deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-5018
Published: 2007-09-20
Description: Stack-based buffer overflow in IMAPD in Mercury/32 4.52 allows remote authenticated users to execute arbitrary code via a long argument in a SEARCH ON command.  NOTE: this issue might overlap with CVE-2004-1211.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/39670; http://secunia.com/advisories/26878; http://www.securityfocus.com/bid/25733
CVE: CVE-2007-5019
Published: 2007-09-20
Description: Buffer overflow in the Sun Java Web Start ActiveX control in Java Runtime Environment (JRE) 1.6.0_X allows remote attackers to have an unknown impact via a long argument to the dnsResolve (isInstalled.dnsResolve) method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/38297; http://www.securityfocus.com/bid/25734; https://exchange.xforce.ibmcloud.com/vulnerabilities/36682
CVE: CVE-2007-5020
Published: 2007-09-21
Description: Unspecified vulnerability in Adobe Acrobat and Reader 8.1 on Windows allows remote attackers to execute arbitrary code via a crafted PDF file, related to the mailto: option and Internet Explorer 7 on Windows XP.  NOTE: this information is based upon a vague pre-advisory by a reliable researcher.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.adobe.com/support/security/advisories/apsa07-04.html; http://www.gnucitizen.org/blog/0day-pdf-pwns-windows; http://www.securityfocus.com/archive/1/480080/100/0/threaded
CVE: CVE-2007-5021
Published: 2007-09-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-4880.  Reason: This candidate is a duplicate of CVE-2007-4880.  Notes: All CVE users should reference CVE-2007-4880 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-5022
Published: 2007-09-21
Description: Unspecified vulnerability in certain IBM Tivoli Storage Manager (TSM) clients 5.1 before 5.1.8.1, 5.2 before 5.2.5.2, 5.3 before 5.3.5.3, and 5.4 before 5.4.1.2, when using "server-initiated prompted scheduling," allows remote attackers to read a client's data, aka IC53616.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/38162; http://secunia.com/advisories/26883; http://www-1.ibm.com/support/docview.wss?uid=swg21268775
CVE: CVE-2007-0061
Published: 2007-09-21
Description: The DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed packet that triggers "corrupt stack memory."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://secunia.com/advisories/26890; http://secunia.com/advisories/27694
CVE: CVE-2007-0062
Published: 2007-09-21
Description: Integer overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before 3.1.1; and the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528; allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a malformed DHCP packet with a large dhcp-max-message-size that triggers a stack-based buffer overflow, related to servers configured to send many DHCP options to clients.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119, CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=227135; http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html
CVE: CVE-2007-0063
Published: 2007-09-21
Description: Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-191
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://secunia.com/advisories/26890; http://secunia.com/advisories/27694
CVE: CVE-2007-4065
Published: 2007-09-21
Description: lib/vorbisfile.c in libvorbisfile in Xiph.Org libvorbis before 1.2.0 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted OGG file, aka trac Changeset 13217.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/24923; http://secunia.com/advisories/26865; http://secunia.com/advisories/27099
CVE: CVE-2007-4066
Published: 2007-09-21
Description: Multiple buffer overflows in Xiph.Org libvorbis before 1.2.0 allow context-dependent attackers to cause a denial of service or have other unspecified impact via a crafted OGG file, aka trac Changesets 13162, 13168, 13169, 13170, 13172, 13211, and 13215, as demonstrated by an overflow in oggenc.exe related to the _psy_noiseguards_8 array.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/24923; http://secunia.com/advisories/26865; http://secunia.com/advisories/27099
CVE: CVE-2007-4496
Published: 2007-09-21
Description: Unspecified vulnerability in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows authenticated users with administrative privileges on a guest operating system to corrupt memory and possibly execute arbitrary code on the host operating system via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://secunia.com/advisories/26890; http://secunia.com/advisories/27694
CVE: CVE-2007-4497
Published: 2007-09-21
Description: Unspecified vulnerability in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows users with login access to a guest operating system to cause a denial of service (guest outage and host process crash or hang) via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://secunia.com/advisories/26890; http://secunia.com/advisories/27694
CVE: CVE-2007-4569
Published: 2007-09-21
Description: backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html; http://secunia.com/advisories/26894; http://secunia.com/advisories/26904
CVE: CVE-2007-4991
Published: 2007-09-21
Description: The SOCKS4 Proxy in Microsoft Internet Security and Acceleration (ISA) Server 2004 SP1 and SP2 allows remote attackers to obtain potentially sensitive information (the destination IP address of another user's session) via an empty packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/45906; http://www.securityfocus.com/bid/25753; http://www.securitytracker.com/id?1018727
CVE: CVE-2007-5023
Published: 2007-09-21
Description: Unquoted Windows search path vulnerability in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075, and Server before 1.0.4 Build 56528 allows local users to gain privileges via unspecified vectors, possibly involving a malicious "program.exe" file in the C: folder.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/25732; http://www.vmware.com/support/ace/doc/releasenotes_ace.html; http://www.vmware.com/support/player/doc/releasenotes_player.html
CVE: CVE-2007-5024
Published: 2007-09-21
Description: EMC VMware Server before 1.0.4 Build 56528 writes passwords in cleartext to unspecified log files, which allows local users to obtain sensitive information by reading these files, a different vulnerability than CVE-2005-3620.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://www.vmware.com/support/server/doc/releasenotes_server.html; http://www.vmware.com/support/server/doc/releasenotes_server.html
CVE: CVE-2007-5025
Published: 2007-09-21
Description: Unspecified vulnerability in EMC VMware ACE before 1.0.3 Build 54075 allows attackers to have an unknown impact via an unspecified manipulation of "images stored in virtual machines downloaded by the user."
CVSS Score: 9.3 (HIGH)
References: http://www.vmware.com/support/ace/doc/releasenotes_ace.html; http://www.vmware.com/support/ace/doc/releasenotes_ace.html
CVE: CVE-2007-5026
Published: 2007-09-21
Description: dBlog CMS, probably 2.0, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing an admin password hash via a direct request for dblog.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/43970; http://securityreason.com/securityalert/3156; http://www.securityfocus.com/archive/1/479969/100/0/threaded
CVE: CVE-2007-5027
Published: 2007-09-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/ddns in the web management panel for the WBR3404TX broadband router with firmware R1.94p0vTIG allow remote attackers to inject arbitrary web script or HTML via the (1) DD or (2) DU parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38886; http://securityreason.com/securityalert/3159; http://www.securityfocus.com/archive/1/479994/100/0/threaded
CVE: CVE-2007-5028
Published: 2007-09-21
Description: Dibbler 0.6.0 on Linux uses weak world-writable permissions for unspecified files in /var/lib/dibbler, which has unknown impact and local attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://klub.com.pl/dhcpv6/; http://klub.com.pl/dhcpv6/
CVE: CVE-2007-5029
Published: 2007-09-21
Description: Dibbler 0.6.0 does not verify that certain length parameters are appropriate for buffer sizes, which allows remote attackers to trigger a buffer over-read and cause a denial of service (daemon crash), as demonstrated by incorrect behavior of the TSrvMsg constructor in SrvMessages/SrvMsg.cpp when (1) reading the option code and option length and (2) parsing options.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-119, CWE-189
References: http://klub.com.pl/dhcpv6/; http://labs.musecurity.com/wp-content/uploads/2007/09/mu-200709-02.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065892.html
CVE: CVE-2007-5030
Published: 2007-09-21
Description: Multiple integer overflows in Dibbler 0.6.0 allow remote attackers to cause a denial of service (daemon crash) via packets containing options with large lengths, which trigger attempts at excessive memory allocation, as demonstrated by (1) the TSrvMsg constructor in SrvMessages/SrvMsg.cpp; the (2) TClntMsg, (3) TClntOptIAAddress, (4) TClntOptIAPrefix, (5) TOptVendorSpecInfo, and (6) TOptOptionRequest constructors; and the (7) TRelIfaceMgr::decodeRelayRepl, (8) TRelMsg::decodeOpts, and (9) TSrvIfaceMgr::decodeRelayForw methods.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://klub.com.pl/dhcpv6/; http://labs.musecurity.com/wp-content/uploads/2007/09/mu-200709-02.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065892.html
CVE: CVE-2007-5031
Published: 2007-09-21
Description: The TSrvOptIA_NA::rebind method in SrvOptions/SrvOptIA_NA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via an invalid IA_NA option in a REBIND message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://klub.com.pl/dhcpv6/; http://labs.musecurity.com/wp-content/uploads/2007/09/mu-200709-02.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065892.html
CVE: CVE-2007-5032
Published: 2007-09-21
Description: Cross-site request forgery (CSRF) vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified add_name and add_radminsuper parameters.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/42521; http://securityreason.com/securityalert/3157; http://www.securityfocus.com/archive/1/480107/100/0/threaded
CVE: CVE-2007-5033
Published: 2007-09-21
Description: Cross-site scripting (XSS) vulnerability in profile.php in phpBB XS 2 allows remote attackers to inject arbitrary web script or HTML via the selfdes parameter in a profile_info editprofile action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38884; http://securityreason.com/securityalert/3158; http://www.securityfocus.com/archive/1/480100/100/0/threaded
CVE: CVE-2007-5034
Published: 2007-09-21
Description: ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS.  NOTE: this issue only occurs when a proxy is defined for https.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://bugzilla.elinks.cz/show_bug.cgi?id=937; http://secunia.com/advisories/26936; http://secunia.com/advisories/26949
CVE: CVE-2007-3916
Published: 2007-09-24
Description: The main function in skkdic-expr.c in SKK Tools 1.2 allows local users to overwrite or delete arbitrary files via a symlink attack on a skkdic$PID temporary file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://bugs.gentoo.org/show_bug.cgi?id=193121; http://osvdb.org/40557; http://secunia.com/advisories/26866
CVE: CVE-2007-5035
Published: 2007-09-24
Description: PHP remote file inclusion vulnerability in html/modules/extranet_profile/main.php in openEngine 1.9 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the this_module_path parameter.  NOTE: this issue is disputed by CVE because PHP encounters a fatal function-call error on a direct request for the file, before reaching the include statement
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://arfis.wordpress.com/2007/09/14/rfi-03-openengine/; http://osvdb.org/38727; http://www.securityfocus.com/bid/25716
CVE: CVE-2007-5036
Published: 2007-09-24
Description: Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated users to cause a denial of service (HTTPS service outage) via a crafted query string in an HTTPS request to (1) adLog.cgi, (2) post.cgi, or (3) ad.cgi, related to the "files filter."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-119
References: http://secunia.com/advisories/26869; http://www.securityfocus.com/bid/25715; http://www.sybsecurity.com/advisors/SYBSEC-ADV01-Airsensor_M520_HTTPD_Remote_Preauth_Denial_Of_Service_and_Buffer_Overflow_PoC
CVE: CVE-2007-5037
Published: 2007-09-24
Description: Buffer overflow in the inotifytools_snprintf function in src/inotifytools.c in the inotify-tools library before 3.11 allows context-dependent attackers to execute arbitrary code via a long filename.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=443913; http://osvdb.org/40563; http://secunia.com/advisories/26825
CVE: CVE-2007-5038
Published: 2007-09-24
Description: The offer_account_by_email function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the createemailregexp parameter, which allows remote attackers to bypass intended restrictions on account creation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://fedoranews.org/updates/FEDORA-2007-229.shtml; http://secunia.com/advisories/26848; http://secunia.com/advisories/26969
CVE: CVE-2007-5039
Published: 2007-09-24
Description: Ghost Security Suite beta 1.110 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey, (2) NtDeleteValueKey, (3) NtQueryValueKey, (4) NtSetSystemInformation, and (5) NtSetValueKey kernel SSDT hooks.
CVSS Score: 2.1 (LOW)
CWE: CWE-20, CWE-264
References: http://osvdb.org/45895; http://securityreason.com/securityalert/3161; http://www.matousec.com/info/advisories/plague-in-security-software-drivers.php
CVE: CVE-2007-5040
Published: 2007-09-24
Description: Ghost Security Suite alpha 1.200 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey, (2) NtCreateThread, (3) NtDeleteValueKey, (4) NtQueryValueKey, (5) NtSetSystemInformation, and (6) NtSetValueKey kernel SSDT hooks.
CVSS Score: 2.1 (LOW)
CWE: CWE-20, CWE-264
References: http://securityreason.com/securityalert/3161; http://www.matousec.com/info/advisories/plague-in-security-software-drivers.php; http://www.matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php
CVE: CVE-2007-5041
Published: 2007-09-24
Description: G DATA InternetSecurity 2007 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey and (2) NtOpenProcess kernel SSDT hooks.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/45896; http://securityreason.com/securityalert/3161; http://www.matousec.com/info/advisories/plague-in-security-software-drivers.php
CVE: CVE-2007-5042
Published: 2007-09-24
Description: Outpost Firewall Pro 4.0.1025.7828 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey, (2) NtDeleteFile, (3) NtLoadDriver, (4) NtOpenProcess, (5) NtOpenSection, (6) NtOpenThread, and (7) NtUnloadDriver kernel SSDT hooks, a partial regression of CVE-2006-7160.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/45899; http://securityreason.com/securityalert/3161; http://www.matousec.com/info/advisories/plague-in-security-software-drivers.php
CVE: CVE-2007-5043
Published: 2007-09-24
Description: Kaspersky Internet Security 7.0.0.125 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to (1) cause a denial of service (crash) and possibly gain privileges via the NtCreateSection kernel SSDT hook or (2) cause a denial of service (avp.exe service outage) via the NtLoadDriver kernel SSDT hook.  NOTE: this issue may partially overlap CVE-2006-3074.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20, CWE-264
References: http://securityreason.com/securityalert/3161; http://www.matousec.com/info/advisories/plague-in-security-software-drivers.php; http://www.matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php
CVE: CVE-2007-5044
Published: 2007-09-24
Description: ZoneAlarm Pro 7.0.362.000 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreatePort and (2) NtDeleteFile kernel SSDT hooks, a partial regression of CVE-2007-2083.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/45898; http://securityreason.com/securityalert/3161; http://www.matousec.com/info/advisories/plague-in-security-software-drivers.php
CVE: CVE-2007-5045
Published: 2007-09-24
Description: Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox "-chrome" argument.  NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://secunia.com/advisories/26881; http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
CVE: CVE-2007-5046
Published: 2007-09-24
Description: Cross-site scripting (XSS) vulnerability in the Webmail interface for IceWarp Merak Mail Server before 9.0.0 allows remote attackers to inject arbitrary JavaScript via a javascript: URI in an attribute of an element in an email message body, as demonstrated by the onload attribute in a BODY element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37428; http://secunia.com/advisories/26877; http://www.mwrinfosecurity.com/publications/mwri_merak-webmail-xss-advisory_2008-09-17.pdf
CVE: CVE-2007-5047
Published: 2007-09-24
Description: Norton Internet Security 2008 15.0.0.60 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the NtOpenSection kernel SSDT hook.  NOTE: the NtCreateMutant and NtOpenEvent function hooks are already covered by CVE-2007-1793.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://osvdb.org/45897; http://securityreason.com/securityalert/3161; http://www.matousec.com/info/advisories/plague-in-security-software-drivers.php
CVE: CVE-2007-5048
Published: 2007-09-24
Description: Heap-based buffer overflow in Lhaplus before 1.55 allows remote attackers to execute arbitrary code via a long filename in an ARJ archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/40582; http://secunia.com/advisories/26907
CVE: CVE-2007-5049
Published: 2007-09-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-3387.  Reason: This candidate is a duplicate of CVE-2007-3387.  Notes: All CVE users should reference CVE-2007-3387 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-5050
Published: 2007-09-24
Description: Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the q parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/38728; http://www.securityfocus.com/archive/1/480233/100/0/threaded; http://www.securityfocus.com/bid/25759
CVE: CVE-2007-5051
Published: 2007-09-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in PhpGedView 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) box_width, (2) PEDIGREE_GENERATIONS, and (3) rootid parameters in ancestry.php, and the (4) newpid parameter in timeline.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/26922; http://secunia.com/advisories/29954; http://www.debian.org/security/2008/dsa-1559