deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2453
Published: 2007-06-11
Description: The random number feature in Linux kernel 2.6 before 2.6.20.13, and 2.6.21.x before 2.6.21.4, (1) does not properly seed pools when there is no entropy, or (2) uses an incorrect cast when extracting entropy, which might cause the random number generator to provide the same values after reboots on systems without an entropy source.
CVSS Score: 1.2 (LOW)
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]9959&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]1272&w=2; http://osvdb.org/37114
CVE: CVE-2007-2873
Published: 2007-06-11
Description: SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.
CVSS Score: 1.9 (LOW)
References: http://osvdb.org/37234; http://spamassassin.apache.org/advisories/cve-2007-2873.txt; http://www.mandriva.com/security/advisories?name=MDKSA-2007:125
CVE: CVE-2007-2876
Published: 2007-06-11
Description: The sctp_new function in (1) ip_conntrack_proto_sctp.c and (2) nf_conntrack_proto_sctp.c in Netfilter in Linux kernel 2.6 before 2.6.20.13, and 2.6.21.x before 2.6.21.4, allows remote attackers to cause a denial of service by causing certain invalid states that trigger a NULL pointer dereference.
CVSS Score: 6.1 (MEDIUM)
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]9959&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]1272&w=2; http://osvdb.org/37112
CVE: CVE-2007-3179
Published: 2007-06-11
Description: Multiple SQL injection vulnerabilities in archives.php in Particle Blogger 1.2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the month parameter and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37468; http://securityreason.com/securityalert/2799; http://www.securityfocus.com/archive/1/469984/100/0/threaded
CVE: CVE-2007-3180
Published: 2007-06-12
Description: Buffer overflow in Help and Support Center before 4.4 C on HP Windows systems allows remote attackers to read or write arbitrary files via unknown vectors.
CVSS Score: 9.4 (HIGH)
CWE: CWE-119
References: http://h10025.www1.hp.com/ewfrf/wc/genericSoftwareDownloadIndex?cc=us&dlc=en&lc=en&softwareitem=ob-48738-1&jumpid=reg_R1002_USEN; http://osvdb.org/37239; http://secunia.com/advisories/25624
CVE: CVE-2007-2796
Published: 2007-06-12
Description: Arris Cadant C3 CMTS allows remote attackers to cause a denial of service (service termination) via a malformed IP packet with an invalid IP option.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/37233; http://secunia.com/advisories/25611; http://www.securityfocus.com/archive/1/471195/100/0/threaded
CVE: CVE-2007-0218
Published: 2007-06-12
Description: Microsoft Internet Explorer 5.01 and 6 allows remote attackers to execute arbitrary code by instantiating certain COM objects from Urlmon.dll, which triggers memory corruption during a call to the IObjectSafety function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=542; http://osvdb.org/35348; http://secunia.com/advisories/25627
CVE: CVE-2007-0934
Published: 2007-06-12
Description: Unspecified vulnerability in Microsoft Visio 2002 allows remote user-assisted attackers to execute arbitrary code via a Visio (.VSD, VSS, .VST) file with a crafted version number that triggers memory corruption.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35342; http://secunia.com/advisories/25619; http://www.securityfocus.com/archive/1/471947/100/0/threaded
CVE: CVE-2007-0936
Published: 2007-06-12
Description: Multiple unspecified vulnerabilities in Microsoft Visio 2002 allow remote user-assisted attackers to execute arbitrary code via a Visio (.VSD, VSS, .VST) file with a crafted packed object that triggers memory corruption, aka "Visio Document Packaging Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35343; http://secunia.com/advisories/25619; http://www.securityfocus.com/archive/1/471947/100/0/threaded
CVE: CVE-2007-1750
Published: 2007-06-12
Description: Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via a crafted Cascading Style Sheets (CSS) tag that triggers memory corruption.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35349; http://secunia.com/advisories/25627; http://securitytracker.com/id?1018235
CVE: CVE-2007-1751
Published: 2007-06-12
Description: Microsoft Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code by causing Internet Explorer to access an uninitialized or deleted object, related to prototype variables and table cells, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-908
References: http://osvdb.org/35351; http://secunia.com/advisories/25627; http://securitytracker.com/id?1018235
CVE: CVE-2007-1752
Published: 2007-06-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-1499.  Reason: This candidate is a duplicate of CVE-2007-1499.  Notes: All CVE users should reference CVE-2007-1499 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-2218
Published: 2007-06-12
Description: Unspecified vulnerability in the Windows Schannel Security Package for Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2, allows remote servers to execute arbitrary code or cause a denial of service via crafted digital signatures that are processed during an SSL handshake.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/25620; http://www.kb.cert.org/vuls/id/810073; http://www.securityfocus.com/archive/1/471947/100/0/threaded
CVE: CVE-2007-2222
Published: 2007-06-12
Description: Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as used by Microsoft Internet Explorer 5.01, 6, and 7, allow remote attackers to execute arbitrary code via a crafted ActiveX object that triggers memory corruption, as demonstrated via the ModeName parameter to the FindEngine function in ACTIVEVOICEPROJECTLib.DirectSS.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/35353; http://retrogod.altervista.org/win_speech_2k_sp4.html; http://retrogod.altervista.org/win_speech_xp_sp2.html
CVE: CVE-2007-2229
Published: 2007-06-12
Description: Microsoft Windows Vista uses insecure default permissions for unspecified "local user information data stores" in the registry and the file system, which allows local users to obtain sensitive information such as administrative passwords, aka "Permissive User Information Store ACLs Information Disclosure Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/35344; http://secunia.com/advisories/25623; http://www.securityfocus.com/archive/1/471947/100/0/threaded
CVE: CVE-2007-3027
Published: 2007-06-12
Description: Race condition in Microsoft Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code by causing Internet Explorer to install multiple language packs in a way that triggers memory corruption, aka "Language Pack Installation Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35350; http://secunia.com/advisories/25627; http://securitytracker.com/id?1018235
CVE: CVE-2007-2219
Published: 2007-06-12
Description: Unspecified vulnerability in the Win32 API on Microsoft Windows 2000, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via certain parameters to an unspecified function.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/35341; http://secunia.com/advisories/25640; http://www.kb.cert.org/vuls/id/457281
CVE: CVE-2007-2225
Published: 2007-06-12
Description: A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
References: http://archive.openmya.devnull.jp/2007.06/msg00060.html; http://openmya.hacker.jp/hasegawa/security/ms07-034.txt; http://osvdb.org/35345
CVE: CVE-2007-0245
Published: 2007-06-12
Description: Heap-based buffer overflow in OpenOffice.org (OOo) 2.2.1 and earlier allows remote attackers to execute arbitrary code via a RTF file with a crafted prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://osvdb.org/35378; http://secunia.com/advisories/25648
CVE: CVE-2007-2227
Published: 2007-06-12
Description: The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "Content Disposition Parsing Cross Domain Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
References: http://archive.openmya.devnull.jp/2007.06/msg00060.html; http://openmya.hacker.jp/hasegawa/security/ms07-034.txt; http://osvdb.org/35346
CVE: CVE-2007-3184
Published: 2007-06-12
Description: Cisco Trust Agent (CTA) before 2.1.104.0, when running on MacOS X, allows attackers with physical access to bypass authentication and modify System Preferences, including passwords, by invoking the Apple Menu when the Access Control Server (ACS) produces a user notification message after posture validation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/25598; http://securityreason.com/securityalert/2796; http://www.cisco.com/en/US/products/products_security_response09186a008085d645.html
CVE: CVE-2007-3185
Published: 2007-06-12
Description: Apple Safari Beta 3.0.1 for Windows public beta allows remote attackers to cause a denial of service (crash) via unspecified DHTML manipulations that trigger memory corruption, as demonstrated using Hamachi.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://aviv.raffon.net/2007/06/11/AppleSafariForWindowsOutWithACrash.aspx; http://lists.apple.com/archives/security-announce/2007/Jun/msg00000.html; http://osvdb.org/38541
CVE: CVE-2007-3186
Published: 2007-06-12
Description: Apple Safari Beta 3.0.1 for Windows allows remote attackers to execute arbitrary commands via shell metacharacters in a URI in the SRC of an IFRAME, as demonstrated using a gopher URI.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://larholm.com/2007/06/12/safari-for-windows-0day-exploit-in-2-hours; http://larholm.com/2007/06/14/safari-301-released/; http://lists.apple.com/archives/security-announce/2007/Jun/msg00000.html
CVE: CVE-2007-3187
Published: 2007-06-12
Description: Multiple unspecified vulnerabilities in Apple Safari for Windows allow remote attackers to cause a denial of service or execute arbitrary code, possibly involving memory corruption, and a different issue from CVE-2007-3185 and CVE-2007-3186.  NOTE: as of 20070612, the original disclosure has no actionable information.  However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.5 (HIGH)
References: http://erratasec.blogspot.com/2007/06/niiiice.html; http://osvdb.org/38543; http://securitytracker.com/id?1018223
CVE: CVE-2007-3181
Published: 2007-06-12
Description: Buffer overflow in fbserver.exe in Firebird SQL 2 before 2.0.1 allows remote attackers to execute arbitrary code via a large p_cnct_count value in a p_cnct structure in a connect (0x01) request to port 3050/tcp, related to "an InterBase version of gds32.dll."
CVSS Score: 10.0 (HIGH)
References: http://dvlabs.tippingpoint.com/advisory/TPTI-07-11; http://osvdb.org/37231; http://secunia.com/advisories/25601
CVE: CVE-2007-3188
Published: 2007-06-12
Description: SQL injection vulnerability in down_indir.asp in Fullaspsite GeometriX Download Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36322; http://secunia.com/advisories/25576; http://www.securityfocus.com/bid/24404
CVE: CVE-2007-3189
Published: 2007-06-12
Description: Cross-site scripting (XSS) vulnerability in auth.php in Just For Fun Network Management System (JFFNMS) 0.8.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9711&w=2; http://secunia.com/advisories/25587; http://secunia.com/advisories/26769
CVE: CVE-2007-3190
Published: 2007-06-12
Description: Multiple SQL injection vulnerabilities in auth.php in Just For Fun Network Management System (JFFNMS) 0.8.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user and (2) pass parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9711&w=2; http://secunia.com/advisories/25587; http://secunia.com/advisories/26769
CVE: CVE-2007-3191
Published: 2007-06-12
Description: Just For Fun Network Management System (JFFNMS) 0.8.3 allows remote attackers to obtain configuration information via a direct request to admin/adm/test.php, which calls the phpinfo function.
CVSS Score: 9.4 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9711&w=2; http://osvdb.org/37167; http://secunia.com/advisories/25587
CVE: CVE-2007-3192
Published: 2007-06-12
Description: admin/setup.php in Just For Fun Network Management System (JFFNMS) 0.8.3 allows remote attackers to read and modify configuration settings via a direct request.
CVSS Score: 9.4 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9711&w=2; http://osvdb.org/37168; http://secunia.com/advisories/25587
CVE: CVE-2007-3193
Published: 2007-06-12
Description: lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty password, which causes ldap_bind to return true when used with certain LDAP implementations.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/37219; http://secunia.com/advisories/25595; http://secunia.com/advisories/26784
CVE: CVE-2007-3194
Published: 2007-06-12
Description: Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the bloggie_root_path parameter to (1) config.php; (2) db.php, (3) template.php, (4) functions.php, and (5) classes.php in includes/; (6) viewmode.php; and (7) blog_body.php.  NOTE: another researcher disputes the vulnerability because the files are protected against direct requests, contain no relevant include statements, or do not exist
CVSS Score: 9.8 (CRITICAL)
References: http://archives.neohapsis.com/archives/bugtraq/2007-06/0125.html; http://osvdb.org/37685; http://securityreason.com/securityalert/2794
CVE: CVE-2007-3195
Published: 2007-06-12
Description: Cross-site scripting (XSS) vulnerability in index.php in ERFAN WIKI 1.00 allows remote attackers to inject arbitrary web script or HTML via the title parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36402; http://secunia.com/advisories/25586; http://www.securityfocus.com/bid/24406
CVE: CVE-2007-3196
Published: 2007-06-12
Description: SQL injection vulnerability in vBSupport.php in vSupport Integrated Ticket System 3.x.x allows remote attackers to execute arbitrary SQL commands via the ticketid parameter in a showticket action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37331; http://osvdb.org/38811; http://securityreason.com/securityalert/2795
CVE: CVE-2007-3197
Published: 2007-06-12
Description: SQL injection vulnerability in vBSupport.php in vBSupport 1.1 before 1.1a allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37162; http://www.vbulletin.org/forum/showthread.php?t=94023&page=38; http://osvdb.org/37162
CVE: CVE-2007-3198
Published: 2007-06-12
Description: Cross-site scripting (XSS) vulnerability in comments.php in Maran PHP Blog (Maran Blog), possibly only versions before 20070610, allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35374; http://secunia.com/advisories/25616; http://securityreason.com/securityalert/2797
CVE: CVE-2007-3199
Published: 2007-06-12
Description: Unrestricted file upload vulnerability in Link Request Contact Form 3.4 allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension and an image content type, as demonstrated by image/jpeg.
CVSS Score: 7.5 (HIGH)
References: http://corryl.altervista.org/index.php?mod=Download/Exploit#exploit-LRCF-v3.4.rar; http://osvdb.org/37204; http://secunia.com/advisories/25614
CVE: CVE-2007-3200
Published: 2007-06-12
Description: NMASINST in Novell Modular Authentication Service (NMAS) 3.1.2 and earlier on NetWare logs its invoking command line to NMASINST.LOG, which might allow local users to obtain the admin username and password by reading this file.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/35943; http://secunia.com/advisories/25592; http://securitytracker.com/id?1018215
CVE: CVE-2007-3201
Published: 2007-06-12
Description: Visual truncation vulnerability in Windows Privacy Tray (WinPT) 1.2.0 allows user-assisted remote attackers to install a key listed under the wrong user ID, and possibly cause the user to encrypt a victim's correspondence with this attacker-supplied key, via a key ID composed of the attacker's user ID, space characters, an invalid WinPT message, additional space characters, and the victim's user ID.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/41727; http://securityreason.com/securityalert/2791; http://wald.intevation.org/tracker/index.php?func=detail&aid=327&group_id=14&atid=138
CVE: CVE-2007-3202
Published: 2007-06-12
Description: Cross-site scripting (XSS) vulnerability in the rich text editor in Webwiz allows remote attackers to inject arbitrary web script or HTML via URL-encoded HTML composed of a frameset in which a frame has a SRC attribute pointing to a JavaScript document.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37330; http://securityreason.com/securityalert/2792; http://www.securityfocus.com/archive/1/471050/100/0/threaded
CVE: CVE-2007-3203
Published: 2007-06-12
Description: Stack-based buffer overflow in smtpdll.dll in the SMTP service in 602Pro LAN SUITE 2003 2003.0.03.0828 allows remote attackers to execute arbitrary code via an e-mail message with a long address. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37232; http://secunia.com/advisories/25429; http://www.kb.cert.org/vuls/id/445313
CVE: CVE-2007-3204
Published: 2007-06-12
Description: SQL injection vulnerability in auth.php in Just For Fun Network Management System (JFFNMS) 0.8.4-pre2 allows remote attackers to execute arbitrary SQL commands via the pass parameter.  NOTE: this issue reportedly exists because of an initial incomplete fix for CVE-2007-3190. The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37169; http://secunia.com/advisories/25587; https://exchange.xforce.ibmcloud.com/vulnerabilities/34911
CVE: CVE-2007-3205
Published: 2007-06-13
Description: The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed.  NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/39834; http://securityreason.com/securityalert/2800; http://www.acid-root.new.fr/advisories/14070612.txt
CVE: CVE-2007-2391
Published: 2007-06-14
Description: Cross-site scripting (XSS) vulnerability in Apple Safari Beta 3.0.1 for Windows allows remote attackers to inject arbitrary web script or HTML via a web page that includes a windows.setTimeout function that is activated after the user has moved from the current page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2007/Jun/msg00000.html; http://osvdb.org/36605; http://securitytracker.com/id?1018238
CVE: CVE-2006-4168
Published: 2007-06-14
Description: Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=543; http://osvdb.org/35379; http://secunia.com/advisories/25642
CVE: CVE-2007-3099
Published: 2007-06-14
Description: usr/mgmt_ipc.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 checks the client's UID on the listening AF_LOCAL socket instead of the new connection, which allows remote attackers to access the management interface and cause a denial of service (iscsid exit or iSCSI connection loss).
CVSS Score: 2.1 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=243719; http://osvdb.org/37269; http://secunia.com/advisories/25679
CVE: CVE-2007-3100
Published: 2007-06-14
Description: usr/log.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 uses a semaphore with insecure permissions (world-writable/world-readable) for managing log messages using shared memory, which allows local users to cause a denial of service (hang) by grabbing the semaphore.
CVSS Score: 2.1 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=243719; http://osvdb.org/37270; http://secunia.com/advisories/25679
CVE: CVE-2007-3208
Published: 2007-06-14
Description: CRLF injection vulnerability in Yet another Bulletin Board (YaBB) 2.1 allows remote attackers to obtain administrative access via requests to (1) register.pl or (2) profile.pl that write CRLF sequences to a .vars file.  NOTE: this can be leveraged to execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=538; http://osvdb.org/37236; http://osvdb.org/37237
CVE: CVE-2007-3209
Published: 2007-06-14
Description: Mail Notification 4.0, when WITH_SSL is set to 0 at compile time, uses unencrypted connections for accounts configured with SSL/TLS, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 7.8 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=428157; http://osvdb.org/37205; http://secunia.com/advisories/25600
CVE: CVE-2007-3210
Published: 2007-06-14
Description: Stack-based buffer overflow in nptoken.mox in the Cellosoft Tokens Object 2.0.0.6 extension for Vitalize! allows remote attackers to execute arbitrary code via a long string argument to the RemoveChr method.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/37235; http://secunia.com/advisories/25604; http://www.securityfocus.com/bid/24458