbitrary PHP code via a URL in the (1) fp or (2) sc parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityvulns.com/Qdocument838.html; http://securityvulns.com/source13951.html; http://www.osvdb.org/36568
CVE: CVE-2007-2429
Published: 2007-05-02
Description: ManageEngine PasswordManager Pro (PMP) allows remote attackers to obtain administrative access to a database by injecting a certain command line for the mysql program, as demonstrated by the "-port 2345" and "-u root" arguments.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/40188; http://www.securityfocus.com/bid/23693; http://osvdb.org/40188
CVE: CVE-2007-2430
Published: 2007-05-02
Description: shared/code/tce_tmx.php in TCExam 4.0.011 and earlier allows remote attackers to create arbitrary PHP files in cache/ by placing file contents and directory traversal manipulations into a SessionUserLang cookie to public/code/index.php.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/25008; http://sourceforge.net/forum/forum.php?forum_id=690912; http://www.attrition.org/pipermail/vim/2007-May/001571.html
CVE: CVE-2007-2431
Published: 2007-05-02
Description: Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks by modifying critical variables such as $_SERVER, as demonstrated by injecting web script via the _SERVER[SCRIPT_NAME] parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/25008; http://sourceforge.net/forum/forum.php?forum_id=690912; http://www.attrition.org/pipermail/vim/2007-May/001572.html
CVE: CVE-2007-2241
Published: 2007-05-02
Description: Unspecified vulnerability in query.c in ISC BIND 9.4.0, and 9.5.0a1 through 9.5.0a3, when recursion is enabled, allows remote attackers to cause a denial of service (daemon exit) via a sequence of queries processed by the query_addsoa function.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/34748; http://secunia.com/advisories/25070; http://www.isc.org/index.pl?/sw/bind/bind-security.php
CVE: CVE-2007-2432
Published: 2007-05-02
Description: Cross-site scripting (XSS) vulnerability in utilities/search.asp in nukedit 4.9.7b allows remote attackers to inject arbitrary web script or HTML via the terms parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35484; http://secunia.com/advisories/25087; http://www.securityfocus.com/bid/23729
CVE: CVE-2007-2433
Published: 2007-05-02
Description: Cross-site scripting (XSS) vulnerability in index.php in Ariadne 2.4.1 allows remote attackers to inject arbitrary web script or HTML via the ARLogin parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/25090; http://www.osvdb.org/35493; http://www.securityfocus.com/bid/23735
CVE: CVE-2007-2434
Published: 2007-05-02
Description: Buffer overflow in asnsp.dll in Aventail Connect 4.1.2.13 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a malformed DNS query.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8458&w=2; http://www.securityfocus.com/bid/23717; http://www.vupen.com/english/advisories/2007/1793
CVE: CVE-2007-2435
Published: 2007-05-02
Description: Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://dev2dev.bea.com/pub/advisory/241; http://docs.info.apple.com/article.html?artnum=307177; http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
CVE: CVE-2007-2436
Published: 2007-05-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-1861.  Reason: This candidate is a duplicate of CVE-2007-1861.  Notes: All CVE users should reference CVE-2007-1861 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-2437
Published: 2007-05-02
Description: The X render (Xrender) extension in X.org X Window System 7.0, 7.1, and 7.2, with Xserver 1.3.0 and earlier, allows remote authenticated users to cause a denial of service (daemon crash) via crafted values to the (1) XRenderCompositeTrapezoids and (2) XRenderAddTraps functions, which trigger a divide-by-zero error.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/34905; http://secunia.com/advisories/25121; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102901-1
CVE: CVE-2007-1320
Published: 2007-05-02
Description: Multiple heap-based buffer overflows in the cirrus_invalidate_region function in the Cirrus VGA extension in QEMU 0.8.2, as used in Xen and possibly other products, might allow local users to execute arbitrary code via unspecified vectors related to "attempting to mark non-existent regions as dirty," aka the "bitblt" heap overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html; http://osvdb.org/35494; http://secunia.com/advisories/25073
CVE: CVE-2007-1322
Published: 2007-05-02
Description: QEMU 0.8.2 allows local users to halt a virtual machine by executing the icebp instruction.
CVSS Score: 2.1 (LOW)
References: http://osvdb.org/35496; http://secunia.com/advisories/25073; http://secunia.com/advisories/25095
CVE: CVE-2007-1366
Published: 2007-05-02
Description: QEMU 0.8.2 allows local users to crash a virtual machine via the divisor operand to the aam instruction, as demonstrated by "aam 0x0," which triggers a divide-by-zero error.
CVSS Score: 2.1 (LOW)
References: http://lists.gnu.org/archive/html/qemu-devel/2007-04/msg00650.html; http://lists.gnu.org/archive/html/qemu-devel/2007-04/msg00651.html; http://osvdb.org/35498
CVE: CVE-2007-2454
Published: 2007-05-02
Description: Heap-based buffer overflow in the VGA device in Parallels allows local users, with root access to the guest operating system, to terminate the virtual machine and possibly execute arbitrary code in the host operating system via unspecified vectors related to bitblt operations.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/40228; http://taviso.decsystem.org/virtsec.pdf; http://osvdb.org/40228
CVE: CVE-2007-2455
Published: 2007-05-02
Description: Parallels allows local users to cause a denial of service (virtual machine abort) via (1) certain INT instructions, as demonstrated by INT 0xAA; (2) an IRET instruction when an invalid address is at the top of the stack; (3) a malformed MOVNTI instruction, as demonstrated by using a register as a destination; or a write operation to (4) SEGR6 or (5) SEGR7.
CVSS Score: 6.1 (MEDIUM)
References: http://osvdb.org/41164; http://osvdb.org/41165; http://osvdb.org/41166
CVE: CVE-2007-2456
Published: 2007-05-02
Description: Multiple PHP remote file inclusion vulnerabilities in FireFly 1.1.01 allow remote attackers to execute arbitrary PHP code via a URL in the doc_root parameter to (1) localize.php or (2) config.php in modules/admin/include/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35701; http://osvdb.org/35702; http://www.attrition.org/pipermail/vim/2007-May/001573.html
CVE: CVE-2007-0655
Published: 2007-05-02
Description: The MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan 8.0.671.1, and possibly other versions, allows remote or local attackers to gain privileges and execute arbitrary commands by connecting directly to TCP port 2222.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35732; http://secunia.com/advisories/23809; http://secunia.com/secunia_research/2007-45/advisory/
CVE: CVE-2007-2457
Published: 2007-05-02
Description: PHP remote file inclusion vulnerability in resources/includes/class.Smarty.php in Pixaria Gallery before 1.4.3 allows remote attackers to execute arbitrary PHP code via a URL in the cfg[sys][base_path] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34976; http://pixaria.com/index.history.php; http://secunia.com/advisories/24821
CVE: CVE-2007-2458
Published: 2007-05-02
Description: Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfg[sys][base_path] parameter to psg.smarty.lib.php and certain include and library scripts, a different vector than CVE-2007-2457.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://pixaria.com/index.history.php; http://secunia.com/advisories/24821; http://www.pixaria.com/news/article/70/
CVE: CVE-2007-2459
Published: 2007-05-02
Description: Heap-based buffer overflow in the BMP reader (bmp.c) in Imager perl module (libimager-perl) 0.45 through 0.56 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted 8-bit/pixel compressed BMP files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=421582; http://imager.perl.org/a/65.html; http://osvdb.org/35470
CVE: CVE-2007-2460
Published: 2007-05-02
Description: PHP remote file inclusion vulnerability in modules/admin/include/config.php in FireFly 1.1.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.attrition.org/pipermail/vim/2007-May/001573.html; http://www.vupen.com/english/advisories/2007/1554; http://www.attrition.org/pipermail/vim/2007-May/001573.html
CVE: CVE-2007-1069
Published: 2007-05-02
Description: The memory management in VMware Workstation before 5.5.4 allows attackers to cause a denial of service (Windows virtual machine crash) by triggering certain general protection faults (GPF).
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35507; http://secunia.com/advisories/25079; http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=49
CVE: CVE-2007-1337
Published: 2007-05-02
Description: The virtual machine process (VMX) in VMware Workstation before 5.5.4 does not properly read state information when moving from the ACPI sleep state to the run state, which allows attackers to cause a denial of service (virtual machine reboot) via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35508; http://secunia.com/advisories/25079; http://www.securityfocus.com/archive/1/467936/30/6690/threaded
CVE: CVE-2007-1744
Published: 2007-05-02
Description: Directory traversal vulnerability in the Shared Folders feature for VMware Workstation before 5.5.4, when a folder is shared, allows users on the guest system to write to arbitrary files on the host system via the "Backdoor I/O Port" interface.
CVSS Score: 6.3 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=521; http://secunia.com/advisories/25079; http://www.securityfocus.com/archive/1/467936/30/6690/threaded
CVE: CVE-2007-1876
Published: 2007-05-02
Description: VMware Workstation before 5.5.4, when running a 64-bit Windows guest on a 64-bit host, allows local users to "corrupt the virtual machine's register context" by debugging a local program and stepping into a "syscall instruction."
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/35509; http://secunia.com/advisories/25079; http://www.securityfocus.com/archive/1/467936/30/6690/threaded
CVE: CVE-2007-1877
Published: 2007-05-02
Description: VMware Workstation before 5.5.4 allows attackers to cause a denial of service against the guest OS by causing the virtual machine process (VMX) to store malformed configuration information.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/25079; http://www.securityfocus.com/archive/1/467936/30/6690/threaded; http://www.securityfocus.com/archive/1/469011/30/6510/threaded
CVE: CVE-2007-1859
Published: 2007-05-02
Description: XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/35531; http://secunia.com/advisories/25065; http://secunia.com/advisories/25105
CVE: CVE-2007-0745
Published: 2007-05-02
Description: The Apple Security Update 2007-004 uses an incorrect configuration file for FTPServer in Apple Mac OS X Server 10.4.9, which might allow remote authenticated users to access additional directories.
CVSS Score: 7.1 (HIGH)
References: http://lists.apple.com/archives/security-announce/2007/May/msg00000.html; http://www.osvdb.org/34869; http://www.securitytracker.com/id?1017990
CVE: CVE-2007-2438
Published: 2007-05-02
Description: The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.
CVSS Score: 7.6 (HIGH)
References: http://attrition.org/pipermail/vim/2007-May/001614.html; http://marc.info/?l=vim-dev&m=[PII_REDACTED]1298&w=2; http://marc.info/?l=vim-dev&m=[PII_REDACTED]4029&w=2
CVE: CVE-2007-0771
Published: 2007-05-02
Description: The utrace support in Linux kernel 2.6.18, and other versions, allows local users to cause a denial of service (system hang) related to "MT exec + utrace_attach spin failure mode," as demonstrated by ptrace-thrash.c.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/35927; http://secunia.com/advisories/25080; http://securitytracker.com/id?1017979
CVE: CVE-2007-2418
Published: 2007-05-02
Description: Heap-based buffer overflow in the Rendezvous / Extensible Messaging and Presence Protocol (XMPP) component (plugins\rendezvous.dll) for Cerulean Studios Trillian Pro before 3.1.5.1 allows remote attackers to execute arbitrary code via a message that triggers the overflow from expansion that occurs during encoding.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blog.ceruleanstudios.com/?p=131; http://dvlabs.tippingpoint.com/advisory/TPTI-07-06; http://osvdb.org/35720