deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-7004
Published: 2007-02-12
Description: Cross-site scripting (XSS) vulnerability in email_request.php in PSY Auction allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.osvdb.org/36360; http://www.securityfocus.com/bid/17974; http://www.securityfocus.com/data/vulnerabilities/exploits/PSYAuction-0515-sql-html.txt
CVE: CVE-2006-7005
Published: 2007-02-12
Description: SQL injection vulnerability in item.php in PSY Auction allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/17974; http://www.securityfocus.com/data/vulnerabilities/exploits/PSYAuction-0515-sql-html.txt; http://www.securityfocus.com/bid/17974
CVE: CVE-2006-7006
Published: 2007-02-12
Description: PHP remote file inclusion vulnerability in upload/admin/team.php in Robin de Graff Somery 0.4.4 allows remote attackers to execute arbitrary PHP code via a URL in the checkauth parameter.  NOTE: CVE disputes this vulnerability because the checkauth parameter is only used in conditionals
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0242.html; http://packetstorm.linuxsecurity.com/0606-exploits/Somery.txt; http://www.attrition.org/pipermail/vim/2007-February/001305.html
CVE: CVE-2006-7007
Published: 2007-02-12
Description: Buffer overflow in Tiny FTPd 1.4 and earlier allows remote attackers to cause a denial of service (daemon crash) via a long USER command, a different vector than CVE-2000-0133.
CVSS Score: 7.8 (HIGH)
References: http://www.osvdb.org/25767; http://www.ph4nt0m.org/bbs/showthread.php?threadid=30080&goto=nextnewest; http://www.securiteam.com/exploits/5LP032KIKC.html
CVE: CVE-2006-7008
Published: 2007-02-12
Description: Unspecified vulnerability in Joomla! before 1.0.10 has unknown impact and attack vectors, related to "securing mosmsg from misuse." NOTE: it is possible that this issue overlaps CVE-2006-1029.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20874; http://www.joomla.org/content/view/1510/74/; http://www.osvdb.org/26915
CVE: CVE-2006-7009
Published: 2007-02-12
Description: Joomla! before 1.0.10 allows remote attackers to spoof the frontend submission forms, which has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20874; http://www.joomla.org/content/view/1510/74/; http://secunia.com/advisories/20874
CVE: CVE-2006-7010
Published: 2007-02-12
Description: The mosgetparam implementation in Joomla! before 1.0.10, does not set a variable's data type to integer when the variable's default value is numeric, which has unspecified impact and attack vectors, which may permit SQL injection attacks.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20874; http://www.joomla.org/content/view/1510/74/; http://www.osvdb.org/26916
CVE: CVE-2007-0886
Published: 2007-02-12
Description: Heap-based buffer underflow in axigen 1.2.6 through 2.0.0b1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via certain base64-encoded data on the pop3 port (110/tcp), which triggers an integer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3302&w=2; http://osvdb.org/38133; http://secunia.com/advisories/24073
CVE: CVE-2007-0887
Published: 2007-02-12
Description: axigen 1.2.6 through 2.0.0b1 does not properly parse login credentials, which allows remote attackers to cause a denial of service (NULL dereference and application crash) via a base64-encoded "*\x00" sequence on the imap port (143/tcp).
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3302&w=2; http://osvdb.org/33165; http://secunia.com/advisories/24073
CVE: CVE-2007-0888
Published: 2007-02-12
Description: Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// (dot dot) sequences in the pathname argument to an FTP (1) GET or (2) PUT command.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24103; http://securityreason.com/securityalert/2236; http://www.kiwisyslog.com/kb/idx/5/178/article/
CVE: CVE-2007-0889
Published: 2007-02-12
Description: Kiwi CatTools before 3.2.0 beta uses weak encryption ("reversible encoding") for passwords, account names, and IP addresses in kiwidb-cattools.kdb, which might allow local users to gain sensitive information by decrypting the file.  NOTE: this issue could be leveraged with a directory traversal vulnerability for a remote attack vector.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/33163; http://secunia.com/advisories/24103; http://securityreason.com/securityalert/2236
CVE: CVE-2007-0890
Published: 2007-02-12
Description: Cross-site scripting (XSS) vulnerability in scripts/passwdmysql in cPanel WebHost Manager (WHM) 11.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the password parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://changelog.cpanel.net/index.cgi; http://osvdb.org/32044; http://secunia.com/advisories/24106
CVE: CVE-2007-0891
Published: 2007-02-12
Description: Cross-site scripting (XSS) vulnerability in the GetCurrentCompletePath function in phpmyvisites.php in phpMyVisites before 2.2 allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3908&w=2; http://osvdb.org/33176; http://secunia.com/advisories/24124
CVE: CVE-2007-0892
Published: 2007-02-12
Description: CRLF injection vulnerability in phpMyVisites before 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the url parameter, when the pagename parameter begins with "FILE:".
CVSS Score: 7.5 (HIGH)
CWE: CWE-93
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3908&w=2; http://osvdb.org/33177; http://www.securityfocus.com/archive/1/459792/100/0/threaded
CVE: CVE-2007-0893
Published: 2007-02-12
Description: Directory traversal vulnerability in phpMyVisites before 2.2 allows remote attackers to include arbitrary files via leading ".." sequences on the pmv_ck_view COOKIE parameter, which bypasses the protection scheme.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3908&w=2; http://osvdb.org/33178; http://www.securityfocus.com/archive/1/459792/100/0/threaded
CVE: CVE-2007-0894
Published: 2007-02-12
Description: MediaWiki before 1.9.2 allows remote attackers to obtain sensitive information via a direct request to (1) Simple.deps.php, (2) MonoBook.deps.php, (3) MySkin.deps.php, or (4) Chick.deps.php in wiki/skins, which shows the installation path in the resulting error message.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.wikimedia.org/show_bug.cgi?id=8819; http://osvdb.org/33706; http://osvdb.org/33707
CVE: CVE-2007-0895
Published: 2007-02-13
Description: Race condition in recursive directory deletion with the (1) -r or (2) -R option in rm in Solaris 8 through 10 before 20070208 allows local users to delete files and directories as the user running rm by moving a low-level directory to a higher level as it is being deleted, which causes rm to chdir to a ".." directory that is higher than expected, possibly up to the root file system, a related issue to CVE-2002-0435.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/24082; http://secunia.com/advisories/24405; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102782-1
CVE: CVE-2007-0842
Published: 2007-02-13
Description: The 64-bit versions of Microsoft Visual C++ 8.0 standard library (MSVCR80.DLL) time functions, including (1) localtime, (2) localtime_s, (3) gmtime, (4) gmtime_s, (5) ctime, (6) ctime_s, (7) wctime, (8) wctime_s, and (9) fstat, trigger an assertion error instead of a NULL pointer or EINVAL when processing a time argument later than Jan 1, 3000, which might allow context-dependent attackers to cause a denial of service (application exit) via large time values. NOTE: it could be argued that this is a design limitation of the functions, and the vulnerability lies with any application that does not validate arguments to these functions.  However, this behavior is inconsistent with documentation, which does not list assertions as a possible result of an error condition.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://msdn2.microsoft.com/en-us/library/a442x3ye%28VS.80%29.aspx; http://osvdb.org/33626; http://securityreason.com/securityalert/2237
CVE: CVE-2007-0896
Published: 2007-02-13
Description: Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10, and (2) Sage++ extensions for Firefox, allows remote attackers to inject arbitrary web script or HTML via a "<SCRIPT/=''SRC='" sequence in an RSS feed, a different vulnerability than CVE-2006-4712.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://mozdev.org/bugs/show_bug.cgi?id=16320; http://osvdb.org/33131
CVE: CVE-2006-1311
Published: 2007-02-13
Description: The RichEdit component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1; Office 2000 SP3, XP SP3, 2003 SP2, and Office 2004 for Mac; and Learning Essentials for Microsoft Office 1.0, 1.1, and 1.5 allows user-assisted remote attackers to execute arbitrary code via a malformed OLE object in an RTF file, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/24152; http://www.kb.cert.org/vuls/id/368132; http://www.osvdb.org/31886
CVE: CVE-2006-3448
Published: 2007-02-13
Description: Buffer overflow in the Step-by-Step Interactive Training in Microsoft Windows 2000 SP4, XP SP2 and Professional, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a long Syllabus string in crafted bookmark link files (cbo, cbl, or .cbm), a different issue than CVE-2005-1212.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/24121; http://www.kb.cert.org/vuls/id/466873; http://www.osvdb.org/31883
CVE: CVE-2006-5270
Published: 2007-02-13
Description: Integer overflow in the Microsoft Malware Protection Engine (mpengine.dll), as used by Windows Live OneCare, Antigen, Defender, and Forefront Security, allows user-assisted remote attackers to execute arbitrary code via a crafted PDF file.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/24146; http://www.kb.cert.org/vuls/id/511577; http://www.osvdb.org/31888
CVE: CVE-2007-0025
Published: 2007-02-13
Description: The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/24150; http://www.kb.cert.org/vuls/id/932041; http://www.osvdb.org/31887
CVE: CVE-2007-0026
Published: 2007-02-13
Description: The OLE Dialog component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption.
CVSS Score: 7.6 (HIGH)
References: http://secunia.com/advisories/24147; http://www.kb.cert.org/vuls/id/497756; http://www.osvdb.org/31885
CVE: CVE-2007-0210
Published: 2007-02-13
Description: The Window Image Acquisition (WIA) Service in Microsoft Windows XP SP2 allows local users to gain privileges via unspecified vectors involving an "unchecked buffer," probably a buffer overflow.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/24132; http://www.osvdb.org/31889; http://www.securityfocus.com/bid/22499
CVE: CVE-2007-0211
Published: 2007-02-13
Description: The hardware detection functionality in the Windows Shell in Microsoft Windows XP SP2 and Professional, and Server 2003 SP1 allows local users to gain privileges via an unvalidated parameter to a function related to the "detection and registration of new hardware."
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/24126; http://www.kb.cert.org/vuls/id/240796; http://www.osvdb.org/31890
CVE: CVE-2007-0214
Published: 2007-02-13
Description: The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Windows 2000 SP3, XP SP2 and Professional, 2003 SP1 allows remote attackers to execute arbitrary code via unspecified functions, related to uninitialized parameters.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/24136; http://www.kb.cert.org/vuls/id/563756; http://www.osvdb.org/31884
CVE: CVE-2007-0900
Published: 2007-02-13
Description: Multiple PHP remote file inclusion vulnerabilities in TagIt! Tagboard 2.1.B Build 2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) configpath parameter to (a) tagviewer.php, (b) tag_process.php, and (c) CONFIG/errmsg.inc.php; and (d) addTagmin.php, (e) ban_watch.php, (f) delTagmin.php, (g) delTag.php, (h) editTagmin.php, (i) editTag.php, (j) manageTagmins.php, and (k) verify.php in tagmin/; the (2) adminpath parameter to (l) tagviewer.php, (m) tag_process.php, and (n) tagmin/index.php; and the (3) admin parameter to (o) readconf.php, (p) updateconf.php, (q) updatefilter.php, and (r) wordfilter.php in tagmin/; different vectors than CVE-2006-5249.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv65-K-159-2007.txt; http://www.osvdb.org/34603; http://www.osvdb.org/34604
CVE: CVE-2007-0901
Published: 2007-02-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) hitcounts and (2) general parameters, different vectors than CVE-2007-0857.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33172; http://secunia.com/advisories/24138; http://secunia.com/advisories/24244
CVE: CVE-2007-0902
Published: 2007-02-13
Description: Unspecified vulnerability in the "Show debugging information" feature in MoinMoin 1.5.7 allows remote attackers to obtain sensitive information.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33173; http://secunia.com/advisories/24138; http://secunia.com/advisories/24244
CVE: CVE-2007-0903
Published: 2007-02-13
Description: Unspecified vulnerability in the mod_roster_odbc module in ejabberd before 1.1.3 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/33179; http://secunia.com/advisories/24075; http://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_113/
CVE: CVE-2007-0904
Published: 2007-02-13
Description: SQL injection vulnerability in projects.php in LightRO CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter to index.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34598; http://www.vupen.com/english/advisories/2007/0540; https://exchange.xforce.ibmcloud.com/vulnerabilities/32347
CVE: CVE-2007-0208
Published: 2007-02-13
Description: Microsoft Word in Office 2000 SP3, XP SP3, Office 2003 SP2, Works Suite 2004 to 2006, and Office 2004 for Mac does not correctly check the properties of certain documents and warn the user of macro content, which allows user-assisted remote attackers to execute arbitrary code.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.osvdb.org/34385; http://www.securityfocus.com/bid/22477; http://www.securitytracker.com/id?1017639
CVE: CVE-2007-0209
Published: 2007-02-13
Description: Microsoft Word in Office 2000 SP3, XP SP3, Office 2003 SP2, Works Suite 2004 to 2006, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a Word file with a malformed drawing object, which leads to memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/34386; http://www.securityfocus.com/bid/22482; http://www.securitytracker.com/id?1017639
CVE: CVE-2006-4697
Published: 2007-02-13
Description: Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from Imjpcksid.dll as ActiveX controls, which allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this issue might be related to CVE-2006-4193.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/24156; http://www.kb.cert.org/vuls/id/753924; http://www.osvdb.org/31891
CVE: CVE-2007-0217
Published: 2007-02-13
Description: The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of a specific length that causes a terminating null byte to be written outside of a buffer, which causes heap corruption.
CVSS Score: 10.0 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=473; http://secunia.com/advisories/24156; http://www.kb.cert.org/vuls/id/613564
CVE: CVE-2007-0219
Published: 2007-02-13
Description: Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from (1) Msb1fren.dll, (2) Htmlmm.ocx, and (3) Blnmgrps.dll as ActiveX controls, which allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2006-4697.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24156; http://www.kb.cert.org/vuls/id/771788; http://www.osvdb.org/31893
CVE: CVE-2007-0905
Published: 2007-02-13
Description: PHP before 5.2.1 allows attackers to bypass safe_mode and open_basedir restrictions via unspecified vectors in the session extension.  NOTE: it is possible that this issue is a duplicate of CVE-2006-6383.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/32768; http://secunia.com/advisories/24089; http://secunia.com/advisories/24419
CVE: CVE-2007-0906
Published: 2007-02-13
Description: Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1) session, (2) zip, (3) imap, and (4) sqlite extensions; (5) stream filters; and the (6) str_replace, (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and (10) ibase_modify_user functions.  NOTE: vector 6 might actually be an integer overflow (CVE-2007-1885).  NOTE: as of 20070411, vector (3) might involve the imap_mail_compose function (CVE-2007-1825).
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html; http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html
CVE: CVE-2007-0907
Published: 2007-02-13
Description: Buffer underflow in PHP before 5.2.1 allows attackers to cause a denial of service via unspecified vectors involving the sapi_header_op function.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html; http://osvdb.org/32767
CVE: CVE-2007-0908
Published: 2007-02-13
Description: The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html; http://osvdb.org/32766
CVE: CVE-2007-0909
Published: 2007-02-13
Description: Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems, and (2) the odbc_result_all function.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html; http://osvdb.org/32764
CVE: CVE-2007-0910
Published: 2007-02-13
Description: Unspecified vulnerability in PHP before 5.2.1 allows attackers to "clobber" certain super-global variables via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc; http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html; http://osvdb.org/32763
CVE: CVE-2007-0911
Published: 2007-02-13
Description: Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).
CVSS Score: 7.8 (HIGH)
References: http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.36&r2=1.445.2.14.2.37; http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html; http://marc.info/?l=php-dev&m=[PII_REDACTED]6516&w=2
CVE: CVE-2007-0912
Published: 2007-02-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in admin/admin.adm.php in Jportal 2.3.1, and possibly earlier, allows remote attackers to perform privileged actions as administrators by tricking the admin into accessing a URL with modified arguments to admin/admin.adm.php.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/33712; http://securityreason.com/securityalert/2239; http://www.securityfocus.com/archive/1/459827/100/0/threaded
CVE: CVE-2006-5859
Published: 2007-02-14
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1, when Global Script Protection is not enabled, allows remote attackers to inject arbitrary HTML and web script via unknown vectors, possibly related to Linkdirect.cfm, Topnav.cfm, and Welcomedoc.cfm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/32121; http://secunia.com/advisories/24115; http://www.adobe.com/support/security/bulletins/apsb07-03.html
CVE: CVE-2007-0913
Published: 2007-02-14
Description: Unspecified vulnerability in Microsoft Powerpoint allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as exploited by Trojan.PPDropper.G.  NOTE: as of 20070213, it is not clear whether this is the same issue as CVE-2006-5296, CVE-2006-4694, CVE-2006-3876, CVE-2006-3877, or older issues.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35763; http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2007[PII_REDACTED]-99&tabid=2; http://osvdb.org/35763
CVE: CVE-2006-5860
Published: 2007-02-14
Description: Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/32122; http://secunia.com/advisories/24093; http://www.adobe.com/support/security/bulletins/apsb07-05.html
CVE: CVE-2007-0914
Published: 2007-02-14
Description: Race condition in the TCP subsystem for Solaris 10 allows remote attackers to cause a denial of service (system panic) via unknown vectors.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/33194; http://secunia.com/advisories/24166; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102796-1