deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-5984
Published: 2007-11-15
Description: classes/Url.php in Justin Hagstrom AutoIndex PHP Script before 2.2.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via a %00 sequence in the dir parameter to index.php, which triggers an erroneous "recursive calculation."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://autoindex.sourceforge.net/change_log.html; http://osvdb.org/45282; http://securityreason.com/securityalert/3360
CVE: CVE-2007-5985
Published: 2007-11-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) account.php, (2) moresmiles.php, or (3) recover.php; or (4) the "to" parameter to usercp.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38751; http://osvdb.org/38752; http://osvdb.org/38753
CVE: CVE-2007-5986
Published: 2007-11-15
Description: SQL injection vulnerability in include/functions.php in BtiTracker before 1.4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27550; http://sourceforge.net/forum/forum.php?forum_id=752472; http://sourceforge.net/project/shownotes.php?release_id=552477
CVE: CVE-2007-5987
Published: 2007-11-15
Description: details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by (1) reading the details of an arbitrary torrent and (2) modifying a torrent owned by a guest.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264, CWE-287
References: http://osvdb.org/42217; http://secunia.com/advisories/27550; http://sourceforge.net/project/shownotes.php?release_id=552477
CVE: CVE-2007-5988
Published: 2007-11-15
Description: blocks/shoutbox_block.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255, CWE-264, CWE-287
References: http://osvdb.org/42216; http://secunia.com/advisories/27550; http://sourceforge.net/project/shownotes.php?release_id=552477
CVE: CVE-2007-3749
Published: 2007-11-15
Description: The kernel in Apple Mac OS X 10.4 through 10.4.10 does not reset the current Mach Thread Port or Thread Exception Port when executing a setuid program, which allows local users to execute arbitrary code by creating the port before launching the setuid program, then writing to the address space of the setuid process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: http://docs.info.apple.com/article.html?artnum=307041; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=630; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
CVE: CVE-2007-4267
Published: 2007-11-15
Description: Stack-based buffer overflow in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a crafted IOCTL request that adds an AppleTalk zone to a routing table.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307041; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=627; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
CVE: CVE-2007-4268
Published: 2007-11-15
Description: Integer signedness error in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a crafted AppleTalk message with a negative value, which satisfies a signed comparison during mbuf allocation but is later interpreted as an unsigned value, which triggers a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-681
References: http://docs.info.apple.com/article.html?artnum=307041; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=628; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
CVE: CVE-2007-4269
Published: 2007-11-15
Description: Integer overflow in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a crafted AppleTalk Session Protocol (ASP) message on an AppleTalk socket, which triggers a heap-based buffer overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=307041; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=629; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
CVE: CVE-2007-4678
Published: 2007-11-15
Description: AppleRAID in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 allows attackers to cause a denial of service (crash) via a crafted striped disk image, which triggers a NULL pointer dereference when it is mounted.
CVSS Score: 7.1 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4679
Published: 2007-11-15
Description: CFFTP in CFNetwork for Apple Mac OS X 10.4 through 10.4.10 allows remote FTP servers to force clients to connect to other hosts via crafted responses to FTP PASV commands.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4680
Published: 2007-11-15
Description: CFNetwork in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 does not properly validate certificates, which allows remote attackers to spoof trusted SSL certificates via a man-in-the-middle attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://docs.info.apple.com/article.html?artnum=307041; http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
CVE: CVE-2007-4681
Published: 2007-11-15
Description: Buffer overflow in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted directory hierarchy.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4682
Published: 2007-11-15
Description: CoreText in Apple Mac OS X 10.4 through 10.4.10 allows attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted text content that triggers an access of an uninitialized object pointer.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-824
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4683
Published: 2007-11-15
Description: Directory traversal vulnerability in the kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to bypass the chroot mechanism via a relative path when changing the current working directory.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-22
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4684
Published: 2007-11-15
Description: Integer overflow in the kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a large num_sels argument to the i386_set_ldt system call.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/058522.html
CVE: CVE-2007-4685
Published: 2007-11-15
Description: The kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to gain privileges by executing setuid or setgid programs in which the stdio, stderr, or stdout file descriptors are "in an unexpected state."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4686
Published: 2007-11-15
Description: Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4687
Published: 2007-11-15
Description: The remote_cmds component in Apple Mac OS X 10.4 through 10.4.10 contains a symbolic link from the tftpboot private directory to the root directory, which allows tftpd users to escape the private directory and access arbitrary files.
CVSS Score: 9.3 (HIGH)
CWE: CWE-16
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4688
Published: 2007-11-15
Description: The Networking component in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to obtain all addresses for a host, including link-local addresses, via a Node Information Query.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4689
Published: 2007-11-15
Description: Double free vulnerability in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (system shutdown) or execute arbitrary code via crafted IPV6 packets.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4690
Published: 2007-11-15
Description: Double free vulnerability in the NFS component in Apple Mac OS X 10.4 through 10.4.10 allows remote authenticated users to execute arbitrary code via a crafted AUTH_UNIX RPC packet.
CVSS Score: 9.0 (HIGH)
CWE: CWE-399
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4691
Published: 2007-11-15
Description: The NSURL component in Apple Mac OS X 10.4 through 10.4.10 performs case-sensitive comparisons that allow attackers to bypass intended restrictions for local file system URLs.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4693
Published: 2007-11-15
Description: The SecurityAgent component in Mac OS X 10.4 through 10.4.10 allows attackers with physical access to bypass the authentication dialog of the screen saver and send keystrokes to a process, related to "handling of keyboard focus between secure text fields."
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4694
Published: 2007-11-15
Description: Safari in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to access local content via file:// URLs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4695
Published: 2007-11-15
Description: Unspecified "input validation" vulnerability in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to modify form field values via unknown vectors related to file uploads.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4696
Published: 2007-11-15
Description: Race condition in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to obtain information for forms from other sites via unknown vectors related to "page transitions" in Safari.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4697
Published: 2007-11-15
Description: Unspecified vulnerability in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via unknown vectors related to browser history, which triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4699
Published: 2007-11-15
Description: The default configuration of Safari in Apple Mac OS X 10.4 through 10.4.10 adds a private key to the keychain with permissions that allow other applications to access the key without warning the user, which might allow other applications to bypass intended access restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4700
Published: 2007-11-15
Description: Unspecified vulnerability in WebKit on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to use Safari as an indirect proxy and send attacker-controlled data to arbitrary TCP ports via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2007-4701
Published: 2007-11-15
Description: WebKit on Apple Mac OS X 10.4 through 10.4.10 does not create temporary files securely when Safari is previewing a PDF file, which allows local users to read the contents of that file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://secunia.com/advisories/27643
CVE: CVE-2006-7230
Published: 2007-11-15
Description: Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate the amount of memory needed for a compiled regular expression pattern when the (1) -x or (2) -i UTF-8 options change within the pattern, which allows context-dependent attackers to cause a denial of service (PCRE or glibc crash) via crafted regular expressions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=198976; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html; http://secunia.com/advisories/27741
CVE: CVE-2007-4702
Published: 2007-11-15
Description: The Application Firewall in Apple Mac OS X 10.5, when "Block all incoming connections" is enabled, does not prevent root processes or mDNSResponder from accepting connections, which might allow remote attackers or local root processes to bypass intended access restrictions.
CVSS Score: 9.3 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=307004; http://lists.apple.com/archives/security-announce/2007/Nov/msg00004.html; http://secunia.com/advisories/27695
CVE: CVE-2007-4703
Published: 2007-11-15
Description: The Application Firewall in Apple Mac OS X 10.5 does not prevent a root process from accepting incoming connections, even when "Block incoming connections" has been set for its associated executable, which might allow remote attackers or local root processes to bypass intended access restrictions.
CVSS Score: 10.0 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=307004; http://lists.apple.com/archives/security-announce/2007/Nov/msg00004.html; http://secunia.com/advisories/27695
CVE: CVE-2007-4704
Published: 2007-11-15
Description: The Application Firewall in Apple Mac OS X 10.5 does not apply changed settings to processes that are started by launchd until the processes are restarted, which might allow attackers to bypass intended access restrictions.
CVSS Score: 10.0 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=307004; http://lists.apple.com/archives/security-announce/2007/Nov/msg00004.html; http://secunia.com/advisories/27695
CVE: CVE-2007-5501
Published: 2007-11-15
Description: The tcp_sacktag_write_queue function in net/ipv4/tcp_input.c in Linux kernel 2.6.21 through 2.6.23.7, and 2.6.24-rc through 2.6.24-rc2, allows remote attackers to cause a denial of service (crash) via crafted ACK responses that trigger a NULL pointer dereference.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=96a2d41a3e495734b63bff4e5dd0112741b93b38; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00002.html; http://lwn.net/Articles/258947/
CVE: CVE-2007-5905
Published: 2007-11-15
Description: Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the (1) CFID or (2) CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-255
References: http://osvdb.org/41478; http://secunia.com/advisories/27644; http://securitytracker.com/id?1018944
CVE: CVE-2007-4344
Published: 2007-11-15
Description: Multiple input validation errors in ACD ACDSee Photo Manager 9.0 build 108, Pro Photo Manager 8.1 build 99, and Photo Editor 4.0 build 195 allow user-assisted remote attackers to execute arbitrary code via a long section string in (1) a PSP image to the ID_PSP.apl plug-in or (2) an LHA archive to the AM_LHA.apl plug-in, resulting in a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20, CWE-119
References: http://secunia.com/advisories/25952; http://secunia.com/secunia_research/2007-73/advisory/; http://securityreason.com/securityalert/3367
CVE: CVE-2007-5990
Published: 2007-11-15
Description: Cross-site scripting (XSS) vulnerability in ExoPHPdesk allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a user profile, possibly the (1) name and (2) website parameters to register.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38672; http://secunia.com/advisories/27638; http://securityreason.com/securityalert/3368
CVE: CVE-2007-5991
Published: 2007-11-15
Description: SQL injection vulnerability in index.php in ExoPHPdesk allows remote attackers to execute arbitrary SQL commands via the user parameter in a profile fn action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3368; http://www.securityfocus.com/archive/1/483673/100/0/threaded; http://www.securityfocus.com/bid/26431
CVE: CVE-2007-5992
Published: 2007-11-15
Description: SQL injection vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrary SQL commands via the seid parameter in a viewcat s action on the forums page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39728; http://www.securityfocus.com/bid/26422; http://www.vupen.com/english/advisories/2007/3905
CVE: CVE-2007-5993
Published: 2007-11-15
Description: Cross-site scripting (XSS) vulnerability in Visionary Technology in Library Solutions (VTLS) vtls.web.gateway before 48.1.1 allows remote attackers to inject arbitrary web script or HTML via the searchtype parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38708; http://secunia.com/advisories/27661; http://securityreason.com/securityalert/3369
CVE: CVE-2007-5994
Published: 2007-11-15
Description: PHP remote file inclusion vulnerability in check_noimage.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the config[path_src_include] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/39727; http://packetstormsecurity.org/0711-exploits/yappa-ng-rfi.txt; http://www.securityfocus.com/bid/26398
CVE: CVE-2007-5995
Published: 2007-11-15
Description: PHP remote file inclusion vulnerability in examples/patExampleGen/bbcodeSource.php in patBBcode 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the example parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/26416; http://www.vupen.com/english/advisories/2007/3904; https://exchange.xforce.ibmcloud.com/vulnerabilities/38425
CVE: CVE-2007-5996
Published: 2007-11-15
Description: SQL injection vulnerability in searchresult.php in Softbiz Link Directory Script allows remote attackers to execute arbitrary SQL commands via the sbcat_id parameter, a related issue to CVE-2007-5449.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/26402; https://exchange.xforce.ibmcloud.com/vulnerabilities/38398; https://www.exploit-db.com/exploits/4620
CVE: CVE-2007-5997
Published: 2007-11-15
Description: SQL injection vulnerability in campaign_stats.php in Softbiz Banner Exchange Network Script 1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/26401; https://exchange.xforce.ibmcloud.com/vulnerabilities/38401; https://www.exploit-db.com/exploits/4619
CVE: CVE-2007-5998
Published: 2007-11-15
Description: SQL injection vulnerability in ads.php in Softbiz Ad Management plus Script 1 allows remote authenticated users to execute arbitrary SQL commands via the package parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/26400; https://exchange.xforce.ibmcloud.com/vulnerabilities/38400; https://www.exploit-db.com/exploits/4618
CVE: CVE-2007-5999
Published: 2007-11-15
Description: SQL injection vulnerability in product_desc.php in Softbiz Auctions Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/26399; https://exchange.xforce.ibmcloud.com/vulnerabilities/38399; https://www.exploit-db.com/exploits/4617
CVE: CVE-2007-6000
Published: 2007-11-15
Description: KDE Konqueror 3.5.6 and earlier allows remote attackers to cause a denial of service (crash) via large HTTP cookie parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://securityreason.com/securityalert/3370; http://www.securityfocus.com/archive/1/483705/100/0/threaded; http://www.securityfocus.com/bid/26435
CVE: CVE-2007-6001
Published: 2007-11-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Bandersnatch 0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) func or (2) date parameter, or the jid parameter in a (3) log or (4) user action, a different vulnerability than CVE-2007-3910.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.portcullis-security.com/180.php; http://www.securityfocus.com/bid/26553; https://exchange.xforce.ibmcloud.com/vulnerabilities/38360