deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-5342
Published: 2007-12-27
Description: The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2337&w=2
CVE: CVE-2007-6525
Published: 2007-12-27
Description: Unspecified vulnerability in eClient in IBM DB2 Content Manager (CM) Toolkit 8.3 before fix pack 7 for z/OS has unknown impact and attack vectors, related to "scripting."
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/41624; http://secunia.com/advisories/28174; http://www-1.ibm.com/support/docview.wss?uid=isg1IO06740
CVE: CVE-2007-6526
Published: 2007-12-27
Description: Cross-site scripting (XSS) vulnerability in tiki-special_chars.php in TikiWiki before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via the area_name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/41179; http://secunia.com/advisories/28225; http://secunia.com/advisories/28602
CVE: CVE-2007-6527
Published: 2007-12-27
Description: uploadimg.php in the Automatic Image Upload with Thumbnails (imgUpload) module 1.3.2 for PunBB only verifies the Content-type field of uploaded files, which allows remote attackers to upload and execute arbitrary content via a file with a (1) JPG, (2) GIF, or (3) PNG MIME type.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/42809; http://secunia.com/advisories/28138; http://www.fortconsult.net/images/pdf/advisories/punBB_imgUpload.pdf
CVE: CVE-2007-6528
Published: 2007-12-27
Description: Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) and modified filename in the movie parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/41178; http://secunia.com/advisories/28225; http://secunia.com/advisories/28602
CVE: CVE-2007-6529
Published: 2007-12-27
Description: Multiple unspecified vulnerabilities in TikiWiki before 1.9.9 have unknown impact and attack vectors involving (1) tiki-edit_css.php, (2) tiki-list_games.php, or (3) tiki-g-admin_shared_source.php.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/41175; http://osvdb.org/41176; http://osvdb.org/41177
CVE: CVE-2007-6530
Published: 2007-12-27
Description: Buffer overflow in the XUpload.ocx ActiveX control in Persits Software XUpload 2.1.0.1, and probably other versions before 3.0, as used by HP Mercury LoadRunner and Groove Virtual Office, allows remote attackers to execute arbitrary code via a long argument to the AddFolder function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8564&w=2; http://osvdb.org/39901; http://secunia.com/advisories/28145
CVE: CVE-2007-6533
Published: 2007-12-27
Description: Buffer overflow in Zoom Player 6.00 beta 2 and earlier allows user-assisted remote attackers to execute arbitrary code via an HTTP link to a PLS file in a crafted ZPL file, which causes an overflow in Unicode handling when generating an error message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/zoomprayer-adv.txt; http://osvdb.org/39872; http://secunia.com/advisories/28214
CVE: CVE-2007-6534
Published: 2007-12-27
Description: Multiple unspecified vulnerabilities in Microsoft Office Publisher allow user-assisted remote attackers to cause a denial of service (application crash) via a crafted PUB file, possibly involving wordart.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/3490; http://www.securityfocus.com/archive/1/485456/100/0/threaded; http://www.securityfocus.com/bid/26982
CVE: CVE-2007-6535
Published: 2007-12-27
Description: Buffer overflow in the YShortcut ActiveX control in YShortcut.dll 2006.8.15.1 in Yahoo! Toolbar might allow attackers to execute arbitrary code via a long string to the IsTaggedBM method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059204.html; http://www.securityfocus.com/bid/26956; https://exchange.xforce.ibmcloud.com/vulnerabilities/39155
CVE: CVE-2007-6536
Published: 2007-12-27
Description: The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the (1) "Downloaded from" and (2) "Privacy considerations" sections without verifying domain names, which makes it easier for remote attackers to spoof domain names and trick users into installing malicious button XML files, as demonstrated by presenting www.google.com when the button was downloaded from an arbitrary site through an open redirector on www.google.com.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://aviv.raffon.net/2007/12/18/GoogleToolbarDialogSpoofingVulnerability.aspx; http://secunia.com/advisories/28166; http://securityreason.com/securityalert/3491
CVE: CVE-2007-6537
Published: 2007-12-27
Description: Stack-based buffer overflow in the zfile_gunzip function in zfile.c in WinUAE 1.4.4 and earlier allows user-assisted remote attackers to execute arbitrary code via a long filename in a gzipped archive, such as a (1) gz, (2) adz, (3) roz, or (4) hdz archive in a compressed floppy disk image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/winuaebof-adv.txt; http://aluigi.org/poc/winuaebof.zip; http://osvdb.org/39902
CVE: CVE-2007-6538
Published: 2007-12-27
Description: SQL injection vulnerability in ing/blocks/mrbs/code/web/view_entry.php in the MRBS plugin for Moodle allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://cvs.moodle.org/contrib/plugins/blocks/mrbs/web/view_entry.php?r1=1.1&r2=1.2; http://osvdb.org/39619; http://secunia.com/advisories/28198
CVE: CVE-2007-6539
Published: 2007-12-27
Description: PHP local file inclusion vulnerability in index.php in IDevspot iSupport 1.8 allows remote attackers to include local files via the include_file parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/39801; http://securityreason.com/securityalert/3488; http://www.securityfocus.com/archive/1/485392/100/0/threaded
CVE: CVE-2007-6540
Published: 2007-12-27
Description: SQL injection vulnerability in neuron news 1.0 allows remote attackers to execute arbitrary SQL commands via the q parameter to the default URI in patch/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39988; http://securityreason.com/securityalert/3489; http://www.securityfocus.com/archive/1/485176/100/0/threaded
CVE: CVE-2007-6541
Published: 2007-12-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in neuron news 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the topic parameter in a viewtopic action, or the (2) newsyear or (3) newsmonth parameter in a newsarchive action to the default URI in patch/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3489; http://www.securityfocus.com/archive/1/485176/100/0/threaded; http://securityreason.com/securityalert/3489
CVE: CVE-2007-6542
Published: 2007-12-27
Description: PHP remote file inclusion vulnerability in admin/frontpage_right.php in Arcadem LE 2.04 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/39802; http://www.securityfocus.com/bid/26986; https://www.exploit-db.com/exploits/4764
CVE: CVE-2007-6543
Published: 2007-12-28
Description: SQL injection vulnerability in suggest-link.php in eSyndiCat Link Exchange Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39795; http://secunia.com/advisories/28199; http://www.securityfocus.com/bid/27029
CVE: CVE-2007-6544
Published: 2007-12-28
Description: Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the lid parameter to (1) brokenfile.php, (2) visit.php, or (3) ratefile.php in modules/mydownloads/; or (4) ratelink.php, (5) modlink.php, or (6) brokenlink.php in modules/mylinks/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/41235; http://osvdb.org/41236; http://osvdb.org/41237
CVE: CVE-2007-6545
Published: 2007-12-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) the subject parameter to modules/news/submit.php; (2) the PATH_INFO to modules/news/index.php, possibly related to the XoopsPageNav class; or (3) an avatar image to edituser.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/41241; http://osvdb.org/41242; http://osvdb.org/41243
CVE: CVE-2007-6546
Published: 2007-12-28
Description: RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/41245; http://securityreason.com/securityalert/3493; http://www.runcms.org/modules/mydownloads/singlefile.php?lid=131
CVE: CVE-2007-6547
Published: 2007-12-28
Description: RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent attackers to change passwords upon obtaining temporary access to a session.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/41246; http://securityreason.com/securityalert/3493; http://www.runcms.org/modules/mydownloads/singlefile.php?lid=131
CVE: CVE-2007-6548
Published: 2007-12-28
Description: Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the (1) header and (2) footer parameters to modules/system/admin.php in a meta-generator action, (3) the disclaimer parameter to modules/system/admin.php in a disclaimer action, (4) the disclaimer parameter to modules/mydownloads/admin/index.php in a mydownloadsConfigAdmin action, (5) the disclaimer parameter to modules/newbb_plus/admin/forum_config.php, (6) the disclaimer parameter to modules/mylinks/admin/index.php in a myLinksConfigAdmin action, or (7) the intro parameter to modules/sections/admin/index.php in a secconfig action, which inject PHP sequences into (a) sections/cache/intro.php, (b) mylinks/cache/disclaimer.php, (c) mydownloads/cache/disclaimer.php, (d) newbb_plus/cache/disclaimer.php, (e) system/cache/disclaimer.php, (f) system/cache/footer.php, (g) system/cache/header.php, or (h) system/cache/maintenance.php in modules/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/41247; http://osvdb.org/41248; http://osvdb.org/41249
CVE: CVE-2007-6549
Published: 2007-12-28
Description: Unspecified vulnerability in RunCMS before 1.6.1 has unknown impact and attack vectors, related to "pagetype using."
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/41252; http://www.runcms.org/modules/mydownloads/singlefile.php?lid=131; https://exchange.xforce.ibmcloud.com/vulnerabilities/39299
CVE: CVE-2007-6550
Published: 2007-12-28
Description: form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct eval injection attacks and execute arbitrary PHP code via the options array parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/42662; http://secunia.com/advisories/28201; http://www.securityfocus.com/bid/27032
CVE: CVE-2007-6551
Published: 2007-12-28
Description: SQL injection vulnerability in showMsg.php in MailMachine Pro 2.2.4, and other versions before 2.2.6, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39638; http://secunia.com/advisories/28232; http://www.attrition.org/pipermail/vim/2008-January/001873.html
CVE: CVE-2007-6552
Published: 2007-12-28
Description: Directory traversal vulnerability in index.php in AuraCMS 2.2 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the act parameter, possibly involving the news pilih component; as demonstrated by including admin/admin_users.php to bypass a protection mechanism against direct request.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://newhack.org/advisories/AuraCMS-2.2-RemoteAddAdmin.txt; http://osvdb.org/39804; http://www.securityfocus.com/bid/27037
CVE: CVE-2007-6553
Published: 2007-12-28
Description: Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONF[app_root] parameter to (1) tcuser.class.php, (2) absencecount.inc.php, (3) avatar.inc.php, (4) csvhandler.class.php, (5) functions.tcpro.php, (6) header.html.inc.php, (7) joomlajack.tcpro.php, (8) menu.inc.php, (9) other.inc.php, (10) tcabsence.class.php, (11) tcabsencegroup.class.php, (12) tcallowance.class.php, (13) tcannouncement.class.php, (14) tcconfig.class.php, (15) tcdaynote.class.php, (16) tcgroup.class.php, (17) tcholiday.class.php, (18) tclogin.class.php, (19) tcmonth.class.php, (20) tctemplate.class.php, (21) tcusergroup.class.php, or (22) tcuseroption.class.php in includes/, possibly a related issue to CVE-2006-4845.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/39805; http://osvdb.org/39806; http://osvdb.org/39807
CVE: CVE-2007-6554
Published: 2007-12-28
Description: Multiple directory traversal vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to (1) index.php, (2) register.php, (3) login.php, or (4) statistics.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/39827; http://osvdb.org/39828; http://osvdb.org/39829
CVE: CVE-2007-6555
Published: 2007-12-28
Description: PHP remote file inclusion vulnerability in modules/mod_pxt_latest.php in the mosDirectory (com_directory) 2.3.2 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/40023; http://www.securityfocus.com/bid/27014; https://www.exploit-db.com/exploits/4783
CVE: CVE-2007-6556
Published: 2007-12-28
Description: Multiple SQL injection vulnerabilities in websihirbazi 5.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to default.asp in a news page action or (2) the pageid parameter to default.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39640; http://secunia.com/advisories/28206; http://www.securityfocus.com/bid/27031
CVE: CVE-2007-6557
Published: 2007-12-28
Description: Multiple SQL injection vulnerabilities in MeGaCheatZ 1.1 allow remote attackers to execute arbitrary SQL commands via the ItemID parameter to (1) comments.php, (2) view.php, (3) siteadmin/ViewItem.php, and unspecified other vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/40024; http://osvdb.org/40025; http://osvdb.org/40026
CVE: CVE-2007-6558
Published: 2007-12-28
Description: TotalPlayer 3.0 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .m3u file.  NOTE: this might be a duplicate of CVE-2006-6288.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/39891; http://secunia.com/advisories/28236; http://securityreason.com/securityalert/3500
CVE: CVE-2007-6559
Published: 2007-12-28
Description: Multiple SQL injection vulnerabilities in Logaholic before 2.0 RC8 allow remote attackers to execute arbitrary SQL commands via (1) the from parameter to index.php or (2) the page parameter to update.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39790; http://osvdb.org/39791; http://secunia.com/advisories/28263
CVE: CVE-2007-6560
Published: 2007-12-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Logaholic before 2.0 RC8 allow remote attackers to inject arbitrary web script or HTML via (1) the newconfname parameter to profiles.php or (2) the conf parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/39792; http://osvdb.org/39793; http://secunia.com/advisories/28263
CVE: CVE-2007-6561
Published: 2007-12-28
Description: Multiple stack-based buffer overflows in PDFLib allow user-assisted remote attackers to execute arbitrary code via a long filename argument to the PDF_load_image function that results in an overflow in the pdc_fsearch_fopen function, and possibly other vectors.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/40275; http://secunia.com/advisories/28239; http://secunia.com/advisories/29304
CVE: CVE-2007-6562
Published: 2007-12-28
Description: Multiple stack-based buffer overflows in the use of FD_SET in TCPreen before 1.4.4 allow remote attackers to cause a denial of service via multiple concurrent connections, which result in overflows in the (1) SocketAddress::Connect function in libsolve/sockprot.cpp and (2) monitor_bridge function in src/bridge.cpp.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://anonsvn.remlab.net/svn/tcpreen/tags/1.4.4/NEWS; http://osvdb.org/40317; http://osvdb.org/40318
CVE: CVE-2007-6563
Published: 2007-12-28
Description: Heap-based buffer overflow in WinAce 2.65 and earlier, and possibly other versions before 2.69, allows user-assisted remote attackers to execute arbitrary code via a long filename in a compressed UUE archive.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://jvndb.jvn.jp/contents/ja/2007/JVNDB-2007-000822.html; http://osvdb.org/40267
CVE: CVE-2007-6564
Published: 2007-12-28
Description: Cross-site scripting (XSS) vulnerability in admin.php in Limbo CMS 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML via the com_option parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28190; http://www.digitrustgroup.com/advisories/web-application-security-limbo-cms.html; http://www.osvdb.org/39642
CVE: CVE-2007-6565
Published: 2007-12-28
Description: Multiple SQL injection vulnerabilities in Blakord Portal 1.3.A Beta and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to an arbitrary component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3497; http://www.securityfocus.com/archive/1/485544/100/0/threaded; http://www.securityfocus.com/bid/27038
CVE: CVE-2007-6566
Published: 2007-12-28
Description: SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://en.rstzone.org/xzero-community-classifieds-v4-95-11-lfi-sql-in-t9394.rst; http://osvdb.org/39740; http://secunia.com/advisories/28250
CVE: CVE-2007-6567
Published: 2007-12-28
Description: Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagename parameter in a page view action.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://en.rstzone.org/xzero-community-classifieds-v4-95-11-lfi-sql-in-t9394.rst; http://osvdb.org/39741; http://www.securityfocus.com/archive/1/485545/100/0/threaded
CVE: CVE-2007-6568
Published: 2007-12-28
Description: PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path_escape parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/39742; http://www.securityfocus.com/bid/27040; https://exchange.xforce.ibmcloud.com/vulnerabilities/39258
CVE: CVE-2007-6569
Published: 2007-12-28
Description: Cross-site scripting (XSS) vulnerability in the View Error Log functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566246.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.sun.com/app/docs/doc/820-2499/aeaaa?a=view; http://secunia.com/advisories/28186; http://secunia.com/advisories/28216
CVE: CVE-2007-6570
Published: 2007-12-28
Description: Cross-site scripting (XSS) vulnerability in the View URL Database functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 and 3.x before 3.6 SP11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566309.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.sun.com/app/docs/doc/820-2499/aeaaa?a=view; http://docs.sun.com/source/820-3637-10/relnotes36sp11_unix.html#wp19247; http://osvdb.org/40851
CVE: CVE-2007-6571
Published: 2007-12-28
Description: Cross-site scripting (XSS) vulnerability in Sun Java System Web Proxy Server 3.6 before SP11 on Windows allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6611356.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28216; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103002-1; http://www.securityfocus.com/bid/26978
CVE: CVE-2007-6572
Published: 2007-12-28
Description: Cross-site scripting (XSS) vulnerability in Sun Java System Web Server 6.1 before SP8 and 7.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566204.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28216; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103002-1; http://www.securityfocus.com/bid/26978
CVE: CVE-2007-6573
Published: 2007-12-28
Description: QK SMTP Server 3 allows remote attackers to cause a denial of service (daemon crash) via a long (1) HELO, (2) MAIL FROM, or (3) RCPT TO command; or (4) a long string in the message sent after the DATA command; possibly a related issue to CVE-2006-5551.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/43533; http://securityreason.com/securityalert/3494; http://www.securityfocus.com/archive/1/485026/100/100/threaded
CVE: CVE-2007-6574
Published: 2007-12-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the origin parameter to work/work.php in a display_upload_form action, or the forum parameter to (2) forum/viewforum.php or (3) forum/viewthread.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/39771; http://osvdb.org/39772; http://osvdb.org/39773
CVE: CVE-2007-6575
Published: 2007-12-28
Description: SQL injection vulnerability in default.php in MMSLamp allows remote attackers to execute arbitrary SQL commands via the idpro parameter in a prodotti_dettaglio action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39761; http://www.securityfocus.com/bid/26995; https://exchange.xforce.ibmcloud.com/vulnerabilities/39220
CVE: CVE-2007-6576
Published: 2007-12-28
Description: Multiple SQL injection vulnerabilities in Adult Script 1.6.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) videolink_count.php or (2) links.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39621; http://osvdb.org/39622; http://secunia.com/advisories/28165