rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-2489 
Heap-based buffer overflow in LiveData Protocol Server 5.00.045, and other versions before update 500062 (5.00.062), allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted request for a WSDL file that causes a negative length to be used in a strncpy call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-03T23:00:00.000Z
CVE-2007-2490 
Unspecified vulnerability in LiveData Server before 5.00.62 allows remote attackers to cause a denial of service (exit) via crafted Connection-Oriented Transport Protocol (COTP) packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-03T23:00:00.000Z
CVE-2007-2491 
The PIIX4 power management subsystem in EMC VMware Workstation 5.5.3.34685 and VMware Server 1.0.1.29996 allows local users to write to arbitrary memory locations via a crafted poke to I/O port 0x1004, triggering a denial of service (virtual machine crash) or other unspecified impact, a related issue to CVE-2007-1337.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T00:00:00.000Z
CVE-2007-2492 
SQL injection vulnerability in index.php in the v4bJournal module for PostNuke allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a journal_comment action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T00:00:00.000Z
CVE-2007-2493 
PHP remote file inclusion vulnerability in faq.php in the FAQ & RULES 2.0.0 and earlier module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T00:00:00.000Z
CVE-2007-2494 
Multiple stack-based buffer overflows in the PowerPointOCX ActiveX control in PowerPointViewer.ocx 3.1.0.3 allow remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) DoOleCommand, (2) FTPDownloadFile, (3) FTPUploadFile, (4) HttpUploadFile, (5) Save, (6) SaveWebFile, (7) HttpDownloadFile, (8) Open, or (9) OpenWebFile property value.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T00:00:00.000Z
CVE-2007-2495 
Multiple stack-based buffer overflows in the ExcelOCX ActiveX control in ExcelViewer.ocx 3.1.0.6 allow remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) DoOleCommand, (2) FTPDownloadFile, (3) FTPUploadFile, (4) HttpUploadFile, (5) Save, (6) SaveWebFile, (7) HttpDownloadFile, (8) Open, or (9) OpenWebFile property value.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T00:00:00.000Z
CVE-2007-2496 
The WordOCX ActiveX control in WordViewer.ocx 3.2.0.5 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) DoOleCommand, (2) FTPDownloadFile, (3) FTPUploadFile, (4) HttpUploadFile, (5) GotoPage, (6) Save, (7) SaveWebFile, (8) HttpDownloadFile, (9) Open, (10) OpenWebFile, (11) SaveAs, or (12) ShowWordStandardDialog property value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T00:00:00.000Z
CVE-2007-2497 
RealNetworks RealPlayer 10 Gold allows remote attackers to cause a denial of service (memory consumption) via a certain .ra file.  NOTE: this issue was referred to as a "memory leak," but it is not clear if this is correct.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T00:00:00.000Z
CVE-2007-2498 
libmp4v2.dll in Winamp 5.02 through 5.34 allows user-assisted remote attackers to execute arbitrary code via a certain .MP4 file.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T00:00:00.000Z
CVE-2007-2499 
Multiple cross-site scripting (XSS) vulnerabilities in DVDdb 0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the movieid parameter to loan.php or (2) the s parameter to listmovies.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T00:00:00.000Z
CVE-2007-2500 
server/parser/sprite_definition.cpp in GNU Gnash (aka GNU Flash Player) 0.7.2 allows remote attackers to execute arbitrary code via a large number of SHOWFRAME elements within a DEFINESPRITE element, which triggers memory corruption and enables the attacker to call free with an arbitrary address, probably resultant from a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T00:00:00.000Z
CVE-2007-2501 
Eval injection vulnerability in codepress.html in CodePress before 0.9.4 allows remote attackers to execute arbitrary code via certain input that is used in an eval function call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T01:00:00.000Z
CVE-2007-2502 
Unspecified vulnerability in HP ProCurve 9300m Series switches with software 08.0.01c through 08.0.01j allows remote attackers to cause a denial of service via unknown vectors, a different switch series than CVE-2006-4015.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T01:00:00.000Z
CVE-2007-2503 
Directory traversal vulnerability in turbulence.php in PHP Turbulence 0.0.1 alpha allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[tcore] parameter.  NOTE: this vulnerability is disputed by CVE and a reliable third party because a direct request to user/turbulence.php triggers a fatal error before inclusion
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T01:00:00.000Z
CVE-2007-2504 
PHP remote file inclusion vulnerability in user/turbulence.php in PHP Turbulence 0.0.1 alpha allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[tcore] parameter.  NOTE: this vulnerability is disputed by CVE and a reliable third party because a direct request to user/turbulence.php triggers a fatal error before inclusion
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T01:00:00.000Z
CVE-2007-2505 
Stack-based buffer overflow in InterVations MailCOPA 8.01 20070323 allows user-assisted remote attackers to execute arbitrary code via a long command line argument, as demonstrated by a long string in the subject field in a mailto URI.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T01:00:00.000Z
CVE-2007-2506 
WebSpeed 3.x in OpenEdge 10.x in Progress Software Progress 9.1e, and certain other 9.x versions, allows remote attackers to cause a denial of service (infinite loop and daemon hang) via a messenger URL that invokes _edit.r with no additional parameters, as demonstrated by requests for cgiip.exe or wsisa.dll with WService=wsbroker1/_edit.r in the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T01:00:00.000Z
CVE-2007-2507 
Directory traversal vulnerability in includes/download.php in Treble Designs 1024 CMS 0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the item parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-04T01:00:00.000Z
CVE-2007-2508 
Multiple stack-based buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2 Build 1174 allow remote attackers to execute arbitrary code via crafted data to (1) TCP port 5168, which triggers an overflow in the CAgRpcClient::CreateBinding function in the AgRpcCln.dll library in SpntSvc.exe; or (2) TCP port 3628, which triggers an overflow in EarthAgent.exe.  NOTE: both issues are reachable via TmRpcSrv.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-2509 
CRLF injection vulnerability in the ftp_putcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T00:00:00.000Z
CVE-2007-2510 
Buffer overflow in the make_http_soap_request function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" (slash) characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T00:00:00.000Z
CVE-2007-2511 
Buffer overflow in the user_filter_factory_create function in PHP before 5.2.2 has unknown impact and local attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T00:00:00.000Z
CVE-2007-2512 
Alcatel-Lucent IP-Touch Telephone running OmniPCX Enterprise 7.0 and later enables the mini switch by default, which allows attackers to gain access to the voice VLAN via daisy-chained systems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-07T21:00:00.000Z
CVE-2007-2513 
Novell GroupWise 7 before SP2 20070524, and GroupWise 6 before 6.5 post-SP6 20070522, allows remote attackers to obtain credentials via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T16:00:00.000Z
CVE-2007-2514 
Stack-based buffer overflow in XferWan.exe as used in multiple products including (1) Symantec Discovery 6.5, (2) Numara Asset Manager 8.0, and (3) Centennial UK Ltd Discovery 2006 Feature Pack, allows remote attackers to execute arbitrary code via a long request. NOTE: this might be a reservation duplicate of CVE-2007-1173.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-06T10:00:00.000Z
CVE-2007-2519 
Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0.  NOTE: it could be argued that this does not cross privilege boundaries in typical installations, since the code being installed could perform the same actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-22T19:00:00.000Z
CVE-2007-2520 
SQL injection vulnerability in admin.php in MyNews 0.10, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the authacc cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T17:00:00.000Z
CVE-2007-2521 
PHP remote file inclusion vulnerability in common.php in E-GADS! before 2.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the locale parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T18:00:00.000Z
CVE-2007-2522 
Stack-based buffer overflow in the inoweb Console Server in CA Anti-Virus for the Enterprise r8, Threat Manager r8, Anti-Spyware for the Enterprise r8, and Protection Suites r3 allows remote attackers to execute arbitrary code via a long (1) username or (2) password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-11T03:55:00.000Z
CVE-2007-2523 
CA Anti-Virus for the Enterprise r8 and Threat Manager r8 before 20070510 use weak permissions (NULL security descriptor) for the Task Service shared file mapping, which allows local users to modify this mapping and gain privileges by triggering a stack-based buffer overflow in InoCore.dll before 8.0.448.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-11T03:55:00.000Z
CVE-2007-2524 
Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action.  NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-2525 
Memory leak in the PPP over Ethernet (PPPoE) socket implementation in the Linux kernel before 2.6.21-git8 allows local users to cause a denial of service (memory consumption) by creating a socket using connect, and releasing it before the PPPIOCGCHAN ioctl is initialized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-2526 
Heap-based buffer overflow in the ConnectAsyncEx function in VNC Viewer ActiveX control (scvncctrl.dll) in the SmartCode VNC Manager 3.6 allows remote attackers to execute arbitrary code via a long argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-2527 
Multiple PHP remote file inclusion vulnerabilities in DynamicPAD before 1.03.31 allow remote attackers to execute arbitrary PHP code via a URL in the HomeDir parameter to (1) dp_logs.php or (2) index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-2528 
Buffer overflow in AgRpcCln.dll for Trend Micro ServerProtect 5.58 for Windows before Security Patch 3 Build 1176 allows remote attackers to execute arbitrary code via unknown vectors related to RPC requests. NOTE: this is probably a different vulnerability than CVE-2007-2508.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-2529 
Integer signedness error in the acl (facl) system call in Solaris 10 before 20070507 allows local users to cause a denial of service (kernel panic) and possibly gain privileges via a certain argument, related to ACE_SETACL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T00:00:00.000Z
CVE-2007-2530 
Multiple PHP remote file inclusion vulnerabilities in Tropicalm Crowell Resource 4.5.2 allow remote attackers to execute arbitrary PHP code via a URL in the RESPATH parameter to (1) dosearch.php or (2) printfriendly.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T00:00:00.000Z
CVE-2007-2531 
PHP remote file inclusion vulnerability in berylium-classes.php in Berylium2 2003-08-18 allows remote attackers to execute arbitrary PHP code via a URL in the beryliumroot parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T00:00:00.000Z
CVE-2007-2532 
Multiple cross-site scripting (XSS) vulnerabilities in Minh Nguyen Duong Obie Website Mini Web Shop 2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) to (1) sendmail.php or (2) order_form.php, different vectors than CVE-2006-6734.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T00:00:00.000Z
CVE-2007-2533 
Multiple buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2- Build 1174 allow remote attackers to execute arbitrary code via a crafted RPC message processed by the (1) the RPCFN_ActiveRollback function in (a) stcommon.dll, or the (2) ENG_SetRealTimeScanConfigInfo or (3) ENG_SendEmail functions in (b) eng50.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T00:00:00.000Z
CVE-2007-2534 
Multiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arbitrary SQL commands via the (1) ADMIN_USER (USER) and (2) ADMIN_PASS (PASS) parameters during a login. NOTE: CVE disputes this vulnerability, since ADMIN_USER/ADMIN_PASS are initialized before use
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T00:00:00.000Z
CVE-2007-2535 
WinAce allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2536 
PicoZip allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2537 
Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via a (1) nickname or (2) Id in a cookie, or (3) the X-Forwarded-For (X_FORWARDED_FOR) HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2538 
SQL injection vulnerability in class/debug/debug_show.php in RunCms 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the executed_queries array parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2539 
The show_files function in RunCms 1.5.2 and earlier allows remote attackers to obtain sensitive information (file existence and file metadata) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2540 
Multiple PHP remote file inclusion vulnerabilities in PMECMS 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config[pathMod] parameter to index.php in (1) mod/image/, (2) mod/liens/, (3) mod/liste/, (4) mod/special/, or (5) mod/texte/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2541 
PHP remote file inclusion vulnerability in includes/ajax_listado.php in Versado CMS 1.07 allows remote attackers to execute arbitrary PHP code via a URL in the urlModulo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2542 
PHP remote file inclusion vulnerability in header.php in workbench survival guide 0.11 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2543 
SQL injection vulnerability in game.php in the Flashgames 1.0.1 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the lid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2544 
PHP remote file inclusion vulnerability in templates/default/tpl_message.php in PHP TopTree BBS 2.0.1a and earlier allows remote attackers to execute arbitrary PHP code via a URL in the right_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2545 
Multiple PHP remote file inclusion vulnerabilities in Persism CMS 0.9.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the system[path] parameter to (1) blocks/headerfile.php, (2) files/blocks/latest_files.php, (3) filters/headerfile.php, (4) forums/blocks/latest_posts.php, (5) groups/headerfile.php, (6) links/blocks/links.php, (7) menu/headerfile.php, (8) news/blocks/latest_news.php, (9) settings/headerfile.php, or (10) users/headerfile.php, in modules/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T01:00:00.000Z
CVE-2007-2546 
Session fixation vulnerability in Simple Machines Forum (SMF) 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T10:00:00.000Z
CVE-2007-2547 
Cross-site scripting (XSS) vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 allows remote attackers to inject arbitrary web script or HTML via the l parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T10:00:00.000Z
CVE-2007-2548 
Unspecified vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 has unknown impact and an l remote attack vector, related to "Cookie Manipulation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T10:00:00.000Z
CVE-2007-2549 
SQL injection vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 allows remote attackers to execute arbitrary SQL commands via the (1) c or (2) quantity parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T10:00:00.000Z
CVE-2007-2550 
Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a cookie name beginning with "ccSID" to (1) cart.php or (2) index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T10:00:00.000Z
CVE-2007-2551 
Cross-site scripting (XSS) vulnerability in usersettings.php in WikkaWiki (Wikka Wiki) before 1.1.6.3 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T10:00:00.000Z
CVE-2007-2552 
The RecentChanges feature in WikkaWiki (Wikka Wiki) before 1.1.6.3 allows remote attackers to obtain the names, and possibly revision notes and dates, of private pages via RSS feeds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T10:00:00.000Z
CVE-2007-2553 
Unspecified vulnerability in dop in HP Tru64 UNIX 5.1B-4, 5.1B-3, and 5.1A PK6 allows local users to gain privileges via a large amount of data in the environment, as demonstrated by a long environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T17:00:00.000Z
CVE-2007-2554 
Associated Press (AP) Newspower 4.0.1 and earlier uses a default blank password for the MySQL root account, which allows remote attackers to insert or modify news articles via shows.tblscript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T17:00:00.000Z
CVE-2007-2555 
Unspecified vulnerability in Default.aspx in Podium CMS allows remote attackers to have an unknown impact, possibly session fixation, via a META HTTP-EQUIV Set-cookie expression in the id parameter, related to "cookie manipulation."  NOTE: this issue might be cross-site scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T17:00:00.000Z
CVE-2007-2556 
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For (X_FORWARDED_FOR) HTTP header, as demonstrated by a request to the /nk/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T18:00:00.000Z
CVE-2007-2557 
MOStlyDB Admin in Mambo 4.6.1 does not properly check privileges, which allows remote authenticated administrators to have an unknown impact via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T18:00:00.000Z