deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-2089
Published: 2007-04-18
Description: Multiple PHP remote file inclusion vulnerabilities in the Jx Development Article 1.1 and earlier component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to com_articles.php in (1) components/ or (2) classes/html/.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/466059/100/0/threaded; http://www.securityfocus.com/bid/23513; http://www.vupen.com/english/advisories/2007/1394
CVE: CVE-2007-2090
Published: 2007-04-18
Description: Cross-site scripting (XSS) vulnerability in index.php in TuMusika Evolution 1.6 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/24874; http://securityreason.com/securityalert/2585; http://www.securityfocus.com/archive/1/465515/100/0/threaded
CVE: CVE-2007-2091
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in blocks/tsdisplay4xoops_block2.php in tsdisplay4xoops (TSD4XOOPS, aka the TeamSpeak display module) 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the xoops_url parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/37413; http://www.securityfocus.com/bid/23518; http://www.vupen.com/english/advisories/2007/1424
CVE: CVE-2007-2092
Published: 2007-04-18
Description: Direct static code injection vulnerability in index.php in Limesoft Guestbook (LS Simple Guestbook) allows remote attackers to inject arbitrary PHP code into posts.txt via the name parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2007/1393; http://www.vupen.com/english/advisories/2007/1393
CVE: CVE-2007-2093
Published: 2007-04-18
Description: Direct static code injection vulnerability in index.php in Limesoft Guestbook (LS Simple Guestbook) 1.0 allows remote attackers to inject arbitrary PHP code into posts.txt via the message parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24904; http://securityreason.com/securityalert/2590; http://www.securityfocus.com/archive/1/465864/100/0/threaded
CVE: CVE-2007-2094
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in index.php in Anthologia 0.5.2 allows remote attackers to execute arbitrary PHP code via a URL in the ads_file parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24908; http://www.osvdb.org/34083; http://www.securityfocus.com/bid/23524
CVE: CVE-2007-2095
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in chat.php in MySpeach 1.9 allows remote attackers to execute arbitrary PHP code via a URL in the my[root] parameter, a different vector than CVE-2007-0498.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2592; http://www.securityfocus.com/archive/1/465721/100/0/threaded; http://securityreason.com/securityalert/2592
CVE: CVE-2007-2096
Published: 2007-04-18
Description: PHP remote file inclusion vulnerability in common.php in Hinton Design PHPHD Download System (phphd_downloads) allows remote attackers to execute arbitrary PHP code via a URL in the phphd_real_path parameter. NOTE: this issue may be present in versions from 2006.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2588; http://www.securityfocus.com/archive/1/465983/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33724
CVE: CVE-2007-2097
Published: 2007-04-18
Description: Multiple PHP remote file inclusion vulnerabilities in OpenConcept Back-End CMS 0.4.7 allow remote attackers to execute arbitrary PHP code via a URL in the includes_path parameter to (1) click.php or (2) pollcollector.php in htdocs/; or (3) index.php, (4) articlepages.php, (5) articles.php, (6) articleform.php, (7) articlesections.php, (8) createArticlesPage.php, (9) guestbook.php, (10) helpguide.php, (11) helpguideeditor.php, (12) links.php, (13) upload.php, (14) sitestatistics.php, (15) nav.php, (16) tpl_upload.php, (17) linksections, or (18) pophelp.php in htdocs/site-admin/; different vectors than CVE-2006-5076.  NOTE: this issue is disputed by a third party, who states that $includes_path is defined before use
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2007-April/001528.html; http://securityreason.com/securityalert/2573; http://www.osvdb.org/34148
CVE: CVE-2007-2098
Published: 2007-04-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in showpic.php in Wabbit PHP Gallery 0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) pic and (2) gal parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34994; http://secunia.com/advisories/24943; http://securityreason.com/securityalert/2574
CVE: CVE-2007-2099
Published: 2007-04-18
Description: Cross-site scripting (XSS) vulnerability in htdocs/php.php in OpenConcept Back-End CMS 0.4.7 allows remote attackers to inject arbitrary web script or HTML via the page[] parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34143; http://securityreason.com/securityalert/2575; http://www.securityfocus.com/archive/1/465728/100/0/threaded
CVE: CVE-2007-2100
Published: 2007-04-18
Description: FAC Guestbook 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/Gdb.mdb.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24872; http://securityreason.com/securityalert/2570; http://www.securityfocus.com/archive/1/465544/100/0/threaded
CVE: CVE-2007-2101
Published: 2007-04-18
Description: FAC Guestbook 3.01 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/gbdb.mdb.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24872; http://www.securityfocus.com/bid/23441; https://exchange.xforce.ibmcloud.com/vulnerabilities/33600
CVE: CVE-2007-2102
Published: 2007-04-18
Description: Cross-site scripting (XSS) vulnerability in weblog.php in my little weblog allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vector than CVE-2006-6087.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/34996; http://secunia.com/advisories/24942; http://securityreason.com/securityalert/2571
CVE: CVE-2007-2103
Published: 2007-04-18
Description: Multiple PHP remote file inclusion vulnerabilities in my little forum 1.7 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) admin.php and (2) timedifference.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35402; http://osvdb.org/35403; http://securityreason.com/securityalert/2576
CVE: CVE-2007-2104
Published: 2007-04-18
Description: Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme_url parameter to (1) index.php, (2) page.php, (3) search.php, (4) single.php, and (5) archives.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35254; http://osvdb.org/35255; http://osvdb.org/35256
CVE: CVE-2007-2105
Published: 2007-04-18
Description: Directory traversal vulnerability in admin/index.php in Monkey CMS 0.0.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the admin_skin parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35260; http://securityreason.com/securityalert/2578; http://www.securityfocus.com/archive/1/464704/100/0/threaded
CVE: CVE-2007-2106
Published: 2007-04-18
Description: Directory traversal vulnerability in index.php in Kai Content Management System (K-CMS) 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the current_theme parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2579; http://www.securityfocus.com/archive/1/464677/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33437
CVE: CVE-2007-2107
Published: 2007-04-18
Description: SQL injection vulnerability in visit.php in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-1960.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37412; http://www.vupen.com/english/advisories/2007/1266; http://osvdb.org/37412
CVE: CVE-2007-2108
Published: 2007-04-18
Description: Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 on Windows allows remote attackers to have an unknown impact, aka DB01.  NOTE: as of 20070424, Oracle has not disputed reliable claims that this issue occurs because the NTLM SSPI AcceptSecurityContext function grants privileges based on the username provided even though all users are authenticated as Guest, which allows remote attackers to gain privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.kb.cert.org/vuls/id/809457; http://www.ngssoftware.com/papers/database-on-xp.pdf
CVE: CVE-2007-2109
Published: 2007-04-18
Description: Multiple unspecified vulnerabilities in Oracle Database 10.2.0.3 have unknown impact and remote authenticated attack vectors related to (1) Rules Manager and Expression Filter components (DB02) and (2) Oracle Streams (DB06).  Note: as of 20070424, Oracle has not disputed reliable claims that DB02 is for a race condition in the RLMGR_TRUNCATE_MAINT trigger in the Rules Manager and Expression Filter components changing the AUTHID of a package from DEFINER to CURRENT_USER after a TRUNCATE call, and DB06 is for SQL injection in the DBMS_APPLY_USER_AGENT.SET_REGISTRATION_HANDLER procedure, which is later passed to the DBMS_APPLY_ADM_INTERNAL.ALTER_APPLY procedure, aka "Oracle Streams".
CVSS Score: 6.0 (MEDIUM)
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html
CVE: CVE-2007-2110
Published: 2007-04-18
Description: Unspecified vulnerability in the Core RDBMS component for Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.4 on Windows systems has unknown impact and attack vectors, aka DB03.  NOTE: as of 20070424, Oracle has not disputed reliable claims that DB03 occurs because RDBMS uses a NULL Discretionary Access Control List (DACL) for the Oracle process and certain shared memory sections, which allows local users to inject threads and execute arbitrary code via the OpenProcess, OpenThread, and SetThreadContext functions (DB03).
CVSS Score: 4.4 (MEDIUM)
References: http://www.freelists.org/archives/oracle-l/12-2006/msg00004.html; http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf
CVE: CVE-2007-2111
Published: 2007-04-18
Description: SQL injection vulnerability in the SYS.DBMS_AQADM_SYS package in Oracle Database 9.0.1.5, 9.2.0.7, and 10.1.0.5 allows remote authenticated users to inject arbitrary SQL commands via unknown vectors, aka DB04.  NOTE: as of 20070424, Oracle has not disputed reliable claims that DB04 is actually for multiple vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html
CVE: CVE-2007-2112
Published: 2007-04-18
Description: Unspecified vulnerability in the Authentication component for Oracle Database 10.1.0.5 and 10.2.0.3 has unknown impact and attack vectors, aka DB05.  NOTE: as of 20070424, Oracle has not disputed reliable claims that this issue allows remote authenticated users to bypass the AUTH_ALTER_SESSION security policies via a logon trigger ("AFTER LOGON ON DATABASE" trigger directive), a related issue to CVE-2006-0547.
CVSS Score: 6.0 (MEDIUM)
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html
CVE: CVE-2007-2113
Published: 2007-04-18
Description: SQL injection vulnerability in the Upgrade/Downgrade component (DBMS_UPGRADE_INTERNAL) for Oracle Database 10.1.0.5 allows remote authenticated users to execute arbitrary SQL commands via unknown vectors, aka DB07.  NOTE: as of 20070424, Oracle has not disputed reliable claims that DB07 is actually for multiple issues.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html
CVE: CVE-2007-2114
Published: 2007-04-18
Description: Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.2 have unknown impact and remote authenticated attack vectors, related to (1) Change Data Capture (CDC), aka DB08, and (2) Oracle Instant Client, aka DB11.  NOTE: as of 20070424, oracle has not disputed reliable claims that these issues are buffer overflows using a long CHANGE_TABLE_NAME parameter to the DBMS_CDC_IPUBLISH.CHGTAB_CACHE procedure (DB08) and Oracle Instant Client genezi utility (DB11).
CVSS Score: 9.0 (HIGH)
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html
CVE: CVE-2007-2115
Published: 2007-04-18
Description: Unspecified vulnerability in the Change Data Capture (CDC) component in Oracle Database 9.2.0.7, 10.1.0.5, and 10.2.0.2 has unknown impact and attack vectors, aka DB09.  NOTE: as of 20070424, oracle has not disputed reliable claims that this issue involves multiple SQL injection vulnerabilities in the DBMS_CDC_PUBLISH with remote authenticated vectors involving the "java classes in CDC.jar."
CVSS Score: 6.8 (MEDIUM)
References: http://www.databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf; http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf
CVE: CVE-2007-2116
Published: 2007-04-18
Description: Unspecified vulnerability in the Advanced Replication component in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 has unknown impact and attack vectors, aka DB10.  NOTE: as of 20070424, Oracle has not disputed claims that these are buffer overflows in kkzi.o for the SYS.DBMS_SNAP_INTERNAL package using the (1) SNAP_OWNER or (2) SNAP_NAME parameters.
CVSS Score: 9.0 (HIGH)
References: http://www.appsecinc.com/resources/alerts/oracle/2007-07.shtml; http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf
CVE: CVE-2007-2117
Published: 2007-04-18
Description: Unspecified vulnerability in the Oracle Text component in Oracle Database 9.0.1.5+ and 9.2.0.5 has unknown impact and attack vectors, aka DB12.  NOTE: as of 20070424, Oracle has not disputed reliable claims that this involves a buffer overflow in the ctxsrv server daemon.
CVSS Score: 6.8 (MEDIUM)
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html
CVE: CVE-2007-2118
Published: 2007-04-18
Description: Unspecified vulnerability in the Upgrade/Downgrade component of Oracle Database 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors, aka DB13.  NOTE: as of 20070424, Oracle has not disputed reliable claims that this is a buffer overflow involving the "mig utility."
CVSS Score: 7.5 (HIGH)
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html
CVE: CVE-2007-2119
Published: 2007-04-18
Description: Cross-site scripting (XSS) vulnerability in boundary_rules.jsp in the Administration Front End for Oracle Enterprise (Ultra) Search, as used in Database Server 9.2.0.8, 10.1.0.5, and 10.2.0.2, and in Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2.0 allows remote attackers to inject arbitrary HTML or web script via the EXPTYPE parameter, aka SES01.
CVSS Score: 6.8 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.red-database-security.com/advisory/oracle_css_ses.html
CVE: CVE-2007-2120
Published: 2007-04-18
Description: The Oracle Discoverer servlet in Oracle Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2.0 allows remote attackers to shut down an Oracle TNS Listener via a TNS STOP command in a request that uses the database/TNS alias, aka AS01.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.red-database-security.com/advisory/oracle_discoverer_servlet.html
CVE: CVE-2007-2121
Published: 2007-04-18
Description: Unspecified vulnerability in the COREid Access component in Oracle Application Server 7.0.4.4 has unknown impact and attack vectors, aka AS02.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.securityfocus.com/archive/1/466329/100/200/threaded
CVE: CVE-2007-2122
Published: 2007-04-18
Description: Unspecified vulnerability in the Wireless component in Oracle Application Server 9.0.4.3 has unknown impact and attack vectors, aka AS03.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.securityfocus.com/archive/1/466329/100/200/threaded
CVE: CVE-2007-2123
Published: 2007-04-18
Description: Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.3 up to 10.1.3.2.0, 10.1.2 up to 10.1.2.2.0, and 9.0.4.3 has unknown impact and attack vectors, aka AS04.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.securityfocus.com/archive/1/466329/100/200/threaded
CVE: CVE-2007-2124
Published: 2007-04-18
Description: Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.4.1.0 has unknown impact and remote attack vectors, aka AS05.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.securityfocus.com/archive/1/466329/100/200/threaded
CVE: CVE-2007-2125
Published: 2007-04-18
Description: Unspecified vulnerability in Collaborative Workspace in Oracle Collaboration Suite 10.1.2 has unknown impact and attack vectors, aka OCS01.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.securityfocus.com/archive/1/466329/100/200/threaded
CVE: CVE-2007-2126
Published: 2007-04-18
Description: Unspecified vulnerability in Oracle E-Business Suite 11.5.10CU2 has unknown impact and remote attack vectors in the (1) Common Applications (APPS01) and (2) iProcurement (APPS02).
CVSS Score: 10.0 (HIGH)
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html
CVE: CVE-2007-2127
Published: 2007-04-18
Description: Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.0 have unknown impact and remote attack vectors via (1) Application Object Library (APPS04), iStore (2) APPS05 and (3) APPS06, (4) iSupport (APPS07), (5) Trade Management (APPS09), (6) Applications Manager (APPS10), and (7) Oracle Report Manager (APPS03).
CVSS Score: 10.0 (HIGH)
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html
CVE: CVE-2007-2128
Published: 2007-04-18
Description: Unspecified vulnerability in the Sales Online component for Oracle E-Business Suite 11.5.10 has unknown impact and remote authenticated attack vectors, aka APPS08.
CVSS Score: 9.0 (HIGH)
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html
CVE: CVE-2007-2129
Published: 2007-04-18
Description: Unspecified vulnerability in the Agent component in Oracle Enterprise Manager 9.2.0.8 has unknown impact and remote attack vectors, aka EM01.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.securityfocus.com/archive/1/466329/100/200/threaded
CVE: CVE-2007-2130
Published: 2007-04-18
Description: Unspecified vulnerability in Workflow Cartridge, as used in Oracle Database Server 9.2.0.1, 10.1.0.2, and 10.2.0.1; Application Server 9.0.4.3 and 10.1.2.0.2; Collaboration Suite 10.1.2; and E-Business Suite; has unknown impact and remote authenticated attack vectors, aka OWF01.
CVSS Score: 9.0 (HIGH)
References: http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf; http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html
CVE: CVE-2007-2131
Published: 2007-04-18
Description: Unspecified vulnerability in PeopleTools in Oracle PeopleSoft Enterprise 8.22.14, 8.47.12, and 8.48.08 has unknown impact and attack vectors, aka PSE01.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.securityfocus.com/archive/1/466329/100/200/threaded
CVE: CVE-2007-2132
Published: 2007-04-18
Description: Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise 8.47.12 and 8.48.08 has unknown impact and attack vectors, aka PSE02.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html; http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html; http://www.securityfocus.com/archive/1/466329/100/200/threaded