Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2008-0377
MicroNews allows remote attackers to bypass authentication and gain administrative privileges via a direct request to admin.php.
Affected Products: n/a
References: [{'name': '20080115 MicroNews Admin Direct Access vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486349/100/0/threaded'}, {'name': '27288', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27288'}, {'name': 'micronews-admin-authentication-bypass(39702)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39702'}, {'name': '3556', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3556'}]
CVE State: PUBLISHED
Explain CVE-2008-0378
Stack-based buffer overflow in SocksCap 2.40-051231 and earlier, when "Resolve all names remotely" is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hostname.
Affected Products: n/a
References: [{'name': '3560', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3560'}, {'name': '20080118 SocksCap Stack Overflow (<= 2.40-051231)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486632/100/0/threaded'}, {'name': 'sockscap-hostname-bo(39781)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39781'}, {'name': '27357', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27357'}]
CVE State: PUBLISHED
Explain CVE-2008-0379
Race condition in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) in Crystal Reports XI Release 2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SelectedSession method, which triggers a buffer overflow.
Affected Products: n/a
References: [{'name': '4931', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4931'}, {'name': '27333', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27333'}, {'name': '1019239', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019239'}, {'name': 'crystalreports-enterprisetree-bo(39743)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39743'}]
CVE State: PUBLISHED
Explain CVE-2008-0380
Buffer overflow in the Digital Data Communications RtspVaPgCtrl ActiveX control (RtspVapgDecoder.dll 1.1.0.29) allows remote attackers to execute arbitrary code via a long MP4Prefix property.
Affected Products: n/a
References: [{'name': '28492', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28492'}, {'name': '27337', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27337'}, {'name': 'ADV-2008-0182', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0182'}, {'name': '4932', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4932'}]
CVE State: PUBLISHED
Explain CVE-2008-0381
Unspecified vulnerability in Mahara before 0.9.1 has unknown impact and remote attack vectors, probably related to cross-site scripting (XSS) in uploaded files.
Affected Products: n/a
References: [{'name': '28484', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28484'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://eduforge.org/frs/shownotes.php?release_id=342'}, {'name': '27348', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27348'}]
CVE State: PUBLISHED
Explain CVE-2008-0382
Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to (1) forumdisplay.php or (2) a results action in search.php.
Affected Products: n/a
References: [{'name': '4928', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4928'}, {'name': '28509', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28509'}, {'name': '20080116 [waraxe-2008-SA#061] - Remote Code Execution in MyBB 1.2.10', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486434/100/0/threaded'}, {'name': '27322', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27322'}, {'name': '4927', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4927'}, {'name': '3559', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3559'}]
CVE State: PUBLISHED
Explain CVE-2008-0383
Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via (1) the mergepost parameter in a do_mergeposts action, (2) rid parameter in an allreports action, or (3) threads parameter in a do_multimovethreads action to (a) moderation.php; or (4) gid parameter to (b) admin/usergroups.php.
Affected Products: n/a
References: [{'name': '27323', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27323'}, {'name': 'mybb-moderationphp-sql-injection(39728)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39728'}, {'name': '28509', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28509'}, {'name': 'mybb-usergroups-sql-injection(39729)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39729'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-62.html'}, {'name': '3558', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3558'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://community.mybboard.net/showthread.php?tid=27227'}, {'name': '20080116 [waraxe-2008-SA#062] - Multiple Sql Injections in MyBB 1.2.10', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486433/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0384
OpenBSD 4.2 allows local users to cause a denial of service (kernel panic) by calling the SIOCGIFRTLABEL IOCTL on an interface that does not have a route label, which triggers a NULL pointer dereference when the return value from the rtlabel_id2name function is not checked.
Affected Products: n/a
References: [{'name': '27252', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27252'}, {'name': '4935', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4935'}, {'name': '[4.2] 20080111 005: RELIABILITY FIX: January 11, 2008', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata42.html#005_ifrtlabel'}, {'name': '28473', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28473'}, {'name': '1019188', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019188'}, {'name': '[openbsd-security-announce] 20080111 errata 005 for OpenBSD 4.2: local users can provoke a kernel panic', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=openbsd-security-announce&m=120007327504064'}]
CVE State: PUBLISHED
Explain CVE-2008-0385
SQL injection vulnerability in server/widgetallocator.php in Urulu 2.1 allows remote attackers to execute arbitrary SQL commands via the connectionId parameter to index.php with (1) statprt/js/request or (2) dyn/js/request in the PATH_INFO.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.csnc.ch/misc/files/advisories/CVE-2008-0385.txt'}, {'name': '3707', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3707'}, {'name': '29162', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29162'}, {'name': '20080228 Urulu 2.1 Blind SQL Injection Vulnerability (CVE-2008-0385)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/488909/100/0/threaded'}, {'name': '28032', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28032'}]
CVE State: PUBLISHED
Explain CVE-2008-0386
Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open?view=log'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email?r1=1.36&r2=1.37'}, {'name': '29048', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29048'}, {'name': 'GLSA-200801-21', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200801-21.xml'}, {'name': '28728', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28728'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?r1=1.24&r2=1.25'}, {'name': 'ADV-2008-0342', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0342'}, {'name': '1019284', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019284'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open?r1=1.32&r2=1.33'}, {'name': 'MDVSA-2008:031', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2008:031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=207331'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open.in?r1=1.17&r2=1.18'}, {'name': 'SUSE-SR:2008:004', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html'}, {'name': '27528', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27528'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?view=log'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=429513'}, {'name': '28638', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28638'}]
CVE State: PUBLISHED
Explain CVE-2008-0387
Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) op_receive, (2) op_start, (3) op_start_and_receive, (4) op_send, (5) op_start_and_send, and (6) op_start_send_and_receive XDR requests, which triggers memory corruption.
Affected Products: n/a
References: [{'name': 'GLSA-200803-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200803-02.xml'}, {'name': '29203', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29203'}, {'name': 'firebird-xdrprotocol-integer-overflow(39996)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39996'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/?action=item&id=2095'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=9028&release_id=570800'}, {'name': '20080128 CORE-2007-1219: Firebird Remote Memory Corruption', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/487173/100/0/threaded'}, {'name': '29501', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29501'}, {'name': '3580', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3580'}, {'name': '27403', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27403'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tracker.firebirdsql.org/browse/CORE-1681'}, {'name': 'DSA-1529', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2008/dsa-1529'}]
CVE State: PUBLISHED
Explain CVE-2008-0388
SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the user parameter in a showprofile action to the default URI.
Affected Products: n/a
References: [{'name': '52211', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52211'}, {'name': '28567', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28567'}, {'name': 'ADV-2008-0235', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0235'}, {'name': 'wpforum-index-sql-injection(39800)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39800'}, {'name': '20080216 WordPress forumaction (PAGE_id)(user)SQL Injectio', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2008-02/0272.html'}, {'name': '4939', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4939'}, {'name': '27362', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27362'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://weblogtoolscollection.com/archives/2008/01/21/wp-forum-plugin-security-bulletin/'}]
CVE State: PUBLISHED
Explain CVE-2008-0389
Unspecified vulnerability in the serveServletsByClassnameEnabled feature in IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.25, 6.1 through 6.1.0.14, and 5.1.1.x before 5.1.1.18 has unknown impact and attack vectors.
Affected Products: n/a
References: [{'name': 'ADV-2008-1133', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1133'}, {'name': '29687', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29687'}, {'name': 'PK52059', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg24018067'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg24018067'}, {'name': 'ADV-2008-0219', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0219'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg27006879#51118'}, {'name': 'websphere-serveservlets-unspecified(39808)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39808'}, {'name': '1019894', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019894'}, {'name': '1019251', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019251'}, {'name': '28576', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28576'}, {'name': '27371', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27371'}]
CVE State: PUBLISHED
Explain CVE-2008-0390
stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to index.php, and execute online.db.txt via a certain request to index.php.
Affected Products: n/a
References: [{'name': '27342', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27342'}, {'name': '4933', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4933'}, {'name': 'auracms-stat-code-execution(39777)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39777'}]
CVE State: PUBLISHED
Explain CVE-2008-0391
inc/elementz.php in aliTalk 1.9.1.1 does not properly verify authentication, which allows remote attackers to add an arbitrary user account via a modified lilil parameter, in conjunction with the ubild and pa parameters.
Affected Products: n/a
References: [{'name': '4922', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4922'}, {'name': '27315', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27315'}]
CVE State: PUBLISHED
Explain CVE-2008-0392
Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to execute arbitrary code via a .dsr file with a long (1) ConnectionName or (2) CommandName line.
Affected Products: n/a
References: [{'name': '28563', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28563'}, {'name': 'ADV-2008-0195', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0195'}, {'name': 'visualbasic-enterprise-dsr-bo(39773)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39773'}, {'name': '27349', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27349'}, {'name': '1019258', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019258'}, {'name': '4938', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4938'}]
CVE State: PUBLISHED
Explain CVE-2008-0393
Directory traversal vulnerability in info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tabla parameter, a different vector than CVE-2008-0361.
Affected Products: n/a
References: [{'name': 'gradman-info-file-include(39768)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39768'}, {'name': '4936', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4936'}, {'name': '27343', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27343'}, {'name': '28520', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28520'}]
CVE State: PUBLISHED
Explain CVE-2008-0394
Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to execute arbitrary code via a long RCPT TO command, which is not properly handled by the makeuserkey function.  NOTE: some of these details were obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.milw0rm.com/sploits/2008-vs-GNU-citadel.tar.gz'}, {'name': '27376', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27376'}, {'name': '1019255', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019255'}, {'name': '4949', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4949'}, {'name': 'ADV-2008-0252', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0252'}, {'name': '28590', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28590'}, {'name': 'citadel-makeuserkey-bo(39807)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39807'}]
CVE State: PUBLISHED
Explain CVE-2008-0395
Kayako SupportSuite 3.11.01 allows remote attackers to obtain server configuration information via a direct request to syncml/index.php, which prints the contents of the $_SERVER superglobal.
Affected Products: n/a
References: [{'name': '28613', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28613'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-63.html'}, {'name': '3573', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3573'}, {'name': '20080121 [waraxe-2008-SA#063] - Information Leakage in Kayako SupportSuite 3.11.01', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486762/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0396
Directory traversal vulnerability in BitDefender Update Server (http.exe), as used in BitDefender products including Security for Fileservers and Enterprise Manager (BDEM), allows remote attackers to read arbitrary files via .. (dot dot) sequences in an HTTP request.
Affected Products: n/a
References: [{'name': '27358', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27358'}, {'name': '20080119 BitDefender Update Server - Unauthorized Remote File Access Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486701/100/0/threaded'}, {'name': 'bitdefender-http-server-directory-traversal(39802)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39802'}, {'name': '3568', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3568'}, {'tags': ['x_refsource_MISC'], 'url': 'http://oliver.greyhat.de/2008/01/19/bitdefender-unauthorized-remote-file-access-vulnerability/'}, {'name': '28578', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28578'}, {'name': 'ADV-2008-0213', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0213'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.oliverkarow.de/research/bitdefender.txt'}]
CVE State: PUBLISHED
Explain CVE-2008-0397
Multiple SQL injection vulnerabilities in aflog 1.01, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to comments.php and (2) an unspecified parameter to view.php.
Affected Products: n/a
References: [{'name': 'ADV-2008-0255', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0255'}, {'name': '28594', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28594'}, {'name': '4958', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4958'}, {'name': 'aflog-comments-sql-injection(39825)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39825'}, {'name': '27398', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27398'}]
CVE State: PUBLISHED
Explain CVE-2008-0398
Cross-site scripting (XSS) vulnerability in aflog 1.01, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the comment form.
Affected Products: n/a
References: [{'name': 'ADV-2008-0255', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0255'}, {'name': '28594', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28594'}, {'name': '4958', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4958'}, {'name': '27398', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27398'}]
CVE State: PUBLISHED
Explain CVE-2008-0399
Multiple buffer overflows in Toshiba Surveillance (Surveillix) RecordSend ActiveX control (MeIpCamX.DLL 1.0.0.4) allow remote attackers to execute arbitrary code via long arguments to the (1) SetPort and (2) SetIpAddress methods.
Affected Products: n/a
References: [{'name': 'toshiba-recordsend-bo(39792)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39792'}, {'name': '4946', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4946'}, {'name': '28557', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28557'}, {'name': '27360', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27360'}, {'name': 'ADV-2008-0214', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0214'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/rgod_toshiba_control.html'}]
CVE State: PUBLISHED
Explain CVE-2008-0400
Cross-site scripting (XSS) vulnerability in header.tpl.php in the modern template for Singapore 0.10.1 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter to default.php.
Affected Products: n/a
References: [{'name': '28573', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28573'}, {'name': '27382', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27382'}, {'tags': ['x_refsource_MISC'], 'url': 'http://trew.icenetx.net/toolz/advisory-singapore-modern-template.txt'}, {'name': 'ADV-2008-0234', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0234'}]
CVE State: PUBLISHED
Explain CVE-2008-0401
Buffer overflow in the logging functionality of the HTTP server in IBM Tivoli Provisioning Manager for OS Deployment (TPMfOSD) before 5.1.0.3 Interim Fix 3 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via an HTTP request with a long method string to port 443/tcp.
Affected Products: n/a
References: [{'name': 'ADV-2008-0239', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0239'}, {'name': '20080122 IBM Tivoli PMfOSD HTTP Request Method Buffer Overflow Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=647'}, {'name': 'tivoli-provisioning-http-unspecified(39819)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39819'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg24018010'}, {'name': '28604', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28604'}, {'name': '1019249', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019249'}, {'name': 'VU#158609', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/158609'}, {'name': '27387', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27387'}]
CVE State: PUBLISHED
Explain CVE-2008-0402
Unspecified vulnerability in IBM WebSphere Business Modeler Basic and Advanced 6.0.2.1 before Interim Fix 11 allows remote authenticated users to bypass intended access restrictions and delete unspecified repository resources via unknown vectors, even when they are not administrators or members of the repository's owning group.
Affected Products: n/a
References: [{'name': 'websphere-repository-weak-security(39830)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39830'}, {'name': '28586', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28586'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg24018060'}, {'name': 'JR28175', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/search.wss?rs=0&q=JR28175&apar=only'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg24018061'}, {'name': 'ADV-2008-0254', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0254'}, {'name': '1019252', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019252'}, {'name': '27389', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27389'}]
CVE State: PUBLISHED
Explain CVE-2008-0403
The web server in Belkin Wireless G Plus MIMO Router F5D9230-4 does not require authentication for SaveCfgFile.cgi, which allows remote attackers to read and modify configuration via a direct request to SaveCfgFile.cgi.
Affected Products: n/a
References: [{'name': '3566', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3566'}, {'name': 'belkin-savecfgfile-authentication-bypass(39793)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39793'}, {'name': 'ADV-2008-0215', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0215'}, {'name': '27359', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27359'}, {'name': '4941', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4941'}, {'name': '20080119 Belkin Wireless G Plus MIMO Router F5D9230-4 Authentication Bypass Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486748/100/0/threaded'}, {'name': '28554', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28554'}]
CVE State: PUBLISHED
Explain CVE-2008-0404
Cross-site scripting (XSS) vulnerability in Mantis before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to the "Most active bugs" summary.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=569765'}, {'name': '28591', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28591'}, {'name': '28577', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28577'}, {'name': 'FEDORA-2008-0856', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00734.html'}, {'name': 'ADV-2008-0232', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0232'}, {'name': 'mantis-mostactive-xss(39801)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39801'}, {'name': '27367', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27367'}, {'name': 'FEDORA-2008-0796', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00676.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=429552'}]
CVE State: PUBLISHED
Explain CVE-2008-0405
Multiple directory traversal vulnerabilities in HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allow remote attackers to create arbitrary (1) files and (2) directories via a .. (dot dot) in an account name, when requesting the / URI; and (3) append arbitrary data to a file via a .. (dot dot) in an account name, when requesting a URI composed of a "/?%0a" sequence followed by the data.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.rejetto.com/hfs/?f=wn'}, {'name': '27423', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27423'}, {'name': '3581', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3581'}, {'name': '20080123 Syhunt: HFS (HTTP File Server) Log Arbitrary File/Directory Manipulation and Denial-of-Service Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486873/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfshack.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfs-1-log.txt'}, {'name': '28631', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28631'}, {'name': 'hfs-unspecified-command-execution(39873)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39873'}]
CVE State: PUBLISHED
Explain CVE-2008-0406
HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allows remote attackers to cause a denial of service (daemon crash) via a long account name.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.rejetto.com/hfs/?f=wn'}, {'name': 'hfs-filename-dos(39875)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39875'}, {'name': '27423', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27423'}, {'name': '3581', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3581'}, {'name': '20080123 Syhunt: HFS (HTTP File Server) Log Arbitrary File/Directory Manipulation and Denial-of-Service Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486873/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfshack.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfs-1-log.txt'}, {'name': '28631', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28631'}]
CVE State: PUBLISHED
Explain CVE-2008-0407
HTTP File Server (HFS) before 2.2c tags HTTP request log entries with the username sent during HTTP Basic Authentication, regardless of whether authentication succeeded, which might make it more difficult for an administrator to determine who made a remote request.
Affected Products: n/a
References: [{'name': '20080123 Syhunt: HFS (HTTP File Server) Username Spoofing and Log Forging/Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486874/100/0/threaded'}, {'name': 'hfs-username-spoofing(39877)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39877'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rejetto.com/hfs/?f=wn'}, {'name': '27423', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27423'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfs-1-username.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfshack.txt'}, {'name': '28631', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28631'}, {'name': '3582', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3582'}]
CVE State: PUBLISHED
Explain CVE-2008-0408
HTTP File Server (HFS) before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication.
Affected Products: n/a
References: [{'name': 'hfs-unspecified-log-injection(39876)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39876'}, {'name': '20080123 Syhunt: HFS (HTTP File Server) Username Spoofing and Log Forging/Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486874/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rejetto.com/hfs/?f=wn'}, {'name': '27423', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27423'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfs-1-username.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfshack.txt'}, {'name': '28631', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28631'}, {'name': '3582', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3582'}]
CVE State: PUBLISHED
Explain CVE-2008-0409
Cross-site scripting (XSS) vulnerability in HTTP File Server (HFS) before 2.2c allows remote attackers to inject arbitrary web script or HTML via the userinfo subcomponent of a URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfs-1-template.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rejetto.com/hfs/?f=wn'}, {'name': '27423', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27423'}, {'name': 'hfs-host-xss(39870)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39870'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfshack.txt'}, {'name': '3583', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3583'}, {'name': '28631', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28631'}, {'name': '20080123 Syhunt: HFS (HTTP File Server) Template Cross-Site Scripting and Information Disclosure Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486872/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0410
HTTP File Server (HFS) before 2.2c allows remote attackers to obtain configuration and usage details by using an id element such as <id>%version%</id> in HTTP Basic Authentication instead of a username and password, as demonstrated by placing this id element in the userinfo subcomponent of a URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfs-1-template.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rejetto.com/hfs/?f=wn'}, {'name': '27423', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27423'}, {'name': 'hfs-sendhfsidentifier-info-disclosure(39871)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39871'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.syhunt.com/advisories/hfshack.txt'}, {'name': '3583', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3583'}, {'name': '28631', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28631'}, {'name': '20080123 Syhunt: HFS (HTTP File Server) Template Cross-Site Scripting and Information Disclosure Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486872/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2008-0421
SQL injection vulnerability in Invision Gallery 2.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in a rate command.
Affected Products: n/a
References: [{'name': '4966', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4966'}]
CVE State: PUBLISHED
Explain CVE-2008-0422
SQL injection vulnerability in mail.php in boastMachine (aka bMachine) 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '4952', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4952'}, {'name': '32379', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/32379'}, {'name': '20080121 boastMachine <=3.1 SQL Injection Vulnerbility', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486737/100/0/threaded'}, {'name': '27369', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27369'}, {'name': '20081120 boastMachine v3.1 Remote Sql Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/498521/100/0/threaded'}, {'name': '3563', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/3563'}, {'name': 'boastmachine-mail-sql-injection(39813)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39813'}, {'name': 'ADV-2008-0227', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0227'}]
CVE State: PUBLISHED
Explain CVE-2008-0423
Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MY_CONF[classRoot] parameter to (1) inc.steps.access_error.php, (2) inc.steps.check_login.php, or (3) inc.steps.init_system.php in admin/functions/.
Affected Products: n/a
References: [{'name': '4955', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4955'}, {'name': '28442', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28442'}, {'name': '27380', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27380'}, {'name': 'lamasoftware-myconf-file-include(39821)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39821'}, {'name': 'ADV-2008-0230', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0230'}]
CVE State: PUBLISHED
Explain CVE-2008-0424
SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary SQL commands via the month parameter.
Affected Products: n/a
References: [{'name': '4951', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4951'}, {'name': '27377', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27377'}, {'name': 'ADV-2008-0226', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0226'}, {'name': 'mooseguy-blog-sql-injection(39816)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39816'}]
CVE State: PUBLISHED
Explain CVE-2008-0425
Absolute path traversal vulnerability in explorerdir.php in Frimousse 0.0.2 allows remote attackers to read arbitrary files and list arbitrary directories via a full pathname in the name parameter.
Affected Products: n/a
References: [{'name': 'frimousse-explorerdir-directory-traversal(39797)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39797'}, {'name': '4943', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4943'}, {'name': 'ADV-2008-0216', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0216'}, {'name': '27385', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27385'}]
CVE State: PUBLISHED
Explain CVE-2008-0426
Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PacerCMS before 0.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) headline, or (3) text field in a message.
Affected Products: n/a
References: [{'name': 'pacercms-submit-xss(39832)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39832'}, {'name': '20080122 PacerCMS Multiple Vulnerabilities (XSS/SQL)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486796/100/0/threaded'}, {'name': '27386', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27386'}, {'name': '28605', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28605'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pacercms.sourceforge.net/index.php/2008/01/21/pacercms-061-streamlines-code-base-addresses-security-issue/'}]
CVE State: PUBLISHED
Explain CVE-2008-0427
Directory traversal vulnerability in file.php in bloofoxCMS 0.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Affected Products: n/a
References: [{'name': 'ADV-2008-0218', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0218'}, {'name': '28415', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28415'}, {'name': '20080120 Bloofox CMS SQL Injection (Authentication bypass) , Source codedisclosure', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486714/100/0/threaded'}, {'name': '4945', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4945'}, {'name': '20080120 Bloofox CMS SQL Injection (Authentication bypass) , Source code', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=120093005310107&w=2'}, {'name': 'bloofoxcms-file-directory-traversal(39795)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39795'}, {'name': '27361', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27361'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugreport.ir/?/27'}]
CVE State: PUBLISHED
Explain CVE-2008-0428
Multiple SQL injection vulnerabilities in the login function in system/class_permissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to admin/index.php.
Affected Products: n/a
References: [{'name': 'ADV-2008-0218', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0218'}, {'name': 'bloofoxcms-index-sql-injection(39794)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39794'}, {'name': '28415', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28415'}, {'name': '20080120 Bloofox CMS SQL Injection (Authentication bypass) , Source codedisclosure', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/486714/100/0/threaded'}, {'name': '4945', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4945'}, {'name': '20080120 Bloofox CMS SQL Injection (Authentication bypass) , Source code', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=120093005310107&w=2'}, {'name': '27361', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27361'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugreport.ir/?/27'}]
CVE State: PUBLISHED
Explain CVE-2008-0429
SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange 2.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter in a forum_catview action.
Affected Products: n/a
References: [{'name': '4956', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4956'}, {'name': '6401', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/6401'}, {'name': 'ADV-2008-0231', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0231'}, {'name': '28581', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28581'}, {'name': 'alstrasoft-indexphp-sql-injection(39820)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39820'}, {'name': '27381', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27381'}]
CVE State: PUBLISHED