DuyTa/cve-kgrag-db huggingface dataset:
CVE-2008-3555
Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3) Knowledge Base (WSNKB) 4.1.36 and earlier, (4) Links 4.1.44 and earlier, and possibly (5) Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the TID parameter, as demonstrated by uploading a .jpg file containing PHP sequences.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: knowledge_base, gallery, links, forum
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://secunia.com/advisories/31392, http://securityreason.com/securityalert/4120, https://exchange.xforce.ibmcloud.com/vulnerabilities/44236
CWE: CWE-22
CVE-2008-3491
SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter in a report action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ipost, itgp
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/47333, http://secunia.com/advisories/31344, http://secunia.com/advisories/31345
CWE: CWE-89
CVE-2008-4593
Apple iPhone 2.1 with firmware 5F136, when Require Passcode is enabled and Show SMS Preview is disabled, allows physically proximate attackers to obtain sensitive information by performing an Emergency Call tap and then reading SMS messages on the device screen, aka Apple bug number 6267416.
CVSS v2.0 Score: 1.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:P/I:N/A:N
Affected Products: iphone
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://securitytracker.com/id?1021021, http://www.karlkraft.com/index.php/2008/10/03/yet-another-iphone-emergency-call-security-bug/, https://exchange.xforce.ibmcloud.com/vulnerabilities/46062
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2008-1194
Multiple unspecified vulnerabilities in the color management library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to cause a denial of service (crash) via unknown vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: jre, jdk
References: http://dev2dev.bea.com/pub/advisory/277, http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html, http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html
CVE-2008-4997
dfxml-invoice in datafreedom-perl 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/zenity temporary file.  NOTE: the vendor disputes this vulnerability, stating that the vector is solely "an EXAMPLE used in the manpage.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: datafreedom-perl
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: http://bugs.debian.org/496429, http://dev.gentoo.org/~rbu/security/debiantemp/datafreedom-perl, http://www.openwall.com/lists/oss-security/2008/10/30/2
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2008-1766
Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: phpbb
References: http://www.phpbb.com/community/viewtopic.php?f=14&t=879735, http://www.vupen.com/english/advisories/2008/1236/references, https://exchange.xforce.ibmcloud.com/vulnerabilities/41886
CVE-2008-6400
Cross-site scripting (XSS) vulnerability in refbase before 0.9.5 allows remote attackers to inject arbitrary web script or HTML via the headerMsg parameter to (1) show.php and (2) search.php.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: refbase
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/32815, http://sourceforge.net/project/shownotes.php?release_id=641612, http://www.securityfocus.com/bid/32372
CWE: CWE-79
CVE-2008-5897
CodeAvalanche FreeWallpaper stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the administrator password via a direct request for _private/CAFreeWallpaper.mdb.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: freewallpaper
Related CWEs: CWE-264
References: http://secunia.com/advisories/33100, https://exchange.xforce.ibmcloud.com/vulnerabilities/47352, https://www.exploit-db.com/exploits/7470
CWE: CWE-264
CVE-2008-2036
SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL commands via the poll_id parameter in a poll action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: koobi
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/29789, http://securityreason.com/securityalert/3843, http://www.securityfocus.com/archive/1/490889/100/0/threaded
CWE: CWE-89
CVE-2008-4040
Directory traversal vulnerability in the Kyocera Command Center in Kyocera FS-118MFP allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: fs_118mfp
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://packetstorm.linuxsecurity.com/0808-exploits/kyocera-traversal.txt, http://secunia.com/advisories/31680, http://www.securityfocus.com/bid/30971
CWE: CWE-22
CVE-2008-3542
Unspecified vulnerability in HP Insight Diagnostics before 7.9.1.2402 allows remote attackers to read arbitrary files via unknown vectors.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: insight_diagnostics
Related CWEs: CWE-264
References: http://marc.info/?l=bugtraq&m=122271894520640&w=2, http://secunia.com/advisories/32061, http://securityreason.com/securityalert/4346
CWE: CWE-264
CVE-2008-6248
Cross-site scripting (XSS) vulnerability in all.php in Galatolo WebManager 1.3a and earlier allows remote attackers to inject arbitrary web script or HTML via the tag parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: galatolo_webmanager
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/31098, http://www.securityfocus.com/bid/30232, https://exchange.xforce.ibmcloud.com/vulnerabilities/43781
CWE: CWE-79
CVE-2008-7019
Esqlanelapse 2.6.1 and 2.6.2 allows remote attackers to bypass authentication and gain privileges via modified (1) enombre and (2) euri cookies.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: esqlanelapse
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://www.securityfocus.com/bid/31428, https://exchange.xforce.ibmcloud.com/vulnerabilities/45438, https://www.exploit-db.com/exploits/6583
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2008-3130
Multiple cross-site scripting (XSS) vulnerabilities in index.php in OpenCart 0.7.7 allow remote attackers to inject arbitrary web script or HTML via the (1) firstname and (2) search parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: opencart
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/30177, https://exchange.xforce.ibmcloud.com/vulnerabilities/43504, https://exchange.xforce.ibmcloud.com/vulnerabilities/43505
CWE: CWE-79
CVE-2008-2042
The Javascript API in Adobe Acrobat Professional 7.0.9 and possibly 8.1.1 exposes a dangerous method, which allows remote attackers to execute arbitrary commands or trigger a buffer overflow via a crafted PDF file that invokes app.checkForUpdate with a malicious callback function.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: acrobat, acrobat_reader
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://secunia.com/advisories/30840, http://securityreason.com/securityalert/3861, http://securitytracker.com/id?1019971
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-0897
Unspecified vulnerability in BEA WebLogic Server 9.0 through 10.0 allows remote authenticated users without "receive" permissions to bypass intended access restrictions and receive messages from a standalone JMS Topic or secured Distributed Topic member destination, related to durable subscriptions.
CVSS v2.0 Score: 7.9 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:N
Affected Products: weblogic_server
Related CWEs: CWE-264
References: http://dev2dev.bea.com/pub/advisory/267, http://secunia.com/advisories/29041, http://www.securitytracker.com/id?1019444
CWE: CWE-264
CVE-2008-6168
Cross-site scripting (XSS) vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified argument, probably the search string.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: miniportail
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.securityfocus.com/bid/31895, https://exchange.xforce.ibmcloud.com/vulnerabilities/46080, https://www.exploit-db.com/exploits/6821
CWE: CWE-79
CVE-2008-5508
Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: thunderbird, debian_linux, firefox, seamonkey, ubuntu_linux
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://secunia.com/advisories/33184, http://secunia.com/advisories/33188, http://secunia.com/advisories/33189
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-2883
PHP remote file inclusion vulnerability in include/plugins/jrBrowser/payment.php in Jamroom 3.3.0 through 3.3.5 allows remote attackers to execute arbitrary PHP code via a URL in the jamroom[jm_dir] parameter.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jamroom
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://secunia.com/advisories/30806, http://www.jamroom.net/, http://www.jamroom.net/index.php?m=td_tracker&o=view&id=1130
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2008-3095
Cross-site scripting (XSS) vulnerability in the Organic Groups (OG) module 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1, a module for Drupal, allows remote authenticated users, with group owner permissions, to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: organic_groups_module
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://drupal.org/node/277873, http://secunia.com/advisories/30928, http://www.securityfocus.com/bid/30070
CWE: CWE-79
CVE-2008-6630
Directory traversal vulnerability in the wt_gallery extension 2.5.0 and earlier for TYPO3 allows remote attackers to read arbitrary image files and determine directory structure via unspecified vectors.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: typo3, wt_gallery
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://osvdb.org/45050, http://secunia.com/advisories/30217, http://typo3.org/teams/security/security-bulletins/typo3-20080513-1/
CWE: CWE-22
CVE-2008-4335
SQL injection vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to execute arbitrary SQL commands via the apa_album_ID parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: atomic_photo_album
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/31409, http://www.vupen.com/english/advisories/2008/2691, https://exchange.xforce.ibmcloud.com/vulnerabilities/45433
CWE: CWE-89
CVE-2008-1913
SQL injection vulnerability in index.php in Lasernet CMS 1.5 and 1.11, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the new parameter in a new action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: lasernet_cms
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/29734, http://www.securityfocus.com/bid/28804, http://www.vupen.com/english/advisories/2008/1239/references
CWE: CWE-89
CVE-2008-6174
Cross-site scripting (XSS) vulnerability in admin/postlister/index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the liste parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: jetbox_cms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.digitrustgroup.com/advisories/web-application-security-jetbox2.html, http://www.securityfocus.com/bid/31890, https://exchange.xforce.ibmcloud.com/vulnerabilities/46082
CWE: CWE-79
CVE-2008-6813
SQL injection vulnerability in index.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQL commands via the id_kat parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpwebnews
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/30079, https://exchange.xforce.ibmcloud.com/vulnerabilities/43684, https://www.exploit-db.com/exploits/5998
CWE: CWE-89
CVE-2008-3919
Unspecified vulnerability in multiple JustSystems Ichitaro products allows remote attackers to execute arbitrary code via a crafted JTD document, as exploited in the wild in August 2008.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: ichitaro
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://secunia.com/advisories/31603, http://www.justsystems.com/jp/info/pd8002.html, http://www.securityfocus.com/bid/30828
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2008-1226
Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment, possibly involving a (1) .jpg or (2) .gif image attachment.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: collaboration_suite
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://jvn.jp/jp/JVN%2395014590/index.html, http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000004.html, http://secunia.com/advisories/29263
CWE: CWE-79
CVE-2008-3887
Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and (2) remote authenticated administrators to execute arbitrary SQL commands via the user_id parameter in a viewuser action.
CVSS v2.0 Score: 6.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Affected Products: dotproject
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstorm.linuxsecurity.com/0808-exploits/dotproject-sqlxss.txt, http://secunia.com/advisories/31681, http://www.securityfocus.com/bid/30924
CWE: CWE-89
CVE-2008-4596
Cross-site scripting (XSS) vulnerability in Shindig-Integrator 5.x, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in generated pages.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: shindig-integrator
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://drupal.org/node/321758, http://secunia.com/advisories/32285, https://exchange.xforce.ibmcloud.com/vulnerabilities/45925
CWE: CWE-79
CVE-2008-6905
Cross-site request forgery (CSRF) vulnerability in index.php in BabbleBoard 1.1.6 allows remote authenticated users to hijack the authentication of administrators for requests that delete (1) categories or (2) groups; (3) ban users; or (4) delete users via the admin page.
CVSS v2.0 Score: 6.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Affected Products: babbleboard
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://osvdb.org/50721, http://secunia.com/advisories/33174, https://exchange.xforce.ibmcloud.com/vulnerabilities/47396
CWE: CWE-352
CVE-2008-0607
SQL injection vulnerability in index.php in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) 2.5.3 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: com_sobi2, sobi2
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/27617, https://www.exploit-db.com/exploits/5038, http://www.securityfocus.com/bid/27617
CWE: CWE-89
CVE-2008-3696
Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, and CVE-2008-3695.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: player, server, ace, workstation
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html, http://secunia.com/advisories/31707, http://secunia.com/advisories/31708
CVE-2008-5292
SQL injection vulnerability in view_snaps.php in VideoGirls BiZ allows remote attackers to execute arbitrary SQL commands via the type parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: videogirls_biz
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/50309, http://secunia.com/advisories/32808, http://securityreason.com/securityalert/4668
CWE: CWE-89
CVE-2008-6894
Multiple cross-site scripting (XSS) vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fName and (2) fPassword parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phone_system
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://marc.info/?l=full-disclosure&m=122868146707468&w=2, http://osvdb.org/50599, http://secunia.com/advisories/33060
CWE: CWE-79
CVE-2008-3296
Directory traversal vulnerability in modules/system/admin.php in XOOPS 2.0.18 1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the fct parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xoops
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://www.securityfocus.com/bid/30330, https://exchange.xforce.ibmcloud.com/vulnerabilities/43966, http://www.securityfocus.com/bid/30330
CWE: CWE-22
CVE-2008-2035
Cross-site scripting (XSS) vulnerability in the Bluemoon, Inc. (1) BackPack 0.91 and earlier, (2) BmSurvey 0.84 and earlier, (3) newbb_fileup 1.83 and earlier, (4) News_embed (news_fileup) 1.44 and earlier, and (5) PopnupBlog 3.19 and earlier modules for XOOPS 2.0.x, XOOPS Cube 2.1, and ImpressCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: xoops_cube, news_fileup, backpack, bmsurvey, popnupblog
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://jvn.jp/jp/JVN%2331351020/index.html, http://secunia.com/advisories/29993, http://www.bluemooninc.biz/~xoops/modules/news/article.php?storyid=69
CWE: CWE-79
CVE-2008-4650
SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands via the eventdate parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: myevent
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://securityreason.com/securityalert/4457, http://www.securityfocus.com/bid/31773, https://exchange.xforce.ibmcloud.com/vulnerabilities/45919
CWE: CWE-89
CVE-2008-0622
Cross-site scripting (XSS) vulnerability in RaidenHTTPD 2.0.19 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the ulang parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: raidenhttpd
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://jvn.jp/jp/JVN%2391868305/index.html, http://secunia.com/advisories/28770, http://www.raidenhttpd.com/jp/security.html
CWE: CWE-79
CVE-2008-5140
trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/opr.ini.##### or (2) /tmp/lpt*.zip temporary file.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: mailscanner
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506353#44, http://lists.debian.org/debian-devel/2008/08/msg00285.html, http://secunia.com/advisories/32730
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2008-5107
The installation process for Citrix Presentation Server 4.5 and Desktop Server 1.0, when MSI logging is enabled, stores database credentials in MSI log files, which allows local users to obtain these credentials by reading the log files.
CVSS v2.0 Score: 1.9 (LOW)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
Affected Products: presentation_server, desktop_server
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://support.citrix.com/article/CTX116228, http://www.securityfocus.com/bid/28047, http://www.vupen.com/english/advisories/2008/0705/references
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2008-2780
The Anubis (aka Anubis+Ripe160) plugin before 1.3 for encrypt stores the unencrypted file's size in cleartext in the header of the encrypted file, which allows attackers to distinguish between encrypted data and random padding at the end of the encrypted file.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: anubis_plugin
Related CWEs: CWE-310
References: http://secunia.com/advisories/30388, http://www.vupen.com/english/advisories/2008/1663/references, https://albinoloverats.net/index.php?option=com_content&task=view&id=60&Itemid=2
CWE: CWE-310
CVE-2008-2539
The Sun Cluster Global File System in Sun Cluster 3.1 on Sun Solaris 8 through 10, when an underlying ufs filesystem is used, might allow local users to read data from arbitrary deleted files, or corrupt files in global filesystems, via unspecified vectors.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: cluster
Related CWEs: CWE-264
References: http://secunia.com/advisories/30483, http://sunsolve.sun.com/search/document.do?assetkey=1-26-201341-1, http://www.securityfocus.com/bid/29458
CWE: CWE-264
CVE-2008-3418
SQL injection vulnerability in browse.php in TriO 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: trio
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/31244, http://securityreason.com/securityalert/4077, https://exchange.xforce.ibmcloud.com/vulnerabilities/44033
CWE: CWE-89
CVE-2008-6371
SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the username (Username parameter).
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: membership_manager_pro
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/50318, http://secunia.com/advisories/32893, http://www.securityfocus.com/bid/32508
CWE: CWE-89
CVE-2008-4482
The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during validation of an XML file.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: xerces-c\+\+
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://issues.apache.org/jira/browse/XERCESC-1051, http://secunia.com/advisories/32108, http://www.securityfocus.com/bid/31533
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-4191
extract-table.pl in Emacspeak 26 and 28 allows local users to overwrite arbitrary files via a symlink attack on the extract-table.csv temporary file.
CVSS v2.0 Score: 6.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:C/A:C
Affected Products: emacspeak
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496431, http://dev.gentoo.org/~rbu/security/debiantemp/emacspeak, http://secunia.com/advisories/31880
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2008-7022
Insecure method vulnerability in ChilkatMail_v7_9.dll in the Chilkat Software IMAP ActiveX control (ChilkatMail2.ChilkatMailMan2.1) allows remote attackers to execute arbitrary programs via the LoadXmlEmail method.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: chilkat_imap_activex_control
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/45532, https://www.exploit-db.com/exploits/6600, https://exchange.xforce.ibmcloud.com/vulnerabilities/45532
CVE-2008-6401
SQL injection vulnerability in sayfa.php in JETIK-WEB allows remote attackers to execute arbitrary SQL commands via the kat parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jetik-web
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/31932, http://www.securityfocus.com/bid/31343, https://exchange.xforce.ibmcloud.com/vulnerabilities/45392
CWE: CWE-89
CVE-2008-2868
SQL injection vulnerability in detail.asp in DUware DUcalendar 1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the iEve parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ducalendar
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/30774, http://www.securityfocus.com/bid/29919, http://www.securitytracker.com/id?1020358
CWE: CWE-89
CVE-2008-0840
Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the username parameter.
CVSS v2.0 Score: 4.4 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Affected Products: lightblog
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://secunia.com/advisories/29017, http://www.securityfocus.com/archive/1/488283/100/0/threaded, http://www.securityfocus.com/bid/27837
CWE: CWE-22
CVE-2008-0310
Directory traversal vulnerability in pkgadd in SCO UnixWare 7.1.4 before p534589 allows local users to create or append to arbitrary files via ".." sequences in an unspecified environment variable, probably PKGINST.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: unixware
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://ftp.sco.com/pub/unixware7/714/security/p534589/p534589.txt, http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=676, http://secunia.com/advisories/29657
CWE: CWE-22
CVE-2008-3986
Unspecified vulnerability in the Oracle Discoverer Administrator component in Oracle Application Server 9.0.4.3 and 10.1.2.2 allows local users to affect confidentiality via unknown vectors.
CVSS v2.0 Score: 1.0 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:S/C:P/I:N/A:N
Affected Products: application_server
References: http://secunia.com/advisories/32291, http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html, http://www.securitytracker.com/id?1021054
CVE-2008-4613
SQL injection vulnerability in forums.asp in PortalApp 4.0 allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: portalapp
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/28337, http://securityreason.com/securityalert/4439, http://www.aspapp.com/content.asp?CatId=197&ContentType=Downloads
CWE: CWE-89
CVE-2008-3794
Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers to execute arbitrary code via a crafted mmst link with a negative size value, which bypasses a size check and triggers an integer overflow followed by a heap-based buffer overflow.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: vlc_media_player
Related CWEs: CWE-189
References: http://mailman.videolan.org/pipermail/vlc-devel/2008-August/048488.html, http://security.gentoo.org/glsa/glsa-200809-06.xml, http://securityreason.com/securityalert/4190
CWE: CWE-189
CVE-2008-2456
SQL injection vulnerability in index.php in ComicShout 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the comic_id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: comicshout
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/30319, http://www.comicshout.com/, http://www.securityfocus.com/bid/29301
CWE: CWE-89
CVE-2008-2970
Multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to (1) index.php and (2) login.php in homepg/.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: academic_web_tools
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://securityreason.com/securityalert/3959, http://www.bugreport.ir/?/44, http://www.securityfocus.com/archive/1/493472/100/0/threaded
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-5977
SQL injection vulnerability in siteadmin/forgot.php in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commands via the adname parameter in a Submit action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php_jobwebsite_pro
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.packetstormsecurity.org/0812-exploits/phpjobwebsite-cmsqlxss.txt, http://www.securityfocus.com/bid/32570, https://exchange.xforce.ibmcloud.com/vulnerabilities/46998
CWE: CWE-89
CVE-2008-3354
Multiple PHP remote file inclusion vulnerabilities in the Newbb Plus (newbb_plus) module 0.93 in RunCMS 1.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) bbPath[path] parameter to votepolls.php and the (2) bbPath[root_theme] parameter to config.php, different vectors than CVE-2006-0659.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: newbb_plus_module, runcms
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://www.securityfocus.com/bid/30331, http://www.securityfocus.com/bid/30331/exploit, https://exchange.xforce.ibmcloud.com/vulnerabilities/43969
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2008-4897
SQL injection vulnerability in fichiers/add_url.php in Logz podcast CMS 1.3.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the art parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: logz
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.org/0810-exploits/logzpodcast-sql.txt, http://secunia.com/advisories/32542, http://securityreason.com/securityalert/4546
CWE: CWE-89
CVE-2008-5915
An unspecified function in the JavaScript implementation in Google Chrome creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:S/C:N/I:P/A:N
Affected Products: chrome
References: http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html, http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161, http://www.infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html
CVE-2008-2821
Directory traversal vulnerability in the FTP client in Glub Tech Secure FTP before 2.5.16 on Windows allows remote FTP servers to create or overwrite arbitrary files via a ..\ (dot dot backslash) in a response to a LIST command, a related issue to CVE-2002-1345.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows_nt, secure_ftp
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://secunia.com/advisories/30725, http://vuln.sg/glubsecureftp2515-en.html, http://www.securityfocus.com/bid/29741
CWE: CWE-22
CVE-2008-6508
Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openfire
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://osvdb.org/49663, http://secunia.com/advisories/32478, http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
CWE: CWE-22
CVE-2008-4660
SQL injection vulnerability in the M1 Intern (m1_intern) 1.0.0 extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: typo3, m1_intern
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://typo3.org/teams/security/security-bulletins/typo3-20081020-1/, http://www.securityfocus.com/bid/31845, http://www.vupen.com/english/advisories/2008/2870
CWE: CWE-89
CVE-2008-5899
CodeAvalanche FreeForAll stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the administrator password via a direct request for _private/CAFFAPage.mdb.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: freeforall
Related CWEs: CWE-264
References: http://secunia.com/advisories/33100, https://exchange.xforce.ibmcloud.com/vulnerabilities/47354, https://www.exploit-db.com/exploits/7469
CWE: CWE-264
CVE-2008-5742
Multiple open redirect vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the redirect parameter in a logoff action to modules/auth/index.php or (2) the url parameter to modules/linkmanager/redirect.php.  NOTE: this was reported within an "HTTP Response Splitting" section in the original disclosure.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:P
Affected Products: netcat
Related CWEs: CWE-59
Related CAPECs: CAPEC-132, CAPEC-76, CAPEC-17
MITRE ATT&CK Techniques: T1547.009, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1574, T1547, T1564
References: http://securityreason.com/securityalert/4819, http://www.securityfocus.com/bid/32992, https://www.exploit-db.com/exploits/7560
CWE: CWE-59
MITRE ATT&CK techniques: T1547.009, T1027.006, T1564.009, T1574.010, T1574.005, T1027.009
MITRE ATT&CK tactics: T1574, T1547, T1564, T1027
CVE-2008-0033
Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a movie file with Image Descriptor (IDSC) atoms containing an invalid atom size, which triggers memory corruption.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: quicktime
Related CWEs: CWE-399
References: http://docs.info.apple.com/article.html?artnum=307301, http://dvlabs.tippingpoint.com/advisory/TPTI-08-01, http://lists.apple.com/archives/security-announce/2008/Jan/msg00001.html
CWE: CWE-399
CVE-2008-6861
Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: absolute_newsletter
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://secunia.com/advisories/32472, http://www.securityfocus.com/bid/32029, https://exchange.xforce.ibmcloud.com/vulnerabilities/46304
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2008-2695
Directory traversal vulnerability in entry.php in phpInv 0.8.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpinv
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://www.securityfocus.com/bid/29597, https://exchange.xforce.ibmcloud.com/vulnerabilities/42926, https://www.exploit-db.com/exploits/5754
CWE: CWE-22
CVE-2008-6258
SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the (1) UserID and (2) Pwd parameters.  NOTE: this might be related to CVE-2004-2108.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: q-shop
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/32742, http://www.securityfocus.com/bid/32329, https://exchange.xforce.ibmcloud.com/vulnerabilities/46649
CWE: CWE-89
CVE-2008-1426
SQL injection vulnerability in album.asp in KAPhotoservice allows remote attackers to execute arbitrary SQL commands via the albumid parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: kaphotoservice
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/29433, http://www.securityfocus.com/archive/1/489891/100/0/threaded, http://www.securityfocus.com/bid/28306
CWE: CWE-89
CVE-2008-3042
Unspecified vulnerability in the DAM Frontend (dam_frontend) extension 0.1.0 and earlier for TYPO3 has unknown impact and attack vectors related to "Improper Error Handling."
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: dam_frontend_extension
Related CWEs: CWE-264
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/, http://www.securityfocus.com/bid/30054, https://exchange.xforce.ibmcloud.com/vulnerabilities/43476
CWE: CWE-264
CVE-2008-6387
Quick Tree View .NET 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to qtv.mdb.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: quick_tree_view_.net
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://www.vupen.com/english/advisories/2008/3293, https://exchange.xforce.ibmcloud.com/vulnerabilities/46956, https://www.exploit-db.com/exploits/7303
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2008-2901
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: family_connections_cms
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/30680, http://www.securityfocus.com/bid/29722, https://exchange.xforce.ibmcloud.com/vulnerabilities/43097
CWE: CWE-89
CVE-2008-3321
admin/index.php in Maian Uploader 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary uploader_cookie cookie.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: maian_uploader
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://secunia.com/advisories/31045, http://www.maianscriptworld.co.uk/free-php-scripts/maian-uploader/development/index.html, http://www.maianscriptworld.co.uk/news.html
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2008-0424
SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary SQL commands via the month parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mgbs
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/27377, http://www.vupen.com/english/advisories/2008/0226, https://exchange.xforce.ibmcloud.com/vulnerabilities/39816
CWE: CWE-89
CVE-2008-0650
SQL injection vulnerability in login.php in Simple OS CMS 0.1c beta allows remote attackers to execute arbitrary SQL commands via the username field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: simple_os_cms
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/27589, http://www.securityfocus.com/bid/27589
CWE: CWE-89