deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1716
Published: 2007-03-27
Description: pam_console does not properly restore ownership for certain console devices when there are multiple users logged into the console and one user logs out, which might allow local users to gain privileges.
CVSS Score: 3.4 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://osvdb.org/37271
CVE: CVE-2006-7175
Published: 2007-03-27
Description: The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not allow the administrator to disable SSLv2 encryption, which could cause less secure channels to be used than desired.
CVSS Score: 7.5 (HIGH)
References: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=172352; https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=172352
CVE: CVE-2006-7176
Published: 2007-03-27
Description: The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not reject the "localhost.localdomain" domain name for e-mail messages that come from external hosts, which might allow remote attackers to spoof messages.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/25098; http://secunia.com/advisories/25743; http://support.avaya.com/elmodocs2/security/ASA-2007-248.htm
CVE: CVE-2007-1717
Published: 2007-03-28
Description: The mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 truncates e-mail messages at the first ASCIIZ ('\0') byte, which might allow context-dependent attackers to prevent intended information from being delivered in e-mail messages.  NOTE: this issue might be security-relevant in cases when the trailing contents of e-mail messages are important, such as logging information or if the message is expected to be well-formed.
CVSS Score: 5.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=306172; http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html; http://secunia.com/advisories/25056
CVE: CVE-2007-1718
Published: 2007-03-28
Description: CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the (1) Subject or (2) To parameter, as demonstrated by a parameter containing a "\r\n\t\n" sequence, related to an increment bug in the SKIP_LONG_HEADER_SEP macro.
CVSS Score: 7.8 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2007-0155.html; http://secunia.com/advisories/24909; http://secunia.com/advisories/24924
CVE: CVE-2007-1719
Published: 2007-03-28
Description: Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on FreeBSD, and possibly other versions, allows local users to execute arbitrary code via a long command line argument, possibly involving the device name.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/24641; http://www.vupen.com/english/advisories/2007/1125; https://exchange.xforce.ibmcloud.com/vulnerabilities/33212
CVE: CVE-2007-1720
Published: 2007-03-28
Description: Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/36572; http://secunia.com/advisories/24697; http://www.securityfocus.com/bid/23156
CVE: CVE-2007-1721
Published: 2007-03-28
Description: Multiple PHP remote file inclusion vulnerabilities in C-Arbre 0.6PR7 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) Richtxt_functions.inc.php, (2) adddocfile.php, (3) auth_check.php, (4) browse_current_category.inc.php, (5) docfile_details.php, (6) main.php, (7) mainarticle.php, (8) maindocfile.php, (9) modify.php, (10) new.php, (11) resource_details.php, or (12) smallsearch.php in lib/; or (13) mwiki/LocalSettings.php.
CVSS Score: 10.0 (HIGH)
References: http://advisories.echo.or.id/adv/adv78-K-159-2007.txt; http://securityreason.com/securityalert/2491; http://www.securityfocus.com/archive/1/463925/100/0/threaded
CVE: CVE-2007-1722
Published: 2007-03-28
Description: Buffer overflow in the DownloadCertificateExt function in SignKorea SKCommAX ActiveX control module 7.2.0.2 and 3280 6.6.0.1 allows remote attackers to execute arbitrary code via a long pszUserID argument.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8827&w=2; http://secunia.com/advisories/24587; http://www.securityfocus.com/bid/23149
CVE: CVE-2007-1723
Published: 2007-03-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administration console in Secure Computing CipherTrust IronMail 6.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) network, (2) defRouterIp, (3) hostName, (4) domainName, (5) ipAddress, (6) defaultRouter, (7) dns1, or (8) dns2 parameter to (a) admin/system_IronMail.do; the (9) ipAddress parameter to (b) admin/systemOutOfBand.do; the (10) password or (11) confirmPassword parameter to (c) admin/systemBackup.do; the (12) Klicense parameter to (d) admin/systemLicenseManager.do; the (13) rows[1].attrValueStr or (14) rows[2].attrValueStr parameter to (e) admin/systemWebAdminConfig.do; the (15) rows[0].attrValueStr, rows[1].attrValueStr, (16) rows[2].attrValue, or (17) rows[2].attrValueStrClone parameter to (f) admin/ldap_ConfigureServiceProperties.do; the (18) input1 parameter to (g) admin/mailFirewall_MailRoutingInternal.do; or the (19) rows[2].attrValueStr, (20) rows[3].attrValueStr, (21) rows[5].attrValueStr, or (22) rows[6].attrValueStr parameter to (h) admin/mailIdsConfig.do.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/34526; http://osvdb.org/34527; http://osvdb.org/34528
CVE: CVE-2007-1724
Published: 2007-03-28
Description: Unspecified vulnerability in ReactOS 0.3.1 has unknown impact and attack vectors, related to a fix for "dozens of win32k bugs and failures," in which the fix itself introduces a vulnerability, possibly related to user-mode and kernel-mode copy failures.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/43446; http://www.reactos.org/wiki/index.php/ChangeLog-0.3.1; http://osvdb.org/43446
CVE: CVE-2007-1725
Published: 2007-03-28
Description: SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL commands via the filename of an uploaded file to the avatar function, as demonstrated by setting admin privileges.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/34497; http://secunia.com/advisories/24644; http://www.securityfocus.com/bid/23158
CVE: CVE-2007-1726
Published: 2007-03-28
Description: Unrestricted file upload vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to upload arbitrary files via the avatar function, which can later be accessed in uploads/.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/34498; http://secunia.com/advisories/24644; http://www.securityfocus.com/bid/23151
CVE: CVE-2007-1727
Published: 2007-03-28
Description: Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, 7.50, and 7.51 allows remote authenticated users to access certain privileged "facilities" via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/24746; http://www.securityfocus.com/bid/23163; http://www.securitytracker.com/id?1017817
CVE: CVE-2007-1728
Published: 2007-03-28
Description: The Remote Play feature in Sony Playstation 3 (PS3) 1.60 and Playstation Portable (PSP) 3.10 OE-A allows remote attackers to cause a denial of service via a flood of UDP packets.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/35184; http://securityreason.com/securityalert/2485; http://www.securityfocus.com/archive/1/463847/100/0/threaded
CVE: CVE-2007-1729
Published: 2007-03-28
Description: SQL injection vulnerability in includes/start.php in Flexbb 1.0.0 10005 Beta Release 1 allows remote attackers to execute arbitrary SQL commands via the flexbb_lang_id COOKIE parameter to index.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2486; http://www.kapda.ir/advisory-481.html; http://www.securityfocus.com/archive/1/463917/100/0/threaded
CVE: CVE-2007-1730
Published: 2007-03-28
Description: Integer signedness error in the DCCP support in the do_dccp_getsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later allows local users to read kernel memory or cause a denial of service (oops) via a negative optlen value.
CVSS Score: 6.6 (MEDIUM)
References: http://marc.info/?l=dccp&m=[PII_REDACTED]6267&w=2; http://secunia.com/advisories/25392; http://securityreason.com/securityalert/2482
CVE: CVE-2007-1731
Published: 2007-03-28
Description: Multiple stack-based buffer overflows in High Performance Anonymous FTP Server (hpaftpd) 1.01 allow remote attackers to execute arbitrary code via long arguments to the (1) USER, (2) PASS, (3) CWD, (4) MKD, (5) RMD, (6) DELE, (7) RNFR, or (8) RNTO FTP command.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/35182; http://www.securiteam.com/securitynews/5AP0L1PKUU.html; http://www.securityfocus.com/bid/23147
CVE: CVE-2007-1732
Published: 2007-03-28
Description: Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators.  However, it has been patched by at least one vendor
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://codex.wordpress.org/Roles_and_Capabilities; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0382&w=2; http://osvdb.org/33884
CVE: CVE-2007-1675
Published: 2007-03-28
Description: Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service via a long username.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/24633; http://www-1.ibm.com/support/docview.wss?uid=swg21257028; http://www.securityfocus.com/bid/23172
CVE: CVE-2007-1733
Published: 2007-03-28
Description: Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 allows remote attackers to execute arbitrary code via a long (1) /cgi-bin/ or (2) /cgi/ pathname in an HTTP GET request, probably a different issue than CVE-2006-5112.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34503; http://secunia.com/advisories/24673; http://securityreason.com/securityalert/2483
CVE: CVE-2007-1734
Published: 2007-03-28
Description: The DCCP support in the do_dccp_getsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later does not verify the upper bounds of the optlen value, which allows local users running on certain architectures to read kernel memory or cause a denial of service (oops), a related issue to CVE-2007-1730.
CVSS Score: 7.2 (HIGH)
References: http://securityreason.com/securityalert/2511; http://www.securityfocus.com/archive/1/463969/100/0/threaded; http://www.securitytracker.com/id?1017820
CVE: CVE-2007-1735
Published: 2007-03-28
Description: Stack-based buffer overflow in Corel WordPerfect Office X3 (13.0.0.565) allows user-assisted remote attackers to execute arbitrary code via a long printer selection (PRS) name in a Wordperfect document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/24664; http://securityreason.com/securityalert/2489; http://www.nop-art.net/advisories/wpwinX3.txt
CVE: CVE-2007-1736
Published: 2007-03-28
Description: Mozilla Firefox 2.0.0.3 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows remote attackers to bypass phishing protection.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2488; http://www.securityfocus.com/archive/1/464041/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33487
CVE: CVE-2007-1737
Published: 2007-03-28
Description: Opera 9.10 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows remote attackers to bypass phishing protection.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2488; http://www.securityfocus.com/archive/1/464041/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33488
CVE: CVE-2007-1738
Published: 2007-03-28
Description: TrueCrypt 4.3, when installed setuid root, allows local users to cause a denial of service (filesystem unavailability) or gain privileges by mounting a crafted TrueCrypt volume, as demonstrated using (1) /usr/bin or (2) another user's home directory, a different issue than CVE-2007-1589.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/24643; http://securityreason.com/securityalert/2492; http://www.securityfocus.com/archive/1/464064/100/0/threaded
CVE: CVE-2007-1739
Published: 2007-03-28
Description: Heap-based buffer overflow in the LDAP server in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service (crash) via a long, malformed DN request, which causes only the lower 16 bits of the string length to be used in memory allocation.
CVSS Score: 7.8 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=494; http://secunia.com/advisories/24633; http://www-1.ibm.com/support/docview.wss?uid=swg21257248
CVE: CVE-2007-1740
Published: 2007-03-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-4843.  Reason: This candidate is a duplicate of CVE-2006-4843.  Notes: All CVE users should reference CVE-2006-4843 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-4843
Published: 2007-03-29
Description: Cross-site scripting (XSS) vulnerability in the Active Content Filter feature in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified "code sequences" that bypass the protection scheme.
CVSS Score: 4.3 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=493; http://secunia.com/advisories/24633; http://www-1.ibm.com/support/docview.wss?uid=swg21257026
CVE: CVE-2007-1349
Published: 2007-03-30
Description: PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://rhn.redhat.com/errata/RHSA-2007-0395.html; http://rhn.redhat.com/errata/RHSA-2008-0630.html
CVE: CVE-2007-1677
Published: 2007-03-30
Description: Multiple buffer overflows in the ISO network protocol support in the NetBSD kernel 2.0 through 4.0_BETA2, and NetBSD-current before 20070329, allow local users to execute arbitrary code via long parameters to certain functions, as demonstrated by a long sockaddr structure argument to the clnp_route function.
CVSS Score: 6.6 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-004.txt.asc; http://osvdb.org/43596; http://www.securityfocus.com/bid/23193
CVE: CVE-2007-1762
Published: 2007-03-30
Description: Mozilla Firefox 2.0.0.1 through 2.0.0.3 does not canonicalize URLs before checking them against the phishing site blacklist, which allows remote attackers to bypass phishing protection via multiple / (slash) characters in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34535; http://www.securityfocus.com/archive/1/464149/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33486
CVE: CVE-2007-1763
Published: 2007-03-30
Description: The ATI kernel driver (atikmdag.sys) in Microsoft Windows Vista allows user-assisted remote attackers to cause a denial of service (crash) via a crafted JPG image, as demonstrated by a slideshow, possibly due to a buffer overflow.
CVSS Score: 7.1 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0077.html; http://leovilletownsquare.com/fusionbb/showtopic.php?fid/27/tid/17600/; http://secunia.com/advisories/24667
CVE: CVE-2007-1764
Published: 2007-03-30
Description: Stack-based buffer overflow in FastStone Image Viewer 2.8 allows user-assisted remote attackers to execute arbitrary code via a crafted JPG image.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/42054; http://securityreason.com/securityalert/2510; http://www.securityfocus.com/archive/1/464148/100/0/threaded
CVE: CVE-2007-1765
Published: 2007-03-30
Description: Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7.  NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.
CVSS Score: 9.3 (HIGH)
References: http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you/; http://research.eeye.com/html/alerts/zeroday/20070328.html; http://vil.nai.com/vil/content/v_141860.htm
CVE: CVE-2007-1766
Published: 2007-03-30
Description: PHP remote file inclusion vulnerability in login/engine/db/profiledit.php in Advanced Login 0.76 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/34587; http://secunia.com/advisories/24695; http://securityreason.com/securityalert/2508
CVE: CVE-2007-1767
Published: 2007-03-30
Description: Unspecified vulnerability in (1) Deskbar.dll and (2) Toolbar.dll in AOL 9.0 before February 2007 allows remote attackers to cause a denial of service (browser crash) via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2007-03/0392.html; http://osvdb.org/35207; https://exchange.xforce.ibmcloud.com/vulnerabilities/33309
CVE: CVE-2006-7177
Published: 2007-03-30
Description: MadWifi, when Ad-Hoc mode is used, allows remote attackers to cause a denial of service (system crash) via unspecified vectors that lead to a kernel panic in the ieee80211_input function, related to "packets coming from a 'malicious' WinXP system."
CVSS Score: 7.8 (HIGH)
References: http://madwifi.org/ticket/880; http://secunia.com/advisories/24841; http://secunia.com/advisories/25861
CVE: CVE-2006-7178
Published: 2007-03-30
Description: MadWifi before 0.9.3 does not properly handle reception of an AUTH frame by an IBSS node, which allows remote attackers to cause a denial of service (system crash) via a certain AUTH frame.
CVSS Score: 7.8 (HIGH)
References: http://madwifi.org/ticket/880; http://madwifi.org/wiki/Releases/0.9.3; http://secunia.com/advisories/24670
CVE: CVE-2006-7179
Published: 2007-03-30
Description: ieee80211_input.c in MadWifi before 0.9.3 does not properly process Channel Switch Announcement Information Elements (CSA IEs), which allows remote attackers to cause a denial of service (loss of communication) via a Channel Switch Count less than or equal to one, triggering a channel change.
CVSS Score: 7.8 (HIGH)
References: http://dev.lintrack.org/ticket/101; http://madwifi.org/ticket/963; http://madwifi.org/wiki/Releases/0.9.3
CVE: CVE-2006-7180
Published: 2007-03-30
Description: ieee80211_output.c in MadWifi before 0.9.3 sends unencrypted packets before WPA authentication succeeds, which allows remote attackers to obtain sensitive information (related to network structure), and possibly cause a denial of service (disrupted authentication) and conduct spoofing attacks.
CVSS Score: 6.8 (MEDIUM)
References: http://madwifi.org/ticket/967; http://madwifi.org/wiki/Releases/0.9.3; http://secunia.com/advisories/24670
CVE: CVE-2007-1768
Published: 2007-03-30
Description: Cross-site scripting (XSS) vulnerability in app/helpers/application_helper.rb in Mephisto 0.7.3 and Mephisto Edge 20070325 allows remote attackers to inject arbitrary web script or HTML via the author name field in a comment.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35309; http://securityreason.com/securityalert/2490; http://www.securityfocus.com/archive/1/463825/100/0/threaded
CVE: CVE-2007-1769
Published: 2007-03-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-1873.  Reason: This candidate is a duplicate of CVE-2007-1873.  Notes: All CVE users should reference CVE-2007-1873 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2007-1770
Published: 2007-03-30
Description: Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when using three tiered ArcSDE configurations, allows remote attackers to cause a denial of service (giomgr crash) and execute arbitrary code via long parameters in crafted requests.
CVSS Score: 10.0 (HIGH)
CWE: CWE-120
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=507; http://secunia.com/advisories/24639; http://support.esri.com/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=19&MetaID=1260
CVE: CVE-2007-1771
Published: 2007-03-30
Description: PHP remote file inclusion vulnerability in manage/javascript/formjavascript.php in Ay System Solutions Web Content System (WCS) 2.7.1 allows remote attackers to execute arbitrary PHP code via a URL in the path[JavascriptEdit] parameter.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/34500; http://secunia.com/advisories/24663; http://www.securityfocus.com/bid/23171
CVE: CVE-2007-1772
Published: 2007-03-30
Description: The FTP service in HP JetDirect print servers allows remote attackers to cause a denial of service (engine crash) via a RETR command with a long pathname.
CVSS Score: 7.1 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2302&w=2; http://www.securityfocus.com/bid/23168; https://exchange.xforce.ibmcloud.com/vulnerabilities/33273
CVE: CVE-2007-1773
Published: 2007-03-30
Description: Multiple directory traversal vulnerabilities in aBitWhizzy allow remote attackers to list arbitrary directories via a .. (dot dot) in the d parameter to (1) whizzery/whizzypic.php or (2) whizzery/whizzylink.php, different vectors than CVE-2006-6384.
CVSS Score: 2.6 (LOW)
CWE: CWE-22
References: http://downloads.securityfocus.com/vulnerabilities/exploits/23167.html; http://lostmon.blogspot.com/2007/03/abitwhizzy-traversal-folder-enumeration.html; http://secunia.com/advisories/24679
CVE: CVE-2007-1774
Published: 2007-03-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in aBitWhizzy allow remote attackers to inject arbitrary web script or HTML via the d parameter to (1) whizzery/whizzypic.php or (2) whizzery/whizzylink.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/23167.html; http://lostmon.blogspot.com/2007/03/abitwhizzy-traversal-folder-enumeration.html; http://secunia.com/advisories/24679
CVE: CVE-2007-1775
Published: 2007-03-30
Description: Unrestricted file upload vulnerability in upload.php3 in JBrowser 2.4 and earlier allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/43445; http://www.securityfocus.com/bid/23166; http://osvdb.org/43445