rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-6558 
TotalPlayer 3.0 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .m3u file.  NOTE: this might be a duplicate of CVE-2006-6288.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6559 
Multiple SQL injection vulnerabilities in Logaholic before 2.0 RC8 allow remote attackers to execute arbitrary SQL commands via (1) the from parameter to index.php or (2) the page parameter to update.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6560 
Multiple cross-site scripting (XSS) vulnerabilities in Logaholic before 2.0 RC8 allow remote attackers to inject arbitrary web script or HTML via (1) the newconfname parameter to profiles.php or (2) the conf parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6561 
Multiple stack-based buffer overflows in PDFLib allow user-assisted remote attackers to execute arbitrary code via a long filename argument to the PDF_load_image function that results in an overflow in the pdc_fsearch_fopen function, and possibly other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6562 
Multiple stack-based buffer overflows in the use of FD_SET in TCPreen before 1.4.4 allow remote attackers to cause a denial of service via multiple concurrent connections, which result in overflows in the (1) SocketAddress::Connect function in libsolve/sockprot.cpp and (2) monitor_bridge function in src/bridge.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6563 
Heap-based buffer overflow in WinAce 2.65 and earlier, and possibly other versions before 2.69, allows user-assisted remote attackers to execute arbitrary code via a long filename in a compressed UUE archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6564 
Cross-site scripting (XSS) vulnerability in admin.php in Limbo CMS 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML via the com_option parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6565 
Multiple SQL injection vulnerabilities in Blakord Portal 1.3.A Beta and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to an arbitrary component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6566 
SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6567 
Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagename parameter in a page view action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6568 
PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path_escape parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6569 
Cross-site scripting (XSS) vulnerability in the View Error Log functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566246.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6570 
Cross-site scripting (XSS) vulnerability in the View URL Database functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 and 3.x before 3.6 SP11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566309.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6571 
Cross-site scripting (XSS) vulnerability in Sun Java System Web Proxy Server 3.6 before SP11 on Windows allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6611356.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6572 
Cross-site scripting (XSS) vulnerability in Sun Java System Web Server 6.1 before SP8 and 7.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566204.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6573 
QK SMTP Server 3 allows remote attackers to cause a denial of service (daemon crash) via a long (1) HELO, (2) MAIL FROM, or (3) RCPT TO command; or (4) a long string in the message sent after the DATA command; possibly a related issue to CVE-2006-5551.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6574 
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the origin parameter to work/work.php in a display_upload_form action, or the forum parameter to (2) forum/viewforum.php or (3) forum/viewthread.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6575 
SQL injection vulnerability in default.php in MMSLamp allows remote attackers to execute arbitrary SQL commands via the idpro parameter in a prodotti_dettaglio action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6576 
Multiple SQL injection vulnerabilities in Adult Script 1.6.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) videolink_count.php or (2) links.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6577 
Multiple SQL injection vulnerabilities in index.php in zBlog 1.2 allow remote attackers to execute arbitrary SQL commands via (1) the categ parameter in a categ action or (2) the article parameter in an articles action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6578 
SQL injection vulnerability in go.php in PHP ZLink 0.3 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6579 
Multiple SQL injection vulnerabilities in Ip Reg 0.3 allow remote attackers to execute arbitrary SQL commands via the vlan_id parameter to (1) vlanview.php, (2) vlanedit.php, and (3) vlandel.php; the (4) assetclassgroup_id parameter to assetclassgroupview.php; the (5) subnet_id parameter to nodelist.php; and unspecified other vectors. NOTE: it was later reported that the vlanview.php and vlandel.php vectors are also in 0.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6580 
Multiple SQL injection vulnerabilities in Wallpaper Site 1.0.09 allow remote attackers to execute arbitrary SQL commands via (1) the catid parameter to category.php or (2) the groupid parameter to editadgroup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6581 
Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the global_lang parameter to (1) header_album.php, (2) header_blog.php, or (3) header_group.php; or (4) admin_header_album.php, (5) admin_header_blog.php, or (6) admin_header_group.php in admin/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6582 
Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter in a page mode action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6583 
SQL injection vulnerability in admin/ops/findip/ajax/search.php in 1024 CMS 1.3.1 allows remote attackers to execute arbitrary SQL commands via the ip parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6584 
Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang parameter to pages/print/default/ops/news.php or (2) the theme_dir parameter to pages/download/default/ops/search.php; or the admin_theme_dir parameter to (3) download.php, (4) forum.php, or (5) news.php in admin/ops/reports/ops/.  NOTE: it was later reported that 1.4.2 beta and earlier are also affected for vector 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6585 
PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to execute arbitrary PHP code via a URL in the output parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6586 
SQL injection vulnerability in sezione_news.php in nicLOR-CMS allows remote attackers to execute arbitrary SQL commands via the id parameter in a sezione page action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6587 
SQL injection vulnerability in plog-rss.php in Plogger 1.0 Beta 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6588 
Cross-site scripting (XSS) vulnerability in PHCDownload 1.10 allows remote attackers to inject arbitrary web script or HTML via the username field in an unspecified component.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6589 
The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6591 
KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6592 
Apple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6593 
Multiple stack-based buffer overflows in l123sr.dll in Autonomy (formerly Verity) KeyView SDK, as used by IBM Lotus Notes 5.x through 8.x, allow user-assisted remote attackers to execute arbitrary code via the (1) Length and (2) Value fields for certain Types in a Lotus 1-2-3 (.123) file in the Worksheet File (WKS) format, as demonstrated by a file with a crafted SRANGE record, a different vulnerability than CVE-2007-5909.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6594 
IBM Lotus Notes 8 for Linux before 8.0.1 uses (1) unspecified weak permissions for the installation kit obtained through a Notes 8 download and (2) 0777 permissions for the installdata file that is created by setup.sh, which allows local users to gain privileges via a Trojan horse file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T21:00:00.000Z
CVE-2007-6595 
ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T19:00:00.000Z
CVE-2007-6596 
ClamAV 0.92 does not recognize Base64 UUEncoded archives, which allows remote attackers to bypass the scanner via a Base64-UUEncoded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T19:00:00.000Z
CVE-2007-6597 
Multiple cross-site scripting (XSS) vulnerabilities in IPortalX before Build 033 allow remote attackers to inject arbitrary web script or HTML via the (1) KW and (2) SF parameters to forum/login_user.asp, and (3) the Date parameter to blogs.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T19:00:00.000Z
CVE-2007-6598 
Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T02:00:00.000Z
CVE-2007-6599 
Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T02:00:00.000Z
CVE-2007-6600 
PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T21:00:00.000Z
CVE-2007-6601 
The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors.  NOTE: this issue exists because of an incomplete fix for CVE-2007-3278.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T21:00:00.000Z
CVE-2007-6602 
SQL injection vulnerability in app/models/identity.php in NoseRub 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the username field to the login script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T20:00:00.000Z
CVE-2007-6603 
Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attackers to obtain the administrator username and password via a direct request to control/backup/backup.php, which generates a backup/dump/backup.sql file that can be downloaded via a direct request to control/downloadfile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T20:00:00.000Z
CVE-2007-6604 
Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the s parameter to the admin page or (2) the pg parameter to an arbitrary module, as demonstrated by reading a password hash in a .dtb file under dati/membri/ or by executing embedded PHP code in images under uploads/avatar/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T20:00:00.000Z
CVE-2007-6605 
Buffer overflow in a certain ActiveX control in SkyFexClient.ocx 1.0.2.77 in SkyFex Client 1.0 allows remote attackers to execute arbitrary code via long strings in the first four arguments to the Start method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T20:00:00.000Z
CVE-2007-6606 
OpenBiblio 0.5.2-pre4 and earlier allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T20:00:00.000Z
CVE-2007-6607 
OpenBiblio 0.5.2-pre4 and earlier allows remote attackers to obtain sensitive information via a direct request for (1) shared/footer.php, (2) circ/mbr_fields.php, or (3) admin/custom_marc_form_fields.php, which reveals the path in various error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T20:00:00.000Z
CVE-2007-6608 
Multiple cross-site scripting (XSS) vulnerabilities in OpenBiblio 0.5.2-pre4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) LAST and (2) FIRST parameters to admin/staff_del_confirm.php, (3) the name parameter to admin/theme_del_confirm.php, or (4) the themeName parameter to admin/theme_preview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T20:00:00.000Z
CVE-2007-6609 
Multiple stack-based buffer overflows in the CPLI_ReadTag_OGG function in CPI_PlaylistItem.c in CoolPlayer 217 and earlier allow user-assisted remote attackers to execute arbitrary code via a long (1) cTag or (2) cValue field in an OGG Vorbis file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-31T20:00:00.000Z
CVE-2007-6610 
unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-03T20:00:00.000Z
CVE-2007-6611 
Cross-site scripting (XSS) vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename, related to bug_report.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-03T22:00:00.000Z
CVE-2007-6612 
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-03T22:00:00.000Z
CVE-2007-6613 
Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image that contains a long joilet file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-03T22:00:00.000Z
CVE-2007-6614 
PHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter, a related issue to CVE-2007-6542.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-03T23:00:00.000Z
CVE-2007-6615 
Directory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the selected_provider parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-03T23:00:00.000Z
CVE-2007-6616 
Cross-site scripting (XSS) vulnerability in simpleforum.cgi in SimpleForum 4.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchkey parameter in a search action.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-03T23:00:00.000Z
CVE-2007-6617 
Cross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to secure/CreateIssue.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-03T23:00:00.000Z
CVE-2007-6618 
JIRA Enterprise Edition before 3.12.1 allows remote attackers to delete another user's shared filter via a modified filter ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-03T23:00:00.000Z
CVE-2007-6619 
The Setup Wizard in Atlassian JIRA Enterprise Edition before 3.12.1 does not properly restrict setup attempts after setup is complete, which allows remote attackers to change the default language.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-03T23:00:00.000Z
CVE-2007-6620 
Directory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6621 
Directory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6622 
SQL injection vulnerability in security.php in ZeusCMS 0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6623 
Absolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathname in the dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z