deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-5334
Published: 2007-10-21
Description: Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 can hide the window's titlebar when displaying XUL markup language documents, which makes it easier for remote attackers to conduct phishing and spoofing attacks by setting the hidechrome attribute.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://secunia.com/advisories/27276; http://secunia.com/advisories/27298
CVE: CVE-2007-5337
Published: 2007-10-21
Description: Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5, when running on Linux systems with gnome-vfs support, might allow remote attackers to read arbitrary files on SSH/sftp servers that accept key authentication by creating a web page on the target server, in which the web page contains URIs with (1) smb: or (2) sftp: schemes that access other files from the server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://secunia.com/advisories/27276; http://secunia.com/advisories/27298
CVE: CVE-2007-5338
Published: 2007-10-21
Description: Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allow remote attackers to execute arbitrary Javascript with user privileges by using the Script object to modify XPCNativeWrappers in a way that causes the script to be executed when a chrome action is performed.
CVSS Score: 9.3 (HIGH)
CWE: CWE-16, CWE-264
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://secunia.com/advisories/27276; http://secunia.com/advisories/27298
CVE: CVE-2007-5617
Published: 2007-10-21
Description: Unspecified vulnerability in VMware Player 1.0.x before 1.0.5 and 2.0 before 2.0.1, and Workstation 5.x before 5.5.5 and 6.x before 6.0.1, prevents it from launching, which has unspecified impact, related to untrusted virtual machine images.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://secunia.com/advisories/26890; http://secunia.com/advisories/27706
CVE: CVE-2007-5618
Published: 2007-10-21
Description: Unquoted Windows search path vulnerability in the Authorization and other services in VMware Player 1.0.x before 1.0.5 and 2.0 before 2.0.1, VMware Server before 1.0.4, and Workstation 5.x before 5.5.5 and 6.x before 6.0.1 might allow local users to gain privileges via malicious programs.
CVSS Score: 7.2 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://lists.vmware.com/pipermail/security-announce/2008/000008.html; http://secunia.com/advisories/26890
CVE: CVE-2007-5619
Published: 2007-10-21
Description: Unspecified vulnerability in VMware Server before 1.0.4 causes user passwords to be recorded in cleartext in server logs, which might allow local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://www.vmware.com/support/server/doc/releasenotes_server.html; http://www.vmware.com/support/server/doc/releasenotes_server.html
CVE: CVE-2007-5190
Published: 2007-10-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Alcatel OmniVista 4760 R4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the action parameter to php-bin/Webclient.php or (2) the Langue parameter to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37997; http://secunia.com/advisories/27294; http://securityreason.com/securityalert/3280
CVE: CVE-2007-5472
Published: 2007-10-22
Description: Cross-site scripting (XSS) vulnerability in the Server component in CA Host-Based Intrusion Prevention System (HIPS) before 8.0.0.93 allows remote attackers to inject arbitrary web script or HTML via requests that are written to logs for later display in the log viewer.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37998; http://secunia.com/advisories/27301; http://securitytracker.com/id?1018839
CVE: CVE-2007-5620
Published: 2007-10-22
Description: Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/44751; http://www.securityfocus.com/bid/26135; http://www.vupen.com/english/advisories/2007/3570
CVE: CVE-2007-5621
Published: 2007-10-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/184336; http://osvdb.org/38073; http://secunia.com/advisories/27291
CVE: CVE-2007-3850
Published: 2007-10-23
Description: The eHCA driver in Linux kernel 2.6 before 2.6.22, when running on PowerPC, does not properly map userspace resources, which allows local users to read portions of physical address space.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=721151d004dcf01a71b12bb6b893f9160284cf6e; http://osvdb.org/45488; http://rhn.redhat.com/errata/RHSA-2007-0940.html
CVE: CVE-2007-4574
Published: 2007-10-23
Description: Unspecified vulnerability in the "stack unwinder fixes" in kernel in Red Hat Enterprise Linux 5, when running on AMD64 and Intel 64, allows local users to cause a denial of service via unknown vectors.
CVSS Score: 4.7 (MEDIUM)
References: http://osvdb.org/45489; http://secunia.com/advisories/27322; http://securitytracker.com/id?1018844
CVE: CVE-2007-5623
Published: 2007-10-23
Description: Buffer overflow in the check_snmp function in Nagios Plugins (nagios-plugins) 1.4.10 allows remote attackers to cause a denial of service (crash) via crafted snmpget replies.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=196308; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00011.html; http://secunia.com/advisories/27419
CVE: CVE-2007-5624
Published: 2007-10-23
Description: Cross-site scripting (XSS) vulnerability in Nagios 2.x before 2.10 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://secunia.com/advisories/27316; http://secunia.com/advisories/27980
CVE: CVE-2007-5625
Published: 2007-10-23
Description: Cross-site scripting (XSS) vulnerability in filename.asp in ASP Site Search SearchSimon Lite 1.0 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38069; http://secunia.com/advisories/27337; http://securityreason.com/securityalert/3275
CVE: CVE-2007-5626
Published: 2007-10-23
Description: make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffing the network.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-319
References: http://bugs.bacula.org/view.php?id=990; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446809; http://osvdb.org/41861
CVE: CVE-2007-5627
Published: 2007-10-23
Description: PHP remote file inclusion vulnerability in content/fnc-readmail3.php in SocketMail 2.2.8 allows remote attackers to execute arbitrary PHP code via a URL in the __SOCKETMAIL_ROOT parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/26162; https://exchange.xforce.ibmcloud.com/vulnerabilities/37344; https://www.exploit-db.com/exploits/4554
CVE: CVE-2007-5628
Published: 2007-10-23
Description: PHP remote file inclusion vulnerability in src/scripture.php in The Online Web Library Site (TOWels) 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the pageHeaderFile parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/26165; https://exchange.xforce.ibmcloud.com/vulnerabilities/37381; https://www.exploit-db.com/exploits/4555
CVE: CVE-2007-5629
Published: 2007-10-23
Description: Cross-site scripting (XSS) vulnerability in admin/logon.asp in ShoppingTree CandyPress Store 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2007-2804.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38155; http://secunia.com/advisories/27339; http://securityreason.com/securityalert/3267
CVE: CVE-2007-5630
Published: 2007-10-23
Description: SQL injection vulnerability in tnews.php in BBsProcesS BBPortalS 1.5.10 through 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a tnews action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/26149; https://exchange.xforce.ibmcloud.com/vulnerabilities/37346; https://www.exploit-db.com/exploits/4550
CVE: CVE-2007-5631
Published: 2007-10-23
Description: Multiple PHP remote file inclusion vulnerabilities in PeopleAggregator 1.2pre6, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the current_blockmodule_path parameter to (1) AudiosMediaGalleryModule/AudiosMediaGalleryModule.php, (2) ImagesMediaGalleryModule/ImagesMediaGalleryModule.php, (3) MembersFacewallModule/MembersFacewallModule.php, (4) NewestGroupsModule/NewestGroupsModule.php, (5) UploadMediaModule/UploadMediaModule.php, and (6) VideosMediaGalleryModule/VideosMediaGalleryModule.php in BetaBlockModules/; and (7) the path_prefix parameter to several components.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/45495; http://osvdb.org/45496; http://osvdb.org/45497
CVE: CVE-2007-5632
Published: 2007-10-23
Description: Multiple unspecified vulnerabilities in the kernel in Sun Solaris 8 through 10 allow local users to cause a denial of service (panic), related to the support for retrieval of kernel statistics, and possibly related to the sfmmu_mlspl_enter or sfmmu_mlist_enter functions.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/38483; http://secunia.com/advisories/27306; http://secunia.com/advisories/27536
CVE: CVE-2007-5633
Published: 2007-10-23
Description: Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users to read or write arbitrary MSRs, and gain privileges and load unsigned drivers, via the (1) IOCTL_RDMSR 0x9C402438 and (2) IOCTL_WRMSR 0x9C40243C IOCTLs to \Device\speedfan, as demonstrated by an IOCTL_WRMSR action on MSR_LSTAR.
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/41842; http://secunia.com/advisories/27312; http://www.bugtrack.almico.com/view.php?id=987
CVE: CVE-2007-5634
Published: 2007-10-23
Description: Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, does not properly check a buffer during an IOCTL 0x9c402420 call, which allows local users to cause a denial of service (machine crash) and possibly gain privileges via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/27312; http://www.bugtrack.almico.com/view.php?id=987; https://exchange.xforce.ibmcloud.com/vulnerabilities/37299
CVE: CVE-2007-5635
Published: 2007-10-23
Description: Multiple unspecified vulnerabilities in Salford Software Support Incident Tracker (SiT!) before 3.30 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/27226; http://sourceforge.net/project/shownotes.php?release_id=547027; http://www.securityfocus.com/bid/26151
CVE: CVE-2007-5636
Published: 2007-10-23
Description: Buffer overflow in the Nortel UNIStim IP Softphone 2050 allows remote attackers to cause a denial of service (application abort) and possibly execute arbitrary code via a flood of invalid characters to the RTCP port (5678/udp) that triggers a Windows error message, aka "extraneous messaging."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/38521; http://secunia.com/advisories/27252; http://securityreason.com/securityalert/3271
CVE: CVE-2007-5637
Published: 2007-10-23
Description: The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines allow remote attackers to eavesdrop on the physical environment via an Open Audio Stream message that enables "surveillance mode." NOTE: issues relating to a small ID number space can be leveraged to make this attack easier.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/41769; http://secunia.com/advisories/27234; http://securityreason.com/securityalert/3272
CVE: CVE-2007-5638
Published: 2007-10-23
Description: The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines, use only 65536 different values in the 32-bit ID number field of an RUDP datagram, which makes it easier for remote attackers to guess the RUDP ID and spoof messages.  NOTE: this can be leveraged for an eavesdropping attack by sending many Open Audio Stream messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-310
References: http://osvdb.org/41770; http://secunia.com/advisories/27234; http://securityreason.com/securityalert/3272
CVE: CVE-2007-5639
Published: 2007-10-23
Description: The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and other Nortel IP Phone, Mobile Voice Client, and WLAN Handsets products allow remote attackers to cause a denial of service (device hang) via a flood of Mute and UnMute messages that have a spoofed source IP address for the Signaling Server.
CVSS Score: 7.1 (HIGH)
References: http://securityreason.com/securityalert/3273; http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=654715; http://www.csnc.ch/static/advisory/csnc/nortel_IP_phone_flooding_denial_of_service_v1.0.txt
CVE: CVE-2007-5640
Published: 2007-10-23
Description: The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), Mobile Voice Client, and other product lines, allow remote attackers to block calls and force re-registration via a resume message to the Signaling Server that has a spoofed source IP address for the phone.  NOTE: the attack is more disruptive if a new spoofed resume message is sent after each re-registration.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/41772; http://secunia.com/advisories/27234; http://securityreason.com/securityalert/3274
CVE: CVE-2007-5641
Published: 2007-10-23
Description: Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the full_path parameter to (1) certinfo/index.php, (2) emails/index.php, (3) events/index.php, (4) fax/index.php, (5) files/index.php, (6) files/list.php, (7) groupadm/index.php, (8) history/index.php, (9) info/index.php, (10) log/index.php, (11) mail/index.php, (12) messages/index.php, (13) organizations/index.php, (14) phones/index.php, (15) presence/index.php, (16) projects/index.php, (17) projects/summary.inc.php, (18) projects/list.php, (19) reports/index.php, (20) search/index.php, (21) snf/index.php, (22) syslog/index.php, (23) tasks/searchsimilar.php, (24) tasks/index.php, (25) tasks/summary.inc.php, and (26) useradm/index.php in modules; (27) /ajax/loadsplash.php; (28) /blocks/birthday.php; (29) /blocks/events.php; and (30) /blocks/help.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/41905; http://osvdb.org/41906; http://osvdb.org/41907
CVE: CVE-2007-5642
Published: 2007-10-23
Description: Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the def_lang parameter to modules/files/list.php; the m_path parameter to (2) modules/projects/summary.inc.php or (3) modules/tasks/summary.inc.php; (4) the module parameter to modules/projects/list.php; or the module parameter to index.php in the (5) certinfo, (6) emails, (7) events, (8) fax, (9) files, (10) groupadm, (11) history, (12) info, (13) log, (14) mail, (15) messages, (16) organizations, (17) phones, (18) presence, (19) projects, (20) reports, (21) search, (22) snf, (23) syslog, (24) tasks, or (25) useradm subdirectory of modules/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/41951; http://osvdb.org/41954; http://osvdb.org/41955
CVE: CVE-2007-5643
Published: 2007-10-23
Description: Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the CategoryID parameter to ajax/sortcategories.php or (2) an unspecified vector to ajax/sortroles.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lussumo.com/community/discussion/7214/vanilla-113-new-remote-blind-sql-injection-exploit-/; http://lussumo.com/swell/168/Vanilla-114-Released/; http://secunia.com/advisories/27348
CVE: CVE-2007-5644
Published: 2007-10-23
Description: Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for (1) ajax/sortcategories.php and (2) ajax/sortroles.php, which allows remote attackers to conduct unauthorized sort operations and other activities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://www.exploit-db.com/exploits/4548; https://www.exploit-db.com/exploits/4548
CVE: CVE-2007-5646
Published: 2007-10-23
Description: SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows remote attackers to execute arbitrary SQL commands via the userspec parameter in a search2 action to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/27346; http://securityreason.com/securityalert/3284; http://www.securityfocus.com/archive/1/482569/100/0/threaded
CVE: CVE-2007-5647
Published: 2007-10-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in SocketKB 1.1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) art_id or (2) node parameter in an article action to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0710-exploits/socketkb-xss.txt; http://secunia.com/advisories/27286; http://www.securityfocus.com/bid/26136
CVE: CVE-2007-5648
Published: 2007-10-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in rnote.php in rNote 0.9.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) d or the (2) u parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38204; http://secunia.com/advisories/27404; http://www.lezr.com/exploits/id/84
CVE: CVE-2007-5649
Published: 2007-10-23
Description: Cross-site scripting (XSS) vulnerability in lostpwd.php in Creative Digital Resources SocketMail 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the lost_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0710-exploits/socketmail-xss.txt; http://secunia.com/advisories/27324; http://www.securityfocus.com/bid/26138
CVE: CVE-2007-5650
Published: 2007-10-23
Description: Directory traversal vulnerability in system.php in ReloadCMS 1.2.7 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3285; http://www.securityfocus.com/archive/1/482573/100/0/threaded; http://www.securityfocus.com/bid/26143
CVE: CVE-2007-5651
Published: 2007-10-23
Description: Unspecified vulnerability in the Extensible Authentication Protocol (EAP) implementation in Cisco IOS 12.3 and 12.4 on Cisco Access Points and 1310 Wireless Bridges (Wireless EAP devices), IOS 12.1 and 12.2 on Cisco switches (Wired EAP devices), and CatOS 6.x through 8.x on Cisco switches allows remote attackers to cause a denial of service (device reload) via a crafted EAP Response Identity packet.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/27329; http://www.cisco.com/en/US/products/products_security_response09186a00808de8bb.html; http://www.securityfocus.com/bid/26139
CVE: CVE-2007-5652
Published: 2007-10-23
Description: IBM DB2 UDB 9.1 before Fixpak 4 does not properly manage storage of a list containing authentication information, which might allow attackers to cause a denial of service (instance crash) or trigger memory corruption.  NOTE: the vendor description of this issue is too vague to be certain that it is security-related.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27177; http://www-1.ibm.com/support/docview.wss?rs=71&uid=swg21283031; http://www-1.ibm.com/support/docview.wss?uid=swg21255607
CVE: CVE-2007-5653
Published: 2007-10-23
Description: The Component Object Model (COM) functions in PHP 5.x on Windows do not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by executing objects with the kill bit set in the corresponding ActiveX control Compatibility Flags, executing programs via a function in compatUI.dll, invoking wscript.shell via wscript.exe, invoking Scripting.FileSystemObject via wshom.ocx, and adding users via a function in shgina.dll, related to the com_load_typelib function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://secunia.com/advisories/27280; http://www.vupen.com/english/advisories/2007/3590; https://exchange.xforce.ibmcloud.com/vulnerabilities/37368
CVE: CVE-2007-5654
Published: 2007-10-23
Description: LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/41867; http://secunia.com/advisories/27302; http://www.litespeedtech.com/latest/litespeed-web-server-3.2.4-released.html
CVE: CVE-2007-5335
Published: 2007-10-24
Description: Mozilla Firefox 2.0 before 2.0.0.8 allows remote attackers to obtain sensitive system information by using the addMicrosummaryGenerator sidebar method to access file: URIs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/42470; http://secunia.com/advisories/27335; http://secunia.com/advisories/27387
CVE: CVE-2007-5336
Published: 2007-10-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-5339.  Reason: This candidate is a reservation duplicate of CVE-2007-5339.  Notes: All CVE users should reference CVE-2007-5339 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-5673
Published: 2007-10-24
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/webif.exe in ifnet WebIf allows remote attackers to inject arbitrary web script or HTML via the cmd parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066947.html; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8935&w=2; http://secunia.com/advisories/27365