deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-0532
Published: 2007-01-26
Description: Tuan Do Uploader (aka php-uploader) 6 beta 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrator password hash via a direct request for userdata/user_1.txt.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/2187; http://www.securityfocus.com/archive/1/457698/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31683
CVE: CVE-2007-0533
Published: 2007-01-26
Description: The AToZed IntraWeb component 8.0 and earlier for Borland Delphi and Kylix, and IntraWeb 9.0 before build (9.0.12), allows remote attackers to cause a denial of service (thread hang or CPU consumption) via a crafted HTTP request, related to the OnBeforeDispatch function in the TIWServerController object.
CVSS Score: 5.0 (MEDIUM)
References: http://blogs.atozed.com/Olaf/20070124.en.aspx; http://blogs.atozed.com/Olaf/20070124A.en.aspx; http://osvdb.org/32973
CVE: CVE-2007-0534
Published: 2007-01-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) Project issue tracking 4.7.0 through 5.x before 20070123 and (2) Project 4.6.0 through 5.x before 20070123 modules for Drupal allow remote authenticated users to inject arbitrary web script or HTML via (a) certain "fields on project nodes" or (b) "certain project-specific settings regarding issue tracking."
CVSS Score: 4.3 (MEDIUM)
References: http://drupal.org/node/112146; http://osvdb.org/32133; http://secunia.com/advisories/23908
CVE: CVE-2007-0535
Published: 2007-01-26
Description: Multiple eval injection vulnerabilities in Vote! Pro 4.0, and possibly earlier, allow remote attackers to execute arbitrary code via requests to unspecified PHP scripts with the poll_id parameter, which is supplied to eval function calls, a different set of vectors than CVE-2007-0504.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31606; http://secunia.com/advisories/23834; http://www.vupen.com/english/advisories/2007/0300
CVE: CVE-2007-0536
Published: 2007-01-27
Description: The chroot helper in rMake for rPath Linux 1 does not drop supplemental groups, which causes packages to be installed with insecure permissions and might allow local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://lists.rpath.com/pipermail/security-announce/2007-January/000137.html; http://osvdb.org/32972; http://secunia.com/advisories/23922
CVE: CVE-2006-6953
Published: 2007-01-29
Description: The virtual keyboard implementation in GlobeTrotter Mobility Manager changes the color of a key as it is pressed, which allows local users to capture arbitrary keystrokes, such as for passwords, by shoulder surfing or grabbing periodic screenshots.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://img45.imageshack.us/my.php?image=poc7ik.jpg; http://www.securityfocus.com/archive/1/438376/100/100/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/27447
CVE: CVE-2006-6954
Published: 2007-01-29
Description: Flock beta 1 0.7 allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/438144/100/100/threaded; http://www.securityfocus.com/archive/1/438365/100/100/threaded; http://www.securityfocus.com/archive/1/439064/100/100/threaded
CVE: CVE-2006-6955
Published: 2007-01-29
Description: Opera allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0085.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/26898; http://archives.neohapsis.com/archives/bugtraq/2006-06/0085.html
CVE: CVE-2006-6956
Published: 2007-01-29
Description: Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0085.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/26898; http://archives.neohapsis.com/archives/bugtraq/2006-06/0085.html
CVE: CVE-2006-6957
Published: 2007-01-29
Description: PHP remote file inclusion vulnerability in addons/mod_media/body.php in Docebo 3.0.3 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[where_framework] parameter.  NOTE: this issue might be resultant from a global overwrite vulnerability. This issue is similar to CVE-2006-2576 and CVE-2006-3107, but the vectors are different.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0109.html; http://securityreason.com/securityalert/2194; http://www.osvdb.org/26710
CVE: CVE-2006-6958
Published: 2007-01-29
Description: Multiple PHP remote file inclusion vulnerabilities in phpBlueDragon 2.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter to (1) team_admin.php, (2) rss_admin.php, (3) manual_admin.php, and (4) forum_admin.php in includes/root_modules/, a different set of vectors than CVE-2006-3076.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/0606-exploits/phpbluedragon-2.txt; http://securityreason.com/securityalert/2193; http://www.osvdb.org/27676
CVE: CVE-2006-6959
Published: 2007-01-29
Description: WebRoot Spy Sweeper 4.5.9 and earlier allows local users to bypass the "Startup-Shield" security restrictions by modifying certain registry keys.
CVSS Score: 4.6 (MEDIUM)
References: http://www.osvdb.org/27535; http://www.securityfocus.com/archive/1/437814/100/200/threaded; http://www.sentinel.gr/advisories/SGA-0001.txt
CVE: CVE-2006-6960
Published: 2007-01-29
Description: The Compression Sweep feature in WebRoot Spy Sweeper 4.5.9 and earlier does not handle non-ZIP archives, which allows remote attackers to bypass the malware detection via files with (1) RAR, (2) GZ, (3) TAR, (4) CAB, or (5) ACE compression.
CVSS Score: 6.8 (MEDIUM)
References: http://www.osvdb.org/27536; http://www.securityfocus.com/archive/1/437814/100/200/threaded; http://www.sentinel.gr/advisories/SGA-0001.txt
CVE: CVE-2006-6961
Published: 2007-01-29
Description: WebRoot Spy Sweeper 4.5.9 and earlier does not detect malware based on file contents, which allows remote attackers to bypass malware detection by changing a file's name.
CVSS Score: 6.8 (MEDIUM)
References: http://www.osvdb.org/27538; http://www.securityfocus.com/archive/1/437814/100/200/threaded; http://www.sentinel.gr/advisories/SGA-0001.txt
CVE: CVE-2006-6962
Published: 2007-01-29
Description: PHP remote file inclusion vulnerability in rsgallery2.html.php in the RS Gallery2 component (com_rsgallery2) 1.11.2 for Joomla! allows attackers to execute arbitrary PHP code via the mosConfig_absolute_path parameter.  NOTE: this issue may overlap CVE-2006-5047.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/18705; http://www.vupen.com/english/advisories/2006/2581; https://exchange.xforce.ibmcloud.com/vulnerabilities/27418
CVE: CVE-2006-6963
Published: 2007-01-29
Description: Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 3.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[where_lms] parameter to (1) class.module/class.definition.php and (2) modules/scorm/scorm_utils.php.  NOTE: this issue may overlap CVE-2006-2577.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0116.html; http://securityreason.com/securityalert/2188; http://www.docebo.org/doceboCms/bugtracker/18_124/bugdetails/appid_1-bugid_154/bugtracker.html
CVE: CVE-2006-6964
Published: 2007-01-29
Description: MailEnable Professional before 1.78 provides a cleartext user password when an administrator edits the user's settings, which allows remote authenticated administrators to obtain sensitive information by viewing the HTML source.
CVSS Score: 4.0 (MEDIUM)
References: http://securitytracker.com/id?1016337; http://www.mailenable.com/Professional1-ReleaseNotes.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/27185
CVE: CVE-2007-0463
Published: 2007-01-29
Description: Format string vulnerability in Apple Software Update 2.0.5 on Mac OS X 10.4.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in (1) SWUTMP or (2) SUCATALOG filenames, or using the (3) application/x-apple.sucatalog+xml MIME type.
CVSS Score: 5.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=305214; http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html; http://projects.info-pull.com/moab/MOAB-24-01-2007.html
CVE: CVE-2007-0537
Published: 2007-01-29
Description: The KDE HTML library (kdelibs), as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to CVE-2007-0478.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://osvdb.org/32975; http://secunia.com/advisories/23932; http://secunia.com/advisories/24013
CVE: CVE-2006-6965
Published: 2007-01-29
Description: CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the media parameter.  NOTE: this issue can be leveraged for XSS attacks.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/31620; http://secunia.com/advisories/23926; http://secunia.com/advisories/24853
CVE: CVE-2007-0538
Published: 2007-01-29
Description: Telligent Community Server 2.1 and earlier allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to (1) a large file, which triggers a long download session without a timeout constraint; or (2) a file with a binary content type, which is downloaded even though it cannot contain usable pingback data.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33583; http://osvdb.org/33584; http://securityreason.com/securityalert/2211
CVE: CVE-2007-0539
Published: 2007-01-29
Description: The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a large file, which triggers a long download session without a timeout constraint.
CVSS Score: 7.8 (HIGH)
References: http://securityreason.com/securityalert/2191; http://www.securityfocus.com/archive/1/457996/100/0/threaded; http://www.securityfocus.com/archive/1/458003/100/0/threaded
CVE: CVE-2007-0540
Published: 2007-01-29
Description: WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a file with a binary content type, which is downloaded even though it cannot contain usable pingback data.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/30013; http://securityreason.com/securityalert/2191; http://www.debian.org/security/2008/dsa-1564
CVE: CVE-2007-0541
Published: 2007-01-29
Description: WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain configurations causes a brief file excerpt to be published as a blog comment.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://securityreason.com/securityalert/2191; http://www.securityfocus.com/archive/1/457996/100/0/threaded; http://www.securityfocus.com/archive/1/458003/100/0/threaded
CVE: CVE-2007-0542
Published: 2007-01-29
Description: Cross-site scripting (XSS) vulnerability in show.php in 212cafe Guestbook 4.00 beta allows remote attackers to inject arbitrary web script or HTML via the user parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2190; http://www.securityfocus.com/archive/1/457660/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31663
CVE: CVE-2007-0543
Published: 2007-01-29
Description: ZixForum 1.14 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for Zixforum.mdb.  NOTE: a followup post suggests that this issue only occurs if the administrator does not properly follow installation directions.
CVSS Score: 9.4 (HIGH)
References: http://securityreason.com/securityalert/2189; http://www.securityfocus.com/archive/1/457950/100/0/threaded; http://www.securityfocus.com/archive/1/458135/100/100/threaded
CVE: CVE-2007-0544
Published: 2007-01-29
Description: Cross-site scripting (XSS) vulnerability in private.php in MyBB (aka MyBulletinBoard) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/32967; http://secunia.com/advisories/23934; http://secunia.com/advisories/28837
CVE: CVE-2007-0545
Published: 2007-01-29
Description: Maxtricity Tagger 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for tagger.mdb.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33577; http://securityreason.com/securityalert/2214; http://www.securityfocus.com/archive/1/457953/100/0/threaded
CVE: CVE-2007-0546
Published: 2007-01-29
Description: Toxiclab Shoutbox 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db.mdb.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/33576; http://securityreason.com/securityalert/2213; http://www.securityfocus.com/archive/1/457931/100/0/threaded
CVE: CVE-2007-0547
Published: 2007-01-29
Description: Cross-site scripting (XSS) vulnerability in CGI-RESCUE WebFORM 4.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/32964; http://secunia.com/advisories/23913
CVE: CVE-2007-0548
Published: 2007-01-29
Description: KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number of requests for nonexistent objects.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/31623; http://secunia.com/advisories/23901; https://exchange.xforce.ibmcloud.com/vulnerabilities/31690
CVE: CVE-2007-0549
Published: 2007-01-29
Description: Cross-site scripting (XSS) vulnerability in list3.php in 212cafeBoard 6.30 Beta allows remote attackers to inject arbitrary web script or HTML via the user parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2212; http://www.securityfocus.com/archive/1/457611/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31650
CVE: CVE-2007-0550
Published: 2007-01-29
Description: Cross-site scripting (XSS) vulnerability in search.php in 212cafeBoard 0.08 Beta allows remote attackers to inject arbitrary web script or HTML via keyword parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2212; http://www.securityfocus.com/archive/1/457611/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31651
CVE: CVE-2007-0551
Published: 2007-01-29
Description: Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33572; http://securityreason.com/securityalert/2195; http://www.securityfocus.com/archive/1/457668/100/0/threaded
CVE: CVE-2007-0552
Published: 2007-01-29
Description: Cross-site scripting (XSS) vulnerability in install/default/error404.html in Oh no! Not another CMS (Onnac) 0.0.8.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the error_url parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://onnac.svn.sourceforge.net/viewvc/onnac/trunk/install/default/error404.html?view=log; http://osvdb.org/36811; http://sourceforge.net/forum/forum.php?forum_id=655260
CVE: CVE-2007-0553
Published: 2007-01-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.inc.php in PHProxy before 0.5 beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) data[realm] and (2) _url parameters, different vectors than CVE-2004-2604.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36812; http://sourceforge.net/project/shownotes.php?release_id=479999&group_id=110693; http://www.securityfocus.com/bid/22255
CVE: CVE-2007-0554
Published: 2007-01-29
Description: SQL injection vulnerability in print.asp in Guo Xu Guos Posting System (GPS) 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31635; http://secunia.com/advisories/23929; http://securityreason.com/securityalert/2209
CVE: CVE-2007-0347
Published: 2007-01-29
Description: The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" (quote) character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a ' character in certain messages, tickets, or Wiki entries.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052058.html; http://osvdb.org/31935; http://secunia.com/advisories/23940
CVE: CVE-2007-0557
Published: 2007-01-29
Description: rMake before 1.0.4 drops root privileges in a way that retains the original supplemental groups, which might allow attackers to gain privileges via a crafted recipe file, a different vulnerability than CVE-2007-0536.
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/32971; https://issues.rpath.com/browse/RPL-1002; http://osvdb.org/32971
CVE: CVE-2007-0558
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in modules/mail/main.php in Inter7 vHostAdmin 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the MODULES_DIR parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36627; http://www.vupen.com/english/advisories/2007/0339; https://www.exploit-db.com/exploits/3191
CVE: CVE-2007-0559
Published: 2007-01-30
Description: PHP remote file inclusion vulnerability in config.php in RPW 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the sql_language parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36626; http://www.vupen.com/english/advisories/2007/0342; https://www.exploit-db.com/exploits/3185
CVE: CVE-2007-0560
Published: 2007-01-30
Description: SQL injection vulnerability in user.asp in ASP EDGE 1.2b and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31619; http://secunia.com/advisories/23894; http://www.securityfocus.com/archive/1/458058/100/100/threaded
CVE: CVE-2007-0561
Published: 2007-01-30
Description: Multiple PHP remote file inclusion vulnerabilities in Xero Portal 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) admin_linkdb.php, (2) admin_forum_prune.php, (3) admin_extensions.php, (4) admin_board.php, (5) admin_attachments.php, or (6) admin_users.php in admin/.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31634; http://osvdb.org/31977; http://osvdb.org/31978
CVE: CVE-2007-0562
Published: 2007-01-30
Description: Windows Explorer (explorer.exe) 6.0.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted .avi file, which triggers the crash when the user right clicks on the file.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/43307; https://www.exploit-db.com/exploits/3190; http://osvdb.org/43307
CVE: CVE-2007-0563
Published: 2007-01-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Symantec Web Security (SWS) before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) error messages and (2) blocked page messages produced by SWS.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/32960; http://osvdb.org/32961; http://secunia.com/advisories/23896
CVE: CVE-2007-0564
Published: 2007-01-30
Description: The license registering interface in Symantec Web Security (SWS) before 3.0.1.85 allows attackers to cause a denial of service (CPU consumption) by submitting a large file.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/23896; http://securityresponse.symantec.com/avcenter/security/Content/2007.01.24c.html; http://securitytracker.com/id?1017558
CVE: CVE-2007-0565
Published: 2007-01-30
Description: CGI-Rescue Shopping Basket Professional 7.50 and earlier allows remote attackers to inject arbitrary operating system commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/31622; http://secunia.com/advisories/23909
CVE: CVE-2007-0566
Published: 2007-01-30
Description: SQL injection vulnerability in news_detail.asp in ASP NEWS 3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33582; http://www.securityfocus.com/archive/1/458057/100/100/threaded; http://www.securityfocus.com/bid/22214
CVE: CVE-2007-0455
Published: 2007-01-30
Description: Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224607; http://fedoranews.org/cms/node/2631; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052848.html
CVE: CVE-2007-0464
Published: 2007-01-30
Description: The _CFNetConnectionWillEnqueueRequests function in CFNetwork 129.19 on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (application crash) via a crafted HTTP 301 response, which results in a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html; http://projects.info-pull.com/moab/MOAB-25-01-2007.html
CVE: CVE-2007-0567
Published: 2007-01-30
Description: Cross-site scripting (XSS) vulnerability in admin.php in Interactive-Scripts.Com PHP Membership Manager 1.5 allows remote attackers to inject arbitrary web script or HTML via the _p parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/33601; http://www.securityfocus.com/archive/1/458226/100/0/threaded; http://www.securityfocus.com/bid/22263