Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2008-0137
PHP remote file inclusion vulnerability in config.inc.php in SNETWORKS PHP CLASSIFIEDS 5.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_escape parameter.
Affected Products: n/a
References: [{'name': 'ADV-2008-0053', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0053'}, {'name': 'snetworks-configinc-file-include(39468)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39468'}, {'name': '4838', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4838'}]
CVE State: PUBLISHED
Explain CVE-2008-0138
PHP remote file inclusion vulnerability in xoopsgallery/init_basic.php in the mod_gallery module for XOOPS, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter.
Affected Products: n/a
References: [{'name': '4847', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4847'}, {'name': '27155', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27155'}, {'name': 'xoops-modgallery-zendhashkey-file-include(39461)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39461'}]
CVE State: PUBLISHED
Explain CVE-2008-0139
Eval injection vulnerability in loudblog/inc/parse_old.php in Loudblog 0.8.0 and earlier allows remote attackers to execute arbitrary PHP code via the template parameter.
Affected Products: n/a
References: [{'name': '4849', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4849'}, {'name': '27157', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27157'}, {'name': '28336', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28336'}, {'name': 'loudblog-template-code-execution(39445)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39445'}]
CVE State: PUBLISHED
Explain CVE-2008-0140
Directory traversal vulnerability in error.php in Uebimiau Webmail 2.7.10 and 2.7.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the selected_theme parameter, a different vector than CVE-2007-3172.
Affected Products: n/a
References: [{'name': '27154', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27154'}, {'name': '4846', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4846'}, {'name': 'uebimiau-webmail-error-directory-traversal(39460)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39460'}, {'name': '20080107 Uebimiau Web-Mail 2.7.10/2.7.2 Remote File Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2008-January/001867.html'}]
CVE State: PUBLISHED
Explain CVE-2008-0141
actions.php in WebPortal CMS 0.6-beta generates predictable passwords containing only the time of day, which makes it easier for remote attackers to obtain access to any account via a lostpass action.
Affected Products: n/a
References: [{'name': '27145', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27145'}, {'name': '4835', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4835'}, {'name': 'webportal-action-weak-security(39486)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39486'}]
CVE State: PUBLISHED
Explain CVE-2008-0142
Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL commands via the user_name parameter to actions.php, and unspecified other vectors.
Affected Products: n/a
References: [{'name': '4835', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4835'}]
CVE State: PUBLISHED
Explain CVE-2008-0143
PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM Broadcaster, allows remote attackers to execute arbitrary PHP code via a URL in the commonpath parameter.
Affected Products: n/a
References: [{'name': '4834', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4834'}, {'name': '27137', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27137'}, {'name': 'samPHPweb-db-file-include(39397)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39397'}, {'name': '28355', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28355'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.spacialaudio.com/news/index.html'}]
CVE State: PUBLISHED
Explain CVE-2008-0144
PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.  NOTE: this can also be leveraged for local file inclusion using directory traversal sequences.
Affected Products: n/a
References: [{'name': '27136', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27136'}, {'name': '28328', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28328'}, {'name': '20080105 NetRisk 1.9.7 Remote File Inclusion Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=119955114428283&w=2'}, {'name': '4833', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4833'}, {'name': 'netrisk-index-file-include(39419)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39419'}]
CVE State: PUBLISHED
Explain CVE-2008-0145
Unspecified vulnerability in glob in PHP before 4.4.8, when open_basedir is enabled, has unknown impact and attack vectors.  NOTE: this issue reportedly exists because of a regression related to CVE-2007-4663.
Affected Products: n/a
References: [{'name': 'ADV-2008-0059', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0059'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/releases/4_4_8.php'}, {'name': 'SSA:2008-045-03', 'tags': ['vendor-advisory', 'x_refsource_SLACKWARE'], 'url': 'http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136'}, {'name': '28936', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28936'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.php.net/bug.php?id=41655'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-4.php'}, {'name': '28318', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28318'}, {'name': 'php-glob-openbasedir-security-bypass(39401)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39401'}]
CVE State: PUBLISHED
Explain CVE-2008-0146
Cross-site scripting (XSS) vulnerability in the error page in W3-mSQL allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the top-level URI.
Affected Products: n/a
References: [{'name': '28294', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28294'}, {'name': '20080103 xss in w3-msql error page', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/485736/100/0/threaded'}, {'name': '3521', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3521'}, {'name': '51235', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51235'}, {'name': '27116', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27116'}]
CVE State: PUBLISHED
Explain CVE-2008-0147
SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via (1) the user_email parameter and possibly (2) username parameter in a Members action.
Affected Products: n/a
References: [{'name': '27180', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27180'}, {'name': '4863', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4863'}, {'name': '28301', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28301'}, {'name': 'smallnuke-index-sql-injection(39525)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39525'}]
CVE State: PUBLISHED
Explain CVE-2008-0148
TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell commands via the cmd parameter in a direct request.
Affected Products: n/a
References: [{'name': '28291', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28291'}, {'name': 'tutos-cmd-command-execution(39531)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39531'}, {'name': '4861', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4861'}]
CVE State: PUBLISHED
Explain CVE-2008-0149
TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function.
Affected Products: n/a
References: [{'name': '28291', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28291'}, {'name': '4861', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4861'}]
CVE State: PUBLISHED
Explain CVE-2008-0150
Unspecified vulnerability in the LDAP authentication feature in Aruba Mobility Controller 2.3.6.15, 2.5.2.11, 2.5.4.25, 2.5.5.7, 3.1.1.3, and 2.4.8.11-FIPS or earlier allows remote attackers to bypass authentication mechanisms and obtain management or VPN interface access.
Affected Products: n/a
References: [{'name': '27144', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27144'}, {'name': '28357', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28357'}, {'name': '20080104 Aruba Mobility Controller User Authentication Vulnerability - Aruba Advisory ID: AID-122207', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/485831/100/0/threaded'}, {'name': '3529', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3529'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.arubanetworks.com/support/alerts/aid-122207.asc'}]
CVE State: PUBLISHED
Explain CVE-2008-0151
Heap-based buffer overflow in Foxit WAC Server 2.1.0.910, 2.0 Build 3503, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Telnet request with long options.
Affected Products: n/a
References: [{'name': '3525', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3525'}, {'name': '27142', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27142'}, {'name': 'wacserver-option-dos(39427)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39427'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/waccaz-adv.txt'}, {'name': '20080219 Two heap overflow in Foxit WAC Server 2.0 Build 3503', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/488366/100/200/threaded'}, {'name': '20080104 Some DoS in some telnet servers', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/485812/100/0/threaded'}, {'name': '28272', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28272'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/wachof-adv.txt'}]
CVE State: PUBLISHED
Explain CVE-2008-0152
SLnet.exe in SeattleLab SLNet RF Telnet Server 4.1.1.3758 and earlier allows user-assisted remote attackers to cause a denial of service (crash) via unspecified telnet options, which triggers a NULL pointer dereference.  NOTE: the crash is not user-assisted when the server is running in debug mode.
Affected Products: n/a
References: [{'name': '28316', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28316'}, {'name': '27134', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27134'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/slnetmsg-adv.txt'}, {'name': '20080104 Some DoS in some telnet servers', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=119947184730448&w=2'}]
CVE State: PUBLISHED
Explain CVE-2008-0153
telnetd.exe in Pragma TelnetServer 7.0.4.589 allows remote attackers to cause a denial of service (process crash and resource exhaustion) via a crafted TELOPT PRAGMA LOGON telnet option, which triggers a NULL pointer dereference.
Affected Products: n/a
References: [{'name': 'pragmatelnetserver-telnetd-dos(39353)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39353'}, {'name': '27143', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27143'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/pragmatel-adv.txt'}, {'name': '20080104 Some DoS in some telnet servers', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=119947184730448&w=2'}]
CVE State: PUBLISHED
Explain CVE-2008-0154
SQL injection vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to execute arbitrary SQL commands the c parameter.
Affected Products: n/a
References: [{'name': '4865', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4865'}, {'name': 'evilboard-index-sql-injection(39529)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39529'}, {'name': '27190', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27190'}]
CVE State: PUBLISHED
Explain CVE-2008-0155
Cross-site scripting (XSS) vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to inject arbitrary web script or HTML via the c parameter.
Affected Products: n/a
References: [{'name': '4865', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4865'}, {'name': 'evilboard-index-xss(39526)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39526'}, {'name': '27190', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27190'}]
CVE State: PUBLISHED
Explain CVE-2008-0156
Absolute path traversal vulnerability in index.php in Million Dollar Script 2.0.14 allows remote attackers to read arbitrary files via encoded "/" (%2F) sequences in the link parameter.
Affected Products: n/a
References: [{'name': '3524', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3524'}, {'name': 'milliondollarscript-index-dir-traversal(39492)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39492'}, {'name': '27174', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27174'}, {'name': '20080107 Million Dollar Script 2.0.14 Remote File Disclosure Vulnerability.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/485882/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0157
SQL injection vulnerability in FlexBB 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb_temp_id parameter in a cookie.
Affected Products: n/a
References: [{'name': '4858', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4858'}, {'name': '27164', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27164'}, {'name': 'flexbb-flexbbtempid-sql-injection(39475)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39475'}, {'name': '28373', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28373'}]
CVE State: PUBLISHED
Explain CVE-2008-0158
Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to read arbitrary files via a .. (dot dot) in the aux_page parameter.
Affected Products: n/a
References: [{'name': 'shopscript-index-directory-traversal(39449)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39449'}, {'name': '27165', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27165'}, {'name': '4855', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4855'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/0801-exploits/shopscript-disclose.txt'}]
CVE State: PUBLISHED
Explain CVE-2008-0159
SQL injection vulnerability in index.php in eggBlog 3.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the eggblogpassword parameter in a cookie.
Affected Products: n/a
References: [{'name': '27168', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27168'}, {'name': 'eggblog-eggblogmail-sql-injection(39473)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39473'}, {'name': '28371', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28371'}, {'name': '4860', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4860'}]
CVE State: PUBLISHED
Explain CVE-2008-0162
misc.c in splitvt 1.6.6 and earlier does not drop group privileges before executing xprop, which allows local users to gain privileges.
Affected Products: n/a
References: [{'name': 'DSA-1500', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1500'}, {'name': '29190', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29190'}, {'name': '29080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29080'}, {'name': 'GLSA-200803-05', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200803-05.xml'}, {'name': '29064', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29064'}, {'name': '27936', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27936'}]
CVE State: PUBLISHED
Explain CVE-2008-0163
Linux kernel 2.6, when using vservers, allows local users to access resources of other vservers via a symlink attack in /proc.
Affected Products: n/a
References: [{'name': 'DSA-1494', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1494'}, {'name': '28875', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28875'}, {'name': '27798', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27798'}, {'name': 'linux-kernel-proc-unauth-access(40486)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/40486'}, {'name': '27704', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27704'}]
CVE State: PUBLISHED
Explain CVE-2008-0164
Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.
Affected Products: n/a
References: [{'name': '3754', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3754'}, {'name': '29361', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29361'}, {'name': '20080313 PR08-02: Plone CMS Security Research - the Art of Plowning', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489544/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.procheckup.com/Hacking_Plone_CMS.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://plone.org/about/security/advisories/cve-2008-0164'}, {'name': 'plone-joinform-csrf(41263)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41263'}]
CVE State: PUBLISHED
Explain CVE-2008-0165
Cross-site request forgery (CSRF) vulnerability in Ikiwiki before 2.42 allows remote attackers to modify user preferences, including passwords, via the (1) preferences and (2) edit forms.
Affected Products: n/a
References: [{'name': 'DSA-1553', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1553'}, {'name': '29907', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29907'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=475445'}, {'name': '29932', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29932'}, {'name': 'ADV-2008-1297', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1297/references'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ikiwiki.info/security/#index31h2'}, {'name': 'ikiwiki-change-password-csrf(41904)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41904'}]
CVE State: PUBLISHED
Explain CVE-2008-0167
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
Affected Products: n/a
References: [{'name': '29215', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/29215'}, {'name': '30286', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30286'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz'}, {'name': 'ADV-2008-1537', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1537/references'}, {'name': '30088', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30088'}, {'name': 'DSA-1577', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1577'}, {'name': 'gforge-unspecified-symlink(42456)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/42456'}]
CVE State: PUBLISHED
Explain CVE-2008-0169
Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.
Affected Products: n/a
References: [{'name': '30468', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30468'}, {'name': 'ADV-2008-1710', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1710'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=483770'}, {'name': '[oss-security] 20080531 Re: CVE id request: ikiwiki', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2008/05/31/3'}, {'name': 'ikiwiki-openid-passwordauth-auth-bypass(42798)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/42798'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ikiwiki.info/news/version_2.48/index.html'}, {'name': '29479', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/29479'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ikiwiki.info/security/#index33h2'}]
CVE State: PUBLISHED
Explain CVE-2008-0171
regex/v4/perl_matcher_non_recursive.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (failed assertion and crash) via an invalid regular expression.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.rpath.com/Advisories:rPSA-2008-0063'}, {'name': '48099', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48099'}, {'name': 'ADV-2008-0249', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0249'}, {'name': '27325', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27325'}, {'name': '28860', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28860'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.boost.org/trac/boost/changeset/42745'}, {'name': '28943', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28943'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.boost.org/trac/boost/changeset/42674'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-2143'}, {'name': 'FEDORA-2008-0880', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00760.html'}, {'name': '28511', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28511'}, {'name': '20080213 rPSA-2008-0063-1 boost', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/488102/100/0/threaded'}, {'name': '28705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28705'}, {'name': '28545', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28545'}, {'name': 'SUSE-SR:2008:006', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html'}, {'name': 'GLSA-200802-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200802-08.xml'}, {'name': '28527', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28527'}, {'name': 'USN-570-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-570-1'}, {'name': '29323', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29323'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=205955'}, {'name': 'MDVSA-2008:032', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:032'}]
CVE State: PUBLISHED
Explain CVE-2008-0172
The get_repeat_type function in basic_regex_creator.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (NULL dereference and crash) via an invalid regular expression.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.rpath.com/Advisories:rPSA-2008-0063'}, {'name': '48099', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48099'}, {'name': 'ADV-2008-0249', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0249'}, {'name': '27325', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27325'}, {'name': '28860', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28860'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.boost.org/trac/boost/changeset/42745'}, {'name': '28943', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28943'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.boost.org/trac/boost/changeset/42674'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-2143'}, {'name': 'FEDORA-2008-0880', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00760.html'}, {'name': '28511', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28511'}, {'name': '20080213 rPSA-2008-0063-1 boost', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/488102/100/0/threaded'}, {'name': '28705', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28705'}, {'name': '28545', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28545'}, {'name': 'SUSE-SR:2008:006', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html'}, {'name': 'GLSA-200802-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200802-08.xml'}, {'name': '28527', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28527'}, {'name': 'USN-570-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-570-1'}, {'name': '29323', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29323'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=205955'}, {'name': 'MDVSA-2008:032', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:032'}]
CVE State: PUBLISHED
Explain CVE-2008-0173
SQL injection vulnerability in Gforge 4.6.99 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified parameters, related to RSS exports.
Affected Products: n/a
References: [{'name': 'DSA-1459', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1459'}, {'name': 'gforge-multiple-sql-injection(39666)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39666'}, {'name': '27266', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27266'}, {'name': 'ADV-2008-0115', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0115'}, {'name': '28395', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28395'}, {'name': '28451', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28451'}]
CVE State: PUBLISHED
Explain CVE-2008-0174
GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the passwords and gain privileges.
Affected Products: n/a
References: [{'name': '20080129 Re: C4 Security Advisory - GE Fanuc Proficy Information Portal 2.6 Authentication Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487244/100/0/threaded'}, {'name': 'VU#180876', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/180876'}, {'name': '3590', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3590'}, {'name': '1019273', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1019273'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.gefanuc.com/support/index?page=kbchannel&id=KB12459'}, {'name': '20080125 C4 Security Advisory - GE Fanuc Proficy Information Portal 2.6 Authentication Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487075/100/0/threaded'}, {'name': '30754', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/30754'}]
CVE State: PUBLISHED
Explain CVE-2008-0175
Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory.
Affected Products: n/a
References: [{'name': '3591', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3591'}, {'name': '28678', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28678'}, {'name': '27446', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27446'}, {'name': '20080129 Re: C4 Security Advisory - GE Fanuc Proficy Information Portal 2.6 Arbitrary File Upload and Execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487242/100/0/threaded'}, {'name': '20080125 C4 Security Advisory - GE Fanuc Proficy Information Portal 2.6 Arbitrary File Upload and Execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487079/100/0/threaded'}, {'name': 'VU#339345', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/339345'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.gefanuc.com/support/index?page=kbchannel&id=KB12460'}, {'name': '1019274', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019274'}, {'name': 'ADV-2008-0307', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0307/references'}]
CVE State: PUBLISHED
Explain CVE-2008-0176
Heap-based buffer overflow in w32rtr.exe in GE Fanuc CIMPLICITY HMI SCADA system 7.0 before 7.0 SIM 9, and earlier versions before 6.1 SP6 Hot fix - 010708_162517_6106, allow remote attackers to execute arbitrary code via unknown vectors.
Affected Products: n/a
References: [{'name': '3592', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3592'}, {'name': '27447', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27447'}, {'name': '20080125 C4 Security Advisory - GE Fanuc Cimplicity 6.1 Heap Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487076/100/0/threaded'}, {'name': '28663', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28663'}, {'name': '1019275', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019275'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.gefanuc.com/support/index?page=kbchannel&id=KB12458'}, {'name': 'ADV-2008-0306', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0306'}, {'name': '20080129 Re: C4 Security Advisory - GE Fanuc Cimplicity 6.1 Heap Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487241/100/0/threaded'}, {'name': 'VU#308556', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/308556'}]
CVE State: PUBLISHED
Explain CVE-2008-0177
The ipcomp6_input function in sys/netinet6/ipcomp_input.c in the KAME project before 20071201 does not properly check the return value of the m_pulldown function, which allows remote attackers to cause a denial of service (system crash) via an IPv6 packet with an IPComp header.
Affected Products: n/a
References: [{'name': '28816', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28816'}, {'name': 'ADV-2008-0688', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0688'}, {'name': 'ADV-2008-0441', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0441'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet6/ipcomp_input.c?f=u&only_with_tag=netbsd-3-1'}, {'name': '27642', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27642'}, {'name': '28788', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28788'}, {'name': 'FreeBSD-SA-08:04', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'http://security.freebsd.org/advisories/FreeBSD-SA-08:04.ipsec.asc'}, {'name': 'TA08-150A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA08-150A.html'}, {'name': '29130', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29130'}, {'name': '28979', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28979'}, {'name': '30430', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30430'}, {'name': 'APPLE-SA-2008-05-28', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2008//May/msg00001.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kame.net/dev/cvsweb2.cgi/kame/kame/sys/netinet6/ipcomp_input.c.diff?r1=1.36%3Br2=1.37'}, {'name': 'APPLE-SA-2008-07-11', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html'}, {'name': 'ADV-2008-2094', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/2094/references'}, {'name': 'ADV-2008-1697', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1697'}, {'name': '1019314', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1019314'}, {'name': 'VU#110947', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/110947'}, {'name': '31074', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/31074'}, {'name': '5191', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5191'}]
CVE State: PUBLISHED
Explain CVE-2008-0178
Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the User-Agent HTTP header.
Affected Products: n/a
References: [{'name': '28742', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28742'}, {'name': 'VU#326065', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/326065'}, {'name': '27547', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27547'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.liferay.com/browse/LEP-4736'}]
CVE State: PUBLISHED
Explain CVE-2008-0179
Cross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.liferay.com/browse/LEP-4737'}, {'name': '28742', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28742'}, {'name': 'VU#888209', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/888209'}, {'name': '27550', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27550'}]
CVE State: PUBLISHED
Explain CVE-2008-0180
Cross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Greeting field in a User Profile.
Affected Products: n/a
References: [{'name': '27546', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27546'}, {'name': '28742', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28742'}, {'name': 'VU#732449', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/732449'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.liferay.com/browse/LEP-4738'}]
CVE State: PUBLISHED
Explain CVE-2008-0181
Cross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Shutdown message.
Affected Products: n/a
References: [{'name': '28742', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28742'}, {'name': 'VU#217825', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/217825'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.liferay.com/browse/LEP-4739'}, {'name': '27554', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27554'}]
CVE State: PUBLISHED
Explain CVE-2008-0182
Cross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified actions as unspecified other authenticated users via the Shutdown message.
Affected Products: n/a
References: [{'name': 'VU#767825', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/767825'}, {'name': '28742', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28742'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.liferay.com/browse/LEP-4739'}]
CVE State: PUBLISHED
Explain CVE-2008-0184
Absolute path traversal vulnerability in index.php in Sys-Hotel on Line System allows remote attackers to read arbitrary files via an encoded "/" ("%2F") in the file parameter.
Affected Products: n/a
References: [{'name': '3528', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3528'}, {'name': '27184', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27184'}, {'name': '20080108 sysHotel On Line Remote File Disclosure Vulnerability.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/485940/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0185
SQL injection vulnerability in index.php in NetRisk 1.9.7 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via the pid parameter in a profile page (possibly profile.php).
Affected Products: n/a
References: [{'name': '28328', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28328'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=551208&group_id=129681'}, {'name': '4852', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4852'}, {'name': '27161', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27161'}, {'name': '20080106 netrisk 1.9.7 Multiple Remote Vulnerabilities (sql injection/xss)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/485834/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0186
Cross-site scripting (XSS) vulnerability in index.php in NetRisk 1.9.7 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter, possibly related to CVE-2008-0144.
Affected Products: n/a
References: [{'name': '28369', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28369'}, {'name': '4852', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4852'}, {'name': '27161', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27161'}, {'name': '20080106 netrisk 1.9.7 Multiple Remote Vulnerabilities (sql injection/xss)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/485834/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0187
SQL injection vulnerability in songinfo.php in SAM Broadcaster samPHPweb, possibly 4.2.2 and earlier, allows remote attackers to execute arbitrary SQL commands via the songid parameter.
Affected Products: n/a
References: [{'name': '4836', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4836'}, {'name': 'sambroadcaster-songinfo-sql-injection(39463)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39463'}, {'name': '27147', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27147'}]
CVE State: PUBLISHED
Explain CVE-2008-0190
Multiple cross-site scripting (XSS) vulnerabilities in templates/example_template.php in AwesomeTemplateEngine allow remote attackers to inject arbitrary web script or HTML via the (1) data[title], (2) data[message], (3) data[table][1][item], (4) data[table][1][url], or (5) data[poweredby] parameter.
Affected Products: n/a
References: [{'name': '20080103 securityvulns.com russian vulnerabilities digest', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html'}, {'name': 'awesometemplateengine-multiple-xss(39396)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39396'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityvulns.ru/Sdocument784.html'}, {'name': '20080103 securityvulns.com russian vulnerabilities digest', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/485786/100/0/threaded'}, {'name': '3539', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3539'}, {'tags': ['x_refsource_MISC'], 'url': 'http://websecurity.com.ua/1694/'}, {'name': '27125', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27125'}]
CVE State: PUBLISHED