rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-5271 
Multiple PHP remote file inclusion vulnerabilities in Trionic Cite CMS 1.2 rev9 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the bField[bf_data] parameter to (1) interface/editors/-custom.php or (2) interface/editors/custom.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-08T23:00:00.000Z
CVE-2007-5272 
SQL injection vulnerability in kategori.asp in Furkan Tastan Blog allows remote attackers to execute arbitrary SQL commands via the id parameter in a goster kat action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-08T23:00:00.000Z
CVE-2007-5273 
Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when an HTTP proxy server is used, allows remote attackers to violate the security model for an applet's outbound connections via a multi-pin DNS rebinding attack in which the applet download relies on DNS resolution on the proxy server, but the applet's socket operations rely on DNS resolution on the local machine, a different issue than CVE-2007-5274. NOTE: this is similar to CVE-2007-5232.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-08T23:00:00.000Z
CVE-2007-5274 
Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound connections via a multi-pin DNS rebinding attack dependent on the LiveConnect API, in which JavaScript download relies on DNS resolution by the browser, but JavaScript socket operations rely on separate DNS resolution by a Java Virtual Machine (JVM), a different issue than CVE-2007-5273.  NOTE: this is similar to CVE-2007-5232.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-08T23:00:00.000Z
CVE-2007-5275 
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-08T23:00:00.000Z
CVE-2007-5276 
Opera 9 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on port 80.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-08T23:00:00.000Z
CVE-2007-5277 
Microsoft Internet Explorer 6 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on port 80, a different issue than CVE-2006-4560.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-08T23:00:00.000Z
CVE-2007-5278 
Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to download files that were uploaded by users, as demonstrated by obtaining a directory listing via a direct request to /upload and then retrieving individual files.  NOTE: in a non-default configuration, the directory listing is denied, but filenames may be predicable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-08T23:00:00.000Z
CVE-2007-5279 
Heap-based buffer overflow in ConeXware PowerArchiver before 10.20.21 might allow remote attackers to execute arbitrary code via a long filename in a BlackHole archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T00:00:00.000Z
CVE-2007-5280 
Multiple cross-site scripting (XSS) vulnerabilities in messages.jsp in AppFuse before 2.0 Final allow remote attackers to inject arbitrary web script or HTML via unspecified input that is recorded in (1) success or (2) error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T00:00:00.000Z
CVE-2007-5281 
The Java Secure Socket Extension (JSSE) in the Hitachi Cosminexus Developer's Kit for Java in various Hitachi Cosminexus 7.5 products before 07-50-01, when using JSSE for SSL/TLS support, allows remote attackers to cause a denial of service via certain SSL/TLS handshake requests.  NOTE: this may be the same as CVE-2007-3698.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T00:00:00.000Z
CVE-2007-5282 
Hitachi Cosminexus Agent 03-00 through 03-05, and Cosminexus Library Standard and Web Edition 04-00 and 04-01, might allow remote attackers to cause a denial of service (agent process crash) via invalid data from clients other than Cosminexus Manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T00:00:00.000Z
CVE-2007-5283 
The TSC Domain Manager in Hitachi TPBroker Object Transaction Monitor and Cosminexus TPBroker Object Transaction Monitor 01-00 through 03-00 might allow attackers to cause a denial of service (crash) via invalid messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T00:00:00.000Z
CVE-2007-5289 
HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\TD_80, and then setting the file's properties to read-only.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-24T17:00:00.000Z
CVE-2007-5290 
Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to login.php and the (2) mode2 parameter to default.asp in an advanced_login mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5291 
Cross-site scripting (XSS) vulnerability in Edit.asp in DB Manager 2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5292 
Cross-site scripting (XSS) vulnerability in photos.cfm in Directory Image Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the backwardDirectory parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5293 
Multiple cross-site scripting (XSS) vulnerabilities in IDMOS 1.0-beta (aka Phoenix) allow remote attackers to inject arbitrary web script or HTML via the (1) err_msg parameter to error.php and the (2) content parameter to templates/simple/ia.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5294 
PHP remote file inclusion vulnerability in core/aural.php in IDMOS 1.0-beta (aka Phoenix) allows remote attackers to execute arbitrary PHP code via a URL in the site_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5295 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in (a) Wikepage Opus 13 2007.2 and (b) TipiWiki 2 allow remote attackers to inject arbitrary web script or HTML via the (1) PageContent and (2) PageName parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5296 
Multiple cross-site scripting (XSS) vulnerabilities in dblisttest.asp in dbList 8.1 allow remote attackers to inject arbitrary web script or HTML via the (1) db, (2) pagesize, (3) sort, (4) strKeyWords, and (5) table parameters.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5297 
Cross-site scripting (XSS) vulnerability in index.php in Minki 1.30 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5298 
Multiple PHP remote file inclusion vulnerabilities in CMS Creamotion allow remote attackers to execute arbitrary PHP code via a URL in the cfg[document_uri] parameter to (1) _administration/securite.php and (2) _administration/gestion_configurations/save_config.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5299 
Multiple directory traversal vulnerabilities in SkaDate 5.0 and 6.0, and possibly later versions such as 6.482, allow remote attackers to read arbitrary files via a .. (dot dot) in the view_mode parameter to (1) featured_list.php and (2) online_list.php in member/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5300 
Off-by-one error in the do_login_loop function in libwzd-core/wzd_login.c in wzdftpd 0.8.0, 0.8.2, and possibly other versions allows remote attackers to cause a denial of service (daemon crash) via a long USER command that triggers a stack-based buffer overflow.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5301 
Buffer overflow in the vorbis_stream_info function in input/vorbis/vorbis_engine.c (aka the vorbis input plugin) in AlsaPlayer before 0.99.80-rc3 allows remote attackers to execute arbitrary code via a .OGG file with long comments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5302 
Multiple cross-site scripting (XSS) vulnerabilities in HP System Management Homepage (SMH) in HP-UX B.11.11, B.11.23, and B.11.31, and SMH before 2.1.10 for Linux and Windows, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5303 
Cross-site scripting (XSS) vulnerability in news_page.php in SnewsCMS Rus 2.1 allows remote attackers to inject arbitrary web script or HTML via the page_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5304 
Multiple cross-site scripting (XSS) vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) repertimage parameter to utilisateurs/vousetesbannis.php, the (2) elseifvotetxtresultatduvote parameter to utilisateurs/votesresultats.php, and the (3) elseifforumtxtmenugeneraleduforum parameter to moduleajouter/depot/adminforum.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5305 
Multiple PHP remote file inclusion vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the (1) contenus parameter to (a) contenus.php; the (2) tpelseifportalrepertoire parameter to (b) votes.php, (c) espaceperso.php, (d) enregistrement.php, (e) commentaire.php, and (f) coeurusr.php in utilisateurs/, and (g) articles/fonctions.php and (h) depot/fonctions.php in moduleajouter/; the (3) corpsdesign parameter to (i) articles/usrarticles.php and (j) depot/usrdepot.php in moduleajouter/; and possibly other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5306 
ELSEIF CMS Beta 0.6 allows remote attackers to obtain sensitive information (full path) via unspecified vectors to utilisateurs/votesresultats.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5307 
ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a .php file via externe/swfupload/upload.php.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in ELSEIF CMS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5308 
SQL injection vulnerability in galerie.php in PHP Homepage M (phpHPm) 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T18:00:00.000Z
CVE-2007-5309 
PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery (com_wmtgallery) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T21:00:00.000Z
CVE-2007-5310 
PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (com_wmtportfolio) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T21:00:00.000Z
CVE-2007-5311 
Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T21:00:00.000Z
CVE-2007-5312 
Cross-site scripting (XSS) vulnerability in TorrentTrader Classic 1.07 allows remote attackers to inject arbitrary web script or HTML via the (1) color parameter to pjirc/css.php and the (2) cat parameter to browse.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T21:00:00.000Z
CVE-2007-5313 
PHP remote file inclusion vulnerability in install/config.php in Picturesolution 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T21:00:00.000Z
CVE-2007-5314 
PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the PEARPATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T21:00:00.000Z
CVE-2007-5315 
PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the livealbum_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T21:00:00.000Z
CVE-2007-5316 
SQL injection vulnerability in browsecats.php in Softbiz Jobs and Recruitment Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T21:00:00.000Z
CVE-2007-5318 
Unspecified vulnerability in preview.php in TYPOlight webCMS 2.4.6 allows remote attackers to download arbitrary files via the src parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T21:00:00.000Z
CVE-2007-5319 
Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 8, 9, and 10 allows local users with console (/dev/console) access to cause a denial of service ("unusable" system console) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T22:00:00.000Z
CVE-2007-5320 
Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete arbitrary files via the CacheFile attribute in the ThumbnailXpres.1 ActiveX control (PegasusImaging.ActiveX.ThumnailXpress1.dll) or (2) overwrite arbitrary files via the CompactFile function in the ImagXpress.8 ActiveX control (PegasusImaging.ActiveX.ImagXpress8.dll).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T22:00:00.000Z
CVE-2007-5321 
Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T22:00:00.000Z
CVE-2007-5322 
Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote attackers to execute arbitrary programs by specifying them as an argument to the FoxDoCmd function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-09T22:00:00.000Z
CVE-2007-5323 
The RepliStor Server Service in EMC Replistor 6.1.3 allows remote attackers to execute arbitrary code via a size value that causes RepliStor to create a smaller buffer than expected, which triggers a buffer overflow when that buffer is used in a recv function call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-11T00:00:00.000Z
CVE-2007-5325 
Multiple buffer overflows in (1) the Message Engine and (2) AScore.dll in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T00:00:00.000Z
CVE-2007-5326 
Multiple buffer overflows in (1) RPC and (2) rpcx.dll in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T00:00:00.000Z
CVE-2007-5327 
Stack-based buffer overflow in the RPC interface for the Message Engine (mediasvr.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to execute arbitrary code via a long argument in the 0x10d opnum.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T00:00:00.000Z
CVE-2007-5328 
The Message Engine RPC service in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows attackers to execute arbitrary code by using certain "insecure method calls" to modify the file system and registry, aka "Privileged function exposure."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T00:00:00.000Z
CVE-2007-5329 
Unspecified vulnerability in dbasvr in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, has unknown impact and attack vectors related to memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T00:00:00.000Z
CVE-2007-5330 
The cadbd RPC service in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to (1) execute arbitrary code via stack-based buffer overflows in unspecified RPC procedures, and (2) trigger memory corruption related to the use of "handle" RPC arguments as pointers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T00:00:00.000Z
CVE-2007-5331 
Queue.dll for the message queuing service (LQserver.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to execute arbitrary code via a malformed ONRPC protocol request for operation 0x76, which causes ARCserve Backup to dereference arbitrary pointers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T00:00:00.000Z
CVE-2007-5332 
Multiple unspecified vulnerabilities in (1) mediasvr and (2) caloggerd in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, have unknown impact and attack vectors related to memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T00:00:00.000Z
CVE-2007-5333 
Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.  NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-12T00:00:00.000Z
CVE-2007-5334 
Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 can hide the window's titlebar when displaying XUL markup language documents, which makes it easier for remote attackers to conduct phishing and spoofing attacks by setting the hidechrome attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-21T20:00:00.000Z
CVE-2007-5335 
Mozilla Firefox 2.0 before 2.0.0.8 allows remote attackers to obtain sensitive system information by using the addMicrosummaryGenerator sidebar method to access file: URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-24T00:00:00.000Z
CVE-2007-5337 
Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5, when running on Linux systems with gnome-vfs support, might allow remote attackers to read arbitrary files on SSH/sftp servers that accept key authentication by creating a web page on the target server, in which the web page contains URIs with (1) smb: or (2) sftp: schemes that access other files from the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-21T20:00:00.000Z
CVE-2007-5338 
Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allow remote attackers to execute arbitrary Javascript with user privileges by using the Script object to modify XPCNativeWrappers in a way that causes the script to be executed when a chrome action is performed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-21T20:00:00.000Z