Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2008-0430
SQL injection vulnerability in form.php in 360 Web Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the IDFM parameter.
Affected Products: n/a
References: [{'name': '27364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27364'}, {'name': 'ADV-2008-0217', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0217'}, {'name': '360web-form-sql-injection(39796)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39796'}, {'name': '4944', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4944'}]
CVE State: PUBLISHED
Explain CVE-2008-0431
Directory traversal vulnerability in administrator/download.php in IDMOS (aka Phoenix) 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter.
Affected Products: n/a
References: [{'name': 'idmos-download-directory-traversal(39823)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39823'}, {'name': '4954', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4954'}, {'name': '27379', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27379'}, {'name': 'ADV-2008-0229', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0229'}, {'name': '28436', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28436'}]
CVE State: PUBLISHED
Explain CVE-2008-0432
Cross-site scripting (XSS) vulnerability in index.php in phpAutoVideo 2.21 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
Affected Products: n/a
References: [{'name': '27346', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27346'}, {'name': 'ADV-2008-0225', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0225'}, {'name': '3567', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3567'}, {'name': 'phpautovideo-index-xss(39771)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39771'}, {'name': '28580', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28580'}, {'name': '20080118 Agares PhpAutoVideo 2.21(XSS/RFI) Multiple Remote Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486591/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0433
PHP remote file inclusion vulnerability in theme/phpAutoVideo/LightTwoOh/sidebar.php in Agares phpAutoVideo 2.21 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the loadpage parameter, a different vector than CVE-2007-6614.
Affected Products: n/a
References: [{'name': '27346', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27346'}, {'name': 'ADV-2008-0225', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0225'}, {'name': '3567', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3567'}, {'name': '28580', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28580'}, {'name': 'phpautovideo-sidebar-file-include(39770)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39770'}, {'name': '20080118 Agares PhpAutoVideo 2.21(XSS/RFI) Multiple Remote Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486591/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0434
Format string vulnerability in the AXIMilter module in AXIGEN Mail Server 5.0.2 allows remote attackers to execute arbitrary code via format string specifiers in the CNHO command.
Affected Products: n/a
References: [{'name': '3570', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3570'}, {'name': '27363', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27363'}, {'name': '4947', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4947'}, {'name': '20080120 AXIGEN 5.0.x AXIMilter Format String Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486722/100/0/threaded'}, {'name': 'axigen-aximilter-format-string(39803)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39803'}, {'name': '20080120 AXIGEN 5.0.x AXIMilter Format String Exploit', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059788.html'}, {'name': '28562', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28562'}, {'name': 'ADV-2008-0237', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0237'}]
CVE State: PUBLISHED
Explain CVE-2008-0435
Directory traversal vulnerability in index.php in OZJournals 2.1.1 allows remote attackers to read portions of arbitrary files via a .. (dot dot) in the id parameter in a printpreview action.
Affected Products: n/a
References: [{'name': '28582', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28582'}, {'name': 'ADV-2008-0228', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0228'}, {'name': '4953', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4953'}, {'name': '27375', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27375'}, {'name': 'ozjournals-id-directory-traversal(39815)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39815'}]
CVE State: PUBLISHED
Explain CVE-2008-0436
Cross-site scripting (XSS) vulnerability in profile-upload/upload.asp in PD9 Software MegaBBS 1.5.14b allows remote attackers to inject arbitrary web script or HTML via the target parameter.
Affected Products: n/a
References: [{'name': '3565', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3565'}, {'name': 'megabbs-upload-xss(39812)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39812'}, {'name': '20080120 MegaBBS ASP Forum Cross-Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486723/100/0/threaded'}, {'name': '27368', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27368'}]
CVE State: PUBLISHED
Explain CVE-2008-0437
Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installation process for HP Virtual Rooms, allow remote attackers to execute arbitrary code via a long (1) AuthenticationURL, (2) PortalAPIURL, or (3) cabroot property value.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'hpvirtualrooms-hpvirtualrooms14-activex-bo(39836)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39836'}, {'name': '27384', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27384'}, {'name': '28595', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28595'}, {'name': '20080122 HP Virtual Rooms WebHPVCInstall Control Multiple Buffer Overflows', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=120098751528333&w=2'}, {'name': '4959', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4959'}, {'name': 'ADV-2008-0236', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0236'}]
CVE State: PUBLISHED
Explain CVE-2008-0438
Cross-site scripting (XSS) vulnerability in the font rendering functionality in Novemberborn sIFR 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the txt parameter to a Flash (SWF) file, as demonstrated by fonts/FuturaLt.swf.
Affected Products: n/a
References: [{'name': '41006', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/41006'}, {'name': '20080122 Re: PR07-38: XSS on sIFR', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486829/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://novemberborn.net/sifr/2.0.3'}, {'name': 'sifr-fontname-xss(39835)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39835'}, {'name': '3571', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3571'}, {'name': '27394', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27394'}, {'name': '20080205 Re: PR07-38: XSS on sIFR', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487585/100/200/threaded'}, {'name': '20080122 PR07-38: XSS on sIFR', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486787/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.procheckup.com/Vulnerability_PR07-38.php'}]
CVE State: PUBLISHED
Explain CVE-2008-0439
Cross-site scripting (XSS) vulnerability in templates/default/admincp/attachments_header.php in DeluxeBB 1.1 allows remote attackers to inject arbitrary web script or HTML via the lang_listofmatches parameter.
Affected Products: n/a
References: [{'name': '27401', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27401'}, {'name': '20080122 DeluxeBB 1.1 XSS Vulnerabilitie', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486804/100/0/threaded'}, {'name': '3564', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3564'}, {'name': 'deluxbb-attachmentsheader-xss(39829)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39829'}]
CVE State: PUBLISHED
Explain CVE-2008-0440
AlstraSoft Forum Pay Per Post Exchange 2.0 stores passwords in cleartext, which makes it easier for attackers to access user accounts.
Affected Products: n/a
References: [{'name': '4956', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4956'}]
CVE State: PUBLISHED
Explain CVE-2008-0441
IBM Tivoli Business Service Manager (TBSM) 4.1.1 stores passwords in cleartext (1) after external authentication, which triggers writing the password to SM_server.log; and (2) after a reconfig action; which allows local users to obtain sensitive information.
Affected Products: n/a
References: [{'name': '27388', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27388'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg24017939'}, {'name': '1019250', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019250'}, {'name': '28603', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28603'}, {'name': 'ADV-2008-0240', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0240'}, {'name': 'tbsm-reconfig-information-disclosure(39822)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39822'}]
CVE State: PUBLISHED
Explain CVE-2008-0442
PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the ffile parameter, a different vector than CVE-2008-0376.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '28568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28568'}, {'name': '27383', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27383'}]
CVE State: PUBLISHED
Explain CVE-2008-0443
Heap-based buffer overflow in the FileUploader.FUploadCtl.1 ActiveX control in FileUploader.dll 2.0.0.2 in Lycos FileUploader Module allows remote attackers to execute arbitrary code via a long HandwriterFilename property value.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '4967', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4967'}, {'name': '27411', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27411'}, {'name': 'lycosfileuploader-fileuploader-activex-bo(39849)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39849'}, {'name': 'ADV-2008-0253', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0253'}, {'name': '28599', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28599'}]
CVE State: PUBLISHED
Explain CVE-2008-0444
Cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via subtext parameter to unspecified components.
Affected Products: n/a
References: [{'name': '28589', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28589'}, {'name': 'ADV-2008-0265', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0265'}, {'name': '41681', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/41681'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://midas.psi.ch/elog/download/ChangeLog'}, {'name': 'elog-subtext-xss(39828)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39828'}, {'name': '27399', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27399'}]
CVE State: PUBLISHED
Explain CVE-2008-0445
The replace_inline_img function in elogd in Electronic Logbook (ELOG) before 2.7.1 allows remote attackers to cause a denial of service (infinite loop) via crafted logbook entries.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '28589', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28589'}, {'name': 'ADV-2008-0265', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0265'}, {'name': 'elog-elogd-logbook-dos(39824)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39824'}, {'name': '27399', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27399'}]
CVE State: PUBLISHED
Explain CVE-2008-0446
SQL injection vulnerability in voircom.php in LulieBlog 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '27416', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27416'}, {'name': '4969', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4969'}, {'name': 'lulieblog-voircom-sql-injection(39854)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39854'}]
CVE State: PUBLISHED
Explain CVE-2008-0447
SQL injection vulnerability in index.php in Foojan WMS PHP Weblog 1.0 allows remote attackers to execute arbitrary SQL commands via the story parameter.
Affected Products: n/a
References: [{'name': '4968', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4968'}, {'name': 'foojanwms-index-sql-injection(39855)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39855'}, {'name': '27415', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27415'}]
CVE State: PUBLISHED
Explain CVE-2008-0448
PHP remote file inclusion vulnerability in utils/class_HTTPRetriever.php in phpSearch allows remote attackers to execute arbitrary PHP code via a URL in the libcurlemuinc parameter.
Affected Products: n/a
References: [{'name': 'phpsearch-classhttpretriever-file-include(39805)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39805'}, {'name': '20080120 Php Search Remote Inclusion', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=120093067011293&w=2'}]
CVE State: PUBLISHED
Explain CVE-2008-0449
SQL injection vulnerability in paypalresult.asp in VP-ASP Shopping Cart 6.50 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'vpasp-paypalresult-sql-injection(39811)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39811'}, {'name': '27347', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27347'}]
CVE State: PUBLISHED
Explain CVE-2008-0450
Multiple PHP remote file inclusion vulnerabilities in BLOG:CMS 4.2.1.c allow remote attackers to execute arbitrary PHP code via a URL in the (1) DIR_PLUGINS parameter to (a) index.php, and the (2) DIR_LIBS parameter to (b) media.php and (c) xmlrpc/server.php in admin/.
Affected Products: n/a
References: [{'name': '20080121 BLOG:CMS 4.2.1.c (DIR_PLUGINS) Multiple Remote File Include', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486743/100/0/threaded'}, {'name': '3576', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3576'}]
CVE State: PUBLISHED
Explain CVE-2008-0451
Multiple SQL injection vulnerabilities in PacerCMS 0.6 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) siteadmin/article-edit.php; and unspecified parameters to (2) submitted-edit.php, (3) page-edit.php, (4) section-edit.php, (5) staff-edit.php, and (6) staff-access.php in siteadmin/.
Affected Products: n/a
References: [{'name': 'pacercms-articleedit-sql-injection(39833)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39833'}, {'name': '3574', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3574'}, {'name': '20080122 PacerCMS Multiple Vulnerabilities (XSS/SQL)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486796/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pacercms.sourceforge.net/index.php/2008/01/21/pacercms-061-streamlines-code-base-addresses-security-issue/'}, {'name': '27397', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27397'}]
CVE State: PUBLISHED
Explain CVE-2008-0452
Directory traversal vulnerability in articles.php in Siteman 1.1.9 allows remote attackers to read arbitrary files via directory traversal sequences in the cat parameter in a viewart action.
Affected Products: n/a
References: [{'name': '4973', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4973'}, {'name': '27422', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27422'}]
CVE State: PUBLISHED
Explain CVE-2008-0453
SQL injection vulnerability in list.php in Easysitenetwork Recipe allows remote attackers to execute arbitrary SQL commands via the categoryid parameter.
Affected Products: n/a
References: [{'name': '4960', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4960'}, {'name': 'easysitenetworkrecipe-list-sql-injection(39853)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39853'}, {'name': '27405', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27405'}]
CVE State: PUBLISHED
Explain CVE-2008-0454
Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1) Dailymotion and possibly (2) Metacafe movie in the Skype video gallery, accessible through a search within the "Add video to chat" dialog, aka "videomood XSS."
Affected Products: n/a
References: [{'name': 'skype-addvideotochat-code-execution(39754)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39754'}, {'name': '20080117 Skype videomood XSS', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0337.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.critical.lt/?opinions/show/1470'}, {'name': '20080117 RE: Skype videomood XSS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486512/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx'}, {'name': '20080117 Re: Skype videomood XSS', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html'}, {'name': '27338', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27338'}, {'name': 'VU#248184', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/248184'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/blog/vulnerabilities-in-skype'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://skype.com/security/skype-sb-2008-001-update1.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://share.skype.com/sites/security/2008/01/skype_cross_zone_scripting_vul.html'}, {'name': 'ADV-2008-0194', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0194'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://skype.com/security/skype-sb-2008-001.html'}]
CVE State: PUBLISHED
Explain CVE-2008-0457
Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.
Affected Products: n/a
References: [{'name': '5078', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5078'}, {'name': '28787', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28787'}, {'name': '20080206 ZDI-08-003: Symantec Backup Exec Remote File Upload Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487688/100/0/threaded'}, {'name': 'ADV-2008-0413', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0413'}, {'name': '27487', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27487'}, {'name': '1019303', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019303'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://seer.entsupport.symantec.com/docs/297171.htm'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/avcenter/security/Content/2008.02.04.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-08-003.html'}]
CVE State: PUBLISHED
Explain CVE-2008-0458
Directory traversal vulnerability in function/sources.php in SLAED CMS 2.5 Lite allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the newlang parameter to index.php.
Affected Products: n/a
References: [{'name': '4975', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4975'}, {'name': 'ADV-2008-0308', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0308'}, {'name': '27426', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27426'}, {'name': 'slaedcms-index-file-include(39897)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39897'}]
CVE State: PUBLISHED
Explain CVE-2008-0459
Directory traversal vulnerability in update/index.php in Liquid-Silver CMS 0.35, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the update parameter.
Affected Products: n/a
References: [{'name': '4976', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4976'}, {'name': '27425', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27425'}, {'name': 'liquidsilvercms-index-file-include(39895)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39895'}, {'name': '28619', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28619'}, {'name': 'ADV-2008-0309', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0309'}]
CVE State: PUBLISHED
Explain CVE-2008-0460
Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'mediawiki-api-xss(39901)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39901'}, {'name': 'FEDORA-2008-2288', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00189.html'}, {'name': 'ADV-2008-0280', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0280'}, {'name': 'FEDORA-2008-2245', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00147.html'}, {'name': '28137', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28137'}, {'name': '[MediaWiki-announce] 20080124 MediaWiki 1.11.1, 1.10.3, 1.9.5 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-January/000068.html'}, {'name': '28629', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28629'}, {'name': '29266', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29266'}]
CVE State: PUBLISHED
Explain CVE-2008-0461
SQL injection vulnerability in index.php in the Search module in PHP-Nuke 8.0 FINAL and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sid parameter in a comments action to modules.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '28624', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28624'}, {'name': 'phpnuke-index-search-sql-injection(39850)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39850'}, {'name': '4965', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4965'}, {'name': '27408', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27408'}, {'name': 'ADV-2008-0264', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0264'}]
CVE State: PUBLISHED
Explain CVE-2008-0462
Cross-site scripting (XSS) vulnerability in the Archive 5.x before 5.x-1.8 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/213478'}, {'name': 'drupal-archive-unspecified-xss(39898)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39898'}, {'name': 'ADV-2008-0278', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0278'}, {'name': '28632', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28632'}, {'name': '27436', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27436'}]
CVE State: PUBLISHED
Explain CVE-2008-0463
Cross-site scripting (XSS) vulnerability in the Workflow 4.7.x before 4.7.x-1.2 and 5.x before 5.x-1.2 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving node properties.
Affected Products: n/a
References: [{'name': '27444', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27444'}, {'name': '28633', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28633'}, {'name': 'workflow-messages-xss(39896)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39896'}, {'name': 'ADV-2008-0279', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0279'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/213473'}]
CVE State: PUBLISHED
Explain CVE-2008-0464
Directory traversal vulnerability in archiv.cgi in absofort aconon Mail 2007 Enterprise SQL 11.7.0 and Mail 2004 Enterprise SQL 11.5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
Affected Products: n/a
References: [{'name': '4977', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4977'}, {'name': '28617', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28617'}, {'tags': ['x_refsource_MISC'], 'url': 'http://burnachurch.com/67/directory-traversal-luecke-in-aconon-mail/'}, {'name': 'ADV-2008-0310', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0310'}, {'name': '27427', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27427'}, {'name': '20080124 Directory Traversal Vulnerability in Aconon Mail', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059856.html'}]
CVE State: PUBLISHED
Explain CVE-2008-0465
Directory traversal vulnerability in optimizer.php in Seagull 0.6.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the files parameter.
Affected Products: n/a
References: [{'name': '20080129 Seagull 0.6.3 Remote File Disclosure Vulnerability fixed', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2008-January/001891.html'}, {'name': '4980', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4980'}, {'name': '28646', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28646'}, {'name': 'ADV-2008-0311', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0311'}, {'name': 'seagullstable-optimizer-directory-traversal(39902)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39902'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://seagullproject.org/publisher/articleview/action/view/frmArticleID/98/'}, {'name': '27437', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27437'}]
CVE State: PUBLISHED
Explain CVE-2008-0466
Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files.  NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability.
Affected Products: n/a
References: [{'name': '20080123 Web Wiz Rich Text Editor Directory traversal + HTM/HTML filecreation on the server', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486868/100/0/threaded'}, {'name': '4970', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4970'}, {'name': '4971', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4971'}, {'name': '27419', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27419'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugreport.ir/?/29'}, {'name': '3584', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3584'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugreport.ir/?/31'}, {'name': '1019267', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1019267'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp'}, {'name': '20080123 Web Wiz Forums Directory traversal', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486866/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0467
Stack-based buffer overflow in Firebird before 2.0.4, and 2.1.x before 2.1.0 RC1, might allow remote attackers to execute arbitrary code via a long username.
Affected Products: n/a
References: [{'name': 'GLSA-200803-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200803-02.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=570816&group_id=9028'}, {'name': '29203', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29203'}, {'name': '28596', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28596'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tracker.firebirdsql.org/browse/CORE-1603'}, {'name': 'firebird-username-bo(39981)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39981'}, {'name': '1019277', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019277'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=9028&release_id=570800'}, {'name': 'ADV-2008-0300', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0300'}, {'name': '27467', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27467'}, {'name': '29501', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29501'}, {'name': 'DSA-1529', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1529'}]
CVE State: PUBLISHED
Explain CVE-2008-0468
SQL injection vulnerability in category.php in Flinx 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '27448', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27448'}, {'name': 'ADV-2008-0313', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0313'}, {'name': '4985', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4985'}, {'name': 'flinx-category-sql-injection(39930)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39930'}]
CVE State: PUBLISHED
Explain CVE-2008-0469
SQL injection vulnerability in index.php in Tiger Php News System (TPNS) 1.0b and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter in a newscat action.
Affected Products: n/a
References: [{'name': 'ADV-2008-0312', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0312'}, {'name': '4984', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4984'}, {'name': 'tigerphpnewssystem-catid-sql-injection(39908)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39908'}, {'name': '27445', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27445'}, {'name': '20080124 Tiger PHP News System SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486961/100/0/threaded'}, {'name': '28641', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28641'}, {'name': '3587', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3587'}]
CVE State: PUBLISHED
Explain CVE-2008-0470
A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.
Affected Products: n/a
References: [{'name': 'comodo-antivirus-command-execution(39904)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39904'}, {'name': '27424', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27424'}, {'name': '4974', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4974'}]
CVE State: PUBLISHED
Explain CVE-2008-0471
Cross-site request forgery (CSRF) vulnerability in privmsg.php in phpBB 2.0.22 allows remote attackers to delete private messages (PM) as arbitrary users via a deleteall action.
Affected Products: n/a
References: [{'name': '28871', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28871'}, {'name': '3585', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3585'}, {'name': 'DSA-1488', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1488'}, {'name': '28630', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28630'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463589'}, {'name': '20080123 phpBB 2.0.22 Remote PM Delete XSRF Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487004/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0472
Cross-site request forgery (CSRF) vulnerability in modcp.php in Woltlab Burning Board (wBB) 2.3.6 PL2 allows remote attackers to delete threads as moderators or administrators via a thread_del action.
Affected Products: n/a
References: [{'name': 'wbb-modcp-csrf(39878)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39878'}, {'name': '20080123 Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486884/100/0/threaded'}, {'name': '28634', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28634'}, {'name': '3586', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3586'}]
CVE State: PUBLISHED
Explain CVE-2008-0473
RTE_popup_save_file.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload (1) .html and (2) .htm files via unspecified vectors.
Affected Products: n/a
References: [{'name': '20080123 Web Wiz Rich Text Editor Directory traversal + HTM/HTML filecreation on the server', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486868/100/0/threaded'}, {'name': '4971', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4971'}, {'name': '27419', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27419'}, {'name': '3584', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3584'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugreport.ir/?/31'}, {'name': '27420', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27420'}, {'name': '1019267', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019267'}]
CVE State: PUBLISHED
Explain CVE-2008-0474
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the (1) showlink parameter to jsp/DiscoveryProfiles.jsp; the (2) attributeIDs, (3) attributeToSelect, (4) redirectto, and (5) resourceid parameters to (a) jsp/ThresholdActionConfiguration.jsp; the (6) page and (7) redirect parameters to (b) jsp/UpdateGlobalSettings.jsp; and the (8) haid and (9) returnpath parameters to (c) showTile.do.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '27443', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27443'}, {'name': '28332', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28332'}, {'name': 'manageengine-multiple-xss(39914)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39914'}]
CVE State: PUBLISHED
Explain CVE-2008-0475
ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information ( Home->Summary) via an invalid URI, as demonstrated by the "/-" URI.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '27443', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27443'}, {'name': '28332', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28332'}, {'name': 'manageengine-home-information-disclosure(39917)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39917'}]
CVE State: PUBLISHED
Explain CVE-2008-0476
ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'manageengine-checks-security-bypass(39915)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39915'}, {'name': '27443', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27443'}, {'name': '28332', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28332'}]
CVE State: PUBLISHED
Explain CVE-2008-0477
Stack-based buffer overflow in the QMPUpgrade.Upgrade.1 ActiveX control in QMPUpgrade.dll 1.0.0.1 in Move Networks Upgrade Manager allows remote attackers to execute arbitrary code via a long first argument to the Upgrade method.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '28647', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28647'}, {'name': 'ADV-2008-0274', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0274'}, {'name': 'movenetworks-qmpupgrade-bo(39913)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39913'}, {'name': '4979', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4979'}, {'name': '27438', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27438'}, {'name': '1019270', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019270'}]
CVE State: PUBLISHED
Explain CVE-2008-0478
Directory traversal vulnerability in index.php in SetCMS 3.6.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the set parameter, as demonstrated by sending a certain CLIENT_IP HTTP header in an enter action to index.php, and injecting PHP sequences into files/enter.set, which is then included by index.php.
Affected Products: n/a
References: [{'name': '4962', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4962'}, {'name': 'setcms-index-file-include(39864)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39864'}, {'name': '27407', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27407'}]
CVE State: PUBLISHED
Explain CVE-2008-0479
Directory traversal vulnerability in RTE_file_browser.asp in Web Wiz NewsPad 1.02 allows remote attackers to list arbitrary directories, and .txt and .zip files, via a .....\\\ in the sub parameter.
Affected Products: n/a
References: [{'name': '1019268', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019268'}, {'name': '28416', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28416'}, {'name': '20080123 Web Wiz NewsPad Directory traversal', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486869/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.webwizguide.com/webwiznewspad/kb/release_notes.asp'}, {'name': 'newspad-rte-directory-traversal(39863)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39863'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bugreport.ir/?/30'}, {'name': '27419', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27419'}, {'name': '3588', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3588'}, {'name': '4972', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4972'}]
CVE State: PUBLISHED