morpheuslord/cve-llm-training huggingface dataset:
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1027.

assistant: Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1028.

assistant: Cross-site scripting (XSS) vulnerability in the Barry Jaspan Image Pager 4.7.x-1.x-dev and 5.x-1.x-dev before 2007-02-08 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to HTML entities and the IMG element.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1029.

assistant: Stack-based buffer overflow in the Connect method in the IMAP4 component in Quiksoft EasyMail Objects before 6.5 allows remote attackers to execute arbitrary code via a long host name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1030.

assistant: Niels Provos libevent 1.2 and 1.2a allows remote attackers to cause a denial of service (infinite loop) via a DNS response containing a label pointer that references its own offset.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1031.

assistant: Directory traversal vulnerability in include/db_conn.php in SpoonLabs Vivvo Article Management CMS 3.4 allows remote attackers to include and execute arbitrary local files via the root parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1032.

assistant: Unspecified vulnerability in phpMyFAQ 1.6.9 and earlier, when register_globals is enabled, allows remote attackers to "gain the privilege for uploading files on the server."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1033.

assistant: Unspecified vulnerability in the Secure site 4.7.x-1.x-dev and 5.x-1.x-dev module for Drupal allows remote attackers to bypass access restrictions via a crafted URL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1034.

assistant: SQL injection vulnerability in the category file in modules.php in the Emporium 2.3.0 and earlier module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1035.

assistant: Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1036.

assistant: The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1037.

assistant: Stack-based buffer overflow in News File Grabber 4.1.0.1 and earlier allows remote attackers to execute arbitrary code via a .nzb file with a long subject field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1038.

assistant: Shemes.com Grabit 1.5.3, and possibly earlier, allows remote attackers to cause a denial of service (application crash) via a .nzb file with a subject field containing ';' (semicolon) characters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1039.

assistant: Unspecified vulnerability in Peanut Knowledge Base (PeanutKB) 0.0.3 and earlier has unknown impact and attack vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1040.

assistant: Directory traversal vulnerability in archives.php in Xpression News (X-News) 1.0.1 allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1041.

assistant: Multiple stack-based buffer overflows in S&H Computer Systems News Rover 12.1 Rev 1 allow remote attackers to execute arbitrary code via a .nzb file with a long (1) group or (2) subject string.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1042.

assistant: Directory traversal vulnerability in news.php in Xpression News (X-News) 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1043.

assistant: Ezboo webstats, possibly 3.0.3, allows remote attackers to bypass authentication and gain access via a direct request to (1) update.php and (2) config.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1044.

assistant: Pearson Education PowerSchool 4.3.6 allows remote attackers to list the contents of the admin folder via a URI composed of the admin/ directory name and an arbitrary filename ending in ".js."  NOTE: it was later reported that this issue had been addressed by 5.1.2.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1045.

assistant: mAlbum 0.3 has default accounts (1) "login"/"pass" for its administrative account and (2) "dqsfg"/"sdfg", which allows remote attackers to gain privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1046.

assistant: Dem_trac allows remote attackers to read log file contents via a direct request for /anc_sit.txt.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1047.

assistant: Unspecified vulnerability in Distributed Checksum Clearinghouse (DCC) before 1.3.51 allows remote attackers to delete or add hosts in /var/dcc/maps.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1048.

assistant: PHP remote file inclusion vulnerability in admin_rebuild_search.php in phpbb_wordsearch allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1049.

assistant: Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1050.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in index.php in AbleDesign MyCalendar allow remote attackers to inject arbitrary web script or HTML via (1) the go parameter, (2) the keyword parameter in the search menu (go=search), or (3) the username or (4) the password in a go=Login action.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1051.

assistant: Comodo Firewall Pro (formerly Comodo Personal Firewall) 2.4.17.183 and earlier uses a weak cryptographic hashing function (CRC32) to identify trusted modules, which allows local users to bypass security protections by substituting modified modules that have the same CRC32 value.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1052.

assistant: PHP remote file inclusion vulnerability in index.php in PBLang (PBL) 4.60 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the dbpath parameter, a different vector than CVE-2006-5062.  NOTE: this issue has been disputed by a reliable third party for 4.65, stating that the dbpath variable is initialized in an included file that is created upon installation
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1053.

assistant: Multiple PHP remote file inclusion vulnerabilities in phpXmms 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the tcmdp parameter to (1) phpxmmsb.php or (2) phpxmmst.php.  NOTE: this issue has been disputed by a reliable third party, stating that the tcmdp variable is initialized by config.php
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1054.

assistant: Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.6.x through 1.9.2, when $wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded value of the rs parameter, which is processed by Internet Explorer.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1055.

assistant: Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rs parameter.  NOTE: this issue might be a duplicate of CVE-2007-0177.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1056.

assistant: VMware Workstation 5.5.3 build 34685 does not provide per-user restrictions on certain privileged actions, which allows local users to perform restricted operations such as changing system time, accessing hardware components, and stopping the "VMware tools service" service. NOTE: exploitation is simplified via (1) weak file permissions (Users = Read & Execute) for %PROGRAMFILES%\VMware; and weak registry key permissions (access by Users) for (2) vmmouse, (3) vmscsi, (4) VMTools, (5) vmx_svga, and (6) vmxnet in HKLM\SYSTEM\CurrentControlSet\Services\; which allows local users to perform various privileged actions outside of the guest OS by executing certain files under %PROGRAMFILES%\VMware\VMware Tools, as demonstrated by (a) VMControlPanel.cpl and (b) vmwareservice.exe.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1057.

assistant: The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 1000 extracts and executes files with insecure permissions, which allows local users to exploit a race condition to replace a world-writable file in /tmp/NetClient and cause another user to execute arbitrary code when attempting to execute this client, as demonstrated by replacing /tmp/NetClient/client.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1058.

assistant: SQL injection vulnerability in user_pages/page.asp in Online Web Building 2.0 allows remote attackers to execute arbitrary SQL commands via the art_id parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1059.

assistant: PHP remote file inclusion vulnerability in function.php in Ultimate Fun Book 1.02 allows remote attackers to execute arbitrary PHP code via a URL in the gbpfad parameter.  NOTE: some sources mention "Ultimate Fun Board," but this appears to be an error.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1060.

assistant: Multiple PHP remote file inclusion vulnerabilities in Interspire SendStudio 2004.14 and earlier, when register_globals and allow_fopenurl are enabled, allow remote attackers to execute arbitrary PHP code via a URL in the ROOTDIR parameter to (1) createemails.inc.php and (2) send_emails.inc.php in /admin/includes/.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1061.

assistant: SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header (HTTP_REFERER variable).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1062.

assistant: The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1063.

assistant: The SSH server in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier, uses a hard-coded username and password, which allows remote attackers to access the device.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1064.

assistant: Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client do not drop privileges when the help facility in the supplicant GUI is invoked, which allows local users to gain privileges, aka CSCsf14120.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1065.

assistant: Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client allows local users to gain SYSTEM privileges via unspecified vectors in the supplicant, aka CSCsf15836.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1066.

assistant: Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client use an insecure default Discretionary Access Control Lists (DACL) for the connection client GUI, which allows local users to gain privileges by injecting "a thread under ConnectionClient.exe," aka CSCsg20558.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1067.

assistant: Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client do not properly parse commands, which allows local users to gain privileges via unspecified vectors, aka CSCsh30624.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1068.

assistant: The (1) TTLS CHAP, (2) TTLS MSCHAP, (3) TTLS MSCHAPv2, (4) TTLS PAP, (5) MD5, (6) GTC, (7) LEAP, (8) PEAP MSCHAPv2, (9) PEAP GTC, and (10) FAST authentication methods in Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client store transmitted authentication credentials in plaintext log files, which allows local users to obtain sensitive information by reading these files, aka CSCsg34423.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1069.

assistant: The memory management in VMware Workstation before 5.5.4 allows attackers to cause a denial of service (Windows virtual machine crash) by triggering certain general protection faults (GPF).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1070.

assistant: Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, allow remote attackers to execute arbitrary code via crafted RPC requests to TmRpcSrv.dll that trigger overflows when calling the (1) CMON_NetTestConnection, (2) CMON_ActiveUpdate, and (3) CMON_ActiveRollback functions in (a) StCommon.dll, and (4) ENG_SetRealTimeScanConfigInfo and (5) ENG_SendEMail functions in (b) eng50.dll.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1071.

assistant: Integer overflow in the gifGetBandProc function in ImageIO in Apple Mac OS X 10.4.8 allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted GIF image that triggers the overflow during decompression.  NOTE: this is a different issue than CVE-2006-3502 and CVE-2006-3503.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1072.

assistant: The command line interface (CLI) in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier allows local users to obtain privileges or cause a denial of service via unspecified vectors.  NOTE: this issue can be leveraged remotely via CVE-2007-1063.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1073.

assistant: Static code injection vulnerability in install.php in mcRefer allows remote attackers to execute arbitrary PHP code via the bgcolor parameter, which is inserted into mcrconf.inc.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1074.

assistant: Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted remote attackers to execute arbitrary code via a long (1) DataPath or (2) DownloadPath attributed in a (a) NBI file, or (3) a long group field in a (b) NZB file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1075.

assistant: TurboFTP 5.30 Build 572 allows remote servers to cause a denial of service (CPU consumption) via a response with a large number of newline characters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1076.

assistant: Multiple directory traversal vulnerabilities in phpTrafficA 1.4.1, and possibly earlier, allow remote attackers to include arbitrary local files via a .. (dot dot) in the (1) file parameter to plotStat.php and the (2) lang parameter to banref.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1077.

assistant: SQL injection vulnerability in page.asp in Design4Online UserPages2 2.0 allows remote attackers to execute arbitrary SQL commands via the art_id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1078.

assistant: PHP remote file inclusion vulnerability in index.php in FlashGameScript 1.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the func parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1079.

assistant: Stack-based buffer overflow in Rhino Software, Inc. FTP Voyager 14.0.0.3 and earlier allows remote servers to cause a denial of service (crash) via a long response to a CWD command, which triggers the overflow when the user aborts the command.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1080.

assistant: Multiple heap-based buffer overflows in TurboFTP 5.30 Build 572 allow remote servers to cause a denial of service via (1) long filename in a response to a LIST command, and (2) a long response to a CWD command.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1081.

assistant: The start function in class.t3lib_formmail.php in TYPO3 before 4.0.5, 4.1beta, and 4.1RC1 allows attackers to inject arbitrary email headers via unknown vectors.  NOTE: some details were obtained from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1082.

assistant: FTP Explorer 1.0.1 Build 047, and other versions before 1.0.1.52, allows remote servers to cause a denial of service (CPU consumption) via a long response to a PWD command.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1083.

assistant: Buffer overflow in the Configuration Checker (ConfigChk) ActiveX control in VSCnfChk.dll 2.0.0.2 for Verisign Managed PKI Service, Secure Messaging for Microsoft Exchange, and Go Secure! allows remote attackers to execute arbitrary code via long arguments to the VerCompare method.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1084.

assistant: Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1085.

assistant: Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inject arbitrary web script or HTML, and possibly gain full access to the system, by using an XSS vulnerability in google.com to extract the signature for the internal web server, then calling the "under" parameter in Advanced Search with the proper signature.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1086.

assistant: Unspecified binaries in IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 allow local users to create or modify arbitrary files via unspecified environment variables related to "unsafe file access."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1087.

assistant: IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 does not properly terminate certain input strings, which allows local users to execute arbitrary code via unspecified environment variables that trigger a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1088.

assistant: Stack-based buffer overflow in IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 allows local users to execute arbitrary code via a long string in unspecified environment variables.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1089.

assistant: IBM DB2 Universal Database (UDB) 9.1 GA through 9.1 FP1 allows local users with table SELECT privileges to perform unauthorized UPDATE and DELETE SQL commands via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1090.

assistant: Microsoft Windows Explorer on Windows XP and 2003 allows remote user-assisted attackers to cause a denial of service (crash) via a malformed WMF file, which triggers the crash when the user browses the folder.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1091.

assistant: Microsoft Internet Explorer 7 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via onUnload Javascript handlers.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1092.

assistant: Mozilla Firefox 1.5.0.9 and 2.0.0.1, and SeaMonkey before 1.0.8 allow remote attackers to execute arbitrary code via JavaScript onUnload handlers that modify the structure of a document, wich triggers memory corruption due to the lack of a finalize hook on DOM window objects.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1093.

assistant: Multiple unspecified vulnerabilities in JP1/Cm2/Network Node Manager (NNM) before 07-10-05, and before 08-00-02 in the 08-x series, allow remote attackers to execute arbitrary code, cause a denial of service, or trigger invalid Web utility behavior.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1094.

assistant: Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (NULL dereference and application crash) via JavaScript onUnload handlers that modify the structure of a document.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1095.

assistant: Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 do not properly implement JavaScript onUnload handlers, which allows remote attackers to run certain JavaScript code and access the location DOM hierarchy in the context of the next web site that is visited by a client.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1096.

assistant: Cross-site scripting (XSS) vulnerability in ps_cart.php in VirtueMart before 20070116 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this issue might overlap CVE-2007-0376.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1097.

assistant: Unrestricted file upload vulnerability in the onAttachFiles function in the upload tool (inc/lib/attachment.lib.php) in Wiclear before 0.11.1 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors related to filename validation.  NOTE: some details were obtained from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1098.

assistant: Multiple unspecified vulnerabilities in ScryMUD before 2.1.11 have unknown impact and attack vectors, possibly related to denial of service caused by a search that begins with a .* sequence.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1099.

assistant: dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1100.

assistant: Directory traversal vulnerability in download.php in Ahmet Sacan Pickle before 20070301 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1101.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Photostand 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) message ("comment") or (2) name field, or the (3) q parameter in a search action in index.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1102.

assistant: Photostand 1.2.0 allows remote attackers to obtain sensitive information via a ' (quote) character in (1) a PHPSESSID cookie or (2) the id parameter in an article action in index.php, which reveal the path in various error messages.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1103.

assistant: Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1104.

assistant: PHP remote file inclusion vulnerability in top.php in PHP Module Implementation (PHP-MIP) 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the laypath parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1105.

assistant: PHP remote file inclusion vulnerability in functions.php in Extreme phpBB (aka phpBB Extreme) 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1106.

assistant: PHP remote file inclusion vulnerability in includes/functions_nomoketos_rules.php in the NoMoKeTos Rules 0.0.1 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1107.

assistant: SQL injection vulnerability in thumbnails.php in Coppermine Photo Gallery (CPG) 1.3.x allows remote authenticated users to execute arbitrary SQL commands via a cpg131_fav cookie.  NOTE: it was later reported that 1.4.10, 1.4.14, and other 1.4.x versions are also affected using similar cookies.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1108.

assistant: PHP remote file inclusion vulnerability in index.php in Christian Schneider CS-Gallery 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the album parameter during a securealbum todo action.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1109.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Phpwebgallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) login or (2) mail_address field in Register.php, or the (3) search_author, (4) mode, (5) start_year, (6) end_year, or (7) date_type field in Search.php, a different vulnerability than CVE-2006-1674.  NOTE: 1.6.2 and other versions might also be affected.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1110.

assistant: Directory traversal vulnerability in data/showcode.php in ActiveCalendar 1.2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1111.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in ActiveCalendar 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the css parameter to (1) flatevents.php, (2) js.php, (3) mysqlevents.php, (4) m_2.php, (5) m_3.php, (6) m_4.php, (7) xmlevents.php, (8) y_2.php, or (9) y_3.php in data/.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1112.

assistant: Kaspersky Anti-Virus 6.0 and Internet Security 6.0 exposes unsafe methods in the (a) AXKLPROD60Lib.KAV60Info (AxKLProd60.dll) and (b) AXKLSYSINFOLib.SysInfo (AxKLSysInfo.dll) ActiveX controls, which allows remote attackers to "download" or delete arbitrary files via crafted arguments to the (1) DeleteFile, (2) StartBatchUploading, (3) StartStrBatchUploading, or (4) StartUploading methods.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1114.

assistant: The child frames in Microsoft Internet Explorer 7 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1115.

assistant: The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1116.

assistant: The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI as a ChromeProtocol and can be loaded via JavaScript, which allows remote attackers to obtain sensitive information by querying the browser's session history.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1117.

assistant: Unspecified vulnerability in Publisher 2007 in Microsoft Office 2007 allows remote attackers to execute arbitrary code via unspecified vectors, related to a "file format vulnerability." NOTE: this information is based upon a vague pre-advisory with no actionable information.  However, the advisory is from a reliable source.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1118.

assistant: Multiple PHP remote file inclusion vulnerabilities in eFiction 3.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path_to_smf parameter to (1) bridges/SMF/logout.php or (2) get_session_vars.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1119.

assistant: Unspecified vulnerability in Novell ZENworks 7 Desktop Management Support Pack 1 before Hot patch 3 (ZDM7SP1HP3) allows remote attackers to upload images to certain folders that were not configured in the "Only allow uploads to the following directories" setting via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1120.

assistant: The (1) Import.LoadFromURL and (2) Export.asText.SaveToFile functions in TeeChart Pro ActiveX control (TeeChart7.ocx) allow remote attackers to download a crafted .tee file to an arbitrary location.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1121.

assistant: Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) 1.00 allow remote attackers to execute arbitrary SQL commands via the id parameter to the (1) updateRow and (2) deleteRow functions in functions.php.  NOTE: some of these details are obtained from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1122.

assistant: Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) 1.00 and 1.01 allow remote attackers to execute arbitrary SQL commands via the id parameter to the (1) updateRow and (2) deleteRow functions in functions.php, a variant of a SQL injection issue that was fixed in 1.01.  NOTE: some of these details are obtained from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1123.

assistant: Multiple PHP remote file inclusion vulnerabilities in ZPanel 2.0 allow remote attackers to execute arbitrary PHP code via a URL in (1) the body parameter to templates/ZPanelV2/template.php or (2) the page parameter to zpanel.php.  NOTE: the zpanel.php vector may overlap CVE-2005-0793.2.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1124.

assistant: Directory traversal vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1125.

assistant: Cross-site scripting (XSS) vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to inject arbitrary web script or HTML via the f parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1126.

assistant: Directory traversal vulnerability in index.php in xtcommerce allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1127.

assistant: Directory traversal vulnerability in enc/stylecss.php in shopkitplus allows remote attackers to read arbitrary files via a .. (dot dot) in the changetheme parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1128.

assistant: shopkitplus allows remote attackers to obtain sensitive information via a request to (1) events.php with a curmonth[]=01 query string or (2) enc/stylecss.php with a changetheme[]= query string, which reveals the path in various error messages.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1129.

assistant: Multiple unrestricted file upload vulnerabilities in MTCMS 3.2 allow remote attackers to upload and execute files via (1) an avatar upload in an add_down action, or (2) an add_link action.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1130.

assistant: PHP remote file inclusion vulnerability in sinagb.php in Sinapis Gastebuch 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the fuss parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1131.

assistant: PHP remote file inclusion vulnerability in sinapis.php in Sinapis Forum 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the fuss parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1132.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in the "Contact Us" functionality in MTCMS 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) message and (2) title fields.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1133.

assistant: PHP remote file inclusion vulnerability in fcring.php in FCRing 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the s_fuss parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1134.

assistant: Unspecified vulnerability in Watchtower (WT) before 0.12 has unknown impact and attack vectors, related to "unauthorized accounts."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1135.

assistant: Multiple SQL injection vulnerabilities in WebMplayer before 0.6.1-Alpha allow remote attackers to execute arbitrary SQL commands via the (1) strid parameter to index.php and the (2) id[0] or other id array index parameter to filecheck.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1136.

assistant: index.php in WebMplayer before 0.6.1-Alpha allows remote attackers to execute arbitrary code via shell metacharacters in an exec function call.  NOTE: some sources have referred to this as eval injection in the param parameter, but CVE source inspection suggests that this is erroneous.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1137.

assistant: putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putmail.py to send the username and password in plaintext while the user believes encryption is in use, and allows remote attackers to obtain sensitive information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1138.

assistant: Absolute path traversal vulnerability in list_main_pages.php in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to list arbitrary directories, and read arbitrary files, via an absolute pathname in the nfolder parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1139.

assistant: Unrestricted file upload vulnerability in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to upload arbitrary scripts via a filename with a double extension.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1140.

assistant: Directory traversal vulnerability in edit.php in pheap allows remote attackers to read and modify arbitrary files via a .. (dot dot) in the filename parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1141.

assistant: PHP remote file inclusion vulnerability in preview.php in Magic News Plus 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the php_script_path parameter.  NOTE: This issue may overlap CVE-2006-0723.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1142.

assistant: Cross-site scripting (XSS) vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the link_parameters parameter in (1) news.php and (2) n_layouts.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1143.

assistant: Directory traversal vulnerability in pn-menu.php in J-Web Pics Navigator 1.0 allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1144.

assistant: Directory traversal vulnerability in jwpn-photos.php in J-Web Pics Navigator 2.0 allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1145.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite - ESupport 3.00.13 and 3.04.10 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a (1) lostpassword or (2) register action in index.php, (3) unspecified vectors in the Submit form in a submit action in index.php, and (4) the user's name in index.php; and (5) allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the Admin and Staff Control Panel. NOTE: this might issue overlap CVE-2004-1412, CVE-2005-0487, or CVE-2005-0842.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1146.

assistant: PHP remote file inclusion vulnerability in function.php in arabhost allows remote attackers to execute arbitrary PHP code via a URL in the adminfolder parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1147.

assistant: PHP remote file inclusion vulnerability in view.php in hbm allows remote attackers to execute arbitrary PHP code via a URL in the hbmpath parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1148.

assistant: PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1149.

assistant: Multiple directory traversal vulnerabilities in LoveCMS 1.4 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the step parameter to install/index.php or (2) the load parameter to the top-level URI.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1150.

assistant: Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1151.

assistant: Cross-site scripting (XSS) vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1152.

assistant: Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) act or (2) pid parameter to the top-level URI (index.php), or the (3) action parameter to admin/index.php.  NOTE: some of these details are obtained from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1153.

assistant: Multiple PHP remote file inclusion vulnerabilities in CutePHP CuteNews 1.3.6 allow remote attackers to execute arbitrary PHP code via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: issue might overlap CVE-2004-1660 or CVE-2006-4445.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1154.

assistant: SQL injection vulnerability in webSPELL allows remote attackers to execute arbitrary SQL commands via a ws_auth cookie, a different vulnerability than CVE-2006-4782.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1155.

assistant: Unrestricted file upload vulnerability in webSPELL allows remote authenticated administrators to upload and execute arbitrary PHP code via the add squad feature.  NOTE: this issue may be an administrative feature, in which case this CVE may be REJECTED.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1156.

assistant: JBrowser allows remote attackers to bypass authentication and access certain administrative capabilities via a direct request for _admin/.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1157.

assistant: Cross-site request forgery (CSRF) vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via certain MBean operations, a different vulnerability than CVE-2006-3733.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1158.

assistant: Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1159.

assistant: Cross-site scripting (XSS) vulnerability in modules/out.php in Pyrophobia 2.1.3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2007-1160.

assistant: webSPELL 4.0, and possibly later versions, allows remote attackers to bypass authentication via a ws_auth cookie, a different vulnerability than CVE-2006-4782.