rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-3342 
Multiple cross-site scripting (XSS) vulnerabilities in Movable Type (MT) before 3.34 allow remote attackers to inject arbitrary web script or HTML via comments that have (1) a malformed SGML numeric character reference with a '\0' (0x00) character in a javascript: URI or (2) an attribute in an element that lacks the '>' character at the end of the start tag, a different vulnerability than CVE-2007-0231.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T23:00:00.000Z
CVE-2007-3343 
Cross-site scripting (XSS) vulnerability in RaidenHTTPD before 2.0.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3344 
Multiple cross-site scripting (XSS) vulnerabilities in netjukebox 4.01b allow remote attackers to inject arbitrary web script or HTML via the (1) album_id, (2) order, (3) sort, (4) filter, and (5) genre_id parameters to (a) index.php; and the (6) url parameter to (b) ridirect.php.  NOTE: the attack also reveals the installation path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3345 
Multiple SQL injection vulnerabilities in index.php in PHPAccounts 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) Outgoing_Type_ID, (2) Outgoing_ID, (3) Project_ID, (4) Client_ID, (5) Invoice_ID, or (6) Vendor_ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3346 
Directory traversal vulnerability in index.php in PHPAccounts 0.5 allows remote attackers to include arbitrary local files via unspecified manipulations of the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3347 
The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3348 
The D-Link DPH-540/DPH-541 phone allows remote attackers to cause a denial of service (device outage) via a malformed SDP header in a SIP INVITE message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3349 
The Aastra 9112i SIP Phone with firmware 1.4.0.1048 and boot version 1.1.0.10 allows remote attackers to (1) cause a denial of service (device freeze) via a malformed SIP message of a certain length or (2) cause a denial of service (continuous ring) via a malformed SIP message of a certain other length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3350 
AOL Instant Messenger (AIM) 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service (application hang) via a flood of spoofed SIP INVITE requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3351 
The SJPhone SIP soft phone 1.60.303c, when installed on the Dell Axim X3 running Windows Mobile 2003, allows remote attackers to cause a denial of service (device hang and traffic amplification) via a direct crafted INVITE transaction, which causes the phone to transmit many RTP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3352 
Cross-site scripting (XSS) vulnerability in the preview form in Stephen Ostermiller Contact Form before 2.00.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that contain an apostrophe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3353 
PHP remote file inclusion vulnerability in includes/template.php in MyEvent 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter.  NOTE: a reliable third party disputes this issue, saying "the entire file is a class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3354 
Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition allow remote attackers to execute arbitrary SQL commands via the s_user_id parameter to ViewCat.php and other unspecified vectors. NOTE: the CatID/ViewCat.php, CatID/gallery.php, and ItemNum/ViewItem.php vectors are already covered by CVE-2005-3978.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3355 
Multiple cross-site scripting (XSS) vulnerabilities in NetClassifieds Premium Edition allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3356 
NetClassifieds Premium Edition allows remote attackers to obtain sensitive information via certain requests that reveal the path in an error message, related to the display_errors setting in (1) Common.php and (2) imageresizer.php, and (3) the use of __FILE__ in error reporting by imageresizer.php; and (4) via certain requests that reveal the table name and complete query, related to the Halt_On_Error setting in Mysql_db.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3357 
NetClassifieds Premium Edition does not use encryption for (1) stored passwords or (2) sensitive data, which might allow attackers to obtain information via certain vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3358 
PHP remote file inclusion vulnerability in html/load_lang.php in SerWeb 0.9.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _SERWEB[serwebdir] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3359 
Multiple PHP remote file inclusion vulnerabilities in SerWeb 0.9.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the _SERWEB[serwebdir] parameter to (1) html/load_apu.php or (2) html/mail_prepend.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3360 
hook.c in BitchX 1.1-final allows remote IRC servers to execute arbitrary commands by sending a client certain data containing NICK and EXEC strings, which exceeds the bounds of a hash table, and injects an EXEC hook function that receives and executes shell commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3361 
The Nortel PC Client SIP Soft Phone 4.1 3.5.208[20051015] allows remote attackers to cause a denial of service (device crash) via a SIP message with a malformed header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3362 
ageet AGEphone before 1.6.2, running on Windows Mobile 5 on the HTC HyTN Pocket PC device, allows remote attackers to (1) cause a denial of service (call disruption and device hang) via a SIP message with a malformed header and (2) cause a denial of service (call disruption, false ring indication, and device outage) via a SIP message with a malformed SDP delimiter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3363 
Multiple unspecified vulnerabilities in ageet AGEphone before 1.6.3 allow remote attackers to have an unknown impact via malformed SIP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3364 
Cross-site scripting (XSS) vulnerability in the cgi-bin/post.mscgi sample page in MyServer 0.8.9 allows remote attackers to inject arbitrary web script or HTML via the body content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3365 
MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive information (script source code) via a modified extension, as demonstrated by post.mscgI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3366 
Cross-site scripting (XSS) vulnerability in Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to inject arbitrary web script or HTML via the URI.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3367 
Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to obtain sensitive information via a direct request, which reveals the path in an error message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3368 
Buffer overflow in the HTTP server on the Polycom SoundPoint IP 601 SIP phone with BootROM 3.0.x+ allows remote attackers to cause a denial of service (device reboot) via a malformed CGI parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3369 
Buffer overflow in the Polycom SoundPoint IP 601 SIP phone with BootROM 3.0.x+ and SIP version 1.6.3.0067 allows remote attackers to cause a denial of service (device hang or reboot) via an INVITE message with a long Via header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3370 
Multiple PHP remote file inclusion vulnerabilities in Sun Board 1.00.00 Alpha allow remote attackers to execute arbitrary PHP code via a URL in (1) the sunPath parameter to include.php or (2) the dir parameter to skin/board/default/doctype.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3371 
PHP remote file inclusion vulnerability in plugins/widgets/htmledit/htmledit.php in Powl 0.94 allows remote attackers to execute arbitrary PHP code via a URL in the _POWL[installPath] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3372 
The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service (exit) via empty TXT data over D-Bus, which triggers an assert error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T21:00:00.000Z
CVE-2007-3373 
daemon.c in cman (redhat-cluster-suite) before 20070622 does not clear a buffer for reading requests, which might allow local users to obtain sensitive information from previous requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-25T19:00:00.000Z
CVE-2007-3374 
Buffer overflow in cluster/cman/daemon/daemon.c in cman (redhat-cluster-suite) before 20070622 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via long client messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-25T20:00:00.000Z
CVE-2007-3375 
Stack-based buffer overflow in Lhaca File Archiver before 1.21 allows user-assisted remote attackers to execute arbitrary code via a crafted LZH archive, as exploited by malware such as Trojan.Lhdropper.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-25T20:00:00.000Z
CVE-2007-3376 
Buffer overflow in Apple Safari 3.0.2 on Windows XP SP2 allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long value in the title HTML tag, which triggers the overflow when the user adds the page as a bookmark.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-25T20:00:00.000Z
CVE-2007-3377 
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-25T21:00:00.000Z
CVE-2007-3378 
The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-29T18:00:00.000Z
CVE-2007-3379 
Unspecified vulnerability in the kernel in Red Hat Enterprise Linux (RHEL) 4 on the x86_64 platform allows local users to cause a denial of service (OOPS) via unspecified vectors related to the get_gate_vma function and the fuser command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-3380 
The Distributed Lock Manager (DLM) in the cluster manager for Linux kernel 2.6.15 allows remote attackers to cause a denial of service (loss of lock services) by connecting to the DLM port, which probably prevents other processes from accessing the service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-20T23:00:00.000Z
CVE-2007-3381 
The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and 2.19.x before 2.19.5 does not properly handle NULL return values from the g_strsplit function, which allows local users to cause a denial of service (persistent daemon crash) via a crafted command to the daemon's socket, related to (1) gdm.c and (2) gdmconfig.c in daemon/, and (3) gdmconfig.c and (4) gdmflexiserver.c in gui/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-3382 
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T22:00:00.000Z
CVE-2007-3383 
Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-25T17:00:00.000Z
CVE-2007-3384 
Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:11:00.000Z
CVE-2007-3385 
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T22:00:00.000Z
CVE-2007-3386 
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T22:00:00.000Z
CVE-2007-3387 
Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-30T23:00:00.000Z
CVE-2007-3388 
Multiple format string vulnerabilities in (1) qtextedit.cpp, (2) qdatatable.cpp, (3) qsqldatabase.cpp, (4) qsqlindex.cpp, (5) qsqlrecord.cpp, (6) qglobal.cpp, and (7) qsvgdevice.cpp in QTextEdit in Trolltech Qt 3 before 3.3.8 20070727 allow remote attackers to execute arbitrary code via format string specifiers in text used to compose an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-3389 
Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via a crafted chunked encoding in an HTTP response, possibly related to a zero-length payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T00:00:00.000Z
CVE-2007-3390 
Wireshark 0.99.5 and 0.10.x up to 0.10.14, when running on certain systems, allows remote attackers to cause a denial of service (crash) via crafted iSeries capture files that trigger a SIGTRAP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T00:00:00.000Z
CVE-2007-3391 
Wireshark 0.99.5 allows remote attackers to cause a denial of service (memory consumption) via a malformed DCP ETSI packet that triggers an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T00:00:00.000Z
CVE-2007-3392 
Wireshark before 0.99.6 allows remote attackers to cause a denial of service via malformed (1) SSL or (2) MMS packets that trigger an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T00:00:00.000Z
CVE-2007-3393 
Off-by-one error in the DHCP/BOOTP dissector in Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via crafted DHCP-over-DOCSIS packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T00:00:00.000Z
CVE-2007-3394 
Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the (1) artid parameter to mod.php in a viewarticle action (publisher mod) and the (2) bid parameter to banners.php in a click action.  NOTE: the mod.php viewdisk and viewlink vectors are already covered by CVE-2006-6873.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3396 
Cross-site scripting (XSS) vulnerability in index.wkf in KeyFocus (KF) web server 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the opsubmenu parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3397 
The web container in IBM WebSphere Application Server (WAS) before 6.0.2.21, and 6.1.x before 6.1.0.9, sends response data intended for a different request in certain circumstances after a closed connection error, which might allow remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3398 
LiteWEB 2.7 allows remote attackers to cause a denial of service (hang) via a large number of requests for nonexistent pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3399 
SQL injection vulnerability in include/get_userdata.php in Power Phlogger (PPhlogger) 2.2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3400 
The NCTAudioEditor2 ActiveX control in NCTWMAFile2.dll 2.6.2.157, as distributed in NCTAudioEditor and NCTAudioStudio 2.7, allows remote attackers to overwrite arbitrary files via the CreateFile method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3401 
PHP remote file inclusion vulnerability in footer.inc.php in B1G b1gBB 2.24 allows remote attackers to execute arbitrary PHP code via a URL in the tfooter parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3402 
SQL injection vulnerability in index.php in pagetool 1.07 allows remote attackers to execute arbitrary SQL commands via the news_id parameter in a pagetool_news action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3403 
Unrestricted file upload vulnerability in upload.php in dreamLog (aka dreamblog) 0.5 allows remote attackers to upload and execute arbitrary PHP code in uploads/images/ via the uploadedFile[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3404 
Directory traversal vulnerability in ShowImage.php in SiteDepth CMS 3.44 allows remote attackers to read arbitrary files via a .. (dot dot) in the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3405 
Multiple cross-site scripting (XSS) vulnerabilities in defter_yaz.asp in Lebisoft zdefter 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) ad and (2) konu parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-3406 
Multiple absolute path traversal vulnerabilities in Microsoft Internet Explorer 6 on Windows XP SP2 allow remote attackers to access arbitrary local files via the file: URI in the (1) src attribute of a (a) bgsound, (b) input, (c) EMBED, (d) img, or (e) script tag; (2) data attribute of an object tag; (3) value attribute of a param tag; (4) background attribute of a body tag; or (5) the background:url attribute declared in the BODY parameter of a STYLE tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T18:00:00.000Z
CVE-2007-3407 
Sergey Lyubka Simple HTTPD (shttpd) 1.38 allows remote attackers to obtain sensitive information (script source code) via a URL with a trailing encoded space (%20).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T18:00:00.000Z