rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-2168 
Static code injection vulnerability in process.php in AimStats 3.2 and earlier allows remote attackers to inject PHP code into config.php via the databasehost parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-22T19:00:00.000Z
CVE-2007-2169 
Static code injection vulnerability in add.php in Mozzers SubSystem 1.0 allows remote attackers to inject PHP code into subs.php via the (1) Sub-name or (2) Sub-url field.  NOTE: an earlier report indicated that the add action can be reached through a request to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-22T19:00:00.000Z
CVE-2007-2170 
The APPLSYS.FND_DM_NODES package in Oracle E-Business Suite does not check for valid sessions, which allows remote attackers to delete arbitrary nodes.  NOTE: due to lack of details from Oracle, it is not clear whether this issue is related to other CVE identifiers such as CVE-2007-2126, CVE-2007-2127, or CVE-2007-2128.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2171 
Stack-based buffer overflow in the base64_decode function in GWINTER.exe in Novell GroupWise (GW) WebAccess before 7.0 SP2 allows remote attackers to execute arbitrary code via long base64 content in an HTTP Basic Authentication request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2172 
A typo in Linux kernel 2.6 before 2.6.21-rc6 and 2.4 before 2.4.35 causes RTA_MAX to be used as an array size instead of RTN_MAX, which leads to an "out of bound access" by the (1) dn_fib_props (dn_fib.c, DECNet) and (2) fib_props (fib_semantics.c, IPv4) functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-22T19:00:00.000Z
CVE-2007-2173 
Eval injection vulnerability in (1) courier-imapd.indirect and (2) courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2, and 4.1.x before 4.1.2-r1, on Gentoo Linux allows remote attackers to execute arbitrary commands via the XMAILDIR variable, related to the LOGINRUN variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T16:00:00.000Z
CVE-2007-2174 
The IOCTL handling in srescan.sys in the ZoneAlarm Spyware Removal Engine (SRE) in Check Point ZoneAlarm before 5.0.156.0 allows local users to execute arbitrary code via certain IOCTL lrp parameter addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T16:00:00.000Z
CVE-2007-2175 
Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the "PWN 2 0WN" contest at CanSecWest 2007.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T16:00:00.000Z
CVE-2007-2176 
Unspecified vulnerability in Mozilla Firefox allows remote attackers to execute arbitrary code via unspecified vectors involving Javascript errors.  NOTE: this might be the same issue as CVE-2007-2175.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T16:00:00.000Z
CVE-2007-2177 
Stack-based buffer overflow in the Microgaming Download Helper ActiveX control (dlhelper.dll) before 7.2.0.19, and the WebHandler Class control, allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T16:00:00.000Z
CVE-2007-2178 
Multiple unspecified vulnerabilities in Objective Development Sharity before 3.3 allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2179 
Multiple unspecified vulnerabilities in IXceedCompression in XceddZipLib (RaidenFTPD.dll) in RaidenFTPD 2.4 allow remote attackers to cause a denial of service (crash) via unspecified vectors involving the (1) CalculateCrc, (2) Compress, and (3) Uncompress functions, which result in a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2180 
Buffer overflow in Nullsoft Winamp 5.3 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted WMV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2181 
PHP remote file inclusion vulnerability in admin/login.php in Webinsta FM Manager 0.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter, a different product and vector than CVE-2005-0748.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2182 
Unrestricted file upload vulnerability in forum_write.php in Maran PHP Forum allows remote attackers to upload and execute arbitrary PHP files via a trailing %00 in a filename in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2183 
SQL injection vulnerability in index.php in PHP-Ring Webring System (aka uPHP_ring_website) 0.9 allows remote attackers to execute arbitrary SQL commands via the ring parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2184 
Directory traversal vulnerability in imgsrv.php in jchit counter 1.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the acc parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2185 
Multiple PHP remote file inclusion vulnerabilities in Supasite 1.23b allow remote attackers to execute arbitrary PHP code via a URL in the supa[db_path] parameter to (1) common_functions.php, (2) admin_auth_cookies.php, (3) admin_mods.php, (4) admin_news.php, (5) admin_topics.php, (6) admin_users.php, (7) admin_utilities.php, (8) site_comment.php, or (9) site_news.php; or the supa[include_path] parameter to (10) admin_settings.php or (11) backend_site.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2186 
Foxit Reader 2.0 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2187 
Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2188 
eXtremail 2.1.1 and earlier does not verify the ID field (aka transaction id) in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2189 
PHP remote file inclusion vulnerability in admin/admin_album_otf.php in the MX Smartor Full Album Pack (FAP) 2.0 RC1 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2190 
PHP remote file inclusion vulnerability in admin/public/webpages.php in Eba News 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2191 
Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by admin/modules/logfiles/asterisk-full-log.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2192 
Buffer overflow in Photofiltre Studio 8.1.1 allows user-assisted remote attackers to execute arbitrary code via a crafted .tif file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2193 
Stack-based buffer overflow in the ID_X.apl plugin in ACDSee 9.0 Build 108, Pro 8.1 Build 99, and Photo Editor 4.0 Build 195 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2194 
Stack-based buffer overflow in XnView 1.90.3 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2195 
aMSN (aka Alvaro's Messenger) 0.96 and earlier allows remote attackers to cause a denial of service (application crash) by sending invalid data to TCP port 31337.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2196 
PHP remote file inclusion vulnerability in jambook.php in the Jambook (com_Jambook) 1.0 beta7 module for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: this issue has been disputed by a reliable third party because the jambook.php protects against direct request
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2197 
Race condition in the NeatUpload ASP.NET component 1.2.11 through 1.2.16, 1.1.18 through 1.1.23, and trunk.379 through trunk.445 allows remote attackers to obtain other clients' HTTP responses via multiple simultaneous requests, which triggers multiple calls to HttpWorkerRequest.FlushResponse for the same HttpWorkerRequest object and causes a buffer to be reused for a different request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T17:00:00.000Z
CVE-2007-2198 
Cross-site scripting (XSS) vulnerability in LAN Management System (LMS) before 1.6.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving the OD parameter to contrib/formularz_przelewu_wplaty/druk.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T18:00:00.000Z
CVE-2007-2199 
PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConcept Library, as used in multiple products including (1) Joomla! 1.5.0 Beta, (2) N/X Web Content Management System (WCMS) 4.5, (3) CJG EXPLORER PRO 3.3, and (4) phpSiteBackup 0.1, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2200 
Directory traversal vulnerability in navigator/navigator_ok.php in Pagode 0.5.8 allows remote attackers to read and possibly delete arbitrary files via a .. (dot dot) in the asolute parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2201 
Multiple PHP remote file inclusion vulnerabilities in Post Revolution 6.6 and 7.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the dir parameter to (1) common.php or (2) themes/default/preview_post_completo.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2202 
PHP remote file inclusion vulnerability in inc_ACVS/SOAP/Transport.php in Accueil et Conseil en Visites et Sejours Web Services (ACVSWS) PHP5 (ACVSWS_PHP5) 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the CheminInclude parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2203 
Cross-site scripting (XSS) vulnerability in Big Blue Guestbook allows remote attackers to inject arbitrary web script or HTML via the message field in the guestbook entry submission form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2204 
Multiple PHP remote file inclusion vulnerabilities in GPL PHP Board (GPB) unstable-2001.11.14-1 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) db.mysql.inc.php or (2) gpb.inc.php in include/, or the (3) theme parameter to themes/ubb/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2205 
PHP remote file inclusion vulnerability in modules/rtmessageadd.php in LAN Management System (LMS) 1.5.3, and possibly 1.5.4, allows remote attackers to execute arbitrary PHP code via a URL in the _LIB_DIR parameter, a different vector than CVE-2007-1643.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2206 
Cross-site scripting (XSS) vulnerability in contact/index.php in Ripe Website Manager 0.8.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a leading "&lt;&quot;&lt;" in the ripeformpost parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2207 
SQL injection vulnerability in contact/index.php in Ripe Website Manager 0.8.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ripeformpost parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2208 
Multiple PHP remote file inclusion vulnerabilities in Extreme PHPBB2 3.0 Pre Final allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) functions.php or (2) functions_portal.php in includes/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2209 
Buffer overflow in igcore15d.dll 15.1.2.0 and 15.2.0.0 for AccuSoft ImageGear, as used in Corel Paint Shop Pro Photo 11.20 and possibly other products, allows user-assisted remote attackers to execute arbitrary code via a crafted .CLP file.  NOTE: some details were obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2210 
A certain ActiveX control in askPopStp.dll in Netsprint Ask IE Toolbar 1.1 allows remote attackers to cause a denial of service (Internet Explorer crash) via a long AddAllowed property value, related to "improper memory handling," possibly a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2211 
SQL injection vulnerability in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a dayview action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2212 
Multiple SQL injection vulnerabilities in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) year or (2) month parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2213 
Unspecified vulnerability in the Initialize function in NetscapeFTPHandler in WS_FTP Home and Professional 2007 allows remote attackers to cause a denial of service (NULL dereference and application crash) via unspecified vectors related to "improper arguments."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2214 
Unrestricted file upload vulnerability in includes/upload_file.php in DmCMS allows remote attackers to upload arbitrary PHP scripts by placing a script's contents in both the File2 and File3 parameters, and sending a ok.php?do=act Referer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T20:00:00.000Z
CVE-2007-2216 
The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function, which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file, aka "ActiveX Object Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T21:00:00.000Z
CVE-2007-2217 
Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute arbitrary code via crafted image files that trigger memory corruption, as demonstrated by a certain .tif (TIFF) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T22:00:00.000Z
CVE-2007-2218 
Unspecified vulnerability in the Windows Schannel Security Package for Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2, allows remote servers to execute arbitrary code or cause a denial of service via crafted digital signatures that are processed during an SSL handshake.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T19:00:00.000Z
CVE-2007-2219 
Unspecified vulnerability in the Win32 API on Microsoft Windows 2000, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via certain parameters to an unspecified function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T20:00:00.000Z
CVE-2007-2221 
Unspecified vulnerability in the mdsauth.dll COM object in Microsoft Windows Media Server in the Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; or 7 on Windows Vista allows remote attackers to overwrite arbitrary files via unspecified vectors, aka the "Arbitrary File Rewrite Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-2222 
Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as used by Microsoft Internet Explorer 5.01, 6, and 7, allow remote attackers to execute arbitrary code via a crafted ActiveX object that triggers memory corruption, as demonstrated via the ModeName parameter to the FindEngine function in ACTIVEVOICEPROJECTLib.DirectSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T19:00:00.000Z
CVE-2007-2223 
Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T21:00:00.000Z
CVE-2007-2224 
Object linking and embedding (OLE) Automation, as used in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Office 2004 for Mac, and Visual Basic 6.0 allows remote attackers to execute arbitrary code via the substringData method on a TextNode object, which causes an integer overflow that leads to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T21:00:00.000Z
CVE-2007-2225 
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T20:00:00.000Z
CVE-2007-2227 
The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "Content Disposition Parsing Cross Domain Information Disclosure Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T21:00:00.000Z
CVE-2007-2228 
rpcrt4.dll (aka the RPC runtime library) in Microsoft Windows XP SP2, XP Professional x64 Edition, Server 2003 SP1 and SP2, Server 2003 x64 Edition and x64 Edition SP2, and Vista and Vista x64 Edition allows remote attackers to cause a denial of service (RPCSS service stop and system restart) via an RPC request that uses NTLMSSP PACKET authentication with a zero-valued verification trailer signature, which triggers an invalid dereference.  NOTE: this also affects Windows 2000 SP4, although the impact is an information leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T22:00:00.000Z
CVE-2007-2229 
Microsoft Windows Vista uses insecure default permissions for unspecified "local user information data stores" in the registry and the file system, which allows local users to obtain sensitive information such as administrative passwords, aka "Permissive User Information Store ACLs Information Disclosure Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T19:00:00.000Z
CVE-2007-2230 
SQL injection vulnerability in CA Clever Path Portal allows remote authenticated users to execute limited SQL commands and retrieve arbitrary database contents via (1) the ofinterest parameter in a light search query, (2) description parameter in the advanced search query, and possibly other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-25T15:00:00.000Z
CVE-2007-2231 
Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-25T15:00:00.000Z
CVE-2007-2232 
The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR (\r) sequences in the cosign cookie parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-25T15:00:00.000Z