deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6885
Published: 2006-12-31
Description: An ActiveX control in SwDir.dll in Macromedia Shockwave 10 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long string in the swURL attribute.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/22067; https://exchange.xforce.ibmcloud.com/vulnerabilities/31160; https://www.exploit-db.com/exploits/3042
CVE: CVE-2006-6886
Published: 2006-12-31
Description: phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for (1) files.public-userroot.inc.php or (2) files.private.additions.inc.php in include/inc_lib/, which reveals the path in various error messages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0423.html; http://www.kapda.ir/advisory-331.html; http://www.osvdb.org/25752
CVE: CVE-2006-6887
Published: 2006-12-31
Description: Unrestricted file upload vulnerability in logahead UNU 1.0 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors related to plugins/widged/_widged.php (aka the WidgEd plugin), a different vulnerability than CVE-2006-6783.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/23470; http://secunia.com/advisories/23470
CVE: CVE-2006-6888
Published: 2006-12-31
Description: P-News 1.16 and 1.17 store sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for db/user.dat.
CVSS Score: 5.0 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/31197; https://www.exploit-db.com/exploits/3054; https://exchange.xforce.ibmcloud.com/vulnerabilities/31197
CVE: CVE-2006-6889
Published: 2006-12-31
Description: FreeStyle Wiki (fswiki) 3.6.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain passwords via a direct request for config/user.dat.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/31227; https://www.exploit-db.com/exploits/3047; https://exchange.xforce.ibmcloud.com/vulnerabilities/31227
CVE: CVE-2006-6890
Published: 2006-12-31
Description: Voodoo chat 1.0RC1b stores sensitive information under the web root with insufficient access control, which allows remote attackers to download passwords via a direct request for data/users.dat.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/31221; https://www.exploit-db.com/exploits/3044; https://exchange.xforce.ibmcloud.com/vulnerabilities/31221
CVE: CVE-2006-6891
Published: 2006-12-31
Description: Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt.
CVSS Score: 5.0 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/31220; https://www.exploit-db.com/exploits/3053; https://exchange.xforce.ibmcloud.com/vulnerabilities/31220
CVE: CVE-2006-6892
Published: 2006-12-31
Description: Cross-site scripting (XSS) vulnerability in the GetLocation function in online.php in Jonathon J. Freeman OvBB 0.13a allows remote attackers to inject arbitrary web script or HTML via the aRequest variable.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23484; http://www.ovbb.org/forums/thread.php?threadid=185; http://www.vupen.com/english/advisories/2007/0039
CVE: CVE-2006-6893
Published: 2006-12-31
Description: Tor allows remote attackers to discover the IP address of a hidden service by accessing this service at a high rate, thereby changing the server's CPU temperature and consequently changing the pattern of time values visible through (1) ICMP timestamps, (2) TCP sequence numbers, and (3) TCP timestamps, a different vulnerability than CVE-2006-0414. NOTE: it could be argued that this is a laws-of-physics vulnerability that is a fundamental design limitation of certain hardware implementations, so perhaps this issue should not be included in CVE.
CVSS Score: 5.0 (MEDIUM)
References: http://events.ccc.de/congress/2006/Fahrplan/events/1513.en.html; http://www.cl.cam.ac.uk/~sjm217/papers/ccs06hotornot.pdf; http://www.lightbluetouchpaper.org/2006/09/04/hot-or-not-revealing-hidden-services-by-their-clock-skew/
CVE: CVE-2006-6894
Published: 2006-12-31
Description: Multiple unspecified vulnerabilities in SPINE before 1.2 have unknown impact and attack vectors, related to (1) "Placeholders in database handler" and (2) "Macro admin security."
CVSS Score: 10.0 (HIGH)
References: http://spine.sourceforge.net/changelog.html; http://spine.sourceforge.net/changelog.html
CVE: CVE-2006-6895
Published: 2006-12-31
Description: The Bluetooth stack in the Sony Ericsson T60 does not properly implement "Limited discoverable" mode, which allows remote attackers to obtain unauthorized inquiry responses.
CVSS Score: 2.9 (LOW)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/37585; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6896
Published: 2006-12-31
Description: The Bluetooth stack in the Plantronic Headset does not properly implement Non-pairable mode, which allows remote attackers to conduct unauthorized pair-up operations.
CVSS Score: 5.4 (MEDIUM)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/37586; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6897
Published: 2006-12-31
Description: Directory traversal vulnerability in Widcomm Bluetooth for Windows (BTW) 3.0.1.905 allows remote attackers to conduct unauthorized file operations via a .. (dot dot) in an unspecified parameter.
CVSS Score: 5.4 (MEDIUM)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/37590; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6898
Published: 2006-12-31
Description: Widcomm Bluetooth for Windows (BTW) before 4.0.1.1500 allows remote attackers to listen to and record conversations, aka the CarWhisperer attack.
CVSS Score: 7.8 (HIGH)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/37589; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6899
Published: 2006-12-31
Description: hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain control of the (1) Mouse and (2) Keyboard Human Interface Device (HID) via a certain configuration of two HID (PSM) endpoints, operating as a server, aka HidAttack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-16
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://mulliner.org/bluetooth/hidattack.php; http://osvdb.org/32830
CVE: CVE-2006-6900
Published: 2006-12-31
Description: Unspecified vulnerability in the Bluetooth stack in Apple Mac OS 10.4 has unknown impact and attack vectors, related to an "implementation bug."
CVSS Score: 10.0 (HIGH)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/37608; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6901
Published: 2006-12-31
Description: Unspecified vulnerability in the Bluetooth stack in Microsoft Windows allows remote attackers to gain administrative access (aka Remote Root) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/36144; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6902
Published: 2006-12-31
Description: Unspecified vulnerability in the Bluetooth stack in Microsoft Windows Mobile Pocket PC edition allows remote attackers to gain administrative access (aka Remote Root) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/36143; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6903
Published: 2006-12-31
Description: Unspecified vulnerability in the Toshiba Bluetooth stack allows remote attackers to gain administrative access (aka Remote Root) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/37607; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6904
Published: 2006-12-31
Description: Unspecified vulnerability in the Broadcom Bluetooth stack allows remote attackers to gain administrative access (aka Remote Root) via unspecified vectors.
CVSS Score: 7.9 (HIGH)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/37592; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6905
Published: 2006-12-31
Description: Unspecified vulnerability in the Widcomm Bluetooth stack allows remote attackers to gain administrative access (aka Remote Root) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/37588; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6906
Published: 2006-12-31
Description: Unspecified vulnerability in the Bluetooth stack on Mac OS 10.4.7 and earlier has unknown impact and local attack vectors, related to "Mach Exception Handling", a different issue than CVE-2006-6900.
CVSS Score: 7.2 (HIGH)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/36836; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6907
Published: 2006-12-31
Description: Unspecified vulnerability in the Bluesoil Bluetooth stack has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/37591; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6908
Published: 2006-12-31
Description: Buffer overflow in the Bluetooth Stack COM Server in the Widcomm Bluetooth stack, as packaged as Widcomm Stack 3.x and earlier on Windows, Widcomm BTStackServer 1.4.2.10 and 1.3.2.7 on Windows, Widcomm Bluetooth Communication Software 1.4.1.03 on Windows, and the Bluetooth implementation in Windows Mobile or Windows CE on the HP IPAQ 2215 and 5450, allows remote attackers to cause a denial of service (service crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf; http://osvdb.org/37587; http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE: CVE-2006-6909
Published: 2006-12-31
Description: Stack-based buffer overflow in http.c in Karl Dahlke Edbrowse (aka Command line editor browser) 3.1.3 allows remote attackers to execute arbitrary code by operating an FTP server that sends directory listings with (1) long user names or (2) long group names.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9173&w=2; http://sourceforge.net/tracker/index.php?func=detail&aid=1622117&group_id=141946&atid=751061; http://www.securityfocus.com/bid/21832
CVE: CVE-2006-6910
Published: 2006-12-31
Description: formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with Abfrage, allows remote attackers to cause a denial of service (daemon crash) via multiple requests containing many /../ sequences in the Name parameter.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/23539; http://www.securityfocus.com/bid/21841; https://exchange.xforce.ibmcloud.com/vulnerabilities/31216
CVE: CVE-2006-6911
Published: 2006-12-31
Description: SQL injection vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated users to execute arbitrary SQL commands via the ordernum parameter.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/31689; http://secunia.com/advisories/23652; https://exchange.xforce.ibmcloud.com/vulnerabilities/31318
CVE: CVE-2006-6912
Published: 2006-12-31
Description: SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/23651; http://www.phpmyfaq.de/advisory_2006-12-15.php; http://www.securityfocus.com/bid/21944
CVE: CVE-2006-6913
Published: 2006-12-31
Description: Unspecified vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to upload arbitrary PHP scripts via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23651; http://www.phpmyfaq.de/advisory_2006-12-15.php; http://www.securityfocus.com/bid/21945
CVE: CVE-2006-6914
Published: 2006-12-31
Description: Unspecified vulnerability in ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote attackers to obtain sensitive information, including passwords, via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://secunia.com/advisories/23688; http://securitytracker.com/id?1017480
CVE: CVE-2006-6915
Published: 2006-12-31
Description: ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote authenticated users to cause a denial of service (port exhaustion) via unspecified vectors. NOTE: some details were obtained from third party sources.
CVSS Score: 4.0 (MEDIUM)
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://secunia.com/advisories/23688; http://securitytracker.com/id?1017480
CVE: CVE-2006-6916
Published: 2006-12-31
Description: Getahead Direct Web Remoting (DWR) before 1.1.3 allows attackers to cause a denial of service (infinite loop) via unknown vectors related to "crafted input."
CVSS Score: 7.5 (HIGH)
References: http://getahead.ltd.uk/dwr/changelog; http://getahead.ltd.uk/dwr/changelog
CVE: CVE-2006-6917
Published: 2006-12-31
Description: Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup R11.5 Server before SP2 allows remote attackers to execute arbitrary code in the Tape Engine (tapeeng.exe) via a crafted RPC request with (1) opnum 38, which is not properly handled in TAPEUTIL.dll 11.5.3884.0, or (2) opnum 37, which is not properly handled in TAPEENG.dll 11.5.3884.0.
CVSS Score: 10.0 (HIGH)
References: http://supportconnectw.ca.com/public/storage/infodocs/basbrtapeeng-secnotice.asp; http://www.lssec.com/advisories/LS-20060908.pdf; http://www.lssec.com/advisories/LS-20061001.pdf
CVE: CVE-2006-7231
Published: 2006-12-31
Description: SQL injection vulnerability in display.asp in Civica Software Civica allows remote attackers to execute arbitrary SQL commands via the Entry parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/20354; https://exchange.xforce.ibmcloud.com/vulnerabilities/40305; http://www.securityfocus.com/bid/20354
CVE: CVE-2006-7232
Published: 2006-12-31
Description: sql_select.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to cause a denial of service (crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table, as originally demonstrated using ORDER BY.
CVSS Score: 3.5 (LOW)
CWE: CWE-89
References: http://bugs.mysql.com/bug.php?id=22413; http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-32.html; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-14.html
CVE: CVE-2006-7233
Published: 2006-12-31
Description: Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0, and possibly other versions before 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31483; http://www.igniterealtime.org/issues/browse/JM-430; http://www.igniterealtime.org/issues/browse/JM-629
CVE: CVE-2007-0015
Published: 2007-01-01
Description: Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI.
CVSS Score: 6.8 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=304989; http://isc.sans.org/diary.html?storyid=2094; http://landonf.bikemonkey.org/code/macosx/MOAB_Day_[PII_REDACTED]0815.15950.zadder.local.html
CVE: CVE-2007-0016
Published: 2007-01-03
Description: Stack-based buffer overflow in MoviePlay 4.76 allows remote attackers to execute arbitrary code via a long filename in a LST file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/32547; http://secunia.com/advisories/22959; http://www.securityfocus.com/bid/21840
CVE: CVE-2007-0017
Published: 2007-01-03
Description: Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html; http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2[PII_REDACTED]5559.6753.timor.html; http://osvdb.org/31163
CVE: CVE-2007-0044
Published: 2007-01-03
Description: Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf; http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html; http://secunia.com/advisories/23812
CVE: CVE-2007-0045
Published: 2007-01-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf; http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
CVE: CVE-2007-0046
Published: 2007-01-03
Description: Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.
CVSS Score: 7.5 (HIGH)
References: http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf; http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html; http://secunia.com/advisories/23691
CVE: CVE-2007-0047
Published: 2007-01-03
Description: CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf; http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html; http://secunia.com/advisories/23882
CVE: CVE-2007-0048
Published: 2007-01-03
Description: Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, when used with Internet Explorer, Google Chrome, or Opera, allows remote attackers to cause a denial of service (memory consumption) via a long sequence of # (hash) characters appended to a PDF URL, related to a "cross-site scripting issue."
CVSS Score: 5.0 (MEDIUM)
References: http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf; http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html; http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
CVE: CVE-2007-0049
Published: 2007-01-04
Description: Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add action with a modified GroupID in a direct request to Customize.asp.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31682; http://secunia.com/advisories/23564; http://www.securityfocus.com/bid/21847
CVE: CVE-2007-0050
Published: 2007-01-04
Description: PHP remote file inclusion vulnerability in index.php in OpenPinboard 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the language parameter.  NOTE: this issue has been disputed by the developer and a third party, since the variable is set before use. CVE analysis suggests that there is a small time window of risk before the installation is complete
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2007-01/0176.html; http://osvdb.org/33375; http://www.securityfocus.com/archive/1/455795/100/0/threaded
CVE: CVE-2007-0051
Published: 2007-01-04
Description: Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto feed.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0100.html; http://docs.info.apple.com/article.html?artnum=305215; http://lists.apple.com/archives/security-announce/2007/Mar//msg00003.html
CVE: CVE-2007-0052
Published: 2007-01-04
Description: SQL injection vulnerability in haberdetay.asp in Vizayn Haber allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31518; http://secunia.com/advisories/23576; http://www.securityfocus.com/bid/21836
CVE: CVE-2007-0053
Published: 2007-01-04
Description: SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the iPro parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32539; http://secunia.com/advisories/23572; http://www.securityfocus.com/bid/21833
CVE: CVE-2007-0054
Published: 2007-01-04
Description: Cross-site scripting (XSS) vulnerability in gbrowse.php in Belchior Foundry vCard PRO allows remote attackers to inject arbitrary web script or HTML via the sortby parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33359; http://www.securityfocus.com/archive/1/455615/100/0/threaded; http://www.securityfocus.com/bid/21844