deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1122
Published: 2007-02-27
Description: Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) 1.00 and 1.01 allow remote attackers to execute arbitrary SQL commands via the id parameter to the (1) updateRow and (2) deleteRow functions in functions.php, a variant of a SQL injection issue that was fixed in 1.01.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/24269; http://sourceforge.net/project/downloading.php?group_id=153333&use_mirror=osdn&filename=abc-1.02.zip; http://www.securityfocus.com/bid/22685
CVE: CVE-2007-1123
Published: 2007-02-27
Description: Multiple PHP remote file inclusion vulnerabilities in ZPanel 2.0 allow remote attackers to execute arbitrary PHP code via a URL in (1) the body parameter to templates/ZPanelV2/template.php or (2) the page parameter to zpanel.php.  NOTE: the zpanel.php vector may overlap CVE-2005-0793.2.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33498; http://secunia.com/advisories/24275; http://www.securityfocus.com/bid/22683
CVE: CVE-2007-1124
Published: 2007-02-27
Description: Directory traversal vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33760; http://securityreason.com/securityalert/2292; http://www.securityfocus.com/archive/1/461080/100/0/threaded
CVE: CVE-2007-1125
Published: 2007-02-27
Description: Cross-site scripting (XSS) vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to inject arbitrary web script or HTML via the f parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/33759; http://secunia.com/advisories/24292; http://securityreason.com/securityalert/2292
CVE: CVE-2007-1126
Published: 2007-02-27
Description: Directory traversal vulnerability in index.php in xtcommerce allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/33758; http://secunia.com/advisories/24301; http://securityreason.com/securityalert/2294
CVE: CVE-2007-1127
Published: 2007-02-27
Description: Directory traversal vulnerability in enc/stylecss.php in shopkitplus allows remote attackers to read arbitrary files via a .. (dot dot) in the changetheme parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/33755; http://secunia.com/advisories/24279; http://securityreason.com/securityalert/2295
CVE: CVE-2007-1128
Published: 2007-02-27
Description: shopkitplus allows remote attackers to obtain sensitive information via a request to (1) events.php with a curmonth[]=01 query string or (2) enc/stylecss.php with a changetheme[]= query string, which reveals the path in various error messages.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33756; http://osvdb.org/33757; http://securityreason.com/securityalert/2295
CVE: CVE-2007-1129
Published: 2007-02-27
Description: Multiple unrestricted file upload vulnerabilities in MTCMS 3.2 allow remote attackers to upload and execute files via (1) an avatar upload in an add_down action, or (2) an add_link action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33778; http://www.securityfocus.com/archive/1/461330/100/100/threaded; http://www.securityfocus.com/bid/22690
CVE: CVE-2007-1130
Published: 2007-02-27
Description: PHP remote file inclusion vulnerability in sinagb.php in Sinapis Gastebuch 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the fuss parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37007; http://www.securityfocus.com/bid/22696; http://www.vupen.com/english/advisories/2007/0737
CVE: CVE-2007-1131
Published: 2007-02-27
Description: PHP remote file inclusion vulnerability in sinapis.php in Sinapis Forum 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the fuss parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37008; http://www.securityfocus.com/bid/22699; http://www.vupen.com/english/advisories/2007/0738
CVE: CVE-2007-1132
Published: 2007-02-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the "Contact Us" functionality in MTCMS 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) message and (2) title fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37443; http://www.securityfocus.com/archive/1/461330/100/100/threaded; http://www.securityfocus.com/bid/22690
CVE: CVE-2007-1133
Published: 2007-02-27
Description: PHP remote file inclusion vulnerability in fcring.php in FCRing 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the s_fuss parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/33802; http://secunia.com/advisories/24305; http://www.securityfocus.com/bid/22693
CVE: CVE-2006-3892
Published: 2007-03-02
Description: The Management Console server in EMC NetWorker (formerly Legato NetWorker) 7.3.2 before Jumbo Update 1 uses weak authentication, which allows remote attackers to execute arbitrary commands.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.legato.com/pub/NetWorker/Updates/732JumboUpdate1/README%20732%20Jumbo%20Update%201.txt; http://osvdb.org/33853; http://secunia.com/advisories/24362
CVE: CVE-2006-7065
Published: 2007-03-02
Description: Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that triggers a crash in mshtml.dll when a refresh is called, probably a null pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0163.html; http://www.securityfocus.com/bid/19364; http://www3.ca.com/be/securityadvisor/vulninfo/Vuln.aspx?ID=34511
CVE: CVE-2006-7066
Published: 2007-03-02
Description: Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating an object inside an iframe, deleting the frame by setting its location.href to about:blank, then accessing a property of the object within the deleted frame, which triggers a NULL pointer dereference.  NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.
CVSS Score: 7.1 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2009-07/0193.html; http://blogs.securiteam.com/index.php/archives/554; http://browserfun.blogspot.com/2006/07/mobb-30-orphan-object-properties.html
CVE: CVE-2006-7067
Published: 2007-03-02
Description: Oracle 10g R2 and possibly other versions allows remote attackers to trigger internal errors, and possibly have other impacts, via an "alter session set events" command with invalid arguments.  NOTE: this issue was originally disputed by a third party, but the dispute was retracted.  NOTE: this issue was called an "integer overflow" in the original source, but this might be incorrect.
CVSS Score: 6.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048251.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048292.html; http://securityreason.com/securityalert/2328
CVE: CVE-2006-7068
Published: 2007-03-02
Description: PHP remote file inclusion vulnerability in CliServ Web Community 0.65 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cl_headers parameter to (1) menu.php3 and (2) login.php3.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19737; https://exchange.xforce.ibmcloud.com/vulnerabilities/28590; https://www.exploit-db.com/exploits/2257
CVE: CVE-2006-7069
Published: 2007-03-02
Description: PHP remote file inclusion vulnerability in smarty_config.php in Socketwiz Bookmarks 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the root_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21857; http://www.securityfocus.com/bid/19935; http://www.vupen.com/english/advisories/2006/3550
CVE: CVE-2006-7070
Published: 2007-03-02
Description: Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile[] parameter with a filename that contains a .php extension followed by a valid image extension such as .gif or .jpg, then calling the rename function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://retrogod.altervista.org/etomite_061_cmd.html; http://secunia.com/advisories/21208; http://securityreason.com/securityalert/2326
CVE: CVE-2006-7071
Published: 2007-03-02
Description: SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commands via the CLIENT_IP parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0249.html; http://rst.void.ru/download/r57ipb216gui.txt; http://secunia.com/advisories/21072
CVE: CVE-2006-7072
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier allows remote attackers to inject arbitrary web script and HTML via the (1) b[username] and (2) c parameters to (a) index.php, the b[username] parameter to (b) admin/index.php, and (3) c[phone] parameter to register.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21237; http://securityreason.com/securityalert/2324; http://www.osvdb.org/27630
CVE: CVE-2006-7073
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in Opentools Attachment Mod before 2.4.5 allows remote attackers to inject arbitrary web script or HTML in Internet Explorer via unknown vectors related to the uploaded attachments form.  NOTE: some details were obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21787; http://sourceforge.net/project/shownotes.php?group_id=66311&release_id=445469; http://www.securityfocus.com/bid/19888
CVE: CVE-2006-7074
Published: 2007-03-02
Description: admin.php in SmartSiteCMS 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the userName cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]7471&w=2; http://secunia.com/advisories/20769; http://www.securityfocus.com/bid/19434
CVE: CVE-2006-7075
Published: 2007-03-02
Description: Buffer overflow in the meta_read_flac function in meta_decoder.c for Aqualung 0.9beta5 and earlier, and CVS 0.193.2 and earlier, allows user-assisted attackers to execute arbitrary code via a long Vorbis comment in a Free Lossless Audio Codec (FLAC) file.
CVSS Score: 6.8 (MEDIUM)
References: http://aluigi.altervista.org/adv/aquabof-adv.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/28310; http://aluigi.altervista.org/adv/aquabof-adv.txt
CVE: CVE-2006-7076
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to inject arbitrary web script or HTML via the entry parameter.  NOTE: this issue might be resultant from SQL injection.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0381.html; http://secunia.com/advisories/19905; http://securityreason.com/securityalert/2323
CVE: CVE-2006-7077
Published: 2007-03-02
Description: SQL injection vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to execute arbitrary SQl commands via the entry parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0381.html; http://secunia.com/advisories/19905; http://securityreason.com/securityalert/2323
CVE: CVE-2006-7078
Published: 2007-03-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Professional Home Page Tools Login Script, as of July 2006, allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) vorname, and (3) nachname parameters in the register script.  NOTE: some details have been obtained from third party sources.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048194.html; http://secunia.com/advisories/21206; http://securityreason.com/securityalert/2329
CVE: CVE-2006-7079
Published: 2007-03-02
Description: Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption['pagetype'] variable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-913
References: http://www.securityfocus.com/bid/20161; https://exchange.xforce.ibmcloud.com/vulnerabilities/29116; https://www.exploit-db.com/exploits/2415
CVE: CVE-2006-7080
Published: 2007-03-02
Description: Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the old_avatar parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/20161; https://exchange.xforce.ibmcloud.com/vulnerabilities/29130; https://www.exploit-db.com/exploits/2415
CVE: CVE-2006-7081
Published: 2007-03-02
Description: Multiple PHP remote file inclusion vulnerabilities in PhpNews 1.0 allow remote attackers to execute arbitrary PHP code via the Include parameter to (1) Include/lib.inc.php3 and (2) Include/variables.php3.
CVSS Score: 7.5 (HIGH)
References: http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-10/0338.html; http://www.iss.net/security_center/static/10456.php; http://www.securityfocus.com/bid/19904
CVE: CVE-2006-7082
Published: 2007-03-02
Description: Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to bypass authentication and upload arbitrary files via direct requests to (1) adm/photos/images.php and (2) adm/down/files.php.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048006.html; http://securityreason.com/securityalert/2322; http://www.osvdb.org/28637
CVE: CVE-2006-7083
Published: 2007-03-02
Description: Directory traversal vulnerability in index.php in Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to read arbitrary files via ".." sequences in the id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048006.html; http://securityreason.com/securityalert/2322; http://www.osvdb.org/28639
CVE: CVE-2006-7084
Published: 2007-03-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-7083.  Reason: This candidate is a duplicate of CVE-2006-7083.  Notes: All CVE users should reference CVE-2006-7083 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-7085
Published: 2007-03-02
Description: Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to add arbitrary content and conduct XSS attacks via a direct request to add_art.php.  NOTE: this issue was originally reported as SQL injection, but this is not likely.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048006.html; http://securityreason.com/securityalert/2322; http://www.osvdb.org/28640
CVE: CVE-2006-7086
Published: 2007-03-02
Description: The (1) dlback.php and (2) dlback.cgi scripts in Hot Links allow remote attackers to obtain sensitive information and download the database via a direct request with a modified dl parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9916&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8228&w=2; http://secunia.com/advisories/22970
CVE: CVE-2006-7087
Published: 2007-03-02
Description: CRLF injection vulnerability in the mail function in Dotdeb PHP before 5.2.0 Rev 3 allows remote attackers to bypass the protection scheme and inject arbitrary email headers via CRLF sequences in the query string, which is processed via the PHP_SELF variable.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050712.html; http://secunia.com/advisories/22877; http://www.dotdeb.org/news/severe_security_hole_in_php_packages
CVE: CVE-2006-7088
Published: 2007-03-02
Description: Multiple SQL injection vulnerabilities in Simple PHP Forum before 0.4 allow remote attackers to execute arbitrary SQL commands via the username parameter to (1) logon_user.php and (2) update_profile.php.
CVSS Score: 7.5 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=462654; http://www.vupen.com/english/advisories/2006/4496; https://exchange.xforce.ibmcloud.com/vulnerabilities/30252
CVE: CVE-2006-7089
Published: 2007-03-02
Description: SQL injection vulnerability in connexion.php in Ban 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6780&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/29863; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6780&w=2
CVE: CVE-2006-7090
Published: 2007-03-02
Description: PHP remote file inclusion vulnerability in phpbb_security.php in phpBB Security 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the php_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://securityreason.com/securityalert/2327; http://www.securityfocus.com/archive/1/448607; http://www.securityfocus.com/bid/20518
CVE: CVE-2006-7091
Published: 2007-03-02
Description: PHP remote file inclusion vulnerability in config.php in phpht Topsites FREE 1.022b allows remote attackers to execute arbitrary PHP code via a URL in the fullpath parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20486; http://www.securityfocus.com/bid/20486
CVE: CVE-2006-7092
Published: 2007-03-02
Description: SQL injection vulnerability in includes/mambo.php in Mambo LaiThai 4.5.4 SP2 and earlier allows remote attackers to execute arbitrary SQL commands via the usercookie[password] cookie parameter.
CVSS Score: 7.5 (HIGH)
References: http://mamboxchange.com/forum/forum.php?forum_id=7767; http://secunia.com/advisories/22263; http://www.securityfocus.com/bid/20413
CVE: CVE-2006-7093
Published: 2007-03-02
Description: Cross-site scripting (XSS) vulnerability in Mambo LaiThai 4.5.4 Security Patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://mamboxchange.com/forum/forum.php?forum_id=7767; http://secunia.com/advisories/22263; http://www.securityfocus.com/bid/20458/info
CVE: CVE-2006-7094
Published: 2007-03-02
Description: ftpd, as used by Gentoo and Debian Linux, sets the gid to the effective uid instead of the effective group id before executing /bin/ls, which allows remote authenticated users to list arbitrary directories with the privileges of gid 0 and possibly enable additional attack vectors.
CVSS Score: 8.5 (HIGH)
References: http://bugs.debian.org/384454; http://bugs.gentoo.org/show_bug.cgi?id=155317; http://osvdb.org/34242
CVE: CVE-2006-7095
Published: 2007-03-02
Description: Integer signedness error in the network_receive_packet function in socket.c in dimension 3 engine (dim3) 1.5 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large data_len value, which is cast to a signed short and results in a buffer overflow.
CVSS Score: 10.0 (HIGH)
References: http://aluigi.altervista.org/adv/dim3bof-adv.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/26082; http://aluigi.altervista.org/adv/dim3bof-adv.txt
CVE: CVE-2006-7096
Published: 2007-03-02
Description: Buffer overflow in the network_host_handle_join function in host.c in dimension 3 engine (dim3) 1.5 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long nickname.
CVSS Score: 10.0 (HIGH)
References: http://aluigi.altervista.org/adv/dim3bof-adv.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/26085; http://aluigi.altervista.org/adv/dim3bof-adv.txt
CVE: CVE-2006-7097
Published: 2007-03-02
Description: Multiple unspecified vulnerabilities in TaskFreak! before 0.1.4 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.taskfreak.com/versions.html; http://www.taskfreak.com/versions.html
CVE: CVE-2007-0001
Published: 2007-03-02
Description: The file watch implementation in the audit subsystem (auditctl -w) in the Red Hat Enterprise Linux (RHEL) 4 kernel 2.6.9 allows local users to cause a denial of service (kernel panic) by replacing a watched file, which does not cause the watch on the old inode to be dropped.
CVSS Score: 4.7 (MEDIUM)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=223129; http://osvdb.org/33031; http://secunia.com/advisories/24300
CVE: CVE-2007-1005
Published: 2007-03-02
Description: Heap-based buffer overflow in SW3eng.exe in the eID Engine service in CA (formerly Computer Associates) eTrust Intrusion Detection 3.0.5.57 and earlier allows remote attackers to cause a denial of service (application crash) via a long key length value to the remote administration port (9191/tcp).
CVSS Score: 7.8 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=484; http://secunia.com/advisories/24309; http://supportconnectw.ca.com/public/ca_common_docs/eid_secnotice.asp
CVE: CVE-2007-1134
Published: 2007-03-02
Description: Unspecified vulnerability in Watchtower (WT) before 0.12 has unknown impact and attack vectors, related to "unauthorized accounts."
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/41106; http://sourceforge.net/project/shownotes.php?release_id=486435&group_id=188798; http://www.securityfocus.com/bid/22721
CVE: CVE-2007-1135
Published: 2007-03-02
Description: Multiple SQL injection vulnerabilities in WebMplayer before 0.6.1-Alpha allow remote attackers to execute arbitrary SQL commands via the (1) strid parameter to index.php and the (2) id[0] or other id array index parameter to filecheck.php.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34442; http://osvdb.org/34443; http://sourceforge.net/project/shownotes.php?release_id=486880&group_id=172354
CVE: CVE-2007-1136
Published: 2007-03-02
Description: index.php in WebMplayer before 0.6.1-Alpha allows remote attackers to execute arbitrary code via shell metacharacters in an exec function call.  NOTE: some sources have referred to this as eval injection in the param parameter, but CVE source inspection suggests that this is erroneous.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://attrition.org/pipermail/vim/2007-February/001399.html; http://osvdb.org/34441; http://sourceforge.net/project/shownotes.php?release_id=486880&group_id=172354
CVE: CVE-2007-1137
Published: 2007-03-02
Description: putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putmail.py to send the username and password in plaintext while the user believes encryption is in use, and allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/33764; http://putmail.sourceforge.net/home.html; http://secunia.com/advisories/24266