Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2008-1183
Multiple cross-site scripting (XSS) vulnerabilities in Crafty Syntax Live Help (CSLH) before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) livehelp.php, (2) user_questions.php, and (3) leavemessage.php.  NOTE: the lostsheep.php vector is covered by CVE-2008-0848.
Affected Products: n/a
References: [{'name': 'cslh-multiple-xss(40636)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/40636'}, {'name': '28071', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28071'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=580994'}, {'name': '29201', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29201'}]
CVE State: PUBLISHED
Explain CVE-2008-1184
The DNSSEC validation library (libval) library in dnssec-tools before 1.3.1 does not properly check that the signing key is the APEX trust anchor, which might allow attackers to conduct unspecified attacks.
Affected Products: n/a
References: [{'name': '29095', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29095'}, {'name': 'dnssectools-libval-security-bypass(40836)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/40836'}, {'name': 'ADV-2008-0673', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0673/references'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/mailarchive/forum.php?thread_name=sdlk5lolzj.fsf%40wes.hardakers.net&forum_name=dnssec-tools-users'}, {'name': '29127', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29127'}, {'name': 'FEDORA-2008-1758', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00820.html'}, {'name': 'FEDORA-2008-1771', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00845.html'}, {'name': '27998', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27998'}]
CVE State: PUBLISHED
Explain CVE-2008-1197
The Marvell driver for the Netgear WN802T Wi-Fi access point with firmware 1.3.16 on the Marvell 88W8361P-BEM1 chipset does not properly parse the SSID information element in an association request, which allows remote authenticated users to cause a denial of service (device reboot or hang) or possibly execute arbitrary code via a "Null SSID."
Affected Products: n/a
References: [{'name': '31770', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/31770'}, {'name': '4215', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/4215'}, {'name': '20080904 Marvell Driver Null SSID Association Request Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/495983/100/0/threaded'}, {'name': '30976', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/30976'}, {'name': 'netgear-wn802t-ssid-dos(44918)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/44918'}]
CVE State: PUBLISHED
Explain CVE-2008-1198
The default IPSec ifup script in Red Hat Enterprise Linux 3 through 5 configures racoon to use aggressive IKE mode instead of main IKE mode, which makes it easier for remote attackers to conduct brute force attacks by sniffing an unencrypted preshared key (PSK) hash.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.ernw.de/download/pskattack.pdf'}, {'name': 'ipsec-ifup-weak-security(41053)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41053'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=435274'}, {'name': '48045', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48045'}, {'name': '1019563', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019563'}]
CVE State: PUBLISHED
Explain CVE-2008-1199
Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.
Affected Products: n/a
References: [{'name': 'GLSA-200803-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200803-25.xml'}, {'name': 'oval:org.mitre.oval:def:10739', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10739'}, {'name': '[Dovecot-news] 20080504 v1.0.11 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.dovecot.org/list/dovecot-news/2008-March/000061.html'}, {'name': '29557', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29557'}, {'name': '20080304 Dovecot mail_extra_groups setting is often used insecurely', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489133/100/0/threaded'}, {'name': '30342', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30342'}, {'name': 'RHSA-2008:0297', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2008-0297.html'}, {'name': 'DSA-1516', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1516'}, {'name': 'USN-593-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/593-1/'}, {'name': 'FEDORA-2008-2475', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00381.html'}, {'name': 'SUSE-SR:2008:020', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html'}, {'name': '28092', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28092'}, {'name': '29226', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29226'}, {'name': '32151', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32151'}, {'name': '29385', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29385'}, {'name': 'dovecot-mailextragroups-unauth-access(41009)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41009'}, {'name': 'FEDORA-2008-2464', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00358.html'}, {'name': '29396', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29396'}]
CVE State: PUBLISHED
Explain CVE-2008-1200
Unspecified vulnerability in Microsoft Access allows remote user-assisted attackers to execute arbitrary code via a crafted .MDB file, possibly related to Jet Engine (msjet40.dll).  NOTE: this is probably a different issue than CVE-2007-6026.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://pandalabs.pandasecurity.com/archive/New-MS-Access-exploit.aspx'}, {'name': '28087', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28087'}]
CVE State: PUBLISHED
Explain CVE-2008-1201
Multiple unspecified vulnerabilities in FLA file parsing in Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 on Windows allow user-assisted remote attackers to execute arbitrary code via a crafted .FLA file.
Affected Products: n/a
References: [{'name': '29455', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29455'}, {'name': '28349', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28349'}, {'tags': ['x_refsource_MISC'], 'url': 'http://ruder.cdut.net/blogview.asp?logID=241'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.fortiguardcenter.com/advisory/FGA-2008-07.html'}, {'name': 'adobe-flash-fla-code-execution(41327)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41327'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/advisories/apsa08-03.html'}, {'name': 'ADV-2008-0948', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0948/references'}, {'name': '1019681', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019681'}]
CVE State: PUBLISHED
Explain CVE-2008-1202
Cross-site scripting (XSS) vulnerability in the web management interface in Adobe LiveCycle Workflow 6.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Affected Products: n/a
References: [{'name': 'ADV-2008-0864', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0864/references'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.liquidmatrix.org/blog/2008/03/11/advisory-adobe-livecycle-workflow-xss-vulnerability/'}, {'name': 'adobe-lifecycle-loginpage-xss(41143)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41143'}, {'name': '3729', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3729'}, {'name': '1019588', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019588'}, {'name': '28209', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28209'}, {'name': '29331', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29331'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb08-10.html'}, {'name': '20080311 Advisory Adobe LiveCycle Workflow XSS Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489413/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-1203
The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection.
Affected Products: n/a
References: [{'name': '29332', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29332'}, {'name': '28207', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28207'}, {'name': 'ADV-2008-0862', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0862/references'}, {'name': '1019600', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019600'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb08-08.html'}, {'name': 'coldfusion-interface-brute-force(41150)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41150'}]
CVE State: PUBLISHED
Explain CVE-2008-1204
Multiple cross-site scripting (XSS) vulnerabilities in the Administration Console in Sun Java System Access Manager 7.1 and 7 2005Q4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the (1) Help and (2) Version windows.
Affected Products: n/a
References: [{'name': '28113', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28113'}, {'name': 'sun-jsam-adminconsole-xss(41024)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41024'}, {'name': '29252', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29252'}, {'name': '201251', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-201251-1'}, {'name': 'ADV-2008-0784', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0784'}]
CVE State: PUBLISHED
Explain CVE-2008-1205
Unspecified vulnerability in the ipsecah kernel module in Sun Solaris 10, when a key management daemon for IPsec security associations is running, allows local users to cause a denial of service (panic) via unspecified vectors.
Affected Products: n/a
References: [{'name': 'ADV-2008-0783', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0783'}, {'name': 'solaris-ipsecah-dos(41023)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41023'}, {'name': '29253', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29253'}, {'name': '233761', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-233761-1'}, {'name': '28112', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28112'}]
CVE State: PUBLISHED
Explain CVE-2008-1206
Format string vulnerability in the log_message function in lks.c in Linux Kiss Server 1.2, when background (daemon) mode is disabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in an invalid command.
Affected Products: n/a
References: [{'name': 'linuxkissserver-logmessage-format-string(41018)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41018'}, {'name': '28099', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28099'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.vashnukad.com/'}, {'name': 'ADV-2008-0785', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0785'}, {'name': '29219', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29219'}, {'name': '20080305 Vulnerability in Linux Kiss Server v1.2', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=120468901813326&w=2'}]
CVE State: PUBLISHED
Explain CVE-2008-1207
Multiple unspecified vulnerabilities in Fujitsu Interstage Smart Repository, as used in multiple Fujitsu Interstage products, allow remote attackers to cause a denial of service (daemon crash) via (1) an invalid request or (2) a large amount of data sent to the registered attribute value.
Affected Products: n/a
References: [{'name': 'interstage-smart-repository-dos(41039)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41039'}, {'name': 'interstage-smartrepository-update-dos(41041)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41041'}, {'name': '29250', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29250'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fujitsu.com/global/support/software/security/products-f/interstage-sr-200801e.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fujitsu.com/global/support/software/security/products-f/interstage-sr-200802e.html'}, {'name': 'ADV-2008-0786', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0786'}, {'name': '28114', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28114'}]
CVE State: PUBLISHED
Explain CVE-2008-1208
Cross-site scripting (XSS) vulnerability in the login page in Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x allows remote attackers to inject arbitrary web script or HTML via the user parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34520'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.louhi.fi/advisory/checkpoint_080306.txt'}, {'name': 'ADV-2008-0788', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0788'}, {'name': '1019554', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019554'}, {'name': '29243', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29243'}, {'name': 'vpn1utmedge-login-xss(41032)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41032'}, {'name': '28116', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28116'}, {'name': '20080306 Checkpoint VPN-1 UTM Edge cross-site scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489203/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-1209
Cross-site scripting (XSS) vulnerability in redirect.do in Xitex WebContent M1 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '29222', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29222'}, {'name': 'xitex-redirect-xss(41021)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41021'}, {'name': '28115', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28115'}]
CVE State: PUBLISHED
Explain CVE-2008-1210
Stack-based buffer overflow in the ctags parsing code in Programmer's Notepad before 2.0.8.718 allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted .c file, when the victim selects the Jump To dialog.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'programmersnotepad-ctags-bo(41022)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41022'}, {'name': '29233', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29233'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=581499&group_id=45545'}, {'name': '28119', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28119'}]
CVE State: PUBLISHED
Explain CVE-2008-1211
Cross-site scripting (XSS) vulnerability in BosDates 3.x and 4.x allows remote attackers to inject arbitrary web script or HTML via (1) the type parameter in calendar.php and (2) the category parameter in calendar_search.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '29255', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29255'}, {'name': 'bosdates-type-category-xss(41020)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41020'}, {'name': '28117', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28117'}]
CVE State: PUBLISHED
Explain CVE-2008-1212
Cross-site scripting (XSS) vulnerability in set_permissions.php in Podcast Generator 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the scriptlang parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '28106', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28106'}, {'name': 'podcastgenerator-setpermissions-xss(41130)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41130'}]
CVE State: PUBLISHED
Explain CVE-2008-1213
Cross-site scripting (XSS) vulnerability in Numara FootPrints for Linux 8.1 allows remote attackers to inject arbitrary web script or HTML via the Title form field when setting an appointment.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'footprints-title-xss(41003)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41003'}, {'name': '28659', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28659'}, {'name': '28103', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28103'}]
CVE State: PUBLISHED
Explain CVE-2008-1214
MRcgi/MRProcessIncomingForms.pl in Numara FootPrints 8.1 on Linux allows remote attackers to execute arbitrary code via shell metacharacters in the PROJECTNUM parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '28659', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28659'}, {'name': 'footprints-projectnum-command-execution(41005)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41005'}]
CVE State: PUBLISHED
Explain CVE-2008-1215
Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters.
Affected Products: n/a
References: [{'name': '29238', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29238'}, {'name': '[4.2] 20080307 009: SECURITY FIX: March 7, 2008', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata42.html#009_ppp'}, {'name': '20080229 *BSD user-ppp local root (when conditions permit)', 'tags': ['mailing-list', 'x_refsource_VULN-DEV'], 'url': 'http://www.securityfocus.com/archive/82/488980/30/0/threaded'}, {'name': '[4.1] 20080307 014: SECURITY FIX: March 7, 2008', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata41.html#014_ppp'}, {'name': '20080301 Re: *BSD user-ppp local root (when conditions permit)', 'tags': ['mailing-list', 'x_refsource_VULN-DEV'], 'url': 'http://www.securityfocus.com/archive/82/489031/30/0/threaded'}, {'name': '28090', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28090'}, {'name': 'userppp-commandexpandinterpret-bo(41034)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41034'}, {'name': '29234', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29234'}, {'name': '29240', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29240'}]
CVE State: PUBLISHED
Explain CVE-2008-1216
IBM Lotus Quickr 8.0 server, and possibly QuickPlace 7.x, does not properly identify URIs containing cross-site scripting (XSS) attack strings, which allows remote attackers to inject arbitrary web script or HTML via a Calendar OpenDocument action to main.nsf with a Count parameter containing a JavaScript event in a malformed element, as demonstrated by an onload event in an IFRAME element.
Affected Products: n/a
References: [{'name': '3721', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3721'}, {'name': '27925', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27925'}, {'name': '29072', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29072'}, {'name': '20080222 IBM Quickr 8 Calendar Xss Injection (Bypass Quickr 8.0 Xss Filter)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/488620/100/100/threaded'}, {'name': 'ADV-2008-0667', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0667'}]
CVE State: PUBLISHED
Explain CVE-2008-1217
Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH, and 8.0.x before 8.0.1 allows remote attackers to execute arbitrary code via a crafted attachment in an e-mail message sent over SMTP, a variant of CVE-2007-6706.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg21271957'}, {'name': '1019464', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1019464'}]
CVE State: PUBLISHED
Explain CVE-2008-1219
SQL injection vulnerability in the Kutub-i Sitte (KutubiSitte) 1.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the kid parameter in a hadisgoster action to modules.php.
Affected Products: n/a
References: [{'name': '28126', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28126'}, {'name': '29279', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29279'}, {'name': '20080306 PHP-Nuke KutubiSitte "kid" SQL Injection exploit code adding', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489258/100/0/threaded'}, {'name': '20080306 PHP-Nuke KutubiSitte "kid" SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489219/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rbt-4.net/forum/viewthread.php?forum_id=51&thread_id=3058'}, {'name': '3722', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3722'}, {'name': 'kutubisitte-kid-sql-injection(41036)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41036'}]
CVE State: PUBLISHED
Explain CVE-2008-1220
SQL injection vulnerability in the 4nChat 0.91 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the roomid parameter in an index action to modules.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '28128', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28128'}, {'name': '4nchat-roomid-sql-injection(41051)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41051'}]
CVE State: PUBLISHED
Explain CVE-2008-1221
Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console (aka eScan Server) 9.0.742.1 allows remote attackers to read arbitrary files via an absolute pathname in the RETR (get) command.
Affected Products: n/a
References: [{'name': '3723', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3723'}, {'name': '29246', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29246'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/escaz-adv.txt'}, {'name': '28127', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28127'}, {'name': '20080306 Directory traversal in MicroWorld eScan Server 9.0.742.98', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489228/100/0/threaded'}, {'name': 'escan-filename-directory-traversal(41033)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41033'}]
CVE State: PUBLISHED
Explain CVE-2008-1222
Cross-site scripting (XSS) vulnerability in Dokeos 1.8.4 before SP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'ADV-2008-0798', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0798'}, {'name': '29254', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29254'}, {'name': '28121', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28121'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://projects.dokeos.com/index.php?do=details&task_id=2312'}, {'name': 'dokeos-unspecified-xss(41046)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41046'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.dokeos.com/wiki/index.php/Security'}]
CVE State: PUBLISHED
Explain CVE-2008-1223
Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': 'dokeos-unspecified-code-execution(41048)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41048'}, {'name': 'ADV-2008-0798', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0798'}, {'name': '29254', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29254'}, {'name': '28121', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28121'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://projects.dokeos.com/index.php?do=details&task_id=2312'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.dokeos.com/wiki/index.php/Security'}]
CVE State: PUBLISHED
Explain CVE-2008-1224
Cross-site scripting (XSS) vulnerability in account.php in BosClassifieds Classified Ads System 3.0 allows remote attackers to inject arbitrary web script or HTML via the returnTo parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'classifiedads-account-xss(41045)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41045'}, {'name': '28140', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28140'}, {'name': '29261', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29261'}]
CVE State: PUBLISHED
Explain CVE-2008-1225
Multiple cross-site scripting (XSS) vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a (1) mail message or (2) discussion board message.  NOTE: this might overlap CVE-2005-1076.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.balupton.com/blogs/dev?title=webct_session_stealer_exploit'}, {'name': '28107', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28107'}, {'name': '29227', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29227'}, {'name': 'webct-dontwraptext-xss(41047)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41047'}, {'name': '20080305 WebCT 4.x Javascript Session Stealer Exploits', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=120471944119467&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.balupton.com/documents/webct_exploits.txt'}]
CVE State: PUBLISHED
Explain CVE-2008-1226
Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment, possibly involving a (1) .jpg or (2) .gif image attachment.
Affected Products: n/a
References: [{'name': '29263', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29263'}, {'name': 'JVN#95014590', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/jp/JVN%2395014590/index.html'}, {'name': 'JVNDB-2008-000004', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000004.html'}, {'name': 'zimbra-email-xss(41044)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41044'}, {'name': '28134', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28134'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.zimbra.com/jp/products/vulnerability.html'}]
CVE State: PUBLISHED
Explain CVE-2008-1227
Stack-based buffer overflow in the silc_fingerprint function in lib/silcutil/silcutil.c in Secure Internet Live Conferencing (SILC) Toolkit 1.1.5, and unspecified earlier versions, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via long input data.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.6'}, {'name': 'GLSA-200804-27', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200804-27.xml'}, {'name': 'silctoolkit-silcfingerprint-bo(41012)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41012'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=372021'}, {'name': 'ADV-2008-0769', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0769'}, {'name': '29174', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29174'}, {'name': 'SUSE-SR:2008:006', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html'}, {'name': '29946', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29946'}, {'name': '28101', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28101'}, {'name': '29323', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29323'}, {'name': 'MDVSA-2008:158', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2008:158'}]
CVE State: PUBLISHED
Explain CVE-2008-1228
Cross-site scripting (XSS) vulnerability in admin.php in MG2 (formerly Minigal) allows remote attackers to inject arbitrary web script or HTML via the list parameter in an import action.
Affected Products: n/a
References: [{'name': '28098', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28098'}, {'name': '20080304 Minigal 2 critical XSS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=120467196623452&w=2'}]
CVE State: PUBLISHED
Explain CVE-2008-1229
Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject arbitrary web script or HTML via the editor parameter, a different vector than CVE-2007-5120.b.
Affected Products: n/a
References: [{'name': '20080213 JSPWiki Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=120300554011544&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0'}, {'name': '28969', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28969'}, {'name': '27785', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27785'}, {'name': 'jspwiki-edit-xss(40507)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/40507'}, {'name': '5112', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5112'}]
CVE State: PUBLISHED
Explain CVE-2008-1230
Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an "entry page."
Affected Products: n/a
References: [{'name': '20080213 JSPWiki Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=120300554011544&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0'}, {'name': '28969', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28969'}, {'name': '27785', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27785'}, {'name': '5112', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5112'}, {'name': 'jspwiki-install-file-upload(40511)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/40511'}]
CVE State: PUBLISHED
Explain CVE-2008-1231
Directory traversal vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to include and execute arbitrary local .jsp files, and obtain sensitive information, via a .. (dot dot) in the editor parameter.
Affected Products: n/a
References: [{'name': '20080213 JSPWiki Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=120300554011544&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0'}, {'name': '28969', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28969'}, {'name': '27785', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27785'}, {'name': 'jspwiki-edit-file-include(40508)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/40508'}, {'name': '5112', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5112'}]
CVE State: PUBLISHED
Explain CVE-2008-1242
The control panel on the Belkin F5D7230-4 router with firmware 9.01.10 maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user, a different vulnerability than CVE-2005-3802.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'belkin-f5d72304-security-bypass(41120)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41120'}, {'name': '28317', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28317'}, {'name': '29345', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29345'}]
CVE State: PUBLISHED
Explain CVE-2008-1243
Cross-site scripting (XSS) vulnerability on the Linksys WRT300N router with firmware 2.00.20, when Mozilla Firefox or Apple Safari is used, allows remote attackers to inject arbitrary web script or HTML via the dyndns_domain parameter to the default URI.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://code.bulix.org/cx46qa-65489'}, {'name': 'linksys-wrt300n-dyndnsdomain-xss(41121)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41121'}, {'tags': ['x_refsource_MISC'], 'url': 'http://code.bulix.org/koom78-65490'}]
CVE State: PUBLISHED
Explain CVE-2008-1244
cgi-bin/setup_dns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to perform administrative actions, as demonstrated by changing a DNS server via the dns1_1, dns1_2, dns1_3, and dns1_4 parameters.  NOTE: it was later reported that F5D7632-4V6 with firmware 6.01.08 is also affected.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=371598'}, {'name': 'belkin-f5d72304-setupdns-security-bypass(41124)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41124'}, {'name': '28319', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28319'}, {'name': '29345', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29345'}]
CVE State: PUBLISHED
Explain CVE-2008-1245
cgi-bin/setup_virtualserver.exe on the Belkin F5D7230-4 router with firmware 9.01.10 allows remote attackers to cause a denial of service (control center outage) via an HTTP request with invalid POST data and a "Connection: Keep-Alive" header.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'name': '28322', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28322'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'belkin-f5d72304-setupvirtualserver-dos(41116)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41116'}, {'name': '29345', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29345'}]
CVE State: PUBLISHED
Explain CVE-2008-1246
The Cisco PIX/ASA Finesse Operation System 7.1 and 7.2 allows local users to gain privileges by entering characters at the enable prompt, erasing these characters via the Backspace key, and then holding down the Backspace key for one second after erasing the final character. NOTE: third parties, including one who works for the vendor, have been unable to reproduce the flaw unless the enable password is blank
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'name': '20080124 Re: PIX Privilege Escalation Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486959'}, {'name': '27457', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27457'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': '20080205 Re: Re: PIX Privilege Escalation Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487579'}, {'name': '20080125 Re: Re: PIX Privilege Escalation Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487051'}, {'name': 'cisco-pixasa-privilege-escalation(41129)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41129'}, {'tags': ['x_refsource_MISC'], 'url': 'http://hackathology.blogspot.com/2008/01/pixasa-finesse-71-72-privilege.html'}, {'name': '20080124 PIX Privilege Escalation Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486938'}]
CVE State: PUBLISHED
Explain CVE-2008-1247
The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri.  NOTE: the Security.tri vector is already covered by CVE-2006-5202.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'name': '29344', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29344'}, {'tags': ['x_refsource_MISC'], 'url': 'http://kinqpinz.info/lib/wrt54g/own.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': '28381', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28381'}, {'tags': ['x_refsource_MISC'], 'url': 'https://kinqpinz.info/lib/wrt54g/'}, {'name': '5926', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5926'}, {'name': 'linksys-wrt54g-security-bypass(41118)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41118'}, {'tags': ['x_refsource_MISC'], 'url': 'https://kinqpinz.info/lib/wrt54g/own2.txt'}, {'name': '5313', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5313'}]
CVE State: PUBLISHED
Explain CVE-2008-1248
The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field.  NOTE: this might overlap CVE-2007-3440.
Affected Products: n/a
References: [{'name': 'snomsip-interface-unauth-access(41171)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41171'}, {'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}]
CVE State: PUBLISHED
Explain CVE-2008-1249
snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service (application crash and corruption of call logs) via a "'); (double quote, quote, close parenthesis, semicolon) sequence in the "Call a number" field.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}]
CVE State: PUBLISHED