deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-5441
Published: 2007-10-14
Description: CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an "admin/adminlog.php?page=1" request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/; http://osvdb.org/45481; http://securityreason.com/securityalert/3223
CVE: CVE-2007-5442
Published: 2007-10-14
Description: CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://securityreason.com/securityalert/3223; http://www.securityfocus.com/archive/1/481984/100/0/threaded; http://securityreason.com/securityalert/3223
CVE: CVE-2007-5443
Published: 2007-10-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) the anchor tag and (2) listtags.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/; http://osvdb.org/42471; http://osvdb.org/42472
CVE: CVE-2007-5444
Published: 2007-10-14
Description: CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/41033; http://securityreason.com/securityalert/3223; http://www.securityfocus.com/archive/1/481984/100/0/threaded
CVE: CVE-2007-5445
Published: 2007-10-14
Description: Buffer overflow in the DB Software Laboratory VImpX (VImpAX1) ActiveX control in VImpX.ocx 4.7.3.0 allows remote attackers to execute arbitrary code via a long RejectedRecordsFile parameter, a different vector than CVE-2007-2667.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/40610; http://securityreason.com/securityalert/3224; http://www.securityfocus.com/archive/1/482223/100/0/threaded
CVE: CVE-2007-5446
Published: 2007-10-14
Description: Absolute path traversal vulnerability in a certain ActiveX control in PBEmail7Ax.dll in PBEmail 7 ActiveX Edition allows remote attackers to create or overwrite arbitrary files via a full pathname in the XmlFilePath argument to the SaveSenderToXml method.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/43481; http://www.securityfocus.com/bid/26058; https://www.exploit-db.com/exploits/4526
CVE: CVE-2007-5447
Published: 2007-10-14
Description: ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncube_read_file function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/41708; http://secunia.com/advisories/27178; http://www.securityfocus.com/bid/26024
CVE: CVE-2007-5448
Published: 2007-10-14
Description: Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service (panic) via a beacon frame with a large length value in the extended supported rates (xrates) element, which triggers an assertion error, related to net80211/ieee80211_scan_ap.c and net80211/ieee80211_scan_sta.c.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=195705; http://madwifi.org/changeset/2736; http://secunia.com/advisories/27197
CVE: CVE-2007-5449
Published: 2007-10-14
Description: SQL injection vulnerability in searchresult.php in Softbiz Recipes Portal Script allows remote attackers to execute arbitrary SQL commands via the sbcat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27258; http://www.securityfocus.com/bid/26063; http://www.vupen.com/english/advisories/2007/3497
CVE: CVE-2007-5450
Published: 2007-10-14
Description: Unspecified vulnerability in Safari on the Apple iPod touch (aka iTouch) and iPhone 1.1.1 allows user-assisted remote attackers to cause a denial of service (application crash), and enable filesystem browsing by the local user, via a certain TIFF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27213; http://www.toc2rta.com/?q=node/23; http://www.vupen.com/english/advisories/2007/3485
CVE: CVE-2007-5451
Published: 2007-10-14
Description: PHP remote file inclusion vulnerability in admin.color.php in the com_colorlab (aka com_color) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/40609; http://www.securityfocus.com/bid/26059; https://www.exploit-db.com/exploits/4524
CVE: CVE-2007-5452
Published: 2007-10-14
Description: Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) ip or (2) t parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-89
References: http://osvdb.org/40608; http://www.securityfocus.com/bid/26022; https://www.exploit-db.com/exploits/4513
CVE: CVE-2007-5453
Published: 2007-10-14
Description: Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitrary code by writing PHP sequences to the php-stats-options record in the _options table, which is used in an eval function call by (1) admin.php, (2) click.php, (3) download.php, and unspecified other files, as demonstrated by modifying _options through a backup restore action in admin.php.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/43480; http://www.securityfocus.com/bid/26022; https://www.exploit-db.com/exploits/4513
CVE: CVE-2007-5454
Published: 2007-10-14
Description: Directory traversal vulnerability in index.php in PHP File Sharing System 1.5.1 allows remote attackers to list or create arbitrary directories, or delete arbitrary files, as demonstrated by listing directories via a .. (dot dot) in the cam parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-10/0343.html; http://secunia.com/advisories/27257; http://www.securityfocus.com/bid/26065
CVE: CVE-2007-5455
Published: 2007-10-14
Description: Cross-site scripting (XSS) vulnerability in wxis.exe in WWWISIS 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a call to the iah/iah.xis IsisScript code, possibly involving the lang or exprSearch parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27310; http://www.securityfocus.com/archive/1/482356/100/0/threaded; http://www.securityfocus.com/bid/26067
CVE: CVE-2007-5456
Published: 2007-10-14
Description: Microsoft Internet Explorer 7 and earlier allows remote attackers to bypass the "File Download - Security Warning" dialog box and download arbitrary .exe files by placing a '?' (question mark) followed by a non-.exe filename after the .exe filename, as demonstrated by (1) .txt, (2) .cda, (3) .log, (4) .dif, (5) .sol, (6) .htt, (7) .itpc, (8) .itms, (9) .dvr-ms, (10) .dib, (11) .asf, (12) .tif, and unspecified other extensions, a different issue than CVE-2004-1331.  NOTE: this issue might not cross privilege boundaries, although it does bypass an intended protection mechanism.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/3222; http://www.securityfocus.com/archive/1/482220/100/0/threaded; http://www.securityfocus.com/archive/1/482248/100/0/threaded
CVE: CVE-2007-5457
Published: 2007-10-14
Description: Multiple PHP remote file inclusion vulnerabilities in Michael Dempfle Joomla Flash Uploader (com_jfu or com_joomla_flash_uploader) 2.5.1 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) install.joomla_flash_uploader.php and (2) uninstall.joomla_flash_uploader.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/486475/100/0/threaded; http://www.securityfocus.com/bid/26044; https://exchange.xforce.ibmcloud.com/vulnerabilities/37181
CVE: CVE-2007-5458
Published: 2007-10-14
Description: SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/27219; http://www.securityfocus.com/bid/26051; https://exchange.xforce.ibmcloud.com/vulnerabilities/37083
CVE: CVE-2007-5459
Published: 2007-10-14
Description: Cross-site scripting (XSS) vulnerability in the sidebar HTML page in the MouseoverDictionary before 0.6.2 extension for Mozilla Firefox allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://maru.bonyari.jp/mouseoverdictionary/; http://osvdb.org/40475
CVE: CVE-2007-5461
Published: 2007-10-15
Description: Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html; http://issues.apache.org/jira/browse/GERONIMO-3549; http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
CVE: CVE-2007-5460
Published: 2007-10-15
Description: Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, uses weak encryption (XOR obfuscation with a fixed key) when sending the user's PIN/Password over the USB connection from the host to the device, which might make it easier for attackers to decode a PIN/Password obtained by (1) sniffing or (2) spoofing the docking process.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-327
References: http://osvdb.org/38499; http://securityreason.com/securityalert/3232; http://www.securityfocus.com/archive/1/482299/100/0/threaded
CVE: CVE-2007-5462
Published: 2007-10-15
Description: Unspecified vulnerability in the Sun Solaris RPC services library (librpcsvc) on Solaris 8 through 10 allows remote attackers to cause a denial of service (mountd crash) via unspecified packets to a server that exports many filesystems, and allows local users to cause a denial of service (automountd crash) via unspecified requests to mount filesystems from a server that exports many filesystems.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/40814; http://secunia.com/advisories/27183; http://secunia.com/advisories/27386
CVE: CVE-2007-5463
Published: 2007-10-15
Description: ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for certificate and key files via an "iDEAL transaction", possibly involving fopen error messages for nonexistent files, a different issue than CVE-2007-5364.  NOTE: this can be leveraged for reading certificate or key files if an installation places these files under the web document root.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/40151; http://secunia.com/advisories/27199; http://securityreason.com/securityalert/3233
CVE: CVE-2007-5464
Published: 2007-10-15
Description: Stack-based buffer overflow in Live for Speed 0.5X10 and earlier allows remote authenticated users to cause a denial of service (client crash) and possibly execute arbitrary code via a long skin name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/lfscbof-adv.txt; http://secunia.com/advisories/27242; http://securityreason.com/securityalert/3234
CVE: CVE-2007-5465
Published: 2007-10-15
Description: Directory traversal vulnerability in doop CMS 1.3.7 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter to an unspecified component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/37864; http://secunia.com/advisories/27255; http://www.securityfocus.com/bid/26075
CVE: CVE-2007-5466
Published: 2007-10-15
Description: Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action, involving the ifParseAuthPlain function; (3) execute arbitrary code via a long LOGIN command to the admin interface port (4501/tcp); or (4) execute arbitrary code via a long string in an IMAP AUTHENTICATE LOGIN (aka CRAM-MD5 authentication) action, involving the ifProcImapAuth1 function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27220; http://www.digit-labs.org/files/exploits/extremail-v4.c; http://www.digit-labs.org/files/exploits/extremail-v5.c
CVE: CVE-2007-5467
Published: 2007-10-15
Description: Integer overflow in eXtremail 2.1.1 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long USER command containing "%s" sequences to the pop3 port (110/tcp), which are expanded to "%%s" before being used in the memmove function, possibly due to an incomplete fix for CVE-2001-1078.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/27220; http://www.digit-labs.org/files/exploits/extremail-v3.pl; http://www.securityfocus.com/archive/1/482293
CVE: CVE-2007-5468
Published: 2007-10-16
Description: Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID (aka "toll fraud and authentication forward attack").
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066581.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066691.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066694.html
CVE: CVE-2007-5469
Published: 2007-10-16
Description: OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID (aka "toll fraud and authentication forward attack").  NOTE: Debian disputes this issue, stating that "having the two URIs mismatch is allowed by the standard and happens in some setups for valid reasons.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446956; http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066581.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066691.html
CVE: CVE-2007-5470
Published: 2007-10-16
Description: Microsoft Expression Media stores the catalog password in cleartext in the catalog IVC file, which allows local users to obtain sensitive information and gain access to the catalog by reading the IVC file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200, CWE-310
References: http://osvdb.org/38486; http://secunia.com/advisories/27144; http://support.microsoft.com/kb/942109
CVE: CVE-2007-5471
Published: 2007-10-16
Description: libgssapi before 0.6-13.7, as used by the ISC BIND named daemon in SUSE Linux Enterprise Server 10 SP 1, terminates upon an initialization error, which allows remote attackers to cause a denial of service (daemon exit) via a GSS-TSIG request.  NOTE: this issue probably affects other daemons that attempt to initialize this library within a chroot configuration or other invalid configuration.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/40935; http://secunia.com/advisories/27189; http://www.securityfocus.com/bid/26076
CVE: CVE-2007-4343
Published: 2007-10-16
Description: Stack-based buffer overflow in IrfanView 3.99 and 4.00 allows user-assisted remote attackers to execute arbitrary code via a crafted palette (.pal) file.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/26619; http://secunia.com/secunia_research/2007-71/advisory/; http://www.irfanview.com/main_history.htm
CVE: CVE-2007-5477
Published: 2007-10-16
Description: Cross-site scripting (XSS) vulnerability in auth.w in djeyl.net WebMod 0.48 Half-Life Dedicated Server plugin allows remote attackers to inject arbitrary web script or HTML via the redir parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37833; http://secunia.com/advisories/27245; http://sla.ckers.org/forum/read.php?3%2C44%2C11482#msg-11482
CVE: CVE-2007-5478
Published: 2007-10-16
Description: Cross-site scripting (XSS) vulnerability in projects in Nabh Stringbeans Portal (sbportal) 3.2 allows remote attackers to inject arbitrary web script or HTML via the project_name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/40165; http://securityreason.com/securityalert/3240; http://www.securityfocus.com/archive/1/482303/100/0/threaded
CVE: CVE-2007-5479
Published: 2007-10-16
Description: Cross-site scripting (XSS) vulnerability in Search.asp in Xcomputer allows remote attackers to inject arbitrary web script or HTML via the EXPS parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3239; http://www.securityfocus.com/archive/1/482307/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/37217
CVE: CVE-2007-5480
Published: 2007-10-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in InnovaAge InnovaShop allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter to msg.jsp, and the (2) contentid parameter to tc/contents/home001.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4520&w=2; http://osvdb.org/37927; http://osvdb.org/37928
CVE: CVE-2007-5481
Published: 2007-10-16
Description: Distributed Checksum Clearinghouse (DCC) 1.3.65 allows remote attackers to cause a denial of service (crash) via a "SOCKS flood."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/27262; http://www.rhyolite.com/anti-spam/dcc/CHANGES; http://www.securityfocus.com/bid/26088
CVE: CVE-2007-5482
Published: 2007-10-16
Description: Unspecified vulnerability in the FTP service in Sun StorEdge/StorageTek 3510 FC Array with firmware before 4.21 allows remote attackers, with access to the Ethernet management interface, to cause a denial of service (I/O request timeout and device hang) via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/40168; http://secunia.com/advisories/27201; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103106-1
CVE: CVE-2007-5483
Published: 2007-10-16
Description: Unspecified vulnerability in the Administrative Scripting Tools (such as wsadmin or ANT) in IBM WebSphere Application Server 5.x and 6.0.x has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/27249; http://www-1.ibm.com/support/docview.wss?uid=swg27006876#60223; http://www-1.ibm.com/support/docview.wss?uid=swg27006879#51116
CVE: CVE-2007-5484
Published: 2007-10-16
Description: Directory traversal vulnerability in wxis.exe in WWWISIS 7.1 allows local users to read arbitrary files via a .. (dot dot) in the IsisScript parameter to iah.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/40170; http://secunia.com/advisories/27198; http://www.securityfocus.com/archive/1/482356/100/0/threaded
CVE: CVE-2007-5485
Published: 2007-10-16
Description: SQL injection vulnerability in index.php in the mg2 1.0 module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the album parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/26083; http://www.vupen.com/english/advisories/2007/3496; https://exchange.xforce.ibmcloud.com/vulnerabilities/37196
CVE: CVE-2007-5486
Published: 2007-10-16
Description: dotProject before 2.1 does not properly check privileges when invoking the Companies module, which allows remote attackers to access this module via a crafted URL.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://bugs.dotproject.net/view.php?id=1910; http://docs.dotproject.net/index.php/Closed_Issues_/_Feature_Requests_-_2.1; http://secunia.com/advisories/27191
CVE: CVE-2007-5487
Published: 2007-10-16
Description: Stack-based buffer overflow in COWON America jetAudio Basic 7.0.3 allows user-assisted remote attackers to execute arbitrary code via a long URL in an EXTM3U section of a .m3u file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27149; http://www.securityfocus.com/bid/26069; http://www.vupen.com/english/advisories/2007/3489
CVE: CVE-2007-5489
Published: 2007-10-17
Description: Directory traversal vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/27269; http://www.securityfocus.com/bid/26090; https://exchange.xforce.ibmcloud.com/vulnerabilities/37240
CVE: CVE-2007-5490
Published: 2007-10-17
Description: SQL injection vulnerability in default.asp in Okul Otomasyon Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27268; http://www.securityfocus.com/bid/26094; https://exchange.xforce.ibmcloud.com/vulnerabilities/37237
CVE: CVE-2007-5491
Published: 2007-10-17
Description: Directory traversal vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to chmod arbitrary files to 0777 via ".." sequences in the lang parameter.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/27503; http://secunia.com/advisories/28008; http://teamforge.net/viewcvs/viewcvs.cgi/tags/release-3.3.9/doc/history.txt?view=markup
CVE: CVE-2007-5492
Published: 2007-10-17
Description: Static code injection vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP code via the value parameter.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/43760; http://secunia.com/advisories/27503; http://secunia.com/advisories/28008
CVE: CVE-2007-5488
Published: 2007-10-17
Description: Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the (1) source and (2) destination numbers, and probably (3) SIP URI, when inserting a record.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://downloads.digium.com/pub/security/AST-2007-023.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066744.html; http://osvdb.org/37880
CVE: CVE-2007-5504
Published: 2007-10-17
Description: Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+ and 10.1.0.5 unknown impact and remote attack vectors, related to (1) Import (DB01) and (2) Advanced Queuing (DB25).  NOTE: as of 20071108, Oracle has not disputed reliable researcher claims that DB25 is for a buffer overflow in the DBLINK_INFO procedure in the DBMS_AQADM_SYS package.
CVSS Score: 6.5 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5918&w=2; http://secunia.com/advisories/27251; http://secunia.com/advisories/27409