deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-5674
Published: 2007-10-24
Description: Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PageName parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/27305; http://www.securityfocus.com/bid/26170; https://exchange.xforce.ibmcloud.com/vulnerabilities/37383
CVE: CVE-2007-5675
Published: 2007-10-24
Description: Stack-based buffer overflow in the DebugPrint function in MultiXTpm Application Server before 4.0.2d allows remote attackers to execute arbitrary code via a long string argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/40386; http://secunia.com/advisories/27323; http://sourceforge.net/project/shownotes.php?release_id=548209&group_id=196021
CVE: CVE-2007-5676
Published: 2007-10-24
Description: PHP remote file inclusion vulnerability in modules/Forums/favorites.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary PHP code via a URL in the nuke_bb_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/26183; https://exchange.xforce.ibmcloud.com/vulnerabilities/37387; https://www.exploit-db.com/exploits/4563
CVE: CVE-2007-5677
Published: 2007-10-24
Description: Cross-site scripting (XSS) vulnerability in shoutbox/blocco.php in Hackish BETA 1.1 allows remote attackers to inject arbitrary web script or HTML via the go_shout parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3308; http://www.securityfocus.com/archive/1/482615/100/0/threaded; http://www.securityfocus.com/bid/26167
CVE: CVE-2007-5678
Published: 2007-10-24
Description: SQL injection vulnerability in the Music module in phpBasic allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3305; http://www.securityfocus.com/archive/1/482680/100/0/threaded; http://securityreason.com/securityalert/3305
CVE: CVE-2007-5679
Published: 2007-10-25
Description: SQL injection vulnerability in index.php in DeeEmm.com DM CMS 0.7.0.Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in the media page (build_media_content.php). NOTE: it was later reported that 0.7.4 is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2007-10/0315.html; http://www.securityfocus.com/bid/26169/info; http://www.vupen.com/english/advisories/2008/2411
CVE: CVE-2007-2983
Published: 2007-10-25
Description: Multiple buffer overflows in the British Telecommunications Consumer webhelper ActiveX control before 2.0.0.8 in btwebcontrol.dll allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/40771; http://secunia.com/advisories/25472; http://www.kb.cert.org/vuls/id/686249
CVE: CVE-2007-5682
Published: 2007-10-26
Description: Incomplete blacklist vulnerability in tiki-graph_formula.php in TikiWiki before 1.9.8.2 allows remote attackers to execute arbitrary code by using variable functions and variable variables to write variables whose names match the whitelist, a different vulnerability than CVE-2007-5423.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://info.tikiwiki.org/tiki-read_article.php?articleId=15; http://osvdb.org/43610; http://www.securityfocus.com/archive/1/482908
CVE: CVE-2007-5683
Published: 2007-10-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to the password reminder page (tiki-remind_password.php), (2) IMG tags in wiki pages, and (3) the local_php parameter to db/tiki-db.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://info.tikiwiki.org/tiki-read_article.php?articleId=15; http://www.securityfocus.com/archive/1/482801/30/0/threaded; http://info.tikiwiki.org/tiki-read_article.php?articleId=15
CVE: CVE-2007-5684
Published: 2007-10-26
Description: Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in (1) error_handler_file and (2) local_php parameters to (a) tiki-index.php, or (3) encoded "..%2F" sequences in the imp_language parameter to tiki-imexport_languages.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://info.tikiwiki.org/tiki-read_article.php?articleId=15; http://www.securityfocus.com/archive/1/482801/30/0/threaded; http://info.tikiwiki.org/tiki-read_article.php?articleId=15
CVE: CVE-2007-3919
Published: 2007-10-28
Description: (1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447795; http://osvdb.org/41342; http://osvdb.org/41343
CVE: CVE-2007-5685
Published: 2007-10-28
Description: The safe_path function in shttp before 0.0.5 allows remote attackers to conduct directory traversal attacks and read files via a combination of ".." and sub-directory specifiers that resolve to a pathname that is at or below the same level as the web document root, but in a different part of the directory tree.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/43607; http://serverkit.org/modules/contrib/shttp/shttp-0.0.5.tar.gz; http://www.digineo.co.uk/shttp_directory_traversal
CVE: CVE-2007-5686
Published: 2007-10-28
Description: initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/27215; http://www.securityfocus.com/archive/1/482129/100/100/threaded; http://www.securityfocus.com/archive/1/482857/100/0/threaded
CVE: CVE-2007-5687
Published: 2007-10-28
Description: Multiple buffer overflows in the rich text processing functionality in JustSystems Ichitaro 2004 through 2007, 11 through 13, and other versions allow remote attackers to execute arbitrary code via a long (1) pard field or (2) font name in the fcharset0 field, which is not properly handled in (a) JSTARO4.OCX; or (3) a long title, which is not properly handled by (b) TJSVDA.DLL.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html
CVE: CVE-2007-5688
Published: 2007-10-29
Description: Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or IP.Board), allow remote attackers to execute arbitrary SQL commands via the (1) go and (2) cat parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27406; http://www.inj3ct-it.org/exploit/Multi_Host.txt; http://www.securityfocus.com/archive/1/482838/100/0/threaded
CVE: CVE-2007-5689
Published: 2007-10-29
Description: The Java Virtual Machine (JVM) in Sun Java Runtime Environment (JRE) in SDK and JRE 1.3.x through 1.3.1_20 and 1.4.x through 1.4.2_15, and JDK and JRE 5.x through 5.0 Update 12 and 6.x through 6 Update 2, allows remote attackers to execute arbitrary programs, or read or modify arbitrary files, via applets that grant privileges to themselves.
CVSS Score: 10.0 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/272; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01234533; http://osvdb.org/40834
CVE: CVE-2007-5690
Published: 2007-10-29
Description: Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name (interface name) in the ifr_name field.  NOTE: the vendor disputes this issue, stating that the application requires root access, so privilege boundaries are not crossed
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://downloads.digium.com/pub/asa/AST-2007-024.html; http://securityreason.com/securityalert/3319; http://www.eleytt.com/advisories/eleytt_ZAPTEL.pdf
CVE: CVE-2007-5691
Published: 2007-10-29
Description: ParseFTPList.cpp in Mozilla Firefox 2.0.0.7 allows remote FTP servers to cause a denial of service (application crash) via a crafted reply to an unspecified listing command, related to "reading from invalid pointer."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/43609; http://securityreason.com/securityalert/3319; http://www.eleytt.com/advisories/eleytt_FFPARSEFTPLIST.pdf
CVE: CVE-2007-5692
Published: 2007-10-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter to integrator.php; (2) the token parameter in a New Password action, (3) the nid_acl parameter in a Folder Properties action, or (4) the uid parameter in a Modify User action to command.php; or (5) the target parameter to index.php, different vectors than CVE-2006-3320.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/41355; http://osvdb.org/41356; http://osvdb.org/41357
CVE: CVE-2007-5693
Published: 2007-10-29
Description: Eval injection vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP code via the edit parameter in an upd cmd action, a different vulnerability than CVE-2007-5492.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/43604; http://secunia.com/advisories/27503; http://secunia.com/advisories/28008
CVE: CVE-2007-5694
Published: 2007-10-29
Description: Absolute path traversal vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to read arbitrary files via an absolute path in the dir parameter, a different vulnerability than CVE-2007-5491.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/41110; http://secunia.com/advisories/27503; http://secunia.com/advisories/28008
CVE: CVE-2007-5695
Published: 2007-10-29
Description: Open redirect vulnerability in command.php in SiteBar 3.3.8 allows remote attackers to redirect users to arbitrary web sites via a URL in the forward parameter in a Log In action.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-59
References: http://osvdb.org/41581; http://secunia.com/advisories/27503; http://secunia.com/advisories/28008
CVE: CVE-2007-5696
Published: 2007-10-29
Description: PHP remote file inclusion vulnerability in includes.php in phpBasic allows remote attackers to execute arbitrary PHP code via a URL in the root parameter, possibly related to the Music module.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://securityreason.com/securityalert/3305; http://www.securityfocus.com/archive/1/482680/100/0/threaded; http://securityreason.com/securityalert/3305
CVE: CVE-2007-3510
Published: 2007-10-29
Description: Buffer overflow in the IMAP service in IBM Lotus Domino before 6.5.6 FP2, and 7.x before 7.0.3, allows remote authenticated users to execute arbitrary code via a long mailbox name.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=605; http://secunia.com/advisories/27321; http://www-1.ibm.com/support/docview.wss?uid=swg21270623
CVE: CVE-2007-3920
Published: 2007-10-29
Description: GNOME screensaver 2.20 in Ubuntu 7.10, when used with Compiz, does not properly reserve input focus, which allows attackers with physical access to take control of the session after entering an Alt-Tab sequence, a related issue to CVE-2007-3069.
CVSS Score: 6.2 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00002.html; http://secunia.com/advisories/27381; http://secunia.com/advisories/28627
CVE: CVE-2007-5544
Published: 2007-10-29
Description: IBM Lotus Notes before 6.5.6, and 7.x before 7.0.3; and Domino before 6.5.5 FP3, and 7.x before 7.0.2 FP1; uses weak permissions (Everyone:Full Control) for memory mapped files (shared memory) in IPC, which allows local users to obtain sensitive information, or inject Lotus Script or other character sequences into a session.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://secunia.com/advisories/27321; http://www-1.ibm.com/support/docview.wss?uid=swg21257030; http://www.securityfocus.com/bid/26146
CVE: CVE-2007-5622
Published: 2007-10-29
Description: Double free vulnerability in the ftpprchild function in ftppr in 3proxy 0.5 through 0.5.3i allows remote attackers to cause a denial of service (daemon crash) via multiple OPEN commands to the FTP proxy.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://3proxy.ru/0.5.3j/Changelog.txt; http://bugs.gentoo.org/show_bug.cgi?id=196772; http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066985.html
CVE: CVE-2007-5697
Published: 2007-10-29
Description: Multiple PHP remote file inclusion vulnerabilities in PHP Image 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the xarg parameter to (1) xarg_corner.php, (2) xarg_corner_bottom.php, and (3) xarg_corner_top.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/40742; http://osvdb.org/40743; http://osvdb.org/40744
CVE: CVE-2007-5698
Published: 2007-10-29
Description: Cross-site scripting (XSS) vulnerability in default.asp in CREApark GOLD KOY PORTALI allows remote attackers to inject arbitrary web script or HTML via the aranan parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27368; http://www.securityfocus.com/bid/26191; https://exchange.xforce.ibmcloud.com/vulnerabilities/37392
CVE: CVE-2007-5699
Published: 2007-10-29
Description: Stack-based buffer overflow in eIQNetworks Enterprise Security Analyzer (ESA) 2.5 allows remote attackers to execute arbitrary code via certain data on TCP port 10616 that results in a long argument to the SEARCHREPORT command, a different vector than CVE-2007-2059.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/26189; https://exchange.xforce.ibmcloud.com/vulnerabilities/38139; https://www.exploit-db.com/exploits/4566
CVE: CVE-2007-5700
Published: 2007-10-29
Description: The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information.
CVSS Score: 6.3 (MEDIUM)
References: http://osvdb.org/40951; http://secunia.com/advisories/27321; http://www-1.ibm.com/support/docview.wss?uid=swg21273266
CVE: CVE-2007-5701
Published: 2007-10-29
Description: Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information (passwords) when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character, which bypasses a blacklist designed to suppress password logging, resulting in cleartext password disclosure in the console log and Admin panel.
CVSS Score: 2.1 (LOW)
CWE: CWE-200, CWE-310
References: http://osvdb.org/40952; http://secunia.com/advisories/27321; http://www-1.ibm.com/support/docview.wss?uid=swg21261095
CVE: CVE-2007-4222
Published: 2007-10-29
Description: Buffer overflow in the TagAttributeListCopy function in nnotes.dll in IBM Lotus Notes before 7.0.3 allows user-assisted remote attackers to execute arbitrary code via a crafted HTML email, related to duplicate RTF conversion when the recipient operates on this email.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=604; http://www-1.ibm.com/support/docview.wss?rs=477&uid=swg21272930; http://www.securityfocus.com/bid/26200
CVE: CVE-2007-4999
Published: 2007-10-29
Description: libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service (NULL dereference and application crash) via a message that contains invalid HTML data, a different vector than CVE-2007-4996.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/38695; http://secunia.com/advisories/27372; http://secunia.com/advisories/27495
CVE: CVE-2007-5413
Published: 2007-10-29
Description: httpd.tkd in Radia Integration Server in Hewlett-Packard (HP) OpenView Configuration Management (CM) Infrastructure 4.0 through 4.2i and Client Configuration Manager (CCM) 2.0 allows remote attackers to read arbitrary files via URLs containing tilde (~) references to home directories, as demonstrated by ~root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01205079; http://osvdb.org/39528; http://secunia.com/advisories/27341
CVE: CVE-2007-5702
Published: 2007-10-29
Description: Cross-site scripting (XSS) vulnerability in swamp/action/LoginActions (aka the login box) in the Novell OpenSUSE SWAMP Workflow Administration and Management Platform 1.x allows remote attackers to inject arbitrary web script or HTML via the username parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27390; http://swamp.svn.sourceforge.net/viewvc/swamp/trunk/swamp/webapps/webswamp/src/java/de/suse/swamp/modules/actions/LoginActions.java?r1=666&r2=700; http://www.osvdb.org/38203
CVE: CVE-2007-5703
Published: 2007-10-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) Request-spk.xuda and (2) Add-msie-request.xuda in RSA KEON Registration Authority Web Interface 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38298; http://osvdb.org/38299; http://secunia.com/advisories/27384
CVE: CVE-2007-5704
Published: 2007-10-29
Description: Multiple SQL injection vulnerabilities in CodeWidgets.com Online Event Registration Template allow remote attackers to execute arbitrary SQL commands via the (1) Email Address and (2) Password fields in (a) login.asp and (b) admin_login.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27375; http://securityreason.com/securityalert/3313; http://www.osvdb.org/38167
CVE: CVE-2007-5705
Published: 2007-10-29
Description: Unspecified vulnerability in the Settings component in the administration system in Jeebles Directory 2.9.60 allows remote authenticated administrators to execute arbitrary PHP code via unspecified vectors related to settings.inc.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/27345; https://exchange.xforce.ibmcloud.com/vulnerabilities/37379; http://secunia.com/advisories/27345
CVE: CVE-2007-5706
Published: 2007-10-29
Description: Absolute path traversal vulnerability in download.php in Jeebles Directory 2.9.60 allows remote attackers to read arbitrary files via a full pathname in the query string.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/27345; http://securityreason.com/securityalert/3315; http://www.securityfocus.com/archive/1/482612/100/0/threaded
CVE: CVE-2007-4348
Published: 2007-10-30
Description: Cross-site scripting (XSS) vulnerability in the CAD service in IBM Tivoli Storage Manager (TSM) Client 5.3.5.3 and 5.4.1.2 for Windows allows remote attackers to inject arbitrary web script or HTML via HTTP requests to port 1581, which generate log entries in a dsmerror.log file that is accessible through a certain web interface.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27013; http://secunia.com/secunia_research/2007-75/advisory; http://www.securityfocus.com/bid/26221
CVE: CVE-2007-5707
Published: 2007-10-30
Description: OpenLDAP before 2.3.39 allows remote attackers to cause a denial of service (slapd crash) via an LDAP request with a malformed objectClasses attribute.  NOTE: this has been reported as a double free, but the reports are inconsistent.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=440632; http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://secunia.com/advisories/27424
CVE: CVE-2007-5708
Published: 2007-10-30
Description: slapo-pcache (overlays/pcache.c) in slapd in OpenLDAP before 2.3.39, when running as a proxy-caching server, allocates memory using a malloc variant instead of calloc, which prevents an array from being initialized properly and might allow attackers to cause a denial of service (segmentation fault) via unknown vectors that prevent the array from being null terminated.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/27424; http://secunia.com/advisories/27683; http://secunia.com/advisories/27756
CVE: CVE-2007-5709
Published: 2007-10-30
Description: Stack-based buffer overflow in Sony SonicStage CONNECT Player (CP) 4.3 allows remote attackers to execute arbitrary code via a long file name in an M3U file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/41998; http://secunia.com/advisories/27270; http://www.securityfocus.com/bid/26241
CVE: CVE-2007-5710
Published: 2007-10-30
Description: Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web script or HTML via the posts_columns array parameter.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://osvdb.org/38279; http://secunia.com/advisories/27407; http://wordpress.org/development/2007/10/wordpress-231/
CVE: CVE-2007-5711
Published: 2007-10-30
Description: Massive Entertainment World in Conflict 1.001 and earlier allows remote attackers to cause a denial of service (failed assertion and daemon crash) via a large packet to TCP or UDP port 48000.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/wicassert-adv.txt; http://aluigi.org/poc/wicassert.zip; http://osvdb.org/39019
CVE: CVE-2007-5712
Published: 2007-10-30
Description: The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.
CVSS Score: 2.6 (LOW)
CWE: CWE-399
References: http://secunia.com/advisories/27435; http://secunia.com/advisories/27597; http://secunia.com/advisories/31961
CVE: CVE-2007-5713
Published: 2007-10-30
Description: Off-by-one error in the GeoIP module in the AMX Mod X 1.76d plugin for Half-Life Server might allow attackers to execute arbitrary code or cause a denial of service via unspecified input related to geolocation, which triggers an error message from the (1) geoip_code2 or (2) geoip_code3 function, leading to a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://bugs.alliedmods.net/?do=details&task_id=519; http://osvdb.org/41980; http://secunia.com/advisories/27411
CVE: CVE-2007-5714
Published: 2007-10-30
Description: The Gentoo ebuild of MLDonkey before 2.9.0-r3 has a p2p user account with an empty default password and valid login shell, which might allow remote attackers to obtain login access and execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/27366; http://security.gentoo.org/glsa/glsa-200710-25.xml; http://secunia.com/advisories/27366