deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-3130
Published: 2007-06-08
Description: Multiple PHP remote file inclusion vulnerabilities in the OpenWiki (formerly JD-Wiki) component (com_jd-wiki) 1.0.2, and possibly earlier, for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) dwpage.php or (2) wantedpages.php, different vectors than CVE-2006-4074.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/37472; http://osvdb.org/37473; http://www.securityfocus.com/bid/24342
CVE: CVE-2007-3131
Published: 2007-06-08
Description: Cross-site scripting (XSS) vulnerability in add_comment.php in Light Blog 4.1 before 20070606 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/25561; http://securityreason.com/securityalert/2783; http://www.securityfocus.com/archive/1/470673/100/0/threaded
CVE: CVE-2007-3132
Published: 2007-06-08
Description: Multiple vulnerabilities in Symantec Ghost Solution Suite 2.0.0 and earlier, with Ghost 8.0.992 and possibly other versions, allow remote attackers to cause a denial of service (client or server crash) via malformed requests to the daemon port, 1346/udp or 1347/udp.
CVSS Score: 5.0 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=540; http://osvdb.org/36106; http://secunia.com/advisories/25539
CVE: CVE-2007-3133
Published: 2007-06-08
Description: SQL injection vulnerability in urunbak.asp in W1L3D4 WEBmarket 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36308; http://secunia.com/advisories/25585; http://securityreason.com/securityalert/2782
CVE: CVE-2007-3134
Published: 2007-06-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in atomPhotoBlog.php in Atom PhotoBlog 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Your Name, (2) Your Homepage, and (3) Your Comment fields, when using "Approve Comments."
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37046; http://secunia.com/advisories/25562; http://sourceforge.net/project/shownotes.php?group_id=186464&release_id=514101
CVE: CVE-2007-3135
Published: 2007-06-08
Description: Cross-site scripting (XSS) vulnerability in atomPhotoBlog.php in Atom Photoblog 1.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tag parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37046; http://secunia.com/advisories/25562; http://securityreason.com/securityalert/2787
CVE: CVE-2007-3136
Published: 2007-06-08
Description: PHP remote file inclusion vulnerability in inc/nuke_include.php in newsSync 1.5.0rc6 allows remote attackers to execute arbitrary PHP code via a URL in the newsSync_NUKE_PATH parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37456; http://www.securityfocus.com/bid/24361; https://exchange.xforce.ibmcloud.com/vulnerabilities/34761
CVE: CVE-2007-3137
Published: 2007-06-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in 4print.asp in WmsCMS 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) sbl, (2) sbr, or (3) search parameter. NOTE: the original disclosure claims the pageid parameter in index.php is affected, but this is incorrect.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/37144; http://secunia.com/advisories/25583; http://securityreason.com/securityalert/2789
CVE: CVE-2007-3138
Published: 2007-06-08
Description: Directory traversal vulnerability in index.php in Open Solution Quick.Cart 2.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in an sLanguage cookie, which is used to define a value in config/general.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36960; http://secunia.com/advisories/25513; http://www.securityfocus.com/bid/24299
CVE: CVE-2007-3139
Published: 2007-06-08
Description: config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to access the application via a login action to admin.php.  NOTE: this can be leveraged to upload and execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36961; http://secunia.com/advisories/25513; https://exchange.xforce.ibmcloud.com/vulnerabilities/34688
CVE: CVE-2007-3140
Published: 2007-06-08
Description: SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/36321; http://secunia.com/advisories/25552; http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.021.html
CVE: CVE-2007-1685
Published: 2007-06-08
Description: Buffer overflow in k9filter.exe in BlueCoat K9 Web Protection 3.2.36, and probably other versions before 3.2.44, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request to port 2372.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0190.html; http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063848.html; http://osvdb.org/37186
CVE: CVE-2007-3141
Published: 2007-06-11
Description: PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 allows remote attackers to execute arbitrary PHP code via a URL in the editor_insert_top parameter.  NOTE: the editor_insert_bottom vector is already covered by CVE-2006-6042.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2786; http://www.securityfocus.com/archive/1/470794/100/0/threaded; http://securityreason.com/securityalert/2786
CVE: CVE-2007-3142
Published: 2007-06-11
Description: Visual truncation vulnerability in Opera 9.21 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after 34 characters, as demonstrated by a phishing attack using HTTP Basic Authentication.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/43463; http://secunia.com/advisories/26545; http://security.gentoo.org/glsa/glsa-200708-17.xml
CVE: CVE-2007-3143
Published: 2007-06-11
Description: Visual truncation vulnerability in Konqueror 3.5.5 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after a certain number of characters, as demonstrated by a phishing attack using HTTP Basic Authentication.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/43465; http://testing.bitsploit.de/test.html; http://www.0x000000.com/?i=334
CVE: CVE-2007-3144
Published: 2007-06-11
Description: Visual truncation vulnerability in Mozilla 1.7.12 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after a certain number of characters, as demonstrated by a phishing attack using HTTP Basic Authentication.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/43466; http://testing.bitsploit.de/test.html; http://www.0x000000.com/?i=334
CVE: CVE-2007-3145
Published: 2007-06-11
Description: Visual truncation vulnerability in Galeon 2.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after a certain number of characters, as demonstrated by a phishing attack using HTTP Basic Authentication.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/43467; http://testing.bitsploit.de/test.html; http://www.0x000000.com/?i=334
CVE: CVE-2007-3146
Published: 2007-06-11
Description: Zen Help Desk 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing a password via a direct request for ZenHelpDesk.mdb.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/39231; http://securityreason.com/securityalert/2788; http://www.securityfocus.com/archive/1/470803/100/0/threaded
CVE: CVE-2007-3147
Published: 2007-06-11
Description: Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the send method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063817.html; http://messenger.yahoo.com/security_update.php?id=060707; http://research.eeye.com/html/advisories/published/AD20070608.html
CVE: CVE-2007-3148
Published: 2007-06-11
Description: Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the receive method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063819.html; http://messenger.yahoo.com/security_update.php?id=060707; http://osvdb.org/37081
CVE: CVE-2007-3149
Published: 2007-06-11
Description: sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings.  NOTE: another researcher disputes this vulnerability, stating that the attacker must be "a user, who can already log into your system, and can already use sudo."
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/26540; http://www.securityfocus.com/archive/1/470739/100/0/threaded; http://www.securityfocus.com/archive/1/470752/100/0/threaded
CVE: CVE-2006-3974
Published: 2007-06-11
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/admin in 3Com OfficeConnect Secure Router with firmware 1.04-168 allows remote attackers to inject arbitrary web script or HTML via the tk parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/36888; http://secunia.com/advisories/21255; http://secunia.com/secunia_research/2006-60/advisory/
CVE: CVE-2007-3150
Published: 2007-06-11
Description: Google Desktop allows user-assisted remote attackers to execute arbitrary programs via a man-in-the-middle attack that injects JavaScript, a www.google.com search IFRAME, and a META HTTP-EQUIV="refresh" that targets a www.google.com search for a local .exe file, which is displayed in the "results stored on your computer" portion of the search results, and when clicked invokes Google Desktop to execute this file.
CVSS Score: 9.3 (HIGH)
References: http://ha.ckers.org/blog/20070531/google-desktop-0day/; http://ha.ckers.org/google-desktop-0day/; http://osvdb.org/40566
CVE: CVE-2007-2875
Published: 2007-06-11
Description: Integer underflow in the cpuset_tasks_read function in the Linux kernel before 2.6.20.13, and 2.6.21.x before 2.6.21.4, when the cpuset filesystem is mounted, allows local users to obtain kernel memory contents by using a large offset when reading the /dev/cpuset/tasks file.
CVSS Score: 2.1 (LOW)
CWE: CWE-189
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.13; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.21.4; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=541
CVE: CVE-2007-2920
Published: 2007-06-11
Description: Multiple stack-based buffer overflows in the Zoomify Viewer ActiveX control in ZActiveX.dll might allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/37207; http://secunia.com/advisories/25625; http://www.kb.cert.org/vuls/id/174177
CVE: CVE-2007-3151
Published: 2007-06-11
Description: rpttop.htm in the web management interface in Packeteer PacketShaper 7.3.0g2 and 7.5.0g1 allows remote attackers to cause a denial of service (device reboot) via a request with empty values of the OP.MEAS.DATAQUERY and MEAS.TYPE parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/37230; http://secunia.com/advisories/25577; http://securityreason.com/securityalert/2801
CVE: CVE-2007-3152
Published: 2007-06-11
Description: c-ares before 1.4.0 uses a predictable seed for the random number generator for the DNS Transaction ID field, which might allow remote attackers to spoof DNS responses by guessing the field value.
CVSS Score: 7.5 (HIGH)
References: http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup; http://osvdb.org/37171; http://secunia.com/advisories/25579
CVE: CVE-2007-3153
Published: 2007-06-11
Description: The ares_init:randomize_key function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence (Unix rand), which makes it easier for remote attackers to spoof DNS responses by guessing certain values.
CVSS Score: 5.0 (MEDIUM)
References: http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup; http://osvdb.org/37172; http://www.securityfocus.com/bid/24386
CVE: CVE-2007-3154
Published: 2007-06-11
Description: Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packages, has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/37187; http://secunia.com/advisories/25454; http://sourceforge.net/project/shownotes.php?release_id=513311&group_id=78745
CVE: CVE-2007-3155
Published: 2007-06-11
Description: Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack vectors related to ADOdb.  NOTE: due to lack of details from the vendor, it is uncertain whether this issue is already covered by another CVE identifier.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/37188; http://secunia.com/advisories/25454; http://sourceforge.net/project/shownotes.php?release_id=513311&group_id=78745
CVE: CVE-2007-3156
Published: 2007-06-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in pam_login.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) message, or (3) question parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/36932; http://secunia.com/advisories/25580; http://secunia.com/advisories/25785
CVE: CVE-2007-3157
Published: 2007-06-11
Description: IPSecDrv.sys 10.4.0.12 in SafeNET High Assurance Remote 1.4.0 Build 12, and SoftRemote, allows remote attackers to cause a denial of service (infinite loop and system hang) via an invalid packet with certain bytes in an option header, possibly related to the IPv6 support for IPSec.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063859.html; http://osvdb.org/37137; http://secunia.com/advisories/25574
CVE: CVE-2007-3158
Published: 2007-06-11
Description: download_script.asp in ASP Folder Gallery allows remote attackers to read arbitrary files via a filename in the file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/38372; http://securityreason.com/securityalert/2793; http://www.securityfocus.com/archive/1/470667/100/0/threaded
CVE: CVE-2007-3159
Published: 2007-06-11
Description: http.c in MiniWeb Http Server 0.8.x allows remote attackers to cause a denial of service (application crash) via a negative value in the Content-Length HTTP header.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/37185; http://secunia.com/advisories/25528; http://www.securityfocus.com/bid/24375
CVE: CVE-2007-3160
Published: 2007-06-11
Description: PHP remote file inclusion vulnerability in admin/header.php in PHP Real Estate Classifieds Premium Plus allows remote attackers to execute arbitrary PHP code via a URL in the loc parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36890; http://secunia.com/advisories/25615; http://www.securityfocus.com/bid/24399
CVE: CVE-2007-3161
Published: 2007-06-11
Description: Buffer overflow in Ace-FTP Client 1.24a allows user-assisted, remote FTP servers to execute arbitrary code via a long response.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/24403; https://exchange.xforce.ibmcloud.com/vulnerabilities/34795; https://www.exploit-db.com/exploits/4058
CVE: CVE-2007-3162
Published: 2007-06-11
Description: Buffer overflow in the NotSafe function in the idaiehlp ActiveX control in idaiehlp.dll 1.9.1.74 in Internet Download Accelerator (ida) 5.2 allows remote attackers to cause a denial of service (Internet Explorer crash) via a long argument.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/40120; http://seclists.org/bugtraq/2010/Sep/76; http://www.exploit-db.com/exploits/14938
CVE: CVE-2007-3163
Published: 2007-06-11
Description: Incomplete blacklist vulnerability in the filemanager in Frederico Caldeira Knabben FCKeditor 2.4.2 allows remote attackers to upload arbitrary .php files via an alternate data stream syntax, as demonstrated by .php::$DATA filenames, a related issue to CVE-2006-0658.
CVSS Score: 5.0 (MEDIUM)
References: http://ha.ckers.org/blog/20070606/additional-image-bypass-on-windows/; http://osvdb.org/37554; http://secunia.com/advisories/25719
CVE: CVE-2007-3164
Published: 2007-06-11
Description: Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if the user misinterprets confusable characters in the internationalized labels, as demonstrated by displaying xn--theshmogroup-bgk.com only in the status bar.
CVSS Score: 5.8 (MEDIUM)
References: http://ha.ckers.org/blog/20070608/cross-domain-basic-auth-phishing-tactics/; http://osvdb.org/36142; http://secunia.com/advisories/25663
CVE: CVE-2007-3165
Published: 2007-06-11
Description: Tor before 0.1.2.14 can construct circuits in which an entry guard is in the same family as the exit node, which might compromise the anonymity of traffic sources and destinations by exposing traffic to inappropriate remote observers.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.seul.org/or/announce/May-2007/msg00000.html; http://osvdb.org/35670; http://secunia.com/advisories/25415
CVE: CVE-2007-3166
Published: 2007-06-11
Description: Buffer overflow in Qualcomm Eudora 7.1.0.9 allows user-assisted, remote IMAP servers to execute arbitrary code via a long FLAGS response to a SELECT INBOX command.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/36197; http://www.securityfocus.com/bid/24251; https://exchange.xforce.ibmcloud.com/vulnerabilities/34625
CVE: CVE-2007-3167
Published: 2007-06-11
Description: Stack-based buffer overflow in the Vivotek Motion Jpeg ActiveX control (aka MjpegControl) in MjpegDecoder.dll 2.0.0.13 allows remote attackers to execute arbitrary code via a long PtzUrl property value.
CVSS Score: 7.6 (HIGH)
References: http://osvdb.org/39230; http://www.securityfocus.com/bid/24245; https://exchange.xforce.ibmcloud.com/vulnerabilities/34615
CVE: CVE-2007-3168
Published: 2007-06-11
Description: A certain ActiveX control in the EDraw Office Viewer Component (edrawofficeviewer.ocx) 4.0.5.20, and other versions before 5.0, allows remote attackers to delete arbitrary files via the DeleteLocalFile method.
CVSS Score: 7.8 (HIGH)
References: http://moaxb.blogspot.com/2007/05/moaxb-28-edraw-office-viewer-component.html; http://osvdb.org/36044; http://secunia.com/advisories/25418
CVE: CVE-2007-3169
Published: 2007-06-11
Description: Buffer overflow in a certain ActiveX control in the EDraw Office Viewer Component (edrawofficeviewer.ocx) 4.0.5.20, and other versions before 5.0, allows remote attackers to cause a denial of service (Internet Explorer 7 crash) or execute arbitrary code via a long first argument to the HttpDownloadFile method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://moaxb.blogspot.com/2007/05/moaxb-29-edraw-office-viewer-component.html; http://osvdb.org/36045; http://secunia.com/advisories/25418
CVE: CVE-2007-3170
Published: 2007-06-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to redirect.php or (2) the selected_theme parameter to demo/pop3/error.php.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063629.html; http://osvdb.org/37463; http://osvdb.org/37464
CVE: CVE-2007-3171
Published: 2007-06-11
Description: Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the (1) smarty or (2) selected_theme parameter, which reveals the path in various error messages.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063629.html; http://osvdb.org/38337; http://www.securityfocus.com/bid/24210
CVE: CVE-2007-3172
Published: 2007-06-11
Description: Directory traversal vulnerability in demo/pop3/error.php in Uebimiau Webmail allows remote attackers to determine the existence of arbitrary directories via an absolute pathname and .. (dot dot) in the selected_theme parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063629.html; http://osvdb.org/38337; http://www.securityfocus.com/bid/24210
CVE: CVE-2007-3173
Published: 2007-06-11
Description: Almnzm allows remote attackers to obtain sensitive information via an activateorder request to index.php with an invalid orderid parameter, probably related to '[' and ']' characters.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/38338; http://www.securityfocus.com/archive/1/469911/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/34574
CVE: CVE-2007-3174
Published: 2007-06-11
Description: Cross-site scripting (XSS) vulnerability in auth.w2b in W2B Online Banking allows remote attackers to inject arbitrary web script or HTML via the adtype parameter, a different vector than CVE-2006-1980.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/37465; http://pridels-team.blogspot.com/2007/05/w2b-online-banking-vuln.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/34594
CVE: CVE-2007-3175
Published: 2007-06-11
Description: Multiple SQL injection vulnerabilities in W2B Online Banking allow remote attackers to execute arbitrary SQL commands via (1) the draft parameter to mailer.w2b or (2) the listDocPay parameter to DocPay.w2b.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37466; http://osvdb.org/37467; http://pridels-team.blogspot.com/2007/05/w2b-online-banking-vuln.html
CVE: CVE-2007-3176
Published: 2007-06-11
Description: Unspecified vulnerability in Ingate Firewall and SIParator before 4.5.2 allows remote authenticated users without full privileges to download a Support Report.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/36707; http://secunia.com/advisories/25420; http://www.ingate.com/relnote-452.php
CVE: CVE-2007-3177
Published: 2007-06-11
Description: Ingate Firewall and SIParator before 4.5.2 allow remote attackers to bypass SIP authentication via a certain maddr parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/36708; http://secunia.com/advisories/25420; http://www.ingate.com/relnote-452.php
CVE: CVE-2007-3178
Published: 2007-06-11
Description: Multiple SQL injection vulnerabilities in Zindizayn Okul Web Sistemi 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) pass parameter to (a) mezungiris.asp or (b) ogretmenkontrol.asp.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/38348; http://osvdb.org/38349; http://securityreason.com/securityalert/2798