Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2008-1250
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'name': '28938', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28938'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': '27767', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27767'}, {'name': 'snom-sipphone-addressbook-csrf(40500)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/40500'}]
CVE State: PUBLISHED
Explain CVE-2008-1251
Cross-site scripting (XSS) vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'name': 'snom-sipphone-addressbook-xss(40499)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/40499'}, {'name': '28938', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28938'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': '27767', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27767'}]
CVE State: PUBLISHED
Explain CVE-2008-1252
b_banner.stm (aka the login page) on the Deutsche Telekom Speedport W500 DSL router allows remote attackers to obtain the logon password by reading the pwd field in the HTML source.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': '28382', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28382'}, {'name': '29414', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29414'}, {'name': 'speedport-w500-bbanner-info-disclosure(41128)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41128'}]
CVE State: PUBLISHED
Explain CVE-2008-1253
Cross-site scripting (XSS) vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attackers to inject arbitrary web script or HTML via the var:category parameter, as demonstrated by a request for advanced/portforw.htm on the fwan page.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': '28439', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28439'}, {'name': '29530', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29530'}, {'name': 'dlinkdslg604t-cgibinwebcm-xss(41117)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41117'}]
CVE State: PUBLISHED
Explain CVE-2008-1254
Multiple cross-site request forgery (CSRF) vulnerabilities on the ZyXEL P-660HW series router allow remote attackers to (1) change DNS servers and (2) add keywords to the "bannedlist" via unspecified vectors.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'zyxel-p660hw-unspecified-csrf(41111)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41111'}]
CVE State: PUBLISHED
Explain CVE-2008-1255
The ZyXEL P-660HW series router maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'name': 'zyxel-p660hw-ip-authentication-bypass(41114)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41114'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}]
CVE State: PUBLISHED
Explain CVE-2008-1256
The ZyXEL P-660HW series router has "admin" as its default password, which allows remote attackers to gain administrative access.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'zyxel-p660hw-default-password(41108)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41108'}]
CVE State: PUBLISHED
Explain CVE-2008-1257
Cross-site scripting (XSS) vulnerability in Forms/DiagGeneral_2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitrary web script or HTML via the PingIPAddr parameter.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'zyxel-p660hw-diaggeneral-xss(41109)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41109'}]
CVE State: PUBLISHED
Explain CVE-2008-1258
Cross-site scripting (XSS) vulnerability in prim.htm on the D-Link DI-604 router allows remote attackers to inject arbitrary web script or HTML via the rf parameter.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'dlink-di604-prim-xss(41122)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41122'}, {'name': '28439', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28439'}, {'name': '29531', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29531'}]
CVE State: PUBLISHED
Explain CVE-2008-1259
The Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a user who previously authenticated within the previous 5 minutes.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'zyxel-ipaddress-authentication-bypass(41112)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41112'}]
CVE State: PUBLISHED
Explain CVE-2008-1260
Multiple cross-site request forgery (CSRF) vulnerabilities on the Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware allow remote attackers to (1) make the admin web server available on the Internet (WAN) interface via the WWWAccessInterface parameter to Forms/RemMagWWW_1 or (2) change the IP whitelisting timeout via the StdioTimout parameter to Forms/rpSysAdmin_1.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'zyxel-p2602hw-multiple-csrf(41170)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41170'}]
CVE State: PUBLISHED
Explain CVE-2008-1261
The Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware provides different responses to admin page requests depending on whether a user is logged in, which allows remote attackers to obtain current login status by requesting an arbitrary admin URI.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'zyxel-p2602hwd1a-loginstatus-info-disclosure(41113)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41113'}]
CVE State: PUBLISHED
Explain CVE-2008-1262
The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication credentials, which allows remote attackers to (1) upload malformed firmware or (2) bind the antenna to a different WiMAX base station via unspecified requests to forms under process_adv/.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'name': '28122', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28122'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'wimaxprost-webinterface-security-bypass(41052)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41052'}, {'name': 'VU#248372', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/248372'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.0x000000.com/?i=524'}, {'name': 'ADV-2008-0802', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0802/references'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sharemethods.net/nepal/servlet/open?keeppath=false&aid=29820'}, {'tags': ['x_refsource_MISC'], 'url': 'http://airspan4wimax.googlepages.com/'}, {'name': '29265', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29265'}]
CVE State: PUBLISHED
Explain CVE-2008-1263
The Linksys WRT54G router stores passwords and keys in cleartext in the Config.bin file, which might allow remote authenticated users to obtain sensitive information via an HTTP request for the top-level Config.bin URI.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'linksys-config-information-disclosure(41115)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41115'}]
CVE State: PUBLISHED
Explain CVE-2008-1264
The Linksys WRT54G router has "admin" as its default FTP password, which allows remote attackers to access sensitive files including nvram.cfg, a file that lists all HTML documents, and an ELF executable file.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'linksys-wrt54g-ftp-default-password(41126)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41126'}]
CVE State: PUBLISHED
Explain CVE-2008-1265
The Linksys WRT54G router allows remote attackers to cause a denial of service (device restart) via a long username and password to the FTP interface.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'linksys-wrt54g-ftp-dos(41127)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41127'}]
CVE State: PUBLISHED
Explain CVE-2008-1266
Multiple buffer overflows in the web interface on the D-Link DI-524 router allow remote attackers to cause a denial of service (device crash) or possibly have unspecified other impact via (1) a long username or (2) an HTTP header with a large name and an empty value.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': '28439', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28439'}, {'name': '29366', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29366'}, {'name': 'dlink-di524-interface-dos(41125)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41125'}]
CVE State: PUBLISHED
Explain CVE-2008-1267
The Siemens SpeedStream 6520 router allows remote attackers to cause a denial of service (web interface crash) via an HTTP request to basehelp_English.htm with a large integer in the Content-Length field.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'name': 'speedstream-basehelpenglish-dos(41123)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41123'}, {'name': '29325', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29325'}, {'name': '28490', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28490'}]
CVE State: PUBLISHED
Explain CVE-2008-1268
The FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which allows remote attackers to establish an FTP session by sending an arbitrary username and password.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://swbae.egloos.com/1701135'}, {'name': 'linksys-wrt54g-ftp-security-bypass(41119)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41119'}]
CVE State: PUBLISHED
Explain CVE-2008-1269
cp06_wifi_m_nocifr.cgi in the admin panel on the Alice Gate 2 Plus Wi-Fi router does not verify authentication credentials, which allows remote attackers to disable Wi-Fi encryption via a certain request.
Affected Products: n/a
References: [{'name': '20080301 The Router Hacking Challenge is Over!', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489009/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gnucitizen.org/projects/router-hacking-challenge/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://vx.netlux.org/wargamevx/alice_gate2_pluswifi_PoC.zip'}, {'name': 'alicegate2pluswifi-admin-security-bypass(41110)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41110'}]
CVE State: PUBLISHED
Explain CVE-2008-1270
mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-2344'}, {'name': '29622', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29622'}, {'name': '29318', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29318'}, {'name': 'SUSE-SR:2008:008', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html'}, {'name': 'GLSA-200804-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200804-08.xml'}, {'name': 'DSA-1521', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1521'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.lighttpd.net/security/lighttpd_sa_2008_03.txt'}, {'name': '20080312 rPSA-2008-0106-1 lighttpd', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489465/100/0/threaded'}, {'name': '29636', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29636'}, {'name': 'ADV-2008-0885', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0885/references'}, {'name': '28226', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28226'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.lighttpd.net/trac/ticket/1587'}, {'name': '29403', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29403'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.lighttpd.net/2008/3/10/1-4-19-made-in-germany'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=212930'}, {'tags': ['x_refsource_MISC'], 'url': 'http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0106'}, {'name': 'lighttpd-moduserdir-information-disclosure(41173)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41173'}]
CVE State: PUBLISHED
Explain CVE-2008-1272
Multiple SQL injection vulnerabilities in BM Classifieds 20080309 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to showad.php and the (2) ad parameter to pfriendly.php.
Affected Products: n/a
References: [{'name': '28159', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28159'}, {'name': '5223', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5223'}, {'name': '29297', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29297'}, {'name': 'bmclassifieds-showad-sql-injection(41066)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41066'}]
CVE State: PUBLISHED
Explain CVE-2008-1273
Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web script or HTML via the path parameter to (1) popup.php, (2) test/dir2.php, (3) admin/upload.php, and (4) dirxml.php in upload/.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'imagevue-path-xss(41169)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41169'}, {'name': '28138', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28138'}, {'tags': ['x_refsource_MISC'], 'url': 'http://downloads.securityfocus.com/vulnerabilities/exploits/28138.html'}]
CVE State: PUBLISHED
Explain CVE-2008-1274
Untrusted search path vulnerability in man in IBM AIX 6.1.0 allows local users to execute arbitrary code via a malicious program in the man directory.
Affected Products: n/a
References: [{'name': 'ADV-2008-0805', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0805/references'}, {'name': '28180', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28180'}, {'name': 'IZ17177', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/search.wss?rs=0&q=IZ17177&apar=only'}, {'name': 'ibm-aix-man-privilege-escalation(41067)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41067'}, {'name': '1019572', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019572'}, {'name': 'oval:org.mitre.oval:def:5169', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5169'}, {'name': '29301', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29301'}]
CVE State: PUBLISHED
Explain CVE-2008-1275
Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x and earlier, and Enterprise Edition 3.x and earlier allow remote attackers to cause a denial of service (crash) via crafted (1) EXPN or (2) VRFY commands.
Affected Products: n/a
References: [{'name': '5235', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5235'}, {'name': 'mailenable-expn-vrfy-dos(41083)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41083'}, {'name': '28154', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28154'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mailenable.com/hotfix/'}, {'name': 'ADV-2008-0800', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0800/references'}, {'name': '29300', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29300'}]
CVE State: PUBLISHED
Explain CVE-2008-1276
Multiple buffer overflows in the IMAP service (MEIMAPS.EXE) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allow remote authenticated attackers to execute arbitrary code via long arguments to the (1) FETCH, (2) EXAMINE, and (3) UNSUBSCRIBE commands.
Affected Products: n/a
References: [{'name': '29277', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29277'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/maildisable-adv.txt'}, {'name': '5249', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5249'}, {'name': 'ADV-2008-0799', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0799/references'}, {'name': '3724', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3724'}, {'name': '20080307 Multiple vulnerabilities in MailEnable Professional/Enterprise 3.13', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489270/100/0/threaded'}, {'name': '1019565', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019565'}, {'name': '28145', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28145'}, {'name': 'mailenable-imapservice-bo(41058)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41058'}]
CVE State: PUBLISHED
Explain CVE-2008-1277
The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote attackers to cause a denial of service (crash) via (1) SEARCH and (2) APPEND commands without required arguments, which triggers a NULL pointer dereference.
Affected Products: n/a
References: [{'name': '29277', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29277'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/maildisable-adv.txt'}, {'name': 'ADV-2008-0799', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0799/references'}, {'name': '3724', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3724'}, {'name': '20080307 Multiple vulnerabilities in MailEnable Professional/Enterprise 3.13', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489270/100/0/threaded'}, {'name': '1019565', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019565'}, {'name': '28145', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28145'}, {'name': 'mailenable-imapservice-dos(41059)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41059'}]
CVE State: PUBLISHED
Explain CVE-2008-1278
The RemotelyAnywhere.exe service in the Remotely Anywhere Server and Workstation 8.0.668 and earlier allows remote attackers to cause a denial of service (crash) via an invalid Accept-Charset header, which triggers a NULL pointer dereference.  NOTE: the service is automatically restarted.
Affected Products: n/a
References: [{'name': '29296', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29296'}, {'name': '20080310 NULL pointer in Remotely Anywhere 8.0.668', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489354/100/0/threaded'}, {'name': 'remotelyanywhere-http-dos(41077)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41077'}, {'name': 'ADV-2008-0816', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0816/references'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/remotelynowhere-adv.txt'}, {'name': '28175', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28175'}]
CVE State: PUBLISHED
Explain CVE-2008-1279
Acronis True Image Group Server 1.5.19.191 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages, allows remote attackers to cause a denial of service (crash) via a packet with an invalid length field, which causes an out-of-bounds read.
Affected Products: n/a
References: [{'name': '29306', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29306'}, {'name': 'ADV-2008-0813', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0813/references'}, {'name': '20080310 Invalid memory access in Acronis True Image Group Server 1.5.19.191', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489353/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/acrogroup-adv.txt'}, {'name': 'acronis-groupserver-dos(41071)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41071'}, {'name': '28169', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28169'}]
CVE State: PUBLISHED
Explain CVE-2008-1280
Acronis True Image Windows Agent 1.0.0.54 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages, allows remote attackers to cause a denial of service (crash) via a malformed packet to port 9876, which triggers a NULL pointer dereference.
Affected Products: n/a
References: [{'name': '29306', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29306'}, {'name': 'acronis-windows-agent-dos(41070)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41070'}, {'name': 'ADV-2008-0812', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0812/references'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/acroagent-adv.txt'}, {'name': '28169', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28169'}, {'name': '20080310 NULL pointer in Acronis True Image Windows Agent 1.0.0.54', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489362/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-1281
Directory traversal vulnerability in TFTPsrvs.exe 2.5.3.1 and earlier, as used in Argon Technology Client Management Services (CMS) 1.31 and earlier, allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Affected Products: n/a
References: [{'name': 'argoncms-tftpsrvs-directory-traversal(41076)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41076'}, {'name': 'ADV-2008-0815', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0815/references'}, {'name': '28160', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28160'}, {'name': '20080310 Directory traversal in Argon Client Management Services 1.31', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489363/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/argonauti-adv.txt'}, {'name': '5230', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/5230'}, {'name': '29302', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29302'}]
CVE State: PUBLISHED
Explain CVE-2008-1282
Buffer overflow in the BFup ActiveX control (BFup.dll) in B21Soft BFup before 1.0.802.29 allows remote attackers to execute arbitrary code via a long FilePath parameter.
Affected Products: n/a
References: [{'name': '28131', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28131'}, {'name': 'JVN#10606373', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/jp/JVN%2310606373/index.html'}, {'name': 'ADV-2008-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0797/references'}, {'name': '29260', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29260'}, {'name': 'bfup-activex-bo(41050)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41050'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.hi-ho.ne.jp/babaq/bfupinfo.html'}]
CVE State: PUBLISHED
Explain CVE-2008-1283
Cross-site scripting (XSS) vulnerability in Neptune Web Server 3.0 allows remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in the 404 error page.
Affected Products: n/a
References: [{'name': 'neptune-webserver-404errorpage-xss(41089)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41089'}, {'name': '28148', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28148'}, {'name': '20080307 XSS in Neptune Web Server', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489282/100/0/threaded'}, {'name': '3725', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3725'}]
CVE State: PUBLISHED
Explain CVE-2008-1284
Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name.
Affected Products: n/a
References: [{'name': '3726', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3726'}, {'name': '29286', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29286'}, {'name': 'horde-theme-file-include(41054)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41054'}, {'name': '[announce] 20080307  Horde Groupware 1.0.5 (final)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.horde.org/archives/announce/2008/000383.html'}, {'name': '[announce] 20080307  Horde Groupware Webmail Edition 1.0.6 (final)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.horde.org/archives/announce/2008/000384.html'}, {'name': 'FEDORA-2008-2406', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00301.html'}, {'name': '20080307 Horde Webmail file inclusion proof of concept & patch.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489239/100/0/threaded'}, {'name': 'GLSA-200805-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200805-01.xml'}, {'name': 'DSA-1519', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1519'}, {'name': '30047', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30047'}, {'name': 'FEDORA-2008-2362', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00253.html'}, {'name': '29374', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29374'}, {'name': '20080308 Re: Horde Webmail file inclusion proof of concept & patch.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489289/100/0/threaded'}, {'name': '[announce] 20080307 Horde 3.1.7 (final)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.horde.org/archives/announce/2008/000382.html'}, {'name': 'ADV-2008-0822', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0822/references'}, {'name': '28153', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28153'}, {'name': '29400', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29400'}]
CVE State: PUBLISHED
Explain CVE-2008-1285
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2008:0828', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2008-0828.html'}, {'name': 'RHSA-2008:0826', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2008-0826.html'}, {'name': '233561', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-233561-1'}, {'name': 'sun-jsf-routines-xss(41081)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41081'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://jira.jboss.org/jira/browse/JBPAPP-682'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=437082'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp03/html-single/readme/index.html'}, {'name': 'ADV-2008-0808', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0808/references'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp01/html-single/readme/'}, {'name': '28192', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28192'}, {'name': 'RHSA-2008:0827', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2008-0827.html'}, {'name': '29327', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29327'}, {'name': 'RHSA-2008:0825', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2008-0825.html'}, {'name': '1020628', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1020628'}]
CVE State: PUBLISHED
Explain CVE-2008-1286
Unspecified vulnerability in Sun Java Web Console 3.0.2, 3.0.3, and 3.0.4 allows remote attackers to bypass intended access restrictions and determine the existence of files or directories via unknown vectors.
Affected Products: n/a
References: [{'name': 'sun-javawebconsole-information-disclosure(41069)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41069'}, {'name': '1019574', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019574'}, {'name': '28155', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28155'}, {'name': '29290', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29290'}, {'name': 'ADV-2008-0806', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0806/references'}, {'name': '231526', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-231526-1'}]
CVE State: PUBLISHED
Explain CVE-2008-1287
IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames.
Affected Products: n/a
References: [{'name': '1019566', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019566'}, {'name': 'clearquest-username-information-disclosure(41042)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41042'}, {'name': '29280', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29280'}, {'name': 'PK55561', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1PK55561'}, {'name': '28132', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28132'}, {'name': 'ADV-2008-0804', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0804/references'}]
CVE State: PUBLISHED
Explain CVE-2008-1288
IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 might allow local or remote attackers to obtain sensitive information about users by reading user cookies.
Affected Products: n/a
References: [{'name': '28133', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28133'}, {'name': '1019567', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019567'}, {'name': '29280', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29280'}, {'name': 'clearquest-cookie-information-disclosure(41043)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41043'}, {'name': 'PK55753', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1PK55753'}, {'name': 'ADV-2008-0804', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0804/references'}]
CVE State: PUBLISHED
Explain CVE-2008-1289
Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the process_sdp function in channels/chan_sip.c.
Affected Products: n/a
References: [{'name': '28308', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28308'}, {'name': '3763', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3763'}, {'tags': ['x_refsource_MISC'], 'url': 'http://labs.musecurity.com/advisories/MU-200803-01.txt'}, {'name': 'asterisk-rtp-codecpayload-bo(41305)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41305'}, {'name': '1019628', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1019628'}, {'name': '29426', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29426'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.asterisk.org/node/48466'}, {'name': 'FEDORA-2008-2554', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html'}, {'name': '20080318 AST-2008-002: Two buffer overflows in RTP Codec Payload Handling', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/489817/100/0/threaded'}, {'name': 'ADV-2008-0928', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0928'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.digium.com/pub/security/AST-2008-002.html'}, {'name': 'FEDORA-2008-2620', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html'}, {'name': 'asterisk-rtppayload-bo(41302)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41302'}, {'name': '29470', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29470'}]
CVE State: PUBLISHED
Explain CVE-2008-1290
ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information.
Affected Products: n/a
References: [{'name': 'GLSA-200803-29', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200803-29.xml'}, {'name': '29460', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29460'}, {'name': '29176', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29176'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380'}, {'name': 'ADV-2008-0734', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0734/references'}, {'name': '28055', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28055'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=212288'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD'}]
CVE State: PUBLISHED
Explain CVE-2008-1291
ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.
Affected Products: n/a
References: [{'name': 'GLSA-200803-29', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200803-29.xml'}, {'name': '29460', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29460'}, {'name': '29176', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29176'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380'}, {'name': 'ADV-2008-0734', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0734/references'}, {'name': '28055', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28055'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=212288'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD'}]
CVE State: PUBLISHED
Explain CVE-2008-1292
ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.
Affected Products: n/a
References: [{'name': 'GLSA-200803-29', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200803-29.xml'}, {'name': '29460', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29460'}, {'name': '29176', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29176'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380'}, {'name': 'ADV-2008-0734', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0734/references'}, {'name': '28055', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28055'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=212288'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD'}]
CVE State: PUBLISHED