deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-3856
Published: 2007-07-18
Description: Unspecified vulnerability in the Oracle Data Mining component for Oracle Database 10g Release 2 10.2.0.2 and 10.2.0.3, 10g 10.1.0.5, and Oracle9i Database Release 2 9.2.0.7, 9.2.0.8, and 9.2.0.8DV has unknown impact and remote authenticated attack vectors related to DMSYS.DMP_SYS, aka DB04.
CVSS Score: 6.5 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3857
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 allow remote authenticated users to have an unknown impact via (a) the Oracle Text component, including (1) unspecified vectors (DB05), (2) CTXSYS.DRVXMD (DB06), (3) CTXSYS.DRI_MOVE_CTXSYS (DB07), (4) CTXSYS.DRVXMD (DB08), and (b) JavaVM (DB14).
CVSS Score: 6.5 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3858
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in Oracle Database 10.2.0.3 allow remote authenticated users to have an unknown impact via (1) EXFSYS.DBMS_RLMGR_UTL in Rules Manager (DB11) and (2) Program Interface (DB13).
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3859
Published: 2007-07-18
Description: Unspecified vulnerability in the Oracle Internet Directory component for Oracle Database 9.2.0.8 and 9.2.0.8DV; Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; and Collaboration Suite 10.1.2 has unknown impact and remote attack vectors, aka OID01.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3860
Published: 2007-07-18
Description: Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01.  NOTE: a reliable researcher states that this is SQL injection in the wwv_flow_security.check_db_password function due to insufficient checks for '"' characters.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3861
Published: 2007-07-18
Description: Unspecified vulnerability in Oracle Jdeveloper in Oracle Application Server 10.1.2.2 and Collaboration Suite 10.1.2 allows context-dependent attackers to have an unknown impact via custom applications that use JBO.KEY, aka JDEV01.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3862
Published: 2007-07-18
Description: Unspecified vulnerability in Oracle Application Server 9.0.4.3 and 10.1.2.0.2 allows remote attackers to have an unknown impact via Oracle Single Sign On, aka AS01.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3863
Published: 2007-07-18
Description: Unspecified vulnerability in Oracle JDeveloper for Application Server 10.1.2.2 and 10.1.3.1, and Collaboration Suite 10.1.2, allows context-dependent attackers to have an unknown impact via custom applications that use JBO.SERVER, aka JDEV02.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3864
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in Oracle Collaboration Suite 10.1.2 have unknown impact and remote attack vectors via (1) Instant Messaging/Presence (OCS01) and (2) Oracle Single Sign On (AS02).
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3865
Published: 2007-07-18
Description: Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 12.0.1 has unknown impact and remote attack vectors, aka APPS01.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3866
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 and 12.0.1 allow remote attackers to have an unknown impact via (a) Oracle Configurator (APPS02), (b) Oracle iExpenses (APPS03), (c) Oracle Application Object Library (APPS09), and (1) APPS12, (2) APPS13, and (3) APPS14 in (d) Oracle Payables.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3867
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 have unknown impact and attack vectors, related to (1) APPS04, (2) APPS05, and (3) APPS06 in (a) Oracle Application Object Library, (4) APPS07 in Oracle Customer Intelligence, (5) APPS08 in Oracle Payments, (7) APPS10 in Oracle Human Resources, and (8) APPS11 in iRecruitment.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3868
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in PeopleTools in Oracle PeopleSoft Enterprise 8.22.15, 8.47.13, 8.48.10, and 8.49.02 allows remote authenticated users or attackers to have an unknown impact via multiple vectors, aka (1) PSE01, (2) PSE02, and (3) PSE03.
CVSS Score: 6.5 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3869
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in the Customer Relationship Management Online Marketing component in Oracle PeopleSoft Enterprise 8.9 Bundle 26 and 9.0 Bundle 7 allow remote authenticated users to have an unknown impact, aka (1) PSE04 and (2) PSE05.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2007-3870
Published: 2007-07-18
Description: Multiple unspecified vulnerabilities in the Human Capital Management component in Oracle PeopleSoft Enterprise 8.9 Bundle 11 allow local users to have unknown impact via unknown vectors, aka (1) PSE06 and (2) PSE07.
CVSS Score: 4.6 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143; http://secunia.com/advisories/26114; http://secunia.com/advisories/26166
CVE: CVE-2006-4183
Published: 2007-07-18
Description: Heap-based buffer overflow in Microsoft DirectX SDK (February 2006) and probably earlier, including 9.0c End User Runtimes, allows context-dependent attackers to execute arbitrary code via a crafted Targa file with a run-length-encoding (RLE) compression that produces more data than expected when decoding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=562; http://secunia.com/advisories/26131; http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=52
CVE: CVE-2007-3268
Published: 2007-07-18
Description: The TFTP implementation in IBM Tivoli Provisioning Manager for OS Deployment 5.1 before Fix Pack 3 allows remote attackers to cause a denial of service (rembo.exe crash and multiple service outage) via a read (RRQ) request with an invalid blksize (blocksize), which triggers a divide-by-zero error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=560; http://secunia.com/advisories/26093; http://securitytracker.com/id?1018401
CVE: CVE-2007-3825
Published: 2007-07-18
Description: Multiple stack-based buffer overflows in the RPC implementation in alert.exe before 8.0.255.0 in CA (formerly Computer Associates) Alert Notification Server, as used in Threat Manager for the Enterprise, Protection Suites, certain BrightStor ARCserve products, and BrightStor Enterprise Backup, allow remote attackers to execute arbitrary code by sending certain data to unspecified RPC procedures.
CVSS Score: 9.3 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=561; http://secunia.com/advisories/26088; http://supportconnectw.ca.com/public/antivirus/infodocs/caantivirus-secnotice.asp
CVE: CVE-2007-3881
Published: 2007-07-18
Description: SQL injection vulnerability in index.php in Pictures Rating (Picture Rating) allows remote attackers to execute arbitrary SQL commands via the msgid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/39144; http://www.securityfocus.com/bid/24945; https://www.exploit-db.com/exploits/4191
CVE: CVE-2007-3882
Published: 2007-07-18
Description: SQL injection vulnerability in index.php in Expert Advisor allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/39146; http://www.securityfocus.com/bid/24943; https://www.exploit-db.com/exploits/4189
CVE: CVE-2007-3883
Published: 2007-07-18
Description: The Data Dynamics ActiveBar ActiveX control (actbar3.ocx) 3.2 and earlier allows remote attackers to create or overwrite files via a full pathname in (1) the second argument to the Save method, or the first argument to the (2) SaveLayoutChanges or (3) SaveMenuUsageData method.
CVSS Score: 5.1 (MEDIUM)
References: http://osvdb.org/37692; http://secunia.com/advisories/26098; http://www.securityfocus.com/bid/24959
CVE: CVE-2007-3884
Published: 2007-07-18
Description: SQL injection vulnerability in philboard_forum.asp in husrevforum 1.0.1 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.  NOTE: it was later reported that 2.0.1 is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/26089; http://secunia.com/advisories/26736; http://www.osvdb.org/38185
CVE: CVE-2007-3885
Published: 2007-07-18
Description: Cross-site scripting (XSS) vulnerability in philboard_search.asp in husrevforum 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the searchterms parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/26089; http://secunia.com/advisories/26736; http://www.osvdb.org/38186
CVE: CVE-2007-3886
Published: 2007-07-18
Description: Cross-site scripting (XSS) vulnerability in default.asp in Element CMS allows remote attackers to inject arbitrary web script or HTML via the s parameter in a search pID action.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0286.html; http://osvdb.org/36356; http://secunia.com/advisories/26080
CVE: CVE-2007-3887
Published: 2007-07-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in mesaj_formu.asp in ASP Ziyaretci Defteri 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Isim, (2) Mesajiniz, and (3) E-posta fields.  NOTE: these probably correspond to the isim, mesaj, and posta parameters to save.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/26079; http://secunia.com/advisories/26375; http://www.packetstormsecurity.org/0707-exploits/aspziy-xss.txt
CVE: CVE-2007-3888
Published: 2007-07-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Insanely Simple Blog 0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the search action, possibly related to the term parameter to index.php; or (2) an anonymous blog entry, possibly involving the (a) posted_by, (b) subject, and (c) content parameters to index.php; as demonstrated by the onmouseover attribute of certain elements.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/26105; http://securityreason.com/securityalert/2904; http://www.securityfocus.com/archive/1/473868/100/0/threaded
CVE: CVE-2007-3889
Published: 2007-07-18
Description: Multiple SQL injection vulnerabilities in Insanely Simple Blog 0.5 and earlier allow remote attackers to execute arbitrary SQL commands via the current_subsection parameter to index.php and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://chroot.org/exploits/chroot_uu_010; http://secunia.com/advisories/26105; http://securityreason.com/securityalert/2904
CVE: CVE-2007-3905
Published: 2007-07-19
Description: SQL injection vulnerability in Zoph before 0.7.0.1 might allow remote attackers to execute arbitrary SQL commands via the _order parameter to (1) photos.php and (2) edit_photos.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/26077; http://secunia.com/advisories/27303; http://sourceforge.net/project/shownotes.php?release_id=523104&group_id=69353
CVE: CVE-2007-3906
Published: 2007-07-19
Description: Unspecified vulnerability in Kaspersky Anti-Virus for Check Point FireWall-1 before Critical Fix 1 (5.5.161.0) might allow attackers to cause a denial of service (kernel hang) via unspecified vectors.  NOTE: it is not clear whether there is an attacker role.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/36127; http://secunia.com/advisories/26064; http://support.kaspersky.com/checkpoint?qid=208279464
CVE: CVE-2007-3907
Published: 2007-07-19
Description: Unspecified vulnerability in login.pl in LedgerSMB 1.2.0 through 1.2.6 allows remote attackers to bypass authentication and perform certain actions as an arbitrary user via unspecified vectors involving a URL with a redirect parameter value, along with a callback parameter containing an escaped URL that specifies the action.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/26121; http://sourceforge.net/project/shownotes.php?release_id=523576&group_id=175965; http://www.ledgersmb.org/node/52
CVE: CVE-2007-3908
Published: 2007-07-19
Description: Unspecified vulnerability in HP ServiceGuard for Linux for Red Hat Enterprise Linux (RHEL) 2.1 SG A.11.14.04 through A.11.14.06; RHEL 3.0 SG A.11.16.04 through A.11.16.10; and ServiceGuard Cluster Object Manager B.03.01.02 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2007-0980.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/38159; http://secunia.com/advisories/26051; http://securityreason.com/securityalert/2907
CVE: CVE-2007-3909
Published: 2007-07-19
Description: Multiple SQL injection vulnerabilities in Bandersnatch 0.4 allow remote attackers to execute arbitrary SQL commands via the (1) date and (2) limit parameters to index.php, and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/26202; http://www.osvdb.org/38268; http://www.portcullis-security.com/uplds/advisories/Bandersnatch%20-%2007-006.txt
CVE: CVE-2007-3910
Published: 2007-07-19
Description: Cross-site scripting (XSS) vulnerability in Bandersnatch 0.4 allows remote attackers to inject arbitrary JavaScript via a Jabber resource name and possibly other data items, which are stored in conversation logs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/26202; http://www.osvdb.org/38269; http://www.portcullis-security.com/182.php
CVE: CVE-2007-3380
Published: 2007-07-20
Description: The Distributed Lock Manager (DLM) in the cluster manager for Linux kernel 2.6.15 allows remote attackers to cause a denial of service (loss of lock services) by connecting to the DLM port, which probably prevents other processes from accessing the service.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://osvdb.org/37109; http://secunia.com/advisories/26139; http://secunia.com/advisories/27322
CVE: CVE-2007-3922
Published: 2007-07-21
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) Applet Class Loader in Sun JDK and JRE 5.0 Update 11 and earlier, 6 through 6 Update 1, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to violate the security model for an applet's outbound connections by connecting to certain localhost services running on the machine that loaded the applet.
CVSS Score: 6.8 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/248; http://docs.info.apple.com/article.html?artnum=307177; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01269450
CVE: CVE-2007-3923
Published: 2007-07-21
Description: The Common Internet File System (CIFS) optimization in Cisco Wide Area Application Services (WAAS) 4.0.7 and 4.0.9, as used by Cisco WAE appliance and the NM-WAE-502 network module, when Edge Services are configured, allows remote attackers to cause a denial of service (loss of service) via a flood of TCP SYN packets to port (1) 139 or (2) 445.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/26122; http://www.cisco.com/warp/public/707/cisco-sa-20070718-waas.shtml; http://www.osvdb.org/36120
CVE: CVE-2007-3924
Published: 2007-07-21
Description: Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Netscape installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a -chrome argument to the navigatorurl URI, which are inserted into the command line that is created when invoking netscape.exe, a related issue to CVE-2007-3670.  NOTE: there has been debate about whether the issue is in Internet Explorer or Netscape. As of 20070713, it is CVE's opinion that IE appears to not properly delimit the URL argument when invoking Netscape; this issue could arise with other protocol handlers in IE.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/26082; http://sla.ckers.org/forum/read.php?3%2C13732%2C13739; http://secunia.com/advisories/26082
CVE: CVE-2007-3925
Published: 2007-07-21
Description: Multiple buffer overflows in the IMAP service (imapd32.exe) in Ipswitch IMail Server 2006 before 2006.21 allow remote authenticated users to execute arbitrary code via the (1) Search or (2) Search Charset command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://docs.ipswitch.com/IMail%202006.21/ReleaseNotes/IMail_RelNotes.htm#NewRelease; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=563; http://secunia.com/advisories/26123
CVE: CVE-2007-3926
Published: 2007-07-21
Description: Ipswitch IMail Server 2006 before 2006.21 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving an "overwritten destructor."
CVSS Score: 7.8 (HIGH)
References: http://docs.ipswitch.com/IMail%202006.21/ReleaseNotes/IMail_RelNotes.htm#NewRelease; http://secunia.com/advisories/26123; http://www.vupen.com/english/advisories/2007/2574
CVE: CVE-2007-3927
Published: 2007-07-21
Description: Multiple buffer overflows in Ipswitch IMail Server 2006 before 2006.21 (1) allow remote attackers to execute arbitrary code via unspecified vectors in Imailsec and (2) allow attackers to have an unknown impact via an unspecified vector related to "subscribe."
CVSS Score: 10.0 (HIGH)
References: http://docs.ipswitch.com/IMail%202006.21/ReleaseNotes/IMail_RelNotes.htm#NewRelease; http://osvdb.org/45818; http://osvdb.org/45819
CVE: CVE-2007-3928
Published: 2007-07-21
Description: Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users to execute arbitrary code via a long e-mail address in an address book entry.  NOTE: this might overlap CVE-2007-3638.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064669.html; http://secunia.com/advisories/26066; http://securityreason.com/securityalert/2906
CVE: CVE-2007-3929
Published: 2007-07-21
Description: Use-after-free vulnerability in the BitTorrent support in Opera before 9.22 allows user-assisted remote attackers to execute arbitrary code via a crafted header in a torrent file, which leaves a dangling pointer to an invalid object.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=564; http://secunia.com/advisories/26138; http://secunia.com/advisories/26545
CVE: CVE-2007-3930
Published: 2007-07-21
Description: Interpretation conflict between Microsoft Internet Explorer and DocuWiki before 2007-06-26b allows remote attackers to inject arbitrary JavaScript and conduct cross-site scripting (XSS) attacks when spellchecking UTF-8 encoded messages via the spell_utf8test function in lib/exe/spellcheck.php, which triggers HTML document identification and script execution by Internet Explorer even though the Content-Type header is text/plain.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.splitbrain.org/index.php?do=details&task_id=1195; http://osvdb.org/38319; http://secunia.com/advisories/26150
CVE: CVE-2007-3931
Published: 2007-07-21
Description: The wrap_setuid_third_party_application function in the installation script for the Samsung SCX-4200 Driver 2.00.95 adds setuid permissions to third party applications such as xsane and xscanimage, which allows local users to gain privileges.
CVSS Score: 4.4 (MEDIUM)
References: http://it.slashdot.org/it/07/07/18/0319203.shtml; http://linuxfr.org/forums/15/22562.html; http://osvdb.org/38214
CVE: CVE-2007-3932
Published: 2007-07-21
Description: uploadimg.php in the Expose RC35 and earlier (com_expose) component for Joomla! sends an error message but does not exit when it detects an attempt to upload a non-JPEG file, which allows remote attackers to upload and execute arbitrary PHP code in the img/ folder.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/41262; http://www.attrition.org/pipermail/vim/2007-July/001717.html; http://www.securityfocus.com/bid/24958
CVE: CVE-2007-3933
Published: 2007-07-21
Description: SQL injection vulnerability in insertorder.cfm in QuickEStore 8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the CFTOKEN parameter, a different vector than CVE-2006-2053.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/36358; http://secunia.com/advisories/26097; http://www.securityfocus.com/bid/24961
CVE: CVE-2007-3934
Published: 2007-07-21
Description: PHP remote file inclusion vulnerability in postscript/postscript.php in BBS E-Market allows remote attackers to execute arbitrary PHP code via a URL in the p_mode parameter.
CVSS Score: 7.5 (HIGH)
References: http://darkcode.ath.cx/f0rum/ind3x.php?action=vthread&forum=12&topic=80; http://osvdb.org/36279; http://secunia.com/advisories/26117
CVE: CVE-2007-3935
Published: 2007-07-21
Description: PHP remote file inclusion vulnerability in link_main.php in the SupaNav 1.0.0 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/36275; http://secunia.com/advisories/26127; http://www.vupen.com/english/advisories/2007/2575