Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2008-1530
GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."
Affected Products: n/a
References: [{'name': 'ADV-2008-1056', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1056/references'}, {'name': '[Announce] 20080326 GnuPG 1.4.9 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html'}, {'name': 'gnupg-keys-code-execution(41547)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41547'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ocert.org/advisories/ocert-2008-1.html'}, {'name': '28487', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28487'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.g10code.com/gnupg/issue894'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=214990'}, {'name': '29568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29568'}]
CVE State: PUBLISHED
Explain CVE-2008-1531
The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://trac.lighttpd.net/trac/ticket/285#comment:21'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-2407'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=214892'}, {'name': 'DSA-1540', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1540'}, {'name': 'SUSE-SR:2008:011', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html'}, {'name': '43788', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/43788'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.lighttpd.net/trac/changeset/2136'}, {'name': 'FEDORA-2008-3343', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00562.html'}, {'name': 'GLSA-200804-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200804-08.xml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://trac.lighttpd.net/trac/ticket/285#comment:18'}, {'name': '30023', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30023'}, {'name': '29505', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29505'}, {'name': '20080331 rPSA-2008-0132-1 lighttpd', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490323/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0132'}, {'name': '28489', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28489'}, {'name': '29636', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29636'}, {'name': 'ADV-2008-1063', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1063/references'}, {'name': '29544', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29544'}, {'name': 'lighttpd-sslerror-dos(41545)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41545'}, {'name': '29649', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29649'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.lighttpd.net/trac/changeset/2140'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.lighttpd.net/trac/changeset/2139'}, {'name': 'FEDORA-2008-3376', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00587.html'}]
CVE State: PUBLISHED
Explain CVE-2008-1532
Perlbal before 1.70, when buffered upload is enabled, allows remote attackers to cause a denial of service (crash) via a zero-byte chunked upload.
Affected Products: n/a
References: [{'name': 'ADV-2008-1045', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1045/references'}, {'name': 'perlbal-clientproxy-dos(41538)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41538'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://search.cpan.org/src/BRADFITZ/Perlbal-1.70/CHANGES'}, {'name': 'FEDORA-2008-2788', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00672.html'}, {'name': '28491', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28491'}, {'name': '29565', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29565'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=439054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=214784'}, {'name': '29619', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29619'}, {'name': 'FEDORA-2008-2778', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00665.html'}]
CVE State: PUBLISHED
Explain CVE-2008-1533
Unspecified vulnerability in the XML-RPC Blogger API plugin in Joomla! 1.5 allows remote attackers to perform unauthorized article operations on articles via unknown vectors.
Affected Products: n/a
References: [{'name': 'joomla-xmlrpc-data-manipulation(41563)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41563'}, {'name': '28861', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28861'}, {'name': '27719', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27719'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/content/view/4560/1/'}]
CVE State: PUBLISHED
Explain CVE-2008-1534
Multiple directory traversal vulnerabilities in PowerPHPBoard 1.00b allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) settings[footer] parameter to footer.inc.php and the (2) settings[header] parameter to header.inc.php.
Affected Products: n/a
References: [{'name': 'powerphpboard-footerheader-file-include(41403)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41403'}, {'name': '3782', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3782'}, {'name': '5303', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5303'}, {'name': '20080324 [DSECRG-08-021] Multiple LFI in PowerPHPBoard 1.00b', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490011/100/0/threaded'}, {'name': '28421', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28421'}, {'name': 'ADV-2008-0992', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0992/references'}]
CVE State: PUBLISHED
Explain CVE-2008-1535
SQL injection vulnerability in the Matti Kiviharju rekry (aka com_rekry or rekry!Joom) 1.0.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the op_id parameter in a view action to index.php.
Affected Products: n/a
References: [{'name': 'rekry!joom-index-sql-injection(41385)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41385'}, {'name': '29510', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29510'}, {'name': '5297', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5297'}, {'name': '28422', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28422'}]
CVE State: PUBLISHED
Explain CVE-2008-1536
Cross-site scripting (XSS) vulnerability in index.php in Pictures Pro (aka Tim Grissett) Photo Cart 4.1 allows remote attackers to inject arbitrary web script or HTML via the amessage parameter.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '28430', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28430'}, {'name': 'photocart-index-xss(41409)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41409'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.picturespro.com/community/forums/photo_cart/index.php?see=viewTopic&topic=296795080324075103'}, {'name': '29490', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29490'}]
CVE State: PUBLISHED
Explain CVE-2008-1537
Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers to include and execute arbitrary local files via a ..  (dot dot) in the page parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
Affected Products: n/a
References: [{'name': '20080324 [DSECRG-08-019] LFI in PowerBook 1.21', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490008/100/0/threaded'}, {'name': '5302', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5302'}, {'name': 'powerbook-index-file-include(41393)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41393'}, {'name': '3783', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3783'}, {'name': '29480', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29480'}, {'name': '28418', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28418'}]
CVE State: PUBLISHED
Explain CVE-2008-1538
Cross-site scripting (XSS) vulnerability in searchAction.do in ManageEngine EventLog Analyzer 5 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Fixed in EventLog Analyzer 10.0 Build 10000.
Affected Products: n/a
References: [{'name': 'eventloganalyzer-searchaction-xss(41408)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41408'}, {'name': '29524', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29524'}]
CVE State: PUBLISHED
Explain CVE-2008-1539
SQL injection vulnerability in includes/dynamic_titles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module.
Affected Products: n/a
References: [{'name': '5295', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5295'}, {'name': '28410', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28410'}, {'name': 'platinum-modules-sql-injection(41387)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41387'}]
CVE State: PUBLISHED
Explain CVE-2008-1540
SQL injection vulnerability in the Datsogallery (com_datsogallery) 1.3.1 module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '28361', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28361'}, {'name': 'datsogallery-index-sql-injection(41348)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41348'}]
CVE State: PUBLISHED
Explain CVE-2008-1541
Directory traversal vulnerability in cgi-bin/his-webshop.pl in HIS Webshop 2.50 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter.
Affected Products: n/a
References: [{'name': '5304', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5304'}, {'name': 'hiswebshop-hiswebshop-directory-traversal(41407)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41407'}, {'name': '28425', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28425'}, {'name': '20080324 HIS-webshop is vulnerable against Directory-Traversal (www.shoppark.de)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490016/100/0/threaded'}, {'name': 'ADV-2008-0991', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0991/references'}, {'name': '29478', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29478'}, {'name': '3784', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3784'}]
CVE State: PUBLISHED
Explain CVE-2008-1542
Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root account, which allows remote attackers to obtain administrative access via a telnet login, a different vulnerability than CVE-2008-1262.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://airspan4wimax.googlepages.com/'}, {'name': 'micromax-default-password(41437)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41437'}, {'name': 'VU#446403', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/446403'}]
CVE State: PUBLISHED
Explain CVE-2008-1543
The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sharemethods.net/nepal/servlet/open?keeppath=false&aid=29820'}, {'name': 'wimaxprost-interface-default-password(41567)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41567'}]
CVE State: PUBLISHED
Explain CVE-2008-1544
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
Affected Products: n/a
References: [{'name': 'MS08-031', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-031'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.mindedsecurity.com/MSA02240108.html'}, {'name': '29453', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29453'}, {'name': 'oval:org.mitre.oval:def:5291', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5291'}, {'name': 'ADV-2008-1778', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1778'}, {'name': '1020226', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1020226'}, {'name': 'TA08-162B', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA08-162B.html'}, {'name': 'HPSBST02344', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=121380194923597&w=2'}, {'name': '28379', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28379'}, {'name': '20080321 [MSA02240108] IE7 allows overwriting of several headers leading to Http request Splitting and smuggling.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489954/100/0/threaded'}, {'name': 'ADV-2008-0980', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0980'}, {'name': 'SSRT080087', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=121380194923597&w=2'}, {'name': '3785', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3785'}]
CVE State: PUBLISHED
Explain CVE-2008-1545
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
Affected Products: n/a
References: [{'name': '29453', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29453'}, {'name': '3786', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3786'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.mindedsecurity.com/MSA01240108.html'}, {'name': 'ADV-2008-0980', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0980'}, {'name': '20080321 [MSA01240108] IE7 Transfer-Encoding: chunked allows Request Splitting/Smuggling.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489960/100/0/threaded'}, {'name': 'ie-setrequestheader-chunk-security-bypass(42804)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/42804'}]
CVE State: PUBLISHED
Explain CVE-2008-1546
servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-conditioning control systems allows remote attackers to cause a denial of service (air-conditioning outage) via an XML document containing a setRequest command.
Affected Products: n/a
References: [{'name': '28406', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28406'}, {'name': 'mitsubishielectric-gb50a-unath-access(41503)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41503'}, {'name': '3794', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3794'}, {'name': '20080322 hacking the mitsubishi GB-50A', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489970/100/0/threaded'}, {'name': '20071117 security contact for mitsubishi electric?', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/483862/2008-03-21/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-1547
Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter.
Affected Products: n/a
References: [{'name': '20081017 Re: MS OWA 2003 Redirection Vulnerability - [MSRC 7368br]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/497500/100/0/threaded'}, {'name': '4441', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/4441'}, {'name': '31765', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/31765'}, {'name': '20081019 Re: MS OWA 2003 Redirection Vulnerability - [MSRC7368br]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/497534/100/0/threaded'}, {'name': 'owa-redir-phishing(46061)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/46061'}, {'name': '20081015 Re: MS OWA 2003 Redirection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/497390/100/0/threaded'}, {'name': '20081015 MS OWA 2003 Redirection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/497374/100/0/threaded'}, {'name': '20081015 Re: Re: MS OWA 2003 Redirection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/497433/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-1548
Multiple cross-site scripting (XSS) vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to inject arbitrary web script or HTML via the (1) UserName parameter to loginproc.asp and the (2) usr parameter to Login.asp.
Affected Products: n/a
References: [{'name': '28436', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28436'}, {'name': 'abi-loginproc-login-xss(41430)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41430'}, {'name': '29533', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29533'}, {'name': '3787', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3787'}, {'name': '20080325 aeries browser interface(ABI) 3.8.3.14 Remote SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490033/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-1549
Multiple SQL injection vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to execute arbitrary SQL commands via the (1) GrdBk parameter to GradebookOptions.asp and the (2) SchlCode variable to loginproc.asp, a different vector than CVE-2008-0942.
Affected Products: n/a
References: [{'name': '28436', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28436'}, {'name': '29533', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29533'}, {'name': '3787', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3787'}, {'name': '20080325 aeries browser interface(ABI) 3.8.3.14 Remote SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490033/100/0/threaded'}, {'name': 'abi-gradebookoptions-loginproc-sql-injection(41429)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41429'}]
CVE State: PUBLISHED
Explain CVE-2008-1550
Multiple cross-site scripting (XSS) vulnerabilities in index.php in CubeCart 4.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the _a parameter in a searchStr action and the (2) Submit parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://holisticinfosec.org/content/view/51/45/'}, {'name': '28452', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28452'}, {'name': '29532', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29532'}, {'name': 'cubecart-indexphp-xss(41559)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41559'}]
CVE State: PUBLISHED
Explain CVE-2008-1551
SQL injection vulnerability in viewcat.php in the Photo 3.02 module for RunCMS allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Affected Products: n/a
References: [{'name': '29513', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29513'}, {'name': 'photo-viewcat-sql-injection(41378)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41378'}, {'name': '5290', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5290'}, {'name': '28395', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28395'}]
CVE State: PUBLISHED
Explain CVE-2008-1552
The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which triggers an integer underflow, signedness error, and a buffer overflow.  NOTE: the researcher describes this as an integer overflow, but CVE uses the "underflow" term in cases of wraparound from unsigned subtraction.
Affected Products: n/a
References: [{'name': '29465', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29465'}, {'name': '29622', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29622'}, {'name': 'SUSE-SR:2008:008', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html'}, {'name': '1019690', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019690'}, {'name': 'GLSA-200804-27', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200804-27.xml'}, {'name': '3795', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3795'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://silcnet.org/general/news/?item=server_20080320_1'}, {'name': '20080325 CORE-2007-1212: SILC pkcs_decode buffer overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490069/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://silcnet.org/general/news/?item=toolkit_20080320_1'}, {'name': '29463', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29463'}, {'name': 'FEDORA-2008-2641', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00538.html'}, {'name': 'ADV-2008-0974', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0974/references'}, {'name': '29946', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29946'}, {'name': '28373', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28373'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/?action=item&id=2206'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://silcnet.org/general/news/?item=client_20080320_1'}, {'name': 'MDVSA-2008:158', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2008:158'}, {'name': 'silc-silcpkcs1decode-bo(41474)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41474'}, {'name': 'FEDORA-2008-2616', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00513.html'}]
CVE State: PUBLISHED
Explain CVE-2008-1553
Directory traversal vulnerability in mod.php in TopperMod 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the to parameter.
Affected Products: n/a
References: [{'name': 'toppermod-mod-file-include(41442)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41442'}, {'name': '28449', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28449'}, {'name': '5312', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5312'}]
CVE State: PUBLISHED
Explain CVE-2008-1554
SQL injection vulnerability in account/index.php in TopperMod 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a non-alphanumeric first character the localita parameter, which bypasses a protection mechanism.
Affected Products: n/a
References: [{'name': '28447', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28447'}, {'name': '5311', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5311'}, {'name': 'toppermod-mod-sql-injection(41441)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41441'}, {'name': '20080327 TopperMod 2.0 Remote SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490163/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-1555
Directory traversal vulnerability in system/_b/contentFiles/gbincluder.php in BolinOS 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _bFileToInclude parameter.
Affected Products: n/a
References: [{'name': '28445', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28445'}, {'name': '5309', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5309'}, {'name': '3788', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3788'}, {'name': '20080325 [DSECRG-08-022] Multiple Security Vulnerabilities in Bolinos 4.6.1', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490058/100/0/threaded'}, {'name': 'bolinos-gbincluder-file-include(41431)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41431'}, {'name': '29535', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29535'}]
CVE State: PUBLISHED
Explain CVE-2008-1556
Multiple cross-site scripting (XSS) vulnerabilities in BolinOS 4.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) system/actionspages/_b/contentFiles/gBImageViewer.php, (2) ForEditor parameter to (b) system/actionspages/_b/contentFiles/gBselectorContents.php, (3) the PATH_INFO to (c) gBLoginPage.php and (d) gBPassword.php in system/actionspages/_b/contentFiles/, (4) formlogin parameter to system/actionspages/_b/contentFiles/gBLoginPage.php, and the (5) bolini_searchengine46Search parameter to (e) help/index.php.
Affected Products: n/a
References: [{'name': '28445', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28445'}, {'name': 'bolinos-multiple-xss(41432)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41432'}, {'name': '5309', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5309'}, {'name': '3788', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3788'}, {'name': '20080325 [DSECRG-08-022] Multiple Security Vulnerabilities in Bolinos 4.6.1', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490058/100/0/threaded'}, {'name': '29535', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29535'}]
CVE State: PUBLISHED
Explain CVE-2008-1557
BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/contentFiles/gBphpInfo.php, which calls the phpinfo function.
Affected Products: n/a
References: [{'name': '5309', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5309'}, {'name': '3788', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3788'}, {'name': '20080325 [DSECRG-08-022] Multiple Security Vulnerabilities in Bolinos 4.6.1', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490058/100/0/threaded'}, {'name': 'bolinos-gbphpinfo-information-disclosure(41434)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41434'}, {'name': '29535', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29535'}]
CVE State: PUBLISHED
Explain CVE-2008-1558
Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote attackers to overwrite memory and execute arbitrary code via a large streamid SDP parameter.  NOTE: this issue has been referred to as an integer overflow.
Affected Products: n/a
References: [{'name': 'ADV-2008-0997', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0997/references'}, {'name': 'mplayer-sdpplin-overflow(41490)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41490'}, {'name': '30412', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30412'}, {'name': 'MDVSA-2008:196', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2008:196'}, {'name': '29515', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29515'}, {'name': '28851', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28851'}, {'name': '5307', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5307'}, {'name': 'DSA-1552', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1552'}, {'name': 'GLSA-200805-22', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200805-22.xml'}, {'name': '29921', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29921'}]
CVE State: PUBLISHED
Explain CVE-2008-1559
SQL injection vulnerability in the Bernard Gilly AlphaContent (com_alphacontent) 2.5.8 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
Affected Products: n/a
References: [{'name': 'alphacontent-index-sql-injection(41428)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41428'}, {'name': '5310', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5310'}, {'name': '28443', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28443'}]
CVE State: PUBLISHED
Explain CVE-2008-1560
Multiple cross-site scripting (XSS) vulnerabilities in Digiappz DigiDomain 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) domain parameter to lookup_result.asp, and the (2) word1 and (3) word2 parameters to suggest_result.asp.
Affected Products: n/a
References: [{'name': '29572', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29572'}, {'name': '20080327 Multiple XSS in DigiDomain', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490157/100/0/threaded'}, {'name': '3789', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3789'}, {'name': 'digidomain-multiple-xss(41500)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41500'}, {'name': '28475', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28475'}]
CVE State: PUBLISHED
Explain CVE-2008-1564
Directory traversal vulnerability in Dan Costin File Transfer before 1.2f allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) in the filename.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://sourceforge.net/tracker/index.php?func=detail&aid=1829601&group_id=178021&atid=883559'}, {'name': '28453', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28453'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=178021&release_id=586923'}, {'name': 'filetransfer-file-directory-traversal(41489)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41489'}, {'name': '29540', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29540'}]
CVE State: PUBLISHED
Explain CVE-2008-1565
Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.
Affected Products: n/a
References: [{'name': '20080325 phpBB PJIRC mod LFI', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490070/100/0/threaded'}, {'name': '28446', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28446'}, {'name': '3790', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3790'}, {'name': 'pjirc-irc-file-include(41456)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41456'}]
CVE State: PUBLISHED
Explain CVE-2008-1566
Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'applicationsmanager-search-xss(41505)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41505'}, {'name': '29564', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29564'}, {'name': '28488', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28488'}]
CVE State: PUBLISHED
Explain CVE-2008-1567
phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information.
Affected Products: n/a
References: [{'name': '28560', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28560'}, {'name': 'SUSE-SR:2009:003', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html'}, {'name': 'DSA-1557', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1557'}, {'name': '32834', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32834'}, {'name': '29964', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29964'}, {'name': '30816', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30816'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sourceforge.net/tracker/index.php?func=detail&aid=1909711&group_id=23067&atid=377408'}, {'name': 'FEDORA-2008-2874', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00080.html'}, {'name': '29613', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29613'}, {'name': '29588', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29588'}, {'name': 'FEDORA-2008-2825', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2'}, {'name': '33822', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33822'}, {'name': 'phpmyadmin-sessiondata-info-disclosure(41541)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41541'}, {'name': 'ADV-2008-1037', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1037/references'}, {'name': 'SUSE-SR:2008:026', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html'}, {'name': 'MDVSA-2008:131', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2008:131'}]
CVE State: PUBLISHED
Explain CVE-2008-1568
comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar, unrar, or jpegtran programs.
Affected Products: n/a
References: [{'name': 'GLSA-200804-29', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200804-29.xml'}, {'name': 'FEDORA-2008-2981', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00171.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=462840'}, {'name': 'comix-filename-command-execution(41554)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41554'}, {'name': '29731', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29731'}, {'name': '28547', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28547'}, {'name': 'FEDORA-2008-2993', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00183.html'}, {'name': '29956', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29956'}, {'name': '29621', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29621'}]
CVE State: PUBLISHED
Explain CVE-2008-1569
policyd-weight 0.1.14 beta-16 and earlier allows local users to modify or delete arbitrary files via a symlink attack on temporary files that are used when creating a socket.
Affected Products: n/a
References: [{'name': '28480', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28480'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.policyd-weight.org/'}, {'name': '29738', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29738'}, {'name': 'GLSA-200804-11', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200804-11.xml'}, {'name': '29553', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29553'}, {'name': '43888', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/43888'}, {'name': 'policydweight-sockets-symlink(41565)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41565'}, {'name': 'DSA-1531', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1531'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=214403'}]
CVE State: PUBLISHED
Explain CVE-2008-1570
Race condition in the create_lockpath function in policyd-weight 0.1.14 beta-16 allows local users to modify or delete arbitrary files by creating the LOCKPATH directory, then modifying it after the symbolic link check occurs.  NOTE: this is due to an incomplete fix for CVE-2008-1569.
Affected Products: n/a
References: [{'name': 'policydweight-createlockpath-race-condition(41570)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41570'}, {'name': '29738', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29738'}, {'name': 'GLSA-200804-11', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200804-11.xml'}, {'name': '43888', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/43888'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=214403'}]
CVE State: PUBLISHED
Explain CVE-2008-1571
Directory traversal vulnerability in the embedded web server in Image Capture in Apple Mac OS X before 10.5 allows remote attackers to read arbitrary files via directory traversal sequences in the URI.
Affected Products: n/a
References: [{'name': '1020141', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1020141'}, {'name': 'TA08-150A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA08-150A.html'}, {'name': 'macosx-imagecapture-directory-traversal(42718)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/42718'}, {'name': '29501', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/29501'}, {'name': '30430', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30430'}, {'name': 'APPLE-SA-2008-05-28', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2008//May/msg00001.html'}, {'name': 'ADV-2008-1697', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1697'}, {'name': '29412', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/29412'}]
CVE State: PUBLISHED