deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-4804
Published: 2007-09-11
Description: Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171.  NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/38409; http://osvdb.org/38410; http://osvdb.org/38411
CVE: CVE-2007-4805
Published: 2007-09-11
Description: Directory traversal vulnerability in getgalldata.php in fuzzylime (cms) 3.0 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) in the p parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/36996; http://secunia.com/advisories/26740; http://www.attrition.org/pipermail/vim/2007-September/001780.html
CVE: CVE-2007-4806
Published: 2007-09-11
Description: PHP remote file inclusion vulnerability in modules/Discipline/CategoryBreakdownTime.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the FocusPath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/26750; http://www.attrition.org/pipermail/vim/2007-September/001788.html; http://www.osvdb.org/36952
CVE: CVE-2007-4807
Published: 2007-09-11
Description: Multiple PHP remote file inclusion vulnerabilities in Focus/SIS 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the staticpath parameter to (1) modules/Discipline/CategoryBreakdownTime.php or (2) modules/Discipline/StudentFieldBreakdown.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/26775; http://www.osvdb.org/36997; http://www.osvdb.org/36998
CVE: CVE-2007-4808
Published: 2007-09-11
Description: Multiple SQL injection vulnerabilities in TLM CMS 3.2 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to news.php in a lirenews action, (2) the idnews parameter to goodies.php in a lire action, (3) the id parameter to file.php in a voir action, (4) the ID parameter to affichage.php, (5) the id_sal parameter to mod_forum/afficher.php, or (6) the id_sujet parameter to mod_forum/messages.php.  NOTE: it was later reported that goodies.php and affichage.php scripts are reachable through index.php, and 1.1 is also affected.  NOTE: it was later reported that the goodies.php vector also affects 3.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/37001; http://osvdb.org/37002; http://osvdb.org/37003
CVE: CVE-2007-4809
Published: 2007-09-11
Description: Multiple PHP remote file inclusion vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 allow remote attackers to execute arbitrary PHP code via a URL in the DOC_ROOT parameter to (1) lib/functions.php or (2) lib/header.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/36943; http://osvdb.org/36944; http://secunia.com/advisories/26767
CVE: CVE-2007-4810
Published: 2007-09-11
Description: Multiple SQL injection vulnerabilities in Netjuke 1.0-rc2 allow remote attackers to execute arbitrary SQL commands via (1) the ge_id parameter in a list.artists action to explore.php or (2) the id parameter in a show.tracks action to xml.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/38833; http://osvdb.org/38834; http://securityreason.com/securityalert/3110
CVE: CVE-2007-4811
Published: 2007-09-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Netjuke 1.0-rc2 allow remote attackers to inject arbitrary web script or HTML via (1) the val parameter to alphabet.php in an alpha.albums action, or the PATH_INFO to (2) random.php or (3) admin/hidden.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38402; http://osvdb.org/38403; http://osvdb.org/38404
CVE: CVE-2007-4812
Published: 2007-09-11
Description: Buffer overflow in Apple Safari 3.0.3 522.15.5, and other versions before Beta Update 3.0.4, allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact by setting document.location.hash to a long string.  NOTE: the crash might actually occur in the alert method.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/Security-announce/2007/Nov/msg00003.html; http://osvdb.org/43971; http://securityreason.com/securityalert/3111
CVE: CVE-2007-4813
Published: 2007-09-11
Description: Cross-site scripting (XSS) vulnerability in Domino Blogsphere 3.01 Beta 7 allows remote attackers to inject arbitrary web script or HTML via the name field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38400; http://www.securityfocus.com/bid/25587; http://osvdb.org/38400
CVE: CVE-2007-4730
Published: 2007-09-11
Description: Buffer overflow in the compNewPixmap function in compalloc.c in the Composite extension for the X.org X11 server before 1.4 allows local users to execute arbitrary code by copying data from a large pixel depth pixmap into a smaller pixel depth pixmap.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugs.freedesktop.org/show_bug.cgi?id=7447; http://bugs.gentoo.org/show_bug.cgi?id=191964; http://lists.freedesktop.org/archives/xorg-announce/2007-September/000378.html
CVE: CVE-2007-4814
Published: 2007-09-11
Description: Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2[PII_REDACTED].00 in Microsoft SQL Server Enterprise Manager 8.05.2004 allows remote attackers to execute arbitrary code via a long second argument to the Start method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://retrogod.altervista.org/microsoft_sqldmo.html; http://securityreason.com/securityalert/3112; http://www.osvdb.org/38399
CVE: CVE-2007-4815
Published: 2007-09-11
Description: Multiple PHP remote file inclusion vulnerabilities in WebED in Markus Iser ED Engine 0.8999 alpha allow remote attackers to execute arbitrary PHP code via a URL in the Codebase parameter to (1) channeledit.php, (2) post.php, (3) view.php, or (4) viewitem.php in source/mod/rss/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/38395; http://osvdb.org/38396; http://osvdb.org/38397
CVE: CVE-2007-4816
Published: 2007-09-11
Description: Multiple buffer overflows in the BaoFeng2 storm ActiveX control in Mps.dll allow remote attackers to have an unknown impact via a long (1) URL, (2) backImage, or (3) titleImage property value; (4) a long first argument to the advancedOpen method; a long argument to the (5) isDVDPath or (6) rawParse method; or (7) a .smpl file with a long path attribute in an item element in a PlayList.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/40491; http://secunia.com/advisories/26749; http://www.milw0rm.com/sploits/09082007-storm.zip
CVE: CVE-2007-4817
Published: 2007-09-11
Description: Unrestricted file upload vulnerability in the Restaurante (com_restaurante) component for Joomla! allows remote attackers to upload and execute arbitrary PHP code via an upload action specifying a filename with a double extension such as .php.jpg, which creates an accessible file under img_original/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/26756; http://www.attrition.org/pipermail/vim/2007-September/001779.html; http://www.securityfocus.com/bid/25612
CVE: CVE-2007-4818
Published: 2007-09-11
Description: Multiple PHP remote file inclusion vulnerabilities in Txx CMS 0.2 allow remote attackers to execute arbitrary PHP code via a URL in the doc_root parameter to (1) addons/plugin.php, (2) addons/sidebar.php, (3) mail/index.php, or (4) mail/mailbox.php in modules/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/38390; http://osvdb.org/38391; http://osvdb.org/38392
CVE: CVE-2007-4819
Published: 2007-09-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Txx CMS 0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38389; http://securityreason.com/securityalert/3116; http://www.securityfocus.com/archive/1/478870/100/0/threaded
CVE: CVE-2007-4820
Published: 2007-09-11
Description: Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitrary local files, and possibly execute local PHP scripts, via the nmf parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/39017; http://www.securityfocus.com/bid/25605; https://exchange.xforce.ibmcloud.com/vulnerabilities/36533
CVE: CVE-2007-4821
Published: 2007-09-11
Description: Buffer overflow in a certain ActiveX control in officeviewer.ocx 5.2.218.1 in EDraw Office Viewer Component 5.2 allows remote attackers to execute arbitrary code via a long first argument to the HttpDownloadFileToTempDir method, a different vulnerability than CVE-2007-3169.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/38832; http://www.securityfocus.com/bid/25593; https://www.exploit-db.com/exploits/4373
CVE: CVE-2007-4822
Published: 2007-09-11
Description: Cross-site request forgery (CSRF) vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as demonstrated by accessing (1) ap.html and (2) filter_ip.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/37665; http://secunia.com/advisories/26712; http://securityreason.com/securityalert/3117
CVE: CVE-2007-4823
Published: 2007-09-11
Description: Multiple buffer overflows in Google Picasa have unspecified attack vectors and impact.  NOTE: this information is based upon a vague pre-advisory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/45901; http://xs-sniper.com/blog/2007/08/20/say-cheeeeeese/; http://osvdb.org/45901
CVE: CVE-2007-4824
Published: 2007-09-11
Description: Multiple cross-application scripting (XAS) vulnerabilities in Google Picasa have unspecified attack vectors and impact.  NOTE: this information is based upon a vague pre-advisory.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/45900; http://xs-sniper.com/blog/2007/08/20/say-cheeeeeese/; http://osvdb.org/45900
CVE: CVE-2007-2930
Published: 2007-09-12
Description: The (1) NSID_SHUFFLE_ONLY and (2) NSID_USE_POOL PRNG algorithms in ISC BIND 8 before 8.4.7-P1 generate predictable DNS query identifiers when sending outgoing queries such as NOTIFY messages when answering questions as a resolver, which allows remote attackers to poison DNS caches via unknown vectors.  NOTE: this issue is different from CVE-2007-2926.
CVSS Score: 4.3 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01283837; http://secunia.com/advisories/26629; http://secunia.com/advisories/26858
CVE: CVE-2007-3036
Published: 2007-09-12
Description: Unspecified vulnerability in the (1) Windows Services for UNIX 3.0 and 3.5, and (2) Subsystem for UNIX-based Applications in Microsoft Windows 2000, XP, Server 2003, and Vista allows local users to gain privileges via unspecified vectors related to "certain setuid binary files."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/26757; http://securitytracker.com/id?1018678; http://www.kb.cert.org/vuls/id/768440
CVE: CVE-2007-3040
Published: 2007-09-12
Description: Stack-based buffer overflow in agentdpv.dll 2.0.0.3425 in Microsoft Agent on Windows 2000 SP4 allows remote attackers to execute arbitrary code via a crafted URL to the Agent (Agent.Control) ActiveX control, which triggers an overflow within the Agent Service (agentsrv.exe) process, a different issue than CVE-2007-1205.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=592; http://secunia.com/advisories/26753; http://securityreason.com/securityalert/3124
CVE: CVE-2007-4019
Published: 2007-09-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-2930.  Reason: This candidate is a reservation duplicate of CVE-2007-2930.  Notes: All CVE users should reference CVE-2007-2930 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-4651
Published: 2007-09-12
Description: Unspecified vulnerability in Adobe Connect Enterprise Server 6 allows remote attackers to read certain pages that are restricted to the administrator via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/38055; http://secunia.com/advisories/26770; http://www.adobe.com/support/security/bulletins/apsb07-14.html
CVE: CVE-2007-4731
Published: 2007-09-12
Description: Stack-based buffer overflow in the TMregChange function in TMReg.dll in Trend Micro ServerProtect before 5.58 Security Patch 4 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 5005.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/45878; http://securityreason.com/securityalert/3128; http://securitytracker.com/id?1018594
CVE: CVE-2007-4752
Published: 2007-09-12
Description: ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=191321; http://docs.info.apple.com/article.html?artnum=307562; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085
CVE: CVE-2007-4825
Published: 2007-09-12
Description: Directory traversal vulnerability in PHP 5.2.4 and earlier allows attackers to bypass open_basedir restrictions and possibly execute arbitrary code via a .. (dot dot) in the dl function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html; http://osvdb.org/45902; http://secunia.com/advisories/27102
CVE: CVE-2007-4826
Published: 2007-09-12
Description: bgpd in Quagga before 0.99.9 allows explicitly configured BGP peers to cause a denial of service (crash) via a malformed (1) OPEN message or (2) a COMMUNITY attribute, which triggers a NULL pointer dereference. NOTE: vector 2 only exists when debugging is enabled.
CVSS Score: 3.5 (LOW)
References: http://fedoranews.org/updates/FEDORA-2007-219.shtml; http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00153.html; http://quagga.net/news2.php?y=2007&m=9&d=7#id[PII_REDACTED]
CVE: CVE-2007-3871
Published: 2007-09-12
Description: Stampit Web uses guessable id values for online stamp purchases, which allows remote attackers to cause a denial of service (stamp invalidation) via a SOAP request with an id value for a stamp that has not yet been printed.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/fulldisclosure/2007/Aug/0441.html; http://securityreason.com/securityalert/3129; https://exchange.xforce.ibmcloud.com/vulnerabilities/36365
CVE: CVE-2007-4727
Published: 2007-09-12
Description: Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://fedoranews.org/updates/FEDORA-2007-213.shtml; http://secunia.com/advisories/26732; http://secunia.com/advisories/26794
CVE: CVE-2007-4828
Published: 2007-09-12
Description: Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://fedoranews.org/updates/FEDORA-2007-218.shtml; http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html; http://secunia.com/advisories/26772
CVE: CVE-2007-4830
Published: 2007-09-12
Description: Cross-site scripting (XSS) vulnerability in CMD_BANDWIDTH_BREAKDOWN in DirectAdmin 1.30.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the user parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/36999; http://pridels-team.blogspot.com/2007/09/directadmin-v1302-xss-vuln.html; http://secunia.com/advisories/26742
CVE: CVE-2007-4831
Published: 2007-09-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in account_settings.php in TorrentTrader 1.07 allow remote attackers to inject arbitrary web script or HTML via the (1) avatar and (2) title parameters.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://osvdb.org/37073; http://secunia.com/advisories/26551; http://www.securityfocus.com/bid/25616
CVE: CVE-2007-4832
Published: 2007-09-12
Description: Format string vulnerability in CellFactor Revolution 1.03 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a malformed nickname.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/cellfucktor-adv.txt; http://osvdb.org/40503; http://secunia.com/advisories/26765
CVE: CVE-2007-4833
Published: 2007-09-12
Description: Unspecified vulnerability in the Edge Component in IBM WebSphere Application Server (WAS) 6.1 before Fix Pack 11 (6.1.0.11) has unknown impact and attack vectors, aka PK44789.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/41617; http://osvdb.org/42882; http://secunia.com/advisories/26761
CVE: CVE-2007-4834
Published: 2007-09-12
Description: Multiple PHP remote file inclusion vulnerabilities in phpRealty 0.02 allow remote attackers to execute arbitrary PHP code via a URL in the MGR parameter to (1) index.php, (2) p_ins.php, and (3) u_ins.php in manager/admin/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/37074; http://osvdb.org/37075; http://osvdb.org/37076
CVE: CVE-2007-4835
Published: 2007-09-12
Description: SQL injection vulnerability in index.php in phpMyQuote 0.20 allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/36947; http://secunia.com/advisories/26762; http://securityreason.com/securityalert/3120
CVE: CVE-2007-4836
Published: 2007-09-12
Description: Cross-site scripting (XSS) vulnerability in index.php in phpMyQuote 0.20 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/36948; http://secunia.com/advisories/26762; http://securityreason.com/securityalert/3120
CVE: CVE-2007-4837
Published: 2007-09-12
Description: SQL injection vulnerability in anket.asp in Proxy Anket 3.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/36939; http://secunia.com/advisories/26735; http://securityreason.com/securityalert/3121
CVE: CVE-2007-4838
Published: 2007-09-12
Description: Multiple buffer overflows in CellFactor Revolution 1.03 and earlier allow remote attackers to execute arbitrary code via a long string in a (1) 0x21, (2) 0x22, or (3) 0x23 packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/cellfucktor-adv.txt; http://aluigi.org/poc/cellfucktor.zip; http://osvdb.org/40502
CVE: CVE-2007-4839
Published: 2007-09-12
Description: Unspecified vulnerability in the PD tools component in IBM WebSphere Application Server (WAS) 6.1 before Fix Pack 11 (6.1.0.11) has unknown impact and attack vectors, aka PK33803.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/41611; http://www-1.ibm.com/support/docview.wss?uid=swg27007951; http://osvdb.org/41611
CVE: CVE-2007-4840
Published: 2007-09-12
Description: PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function.  NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html; http://osvdb.org/38916; http://secunia.com/advisories/27102
CVE: CVE-2007-4841
Published: 2007-09-12
Description: Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to execute arbitrary commands via a (1) mailto, (2) nntp, (3) news, or (4) snews URI with invalid "%" encoding, related to improper file type handling on Windows XP with Internet Explorer 7 installed, a variant of CVE-2007-3845.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579; http://secunia.com/advisories/27311
CVE: CVE-2007-4842
Published: 2007-09-12
Description: Directory traversal vulnerability in Enriva Development Magellan Explorer 3.32 build 2305 and earlier allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a filename. NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://blog.hispasec.com/lab/advisories/adv_MagellanExplorer_3_32_Remote_Traversal.txt; http://osvdb.org/40501; http://secunia.com/advisories/26737
CVE: CVE-2007-4843
Published: 2007-09-12
Description: Directory traversal vulnerability in X-Diesel Unreal Commander 0.92 build 565 and 573 allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a filename.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://blog.hispasec.com/lab/advisories/adv_UnrealCommander_0_92_build_573_Multiple_FTP_Based_Vulnerabilities.txt; http://osvdb.org/39615; http://secunia.com/advisories/26739
CVE: CVE-2007-4844
Published: 2007-09-12
Description: X-Diesel Unreal Commander 0.92 build 565 and 573 does not properly react to an FTP server's behavior after sending a "CWD /" command, which allows remote FTP servers to cause a denial of service (infinite loop) by (1) repeatedly sending a 550 error response, or (2) sending a 550 error response and then disconnecting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://blog.hispasec.com/lab/advisories/adv_UnrealCommander_0_92_build_573_Multiple_FTP_Based_Vulnerabilities.txt; http://osvdb.org/39616; http://securityreason.com/securityalert/3125
CVE: CVE-2007-4845
Published: 2007-09-12
Description: Multiple SQL injection vulnerabilities in UPLOAD/index.php in RW::Download 2.0.3 lite allow remote attackers to execute arbitrary SQL commands via the (1) dlid or (2) cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/37077; http://www.securityfocus.com/bid/25589; https://www.exploit-db.com/exploits/4371
CVE: CVE-2007-4846
Published: 2007-09-12
Description: SQL injection vulnerability in start.php in Webace-Linkscript (wls) 1.3 Special Edition (SE) allows remote attackers to execute arbitrary SQL commands via the id parameter in a rubrik go action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/36940; http://osvdb.org/36945; http://osvdb.org/37078