deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-6173
Published: 2007-11-30
Description: Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Enterprise Portal 4.3.1 allows remote attackers to inject arbitrary web script or HTML via the emailAddress parameter in a Send New Password action, a different vector than CVE-2007-6055.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38891; http://secunia.com/advisories/27821; http://secunia.com/advisories/34714
CVE: CVE-2007-6174
Published: 2007-11-30
Description: PHPDevShell before 0.7.0 allows remote authenticated users to gain privileges via a crafted request to update a user profile.  NOTE: some of these details are obtained from third party information.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/27828; http://www.phpdevshell.org/changelog; http://www.securityfocus.com/bid/26615
CVE: CVE-2007-6175
Published: 2007-11-30
Description: Buffer overflow in Lhaplus 1.55 and earlier allows remote attackers to execute arbitrary code via a crafted LZH archive, a different vector than CVE-2007-5048.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://osvdb.org/40583; http://secunia.com/advisories/27734
CVE: CVE-2007-6176
Published: 2007-11-30
Description: kb_whois.cgi in K+B-Bestellsystem (aka KB-Bestellsystem) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) domain or (2) tld parameter in a check_owner action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2874&w=2; http://secunia.com/advisories/27782; http://www.securityfocus.com/bid/26541
CVE: CVE-2007-6177
Published: 2007-11-30
Description: PHP remote file inclusion vulnerability in Exchange/include.php in PHP_CON 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the webappcfg[APPPATH] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/38915; http://secunia.com/advisories/27852; http://www.securityfocus.com/bid/26622
CVE: CVE-2007-6178
Published: 2007-11-30
Description: Multiple PHP remote file inclusion vulnerabilities in Easy Hosting Control Panel for Ubuntu (EHCP) 0.22.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the confdir parameter to (1) dbutil.bck.php and (2) dbutil.php in config/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/26623; https://exchange.xforce.ibmcloud.com/vulnerabilities/38698; https://www.exploit-db.com/exploits/4671
CVE: CVE-2007-6179
Published: 2007-11-30
Description: Multiple PHP remote file inclusion vulnerabilities in Charray's CMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the ccms_library_path parameter to (1) markdown.php and (2) gallery.php in decoder/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/38912; http://osvdb.org/38913; http://secunia.com/advisories/27854
CVE: CVE-2007-6180
Published: 2007-11-30
Description: Race condition in the Remote Procedure Call kernel module (rpcmod) in Sun Solaris 8 through 10 allows local users to cause a denial of service (NULL dereference and panic) via unspecified vectors.
CVSS Score: 7.6 (HIGH)
CWE: CWE-362
References: http://osvdb.org/40821; http://secunia.com/advisories/27831; http://secunia.com/advisories/28057
CVE: CVE-2007-6181
Published: 2007-11-30
Description: Heap-based buffer overflow in cygwin1.dll in Cygwin 1.5.7 and earlier allows context-dependent attackers to execute arbitrary code via a filename with a certain length, as demonstrated by a remote authenticated user who uses the SCP protocol to send a file to the Cygwin machine, and thereby causes scp.exe on this machine to execute, and then overwrite heap memory with characters from the filename. NOTE: it is also reported that a related issue might exist in 1.5.7 through 1.5.19.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://cygwin.com/ml/cygwin-developers/2007-11/msg00005.html; http://cygwin.com/ml/cygwin-developers/2007-11/msg00024.html; http://cygwin.com/ml/cygwin-developers/2007-11/msg00026.html
CVE: CVE-2007-6182
Published: 2007-11-30
Description: The responder program in ISPsystem ISPmanager (aka ISPmgr) 4.2.15.1 allows local users to gain privileges via shell metacharacters in command line arguments.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://ispsystem.com/en/support/changelog/ispmgr.html?all=yes; http://osvdb.org/42337; http://secunia.com/advisories/27585
CVE: CVE-2007-6183
Published: 2007-11-30
Description: Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453689; http://bugs.gentoo.org/show_bug.cgi?id=200623; http://em386.blogspot.com/2007/11/your-favorite-better-than-c-scripting.html
CVE: CVE-2007-6184
Published: 2007-11-30
Description: Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://downloads.sourceforge.net/project-alumni/security-patch-1.0.9.zip?modtime=[PII_REDACTED]&big_mirror=0; http://secunia.com/advisories/27820; http://www.securityfocus.com/bid/26612
CVE: CVE-2007-6185
Published: 2007-11-30
Description: Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a download action, as demonstrated by a certain PHP file containing database credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/39685; http://securityreason.com/securityalert/3408; http://www.securityfocus.com/archive/1/484268/100/0/threaded
CVE: CVE-2007-6186
Published: 2007-11-30
Description: Unspecified vulnerability in PHPDevShell before 0.7.0 has unknown impact and attack vectors, involving a "minor security bug in repair & optimize database."
CVSS Score: 10.0 (HIGH)
References: http://www.phpdevshell.org/changelog; https://exchange.xforce.ibmcloud.com/vulnerabilities/38803; http://www.phpdevshell.org/changelog
CVE: CVE-2007-5503
Published: 2007-11-30
Description: Multiple integer overflows in Cairo before 1.4.12 might allow remote attackers to execute arbitrary code, as demonstrated using a crafted PNG image with large width and height values, which is not properly handled by the read_png function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=200350; http://bugs.gentoo.org/show_bug.cgi?id=201860; http://gitweb.freedesktop.org/?p=cairo%3Ba=commitdiff%3Bh=5c7d2d14d78e4dfb1ef6d2c40f0910f177e07360
CVE: CVE-2007-6150
Published: 2007-11-30
Description: The "internal state tracking" code for the random and urandom devices in FreeBSD 5.5, 6.1 through 6.3, and 7.0 beta 4 allows local users to obtain portions of previously-accessed random values, which could be leveraged to bypass protection mechanisms that rely on secrecy of those values.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://osvdb.org/39600; http://secunia.com/advisories/27879; http://security.FreeBSD.org/advisories/FreeBSD-SA-07:09.random.asc
CVE: CVE-2007-6170
Published: 2007-11-30
Description: SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://downloads.digium.com/pub/security/AST-2007-026.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html; http://secunia.com/advisories/27827
CVE: CVE-2007-6171
Published: 2007-11-30
Description: SQL injection vulnerability in the Postgres Realtime Engine (res_config_pgsql) in Asterisk 1.4.x before 1.4.15 and C.x before C.1.0-beta6 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://downloads.digium.com/pub/security/AST-2007-025.html; http://osvdb.org/38933; http://secunia.com/advisories/27873
CVE: CVE-2007-6187
Published: 2007-11-30
Description: Multiple directory traversal vulnerabilities in PHP Content Architect (aka NoAh) 0.9 pre 1.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the filepath parameter to (1) css_file.php, (2) js_file.php, or (3) xml_file.php in noah/modules/nosystem/templates/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/39682; http://osvdb.org/39683; http://osvdb.org/39684
CVE: CVE-2007-6188
Published: 2007-11-30
Description: Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to (1) languages_n.php, (2) languages_f.php, or (3) languages.php in inc/; and (4) allow remote attackers to read arbitrary local files via a .. (dot dot) in the uri parameter to frames/nogui/sc_download.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/42450; http://osvdb.org/42451; http://osvdb.org/42452
CVE: CVE-2007-6189
Published: 2007-11-30
Description: A certain ActiveX control in (1) OScan8.ocx and (2) Oscan81.ocx in BitDefender Online Anti-Virus Scanner 8.0 allows remote attackers to execute arbitrary code via a long argument to the InitX method that begins with a "%%" sequence, which is misinterpreted as a Unicode string and decoded twice, leading to improper memory allocation and a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://research.eeye.com/html/advisories/published/AD20071120.html; http://secunia.com/advisories/27717; http://securityreason.com/securityalert/3405
CVE: CVE-2007-6190
Published: 2007-11-30
Description: The HTTP daemon in the Cisco Unified IP Phone, when the Extension Mobility feature is enabled, allows remote authenticated users of other phones associated with the same CUCM server to eavesdrop on the physical environment via a CiscoIPPhoneExecute message containing a URL attribute of an ExecuteItem element that specifies a Real-Time Transport Protocol (RTP) audio stream.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://osvdb.org/40874; http://secunia.com/advisories/27829; http://securitytracker.com/id?1019006
CVE: CVE-2007-6191
Published: 2007-11-30
Description: Multiple PHP remote file inclusion vulnerabilities in Armin Burger p.mapper 3.2.0 beta3 allow remote attackers to execute arbitrary PHP code via a URL in the _SESSION[PM_INCPHP] parameter to (1) incphp/globals.php or (2) plugins/export/mc_table.php.  NOTE: it could be argued that this vulnerability is caused by a problem in PHP and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in p.mapper.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/27876; http://www.packetstormsecurity.org/0711-exploits/pmapper-rfi.txt; http://www.securityfocus.com/bid/26614
CVE: CVE-2007-6192
Published: 2007-11-30
Description: The web management interface in Citrix NetScaler 8.0 build 47.8 uses weak encryption (XOR of unpadded data) to store credentials within a cookie, which makes it easier for remote attackers to obtain cleartext credentials when a cookie is captured via a known-plaintext attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://securityreason.com/securityalert/3409; http://securitytracker.com/id?1018991; http://www.securityfocus.com/archive/1/484182/100/0/threaded
CVE: CVE-2007-6193
Published: 2007-11-30
Description: The web management interface in Citrix NetScaler 8.0 build 47.8 stores the device's primary IP address in a cookie, which might allow remote attackers to obtain sensitive network configuration information if this address is not the same as the address being used by the web interface.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://securityreason.com/securityalert/3409; http://www.securityfocus.com/archive/1/484182/100/0/threaded; http://securityreason.com/securityalert/3409
CVE: CVE-2007-5494
Published: 2007-11-30
Description: Memory leak in the Red Hat Content Accelerator kernel patch in Red Hat Enterprise Linux (RHEL) 4 and 5 allows local users to cause a denial of service (memory consumption) via a large number of open requests involving O_ATOMICLOOKUP.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/44153; http://secunia.com/advisories/27824; http://secunia.com/advisories/28162
CVE: CVE-2007-5502
Published: 2007-12-01
Description: The PRNG implementation for the OpenSSL FIPS Object Module 1.1.1 does not perform auto-seeding during the FIPS self-test, which generates random data that is more predictable than expected and makes it easier for attackers to bypass protection mechanisms that rely on the randomness.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/27859; http://www.kb.cert.org/vuls/id/150249; http://www.openssl.org/news/secadv_20071129.txt
CVE: CVE-2007-5742
Published: 2007-12-01
Description: Directory traversal vulnerability in the WML engine preprocessor for Wesnoth 1.2.x before 1.2.8, and 1.3.x before 1.3.12, allows remote attackers to read arbitrary files via ".." sequences in unknown vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://osvdb.org/41713; http://secunia.com/advisories/27786; http://secunia.com/advisories/27920
CVE: CVE-2007-6196
Published: 2007-12-01
Description: Cross-site scripting (XSS) vulnerability in util.php in Calacode @Mail before 5.2 allows remote attackers to inject arbitrary web script or HTML via the func parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/38911; http://secunia.com/advisories/27837; http://terra.calacode.com/mail/docs/changelog.html
CVE: CVE-2007-6197
Published: 2007-12-01
Description: The Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allows remote attackers to obtain version numbers and internal hostnames by reading comments in the HTML source of any page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://procheckup.com/Vulnerability_PR06-08.php; http://procheckup.com/Vulnerability_PR06-09.php; http://secunia.com/advisories/27840
CVE: CVE-2007-6198
Published: 2007-12-01
Description: portal/server.pt in the Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allows wildcards in advanced searches for usernames, which allows remote attackers to enumerate valid usernames via the in_tx_fulltext parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://procheckup.com/Vulnerability_PR06-11.php; http://secunia.com/advisories/27840; http://www.securityfocus.com/archive/1/484469/100/0/threaded
CVE: CVE-2007-6199
Published: 2007-12-01
Description: rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy.
CVSS Score: 9.3 (HIGH)
CWE: CWE-16
References: http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html; http://rsync.samba.org/security.html#s3_0_0
CVE: CVE-2007-6200
Published: 2007-12-01
Description: Unspecified vulnerability in rsync before 3.0.0pre6, when running a writable rsync daemon, allows remote attackers to bypass exclude, exclude_from, and filter and read or write hidden files via (1) symlink, (2) partial-dir, (3) backup-dir, and unspecified (4) dest options.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html; http://rsync.samba.org/security.html#s3_0_0
CVE: CVE-2007-6201
Published: 2007-12-01
Description: Unspecified vulnerability in Wesnoth 1.2.x before 1.2.8, and 1.3.x before 1.3.12, allows attackers to cause a denial of service (hang) via a "faulty add-on" and possibly execute other commands via unknown vectors related to the turn_cmd option.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/27786; http://sourceforge.net/project/shownotes.php?release_id=557098; http://www.securityfocus.com/bid/26625
CVE: CVE-2007-6202
Published: 2007-12-01
Description: SQL injection vulnerability in plugins/search/search.php in Neocrome Seditio CMS 121 and earlier allows remote attackers to execute arbitrary SQL commands via the pag_sub[] parameter to plug.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/38924; http://secunia.com/advisories/27881; http://www.neocrome.net/page.php?id=2349
CVE: CVE-2006-7225
Published: 2007-12-03
Description: Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to cause a denial of service (error or crash) via a regular expression that involves a "malformed POSIX character class", as demonstrated via an invalid character after a [[ sequence.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html; http://secunia.com/advisories/28041; http://secunia.com/advisories/28658
CVE: CVE-2006-7226
Published: 2007-12-03
Description: Perl-Compatible Regular Expression (PCRE) library before 6.7 does not properly calculate the compiled memory allocation for regular expressions that involve a quantified "subpattern containing a named recursion or subroutine reference," which allows context-dependent attackers to cause a denial of service (error or crash).
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html; http://secunia.com/advisories/28041; http://secunia.com/advisories/28658
CVE: CVE-2007-6203
Published: 2007-12-03
Description: Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html
CVE: CVE-2007-6206
Published: 2007-12-04
Description: The do_coredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location, which might allow local users to obtain sensitive information.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://bugzilla.kernel.org/show_bug.cgi?id=3043; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=c46f739dd39db3b07ab5deb4e3ec81e1c04a91af; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00005.html
CVE: CVE-2007-6207
Published: 2007-12-04
Description: Xen 3.x, possibly before 3.1.2, when running on IA64 systems, does not check the RID value for mov_to_rr, which allows a VTi domain to read memory of other domains.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://lists.xensource.com/archives/html/xen-announce/2007-11/msg00000.html; http://lists.xensource.com/archives/html/xen-ia64-devel/2007-10/msg00189.html; http://osvdb.org/41341
CVE: CVE-2007-6208
Published: 2007-12-04
Description: sylprint.pl in claws mail tools (claws-mail-tools) allows local users to overwrite arbitrary files via a symlink attack on the sylprint.[USER].[PID] temporary file.
CVSS Score: 3.6 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454089; http://osvdb.org/42478; http://secunia.com/advisories/27897
CVE: CVE-2007-6209
Published: 2007-12-04
Description: Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/42481; http://secunia.com/advisories/27899; http://www.securityfocus.com/bid/26674
CVE: CVE-2007-6210
Published: 2007-12-04
Description: zabbix_agentd 1.1.4 in ZABBIX before 1.4.3 runs "UserParameter" scripts with gid 0, which might allow local users to gain privileges.
CVSS Score: 2.1 (LOW)
CWE: CWE-16
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=452682; http://secunia.com/advisories/27903; http://secunia.com/advisories/27948
CVE: CVE-2007-6211
Published: 2007-12-04
Description: Send ICMP Nasty Garbage (sing) on Debian GNU/Linux allows local users to append to arbitrary files and gain privileges via the -L (output log file) option.  NOTE: this issue is only a vulnerability in limited environments, since sing is not installed setuid, and the administrator would need to override a non-setuid default during installation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/44157; http://securityreason.com/securityalert/3412; http://www.securityfocus.com/archive/1/484472/100/0/threaded
CVE: CVE-2007-6212
Published: 2007-12-04
Description: Directory traversal vulnerability in region.php in KML share 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the layer parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/39700; http://www.securityfocus.com/bid/26649; https://exchange.xforce.ibmcloud.com/vulnerabilities/38775
CVE: CVE-2007-6213
Published: 2007-12-04
Description: Multiple directory traversal vulnerabilities in mod/chat/index.php in WebED 0.0.9 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) Root and (2) Path parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/39699; http://www.securityfocus.com/bid/26640; https://www.exploit-db.com/exploits/4677
CVE: CVE-2007-6214
Published: 2007-12-04
Description: Directory traversal vulnerability in include/file_download.php in LearnLoop 2.0 beta7 allows remote attackers to read arbitrary files via a .. (dot dot) in the sFilePath parameter.  NOTE: exploitation requires that the product is configured, but has zero files in the database.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/26651; https://exchange.xforce.ibmcloud.com/vulnerabilities/38776; https://www.exploit-db.com/exploits/4680
CVE: CVE-2007-6215
Published: 2007-12-04
Description: Multiple directory traversal vulnerabilities in play.php in Web-MeetMe 3.0.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) roomNo and possibly the (2) bookid parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/26641; https://exchange.xforce.ibmcloud.com/vulnerabilities/38772; https://www.exploit-db.com/exploits/4676
CVE: CVE-2007-6216
Published: 2007-12-04
Description: Race condition in the Fibre Channel protocol (fcp) driver and Devices filesystem (devfs) in Sun Solaris 10 allows local users to cause a denial of service (system hang) via some programs that access hardware resources, as demonstrated by the (1) cfgadm and (2) format programs.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://osvdb.org/40826; http://osvdb.org/40827; http://secunia.com/advisories/27867
CVE: CVE-2007-6217
Published: 2007-12-04
Description: Multiple SQL injection vulnerabilities in login.asp in Irola My-Time (aka Timesheet) 3.5 allow remote attackers to execute arbitrary SQL commands via the (1) login (aka Username) and (2) password parameters. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://aria-security.net/forum/showthread.php?p=1106; http://osvdb.org/38813; http://secunia.com/advisories/27798