DuyTa/cve-kgrag-db huggingface dataset:
CVE-2008-1580
CFNetwork in Safari in Apple Mac OS X before 10.5.3 automatically sends an SSL client certificate in response to a web server's certificate request, which allows remote web sites to obtain sensitive information (Subject data) from personally identifiable certificates, and use arbitrary certificates to track user activities across domains, a related issue to CVE-2007-4879.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: mac_os_x_server, safari, mac_os_x
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html, http://secunia.com/advisories/30430, http://securitytracker.com/id?1020134
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2008-0399
Multiple buffer overflows in Toshiba Surveillance (Surveillix) RecordSend ActiveX control (MeIpCamX.DLL 1.0.0.4) allow remote attackers to execute arbitrary code via long arguments to the (1) SetPort and (2) SetIpAddress methods.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: surveillix
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://retrogod.altervista.org/rgod_toshiba_control.html, http://secunia.com/advisories/28557, http://www.securityfocus.com/bid/27360
CWE: CWE-119
CVE-2008-0848
Cross-site scripting (XSS) vulnerability in lostsheep.php in Crafty Syntax Live Help (CSLH) before 2.14.16, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: the versions claimed by the original researcher are probably incorrect.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: crafty_syntax_live_help
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/29201, http://securityreason.com/securityalert/3688, http://sourceforge.net/project/shownotes.php?release_id=580994
CWE: CWE-79
CVE-2008-4612
Cross-site scripting (XSS) vulnerability in PortalApp 4.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter to (1) forums.asp and (2) content.asp.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: portalapp
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/28337, http://securityreason.com/securityalert/4439, http://www.aspapp.com/content.asp?CatId=197&ContentType=Downloads
CWE: CWE-79
CVE-2008-2377
Use-after-free vulnerability in the _gnutls_handshake_hash_buffers_clear function in lib/gnutls_handshake.c in libgnutls in GnuTLS 2.3.5 through 2.4.0 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via TLS transmission of data that is improperly used when the peer calls gnutls_handshake within a normal session, leading to attempted access to a deallocated libgcrypt handle.
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: gnutls
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947, http://secunia.com/advisories/31505, http://www.gnu.org/software/gnutls/security.html
CWE: CWE-119
CVE-2008-2236
Cross-site scripting (XSS) vulnerability in blosxom.cgi in Blosxom before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the flav parameter (flavour variable).  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: blosxom
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://jvn.jp/en/jp/JVN03300113/index.html, http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000073.html, http://secunia.com/advisories/32074
CWE: CWE-79
CVE-2008-5224
Cross-site scripting (XSS) vulnerability in Kent Web Mart 1.61 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: kent-web_mart
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://jvn.jp/en/jp/JVN43906021/index.html, http://secunia.com/advisories/30444, http://www.kent-web.com/cart/mart.html
CWE: CWE-79
CVE-2008-6689
SQL injection vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: typo3, dmmjobcontrol
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/46386, http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/, https://exchange.xforce.ibmcloud.com/vulnerabilities/43204
CWE: CWE-89
CVE-2008-3351
SQL injection vulnerability in atomPhotoBlog.php in Atom PhotoBlog 1.0.9.1 and 1.1.5b1 allows remote attackers to execute arbitrary SQL commands via the photoId parameter in a show action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: atomphotoblog
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/31205, http://securityreason.com/securityalert/4053, https://exchange.xforce.ibmcloud.com/vulnerabilities/43982
CWE: CWE-89
CVE-2008-2470
The InstallShield Update Service Agent ActiveX control in isusweb.dll allows remote attackers to cause a denial of service (memory corruption and browser crash) and possibly execute arbitrary code via a call to ExecuteRemote with a URL that results in a 404 error response.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: flexnet_connect
References: http://support.installshield.com/kb/view.asp?articleid=Q113020, http://www.kb.cert.org/vuls/id/630017, http://www.securityfocus.com/bid/31235
CVE-2008-4975
mkmailpost in newsgate 1.6 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mmp##### temporary file.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: newsgate
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: http://bugs.debian.org/496437, http://dev.gentoo.org/~rbu/security/debiantemp/newsgate, http://uvw.ru/report.lenny.txt
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2008-3973
Unspecified vulnerability in the SQL*Plus Windows GUI component in Oracle Database allows local users to affect confidentiality via unknown vectors.
CVSS v2.0 Score: 1.7 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:P/I:N/A:N
Affected Products: database_11g, database_10g
References: http://osvdb.org/51351, http://secunia.com/advisories/33525, http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html
CVE-2008-0899
Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: weblogic_server
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://dev2dev.bea.com/pub/advisory/269, http://secunia.com/advisories/29041, http://www.securitytracker.com/id?1019448
CWE: CWE-79
CVE-2008-1571
Directory traversal vulnerability in the embedded web server in Image Capture in Apple Mac OS X before 10.5 allows remote attackers to read arbitrary files via directory traversal sequences in the URI.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mac_os_x_server, mac_os_x
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html, http://secunia.com/advisories/30430, http://securitytracker.com/id?1020141
CWE: CWE-22
CVE-2008-5082
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.
CVSS v2.0 Score: 6.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Affected Products: certificate_system, _dogtag_certificate_system
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://secunia.com/advisories/33693, http://www.securityfocus.com/bid/33508, http://www.vupen.com/english/advisories/2009/0145
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2008-6781
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ez_gaming_directory
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/49553, http://secunia.com/advisories/32558, http://www.securityfocus.com/bid/32021
CWE: CWE-89
CVE-2008-0193
Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: wordpress
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html, http://secunia.com/advisories/29014, http://securityreason.com/securityalert/3539
CWE: CWE-79
CVE-2008-1373
Buffer overflow in the gif_read_lzw function in CUPS 1.3.6 allows remote attackers to have an unknown impact via a GIF file with a large code_size value, a similar issue to CVE-2006-4484.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cups
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00003.html, http://secunia.com/advisories/29573, http://secunia.com/advisories/29603
CWE: CWE-119
CVE-2008-1670
Heap-based buffer overflow in the progressive PNG Image loader (decoders/pngloader.cpp) in KHTML in KDE 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted image.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: kde
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html, http://secunia.com/advisories/29980, http://www.kde.org/info/security/advisory-20080426-1.txt
CWE: CWE-119
CVE-2008-0013
Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to the product's configuration, a different vulnerability than CVE-2008-0012 and CVE-2008-0014.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: serverprotect
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://blogs.iss.net/archive/trend.html, http://secunia.com/advisories/32618, http://www.iss.net/threats/310.html
CWE: CWE-119
CVE-2008-4009
Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.1, when configuring multiple authorizers, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: bea_product_suite
References: http://secunia.com/advisories/32304, http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html, http://www.securitytracker.com/id?1021056
CVE-2008-0837
Cross-site scripting (XSS) vulnerability in the log feature in the John Godley Search Unleashed 0.2.10 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, which is not properly handled when the administrator views the log file.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: search_unleashed, search_unleashed_plugin
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/28968, http://securityreason.com/securityalert/3674, http://urbangiraffe.com/tracker/issues/show/60
CWE: CWE-79
CVE-2008-6173
Cross-site scripting (XSS) vulnerability in fullscreen.php in ClipShare Pro 4.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: clipshare
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://downloads.securityfocus.com/vulnerabilities/exploits/31898.html, http://secunia.com/advisories/32399, http://www.securityfocus.com/bid/31898
CWE: CWE-79
CVE-2008-0116
Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka "Excel Rich Text Validation Vulnerability."
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: excel, office, office_compatibility_pack_for_word_excel_ppt_2007, excel_viewer
Related CWEs: CWE-20, CWE-94
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1027.006
MITRE ATT&CK Tactics: T1036, T1553, T1562
References: http://dvlabs.tippingpoint.com/advisory/TPTI-08-03, http://marc.info/?l=bugtraq&m=120585858807305&w=2, http://www.securityfocus.com/archive/1/489430/100/0/threaded
CWE: CWE-20, CWE-94
MITRE ATT&CK techniques: T1574.006, T1553.002, T1027.006, T1564.009, T1574.007, T1539, T1036.001, T1562.003, T1027, T1027.009
MITRE ATT&CK tactics: T1036, T1553, T1562, T1574, T1564, T1027
CVE-2008-6126
Multiple directory traversal vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter to download.php and the (2) page parameter to index.php, a different vector than CVE-2008-3589.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mozilocms
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://cms.mozilo.de/index.php?cat=10_moziloCMS&page=60_Changelog, http://secunia.com/advisories/32021, http://www.majorsecurity.de/index_2.php?major_rls=major_rls55
CWE: CWE-22
CVE-2008-5042
Zeeways PhotoVideoTube 1.1 and earlier allows remote attackers to bypass authentication and perform administrative tasks via a direct request to admin/home.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: photovideotube
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://secunia.com/advisories/32601, http://securityreason.com/securityalert/4574, http://www.securityfocus.com/bid/32223
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2008-1230
Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an "entry page."
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: jspwiki
Related CWEs: CWE-264
References: http://marc.info/?l=bugtraq&m=120300554011544&w=2, http://secunia.com/advisories/28969, http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0
CWE: CWE-264
CVE-2008-6343
Cross-site scripting (XSS) vulnerability in the TU-Clausthal ODIN (tuc_odin) extension 0.0.1, 0.1.0, 0.1.1, and 0.2.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: typo3, tu-clausthal_odin
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://typo3.org/teams/security/security-bulletins/typo3-20081222-4/, http://typo3.org/teams/security/security-bulletins/typo3-20081222-4/
CWE: CWE-79
CVE-2008-1744
The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, and 4.3 before 4.3(2) allows remote attackers to cause a denial of service (service crash) via malformed network traffic, aka Bug ID CSCsk46770.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: unified_communications_manager, unified_callmanager
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://secunia.com/advisories/30238, http://securitytracker.com/id?1020022, http://www.cisco.com/en/US/products/products_security_advisory09186a0080995688.shtml
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-1064
Cross-site scripting (XSS) vulnerability in images.php in the Red Mexico RMSOFT Gallery System (GS) 2.0 module (aka rmgs) for XOOPS allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: xoops_rmsoft_gallery_system
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.xssing.com/index.php?x=3&y=12, https://exchange.xforce.ibmcloud.com/vulnerabilities/41013, http://www.xssing.com/index.php?x=3&y=12
CWE: CWE-79
CVE-2008-0716
The agent in Symantec Altiris Notification Server before 6.0 SP3 R7 allows local users to gain privileges via a "Shatter" style attack.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C
Affected Products: altiris_notification_server
References: http://secunia.com/advisories/28832, http://securityresponse.symantec.com/avcenter/security/Content/2008.02.06.html, http://www.securityfocus.com/bid/27645