deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-6002
Published: 2007-11-15
Description: Cross-site scripting (XSS) vulnerability in Fenriru (1) Sleipnir 2.5.17 R2 and earlier and (2) Grani 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field in a search for additions to the Favorites section.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/38875; http://osvdb.org/38876
CVE: CVE-2007-6003
Published: 2007-11-15
Description: Cross-site scripting (XSS) vulnerability in cgi/b/ic/connect in the Thomson SpeedTouch 716 with firmware 5.4.0.14 allows remote attackers to inject arbitrary web script or HTML via the url parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27564; https://exchange.xforce.ibmcloud.com/vulnerabilities/38419; http://secunia.com/advisories/27564
CVE: CVE-2007-6004
Published: 2007-11-15
Description: Multiple SQL injection vulnerabilities in index.php in Toko Instan 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in an artikel action or (2) the katid parameter in a produk action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/26433; http://www.vupen.com/english/advisories/2007/3906; https://exchange.xforce.ibmcloud.com/vulnerabilities/38449
CVE: CVE-2007-6005
Published: 2007-11-15
Description: Unspecified vulnerability in the GpcContainer.GpcContainer.1 ActiveX control in WebEx allows remote attackers to cause a denial of service (memory access violation and crash) via (1) an invalid argument to the InitParam method or (2) an unspecified vector involving the SetParam method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5838&w=2; http://osvdb.org/45294; http://www.securityfocus.com/bid/26430
CVE: CVE-2007-6006
Published: 2007-11-15
Description: TestLink before 1.7.1 does not enforce an unspecified authorization mechanism, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://osvdb.org/42211; http://secunia.com/advisories/27600; http://sourceforge.net/project/shownotes.php?release_id=548619&group_id=90976
CVE: CVE-2007-6007
Published: 2007-11-15
Description: Integer overflow in the ID_PSP.apl plug-in for ACD ACDSee Photo Manager 9.0 build 108, Pro Photo Manager 8.1 build 99, and Photo Editor 4.0 build 195 allows user-assisted remote attackers to execute arbitrary code via a crafted PSP image that triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/25952; http://secunia.com/secunia_research/2007-73/advisory/; http://securityreason.com/securityalert/3367
CVE: CVE-2007-6008
Published: 2007-11-15
Description: Heap-based buffer overflow in emlsr.dll before 2.0.0.4 in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK allows remote attackers to execute arbitrary code via a long Content-Type header line in an EML file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27304; http://secunia.com/advisories/27304
CVE: CVE-2007-6009
Published: 2007-11-15
Description: Multiple buffer overflows in ACD products allow user-assisted remote attackers to execute arbitrary code via a long section string in a (1) XBM or (2) XPM file to (a) ID_X.apl or (b) IDE_ACDStd.apl.  NOTE: the PSP and LHA vectors are already covered by CVE-2007-4344 and CVE-2007-6007.  NOTE: these might be integer overflows rather than buffer overflows.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/45278; http://www.acdsee.com/support/knowledgebase/article?id=2800; http://www.securityfocus.com/bid/26554
CVE: CVE-2007-6010
Published: 2007-11-15
Description: Unspecified vulnerability in pioneers (formerly gnocatan) 0.11.3 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors that trigger an assert error.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-5933.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449541; http://osvdb.org/45293; http://securitytracker.com/id?1019024
CVE: CVE-2007-6011
Published: 2007-11-16
Description: Unspecified vulnerability in main.php of BugHotel Reservation System before 4.9.9 P3 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/26178; http://www.securityfocus.com/bid/26178
CVE: CVE-2007-4572
Published: 2007-11-16
Description: Stack-based buffer overflow in nmbd in Samba 3.0.0 through 3.0.26a, when configured as a Primary or Backup Domain controller, allows remote attackers to have an unknown impact via crafted GETDC mailslot requests, related to handling of GETDC logon server requests.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307179; http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html; http://lists.vmware.com/pipermail/security-announce/2008/000002.html
CVE: CVE-2007-5398
Published: 2007-11-16
Description: Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307179; http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html; http://lists.vmware.com/pipermail/security-announce/2008/000002.html
CVE: CVE-2007-6012
Published: 2007-11-16
Description: SQL injection vulnerability in SearchR.asp in DocuSafe 4.1.0 and 4.1.2 allows remote attackers to execute arbitrary SQL commands via the artnr parameter (aka the search section).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27660; http://securityreason.com/securityalert/3374; http://www.securityfocus.com/archive/1/483694/100/0/threaded
CVE: CVE-2007-6013
Published: 2007-11-19
Description: Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/058576.html; http://osvdb.org/40801; http://secunia.com/advisories/27714
CVE: CVE-2007-6025
Published: 2007-11-19
Description: Stack-based buffer overflow in driver_wext.c in wpa_supplicant 0.6.0 and earlier allows remote attackers to cause a denial of service (crash) via crafted TSF data.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442387; http://www.mandriva.com/security/advisories?name=MDKSA-2007:245; http://www.securityfocus.com/bid/26555
CVE: CVE-2007-6026
Published: 2007-11-20
Description: Stack-based buffer overflow in Microsoft msjet40.dll 4.0.8618.0 (aka Microsoft Jet Engine), as used by Access 2003 in Microsoft Office 2003 SP3, allows user-assisted attackers to execute arbitrary code via a crafted MDB file database file containing a column structure with a modified column count.  NOTE: this might be the same issue as CVE-2005-0944.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-08-04; http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/058531.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3574&w=2
CVE: CVE-2007-5670
Published: 2007-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-5956.  Reason: This candidate is a duplicate of CVE-2007-5956.  Notes: All CVE users should reference CVE-2007-5956 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-6027
Published: 2007-11-20
Description: PHP remote file inclusion vulnerability in admin.jjgallery.php in the Carousel Flash Image Gallery (com_jjgallery) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/26471; http://www.vupen.com/english/advisories/2007/3907; https://exchange.xforce.ibmcloud.com/vulnerabilities/38500
CVE: CVE-2007-6028
Published: 2007-11-20
Description: Multiple stack-based buffer overflows in the VSFlexGrid.VSFlexGridL ActiveX control in ComponentOne FlexGrid 7.1 Light allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long string in the (1) Text, (2) EditSelText, (3) EditText, and (4) CellFontName property values.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8574&w=2; http://www.securityfocus.com/bid/26467; https://exchange.xforce.ibmcloud.com/vulnerabilities/38507
CVE: CVE-2007-5500
Published: 2007-11-20
Description: The wait_task_stopped function in the Linux kernel before 2.6.23.8 checks a TASK_TRACED bit instead of an exit_state value, which allows local users to cause a denial of service (machine crash) via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.9 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.23.y.git%3Ba=commitdiff%3Bh=36ef66c5d137b9a31fd8c35d236fb9e26ef74f97; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html
CVE: CVE-2007-6029
Published: 2007-11-20
Description: Unspecified vulnerability in ClamAV 0.91.1 and 0.91.2 allows remote attackers to execute arbitrary code via a crafted e-mail message. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://wabisabilabi.blogspot.com/2007/11/focus-on-clamav-remote-code-execution.html; http://wslabi.com/wabisabilabi/showBidInfo.do?code=ZD-00000069; http://www.securityfocus.com/bid/26463
CVE: CVE-2007-6030
Published: 2007-11-20
Description: Unspecified vulnerability in Weird Solutions BOOTPTurbo 1.2 has unknown impact and remote attack vectors.  NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.
CVSS Score: 10.0 (HIGH)
References: http://wslabi.com/wabisabilabi/showBidInfo.do?code=ZD-00000065; http://www.securityfocus.com/bid/26601; http://wslabi.com/wabisabilabi/showBidInfo.do?code=ZD-00000065
CVE: CVE-2007-6031
Published: 2007-11-20
Description: Unspecified vulnerability in VanDyke VShell 3.0.1 allows remote attackers to cause a denial of service via unspecified vectors.  NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/45289; http://wslabi.com/wabisabilabi/showBidInfo.do?code=ZD-00000146; http://www.securityfocus.com/bid/26602
CVE: CVE-2007-6032
Published: 2007-11-20
Description: SQL injection vulnerability in calendar/page.asp in Aleris Web Publishing Server 3.0 allows remote attackers to execute arbitrary SQL commands via the mode parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8780&w=2; http://packetstormsecurity.org/0710-exploits/aleris-sql.txt; http://secunia.com/advisories/27396
CVE: CVE-2007-6033
Published: 2007-11-20
Description: Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions (Everyone/Full Control), which allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://osvdb.org/42398; http://pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsThreadID=2&NewsID=201804; http://secunia.com/advisories/27751
CVE: CVE-2007-6034
Published: 2007-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-6062.  Reason: This candidate is a duplicate of CVE-2007-6062.  Notes: All CVE users should reference CVE-2007-6062 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-6035
Published: 2007-11-20
Description: SQL injection vulnerability in graph.php in Cacti before 0.8.7a allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.gentoo.org/show_bug.cgi?id=199509; http://secunia.com/advisories/27719; http://secunia.com/advisories/27745
CVE: CVE-2007-6036
Published: 2007-11-20
Description: The parseRTSPRequestString function in LIVE555 Media Server 2007.11.01 and earlier allows remote attackers to cause a denial of service (daemon crash) via a short RTSP query, which causes a negative number to be used during memory allocation.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/live555x-adv.txt; http://secunia.com/advisories/27711; http://secunia.com/advisories/29356
CVE: CVE-2007-6037
Published: 2007-11-20
Description: Cross-site scripting (XSS) vulnerability in ws/generic_api_call.pl in Citrix NetScaler 8.0 build 47.8 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter and other unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/39009; http://secunia.com/advisories/27726; http://securityreason.com/securityalert/3377
CVE: CVE-2007-6038
Published: 2007-11-20
Description: PHP remote file inclusion vulnerability in xajax_functions.php in the JUser (com_juser) 1.0.14 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/26499; https://exchange.xforce.ibmcloud.com/vulnerabilities/38555; https://www.exploit-db.com/exploits/4636
CVE: CVE-2007-5898
Published: 2007-11-20
Description: The (1) htmlentities and (2) htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html; http://secunia.com/advisories/27648; http://secunia.com/advisories/27659
CVE: CVE-2007-5900
Published: 2007-11-20
Description: PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php_admin_value or php_admin_flag in httpd.conf by using ini_set to modify arbitrary configuration variables, a different issue than CVE-2006-4625.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://bugs.php.net/bug.php?id=41561; http://secunia.com/advisories/27648; http://secunia.com/advisories/27659
CVE: CVE-2007-5361
Published: 2007-11-20
Description: The Communication Server in Alcatel-Lucent OmniPCX Enterprise 7.1 and earlier caches an IP address during a TFTP request from an IP Touch phone, and uses this IP address as the destination for all subsequent VoIP packets to this phone, which allows remote attackers to cause a denial of service (loss of audio) or intercept voice communications via a crafted TFTP request containing the phone's MAC address in the filename.
CVSS Score: 8.5 (HIGH)
References: http://osvdb.org/40522; http://secunia.com/advisories/27710; http://securityreason.com/securityalert/3387
CVE: CVE-2007-5899
Published: 2007-11-20
Description: The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL, as demonstrated by a rewritten form containing a local session ID.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://bugs.php.net/bug.php?id=42869; http://osvdb.org/38918; http://secunia.com/advisories/27659
CVE: CVE-2007-6039
Published: 2007-11-20
Description: PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function, the message parameter to the (2) dcgettext or (3) gettext function, the msgid1 parameter to the (4) dngettext or (5) ngettext function, or (6) the classname parameter to the stream_wrapper_register function.  NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless this issue can be demonstrated for code execution.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://securityreason.com/securityalert/3365; http://securityreason.com/securityalert/3366; http://www.securityfocus.com/archive/1/483644/100/0/threaded
CVE: CVE-2007-6040
Published: 2007-11-20
Description: The Belkin F5D7230-4 Wireless G Router allows remote attackers to cause a denial of service (degraded networking and logging) via a flood of TCP SYN packets, a related issue to CVE-1999-0116.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://securityreason.com/securityalert/3383; http://www.securityfocus.com/archive/1/483890/100/0/threaded; http://www.securityfocus.com/bid/26498
CVE: CVE-2007-6041
Published: 2007-11-20
Description: Buffer overflow in the Sequencer::queueMessage function in sequencer.cpp in the server in Rigs of Rods (RoR) before 0.33d SP1 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code by sending a nickname, then a vehicle name in a MSG2_USE_VEHICLE message, in which the combined length triggers the overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/rorbof-adv.txt; http://aluigi.org/poc/rorbof.zip; http://forum.rigsofrods.com/index.php?topic=3140.0
CVE: CVE-2007-6042
Published: 2007-11-20
Description: PHP remote file inclusion vulnerability in fehler.inc.php in SWSoft Confixx Professional 3.2.1 allows remote attackers to execute arbitrary PHP code via a URL in an unspecified parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/26500; http://www.securityfocus.com/bid/26500
CVE: CVE-2007-6043
Published: 2007-11-20
Description: The CryptGenRandom function in Microsoft Windows 2000 generates predictable values, which makes it easier for context-dependent attackers to reduce the effectiveness of cryptographic mechanisms, as demonstrated by attacks on (1) forward security and (2) backward security, related to use of eight instances of the RC4 cipher, and possibly a related issue to CVE-2007-3898.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://eprint.iacr.org/2007/419.pdf; http://www.computerworld.com.au/index.php/id%3B[PII_REDACTED]%3Bfp%3B2%3Bfpid%3B1; http://www.securityfocus.com/bid/26495
CVE: CVE-2007-6044
Published: 2007-11-20
Description: Multiple unspecified vulnerabilities in IBM WebSphere MQ 6.0 have unknown impact and remote attack vectors involving "memory corruption." NOTE: as of 20071116, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://osvdb.org/45302; http://securityreason.com/securityalert/3381; http://www.irmplc.com/index.php/111-Vendor-Alerts#IBM
CVE: CVE-2007-6045
Published: 2007-11-20
Description: Unspecified vulnerability in (1) DB2WATCH and (2) DB2FREEZE in IBM DB2 UDB 9.1 before Fixpak 4 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/41014; http://osvdb.org/41015; http://secunia.com/advisories/27667
CVE: CVE-2007-6046
Published: 2007-11-20
Description: Unspecified vulnerability in unspecified setuid programs in IBM DB2 UDB 9.1 before Fixpak 4 allows local users to have an unknown impact.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/27667; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ07018; http://www-1.ibm.com/support/docview.wss?uid=swg21255607
CVE: CVE-2007-6047
Published: 2007-11-20
Description: Unspecified vulnerability in the DB2DART tool in IBM DB2 UDB 9.1 before Fixpak 4 allows attackers to execute arbitrary commands as the DB2 instance owner, related to invocation of TPUT by DB2DART.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/27667; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ03646; http://www-1.ibm.com/support/docview.wss?uid=swg21255607
CVE: CVE-2007-6048
Published: 2007-11-20
Description: IBM DB2 UDB 9.1 before Fixpak 4 uses incorrect permissions on ACLs for DB2NODES.CFG, which has unknown impact and attack vectors.  NOTE: the vendor description of this issue is too vague to be certain that it is security-related.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/41017; http://secunia.com/advisories/27667; http://www-1.ibm.com/support/docview.wss?uid=swg1JR26989
CVE: CVE-2007-6049
Published: 2007-11-20
Description: Unspecified vulnerability in the SSL LOAD GSKIT action in IBM DB2 UDB 9.1 before Fixpak 4 has unknown impact and attack vectors, involving a call to dlopen when the effective uid is root.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/41013; http://secunia.com/advisories/27667; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ05461
CVE: CVE-2007-6050
Published: 2007-11-20
Description: Unspecified vulnerability in DB2LICD in IBM DB2 UDB 9.1 before Fixpak 4 has unknown impact and attack vectors, related to creation of an "insecure directory."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www-1.ibm.com/support/docview.wss?uid=swg1IZ03881; http://www-1.ibm.com/support/docview.wss?uid=swg21255607; http://www.securityfocus.com/bid/26450
CVE: CVE-2007-6051
Published: 2007-11-20
Description: IBM DB2 UDB 9.1 before Fixpak 4 assigns incorrect privileges to the (1) DB2ADMNS and (2) DB2USERS alternative groups, which has unknown impact.  NOTE: the vendor description of this issue is too vague to be certain that it is security-related.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/41011; http://www-1.ibm.com/support/docview.wss?uid=swg1JR26854; http://www-1.ibm.com/support/docview.wss?uid=swg21255607
CVE: CVE-2007-6052
Published: 2007-11-20
Description: IBM DB2 UDB 9.1 before Fixpak 4 does not properly perform vector aggregation, which might allow attackers to cause a denial of service (divide-by-zero error and DBMS crash), related to an "overflow." NOTE: the vendor description of this issue is too vague to be certain that it is security-related.
CVSS Score: 7.8 (HIGH)
References: http://www-1.ibm.com/support/docview.wss?uid=swg1IZ08205; http://www-1.ibm.com/support/docview.wss?uid=swg21255607; http://www.securityfocus.com/bid/26450