DuyTa/cve-kgrag-db huggingface dataset:
CVE-2008-2545
Skype 3.6.0.248, and other versions before 3.8.0.139, uses a case-sensitive comparison when checking for dangerous extensions, which allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI with a dangerous extension that uses a different case.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: skype
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=711, http://secunia.com/advisories/30547, http://www.securityfocus.com/bid/29553
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-0419
Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows remote attackers to steal navigation history and cause a denial of service (crash) via images in a page that uses designMode frames, which triggers memory corruption related to resize handles.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: seamonkey, firefox
Related CWEs: CWE-399
References: http://browser.netscape.com/releasenotes/, http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html, http://secunia.com/advisories/28754
CWE: CWE-399
CVE-2008-1922
Multiple stack-based buffer overflows in Sarg might allow attackers to execute arbitrary code via unknown vectors, probably a crafted Squid log file.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: squid_analysis_report_generator
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html, http://secunia.com/advisories/30156, http://secunia.com/advisories/30202
CWE: CWE-119
CVE-2008-0906
SQL injection vulnerability in the Docum module in PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle operation.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php-nuke_module_docum
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/27912, https://exchange.xforce.ibmcloud.com/vulnerabilities/40720, https://www.exploit-db.com/exploits/5161
CWE: CWE-89
CVE-2008-0350
admin/index.php in Evilsentinel 1.0.9 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to gain administrative privileges and make arbitrary configuration changes.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: evilsentinel
Related CWEs: CWE-264
References: http://evilsentinel.altervista.org/forum/index.php?topic=49.0, http://secunia.com/advisories/28427, http://www.securityfocus.com/bid/27227
CWE: CWE-264
CVE-2008-6882
Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: joomla, com_livechat
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.securityfocus.com/bid/32803, https://exchange.xforce.ibmcloud.com/vulnerabilities/47305, https://www.exploit-db.com/exploits/7441
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-2174
Multiple unspecified vulnerabilities in Robin Rawson-Tetley Animal Shelter Manager (ASM) before 2.2.2 have unknown impact and attack vectors, related to "various areas where security was missing."
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: animal_shelter_manager
Related CWEs: CWE-264
References: http://secunia.com/advisories/30041, http://sourceforge.net/forum/forum.php?forum_id=818214, http://sourceforge.net/project/shownotes.php?group_id=82533&release_id=596220
CWE: CWE-264
CVE-2008-7263
ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pyftpdlib
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://code.google.com/p/pyftpdlib/issues/detail?id=73, http://code.google.com/p/pyftpdlib/source/browse/trunk/HISTORY, http://code.google.com/p/pyftpdlib/source/detail?r=348
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2008-0652
SQL injection vulnerability in index.php in the Downloads (com_downloads) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in a selectfolder action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: com_downloads
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/27648, https://www.exploit-db.com/exploits/5073, http://www.securityfocus.com/bid/27648
CWE: CWE-89
CVE-2008-4449
Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIVMSG message.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: mirc
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://secunia.com/advisories/32102, http://securityreason.com/securityalert/4352, http://www.securityfocus.com/bid/31552
CWE: CWE-119
CVE-2008-4778
SQL injection vulnerability in the gallery module in Koobi CMS 4.3.0 allows remote attackers to execute arbitrary SQL commands via the galid parameter in a showimages action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: koobi_cms
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://securityreason.com/securityalert/4525, http://www.securityfocus.com/archive/1/490886/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/46254
CWE: CWE-89
CVE-2008-2075
Cross-site scripting (XSS) vulnerability in pic.php in AstroCam 2.5.0 through 2.7.3 allows remote attackers to inject arbitrary web script or HTML via the picfile parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: astrocam
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://astrocam.svn.sourceforge.net/viewvc/astrocam/BUGS?view=markup, http://astrocam.svn.sourceforge.net/viewvc/astrocam/CHANGELOG?view=markup, http://astrocam.svn.sourceforge.net/viewvc/astrocam/v2.x/pic.php?r1=125&r2=126
CWE: CWE-79
CVE-2008-2874
SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitrary SQL commands via the sbjoke_id parameter, a different vector than CVE-2008-1050.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: softbiz_jokes_and_funny_pics_script
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/30810, http://www.securityfocus.com/bid/29931, http://www.vupen.com/english/advisories/2008/1951/references
CWE: CWE-89
CVE-2008-6324
SQL injection vulnerability in forummessages.cfm in CF_Forum allows remote attackers to execute arbitrary SQL commands via the categorynbr parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cf_forum
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/33064, http://www.securityfocus.com/bid/32767, https://www.exploit-db.com/exploits/7416
CWE: CWE-89
CVE-2008-7028
RPG.Board 0.8 Beta2 and earlier allows remote attackers to bypass authentication and gain privileges by setting the keep4u cookie to a certain value.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: rpg_board
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://www.securityfocus.com/bid/31466, https://exchange.xforce.ibmcloud.com/vulnerabilities/45501, https://www.exploit-db.com/exploits/6591
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2008-4281
Directory traversal vulnerability in VMWare ESXi 3.5 before ESXe350-200810401-O-UG and ESX 3.5 before ESX350-200810201-UG allows administrators with the Datastore.FileManagement privilege to gain privileges via unknown vectors.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: esx, esxi
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://lists.vmware.com/pipermail/security-announce/2008/000042.html, http://secunia.com/advisories/32624, http://www.securityfocus.com/archive/1/498138/100/0/threaded
CWE: CWE-22
CVE-2008-5353
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: jre, sdk, jdk
References: http://blog.cr0.org/2009/05/write-once-own-everyone.html, http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html, http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html
CVE-2008-5879
Cross-site scripting (XSS) vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phpclanwebsite
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/33211, http://securityreason.com/securityalert/4881, http://www.securityfocus.com/bid/32915
CWE: CWE-79
CVE-2008-1905
NMMediaServer.exe in Nero MediaHome 3.3.3.0 and earlier, as used in Nero 8.3.2.1 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a long HTTP request to TCP port 54444, a different vector than CVE-2007-2322.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: nero, mediahome
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://aluigi.altervista.org/adv/neromedia-adv.txt, http://secunia.com/advisories/29808, http://www.securityfocus.com/bid/28775
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-3328
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: trac
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/31231, http://secunia.com/advisories/31314, http://trac.edgewall.org/wiki/ChangeLog
CWE: CWE-79
CVE-2008-5173
Unspecified vulnerability in testMaker before 3.0p16 allows remote authenticated users to execute arbitrary PHP code via unspecified attack vectors.
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: testmaker
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://secunia.com/advisories/30870, http://sourceforge.net/project/shownotes.php?release_id=609679, http://www.securityfocus.com/bid/29978
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2008-3553
Multiple unspecified vulnerabilities in Nokia Series 40 3rd edition devices allow remote attackers to execute arbitrary code via unknown vectors, probably related to MIDP privilege escalation and persistent MIDlets, aka "ISSUES 3-10." NOTE: as of 20080807, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a company led by a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: j2me, series_40
Related CWEs: CWE-264
References: http://www.security-explorations.com/n2press.htm, http://www.security-explorations.com/n2srp.htm, http://www.security-explorations.com/n2vendors.htm
CWE: CWE-264
CVE-2008-7012
courier/1000@/api_error_email.html (aka "error reporting page") in Accellion File Transfer Appliance FTA_7_0_178, and possibly other versions before FTA_7_0_189, allows remote attackers to send spam e-mail via modified description and client_email parameters.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
Affected Products: secure_file_transfer_appliance
References: http://osvdb.org/48242, http://secunia.com/advisories/31848, http://www.securityfocus.com/bid/31178
CVE-2008-5815
SQL injection vulnerability in Acomment.php in phpAlumni allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpalumni
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://securityreason.com/securityalert/4859, http://www.securityfocus.com/bid/33055, https://www.exploit-db.com/exploits/7621
CWE: CWE-89
CVE-2008-6134
SQL injection vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: drupal, everyblog
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://drupal.org/node/318746, http://secunia.com/advisories/32194, http://www.securityfocus.com/bid/31656
CWE: CWE-89
CVE-2008-4331
Directory traversal vulnerability in library/pagefunctions.inc.php in phpOCS 0.1 beta3 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpocs
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://www.securityfocus.com/bid/31392, https://exchange.xforce.ibmcloud.com/vulnerabilities/45424, https://www.exploit-db.com/exploits/6563
CWE: CWE-22
CVE-2008-2806
Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 on Mac OS X allow remote attackers to bypass the Same Origin Policy and create arbitrary socket connections via a crafted Java applet, related to the Java Embedding Plugin (JEP) and Java LiveConnect.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: thunderbird, seamonkey, firefox
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html, http://secunia.com/advisories/30898, http://secunia.com/advisories/30911
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-1846
The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: netweaver
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://securityreason.com/securityalert/3812, http://www.aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php, http://www.securityfocus.com/archive/1/490625/100/0/threaded
CWE: CWE-79
CVE-2008-6589
Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) index.php and (2) LightNEasy.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: lightneasy, sqlite
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/29833, http://www.osvdb.org/44676, http://www.osvdb.org/44677
CWE: CWE-79
CVE-2008-2252
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate parameters sent from user mode to the kernel, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Corruption Vulnerability."
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_server_2003, windows_2000, windows_vista, windows_xp, windows_server_2008
Related CWEs: CWE-264
References: http://marc.info/?l=bugtraq&m=122479227205998&w=2, http://secunia.com/advisories/32247, http://www.securityfocus.com/bid/31652
CWE: CWE-264
CVE-2008-2000
Unspecified vulnerability in Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls document.write in an infinite loop.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: safari
Related CWEs: CWE-399
References: http://es.geocities.com/jplopezy/pruebasafari3.html, http://securityreason.com/securityalert/3833, http://www.securityfocus.com/archive/1/491192/100/0/threaded
CWE: CWE-399
CVE-2008-6083
Directory traversal vulnerability in header.php in TXTshop beta 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: txtshop
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://www.securityfocus.com/archive/1/497752/100/0/threaded, http://www.securityfocus.com/bid/31885, https://exchange.xforce.ibmcloud.com/vulnerabilities/46063
CWE: CWE-22
CVE-2008-2300
Unspecified vulnerability in Citrix Presentation Server 4.5 and earlier, Citrix Access Essentials 2.0 and earlier, and Citrix Desktop Server 1.0 allows remote authenticated users to access unauthorized desktops via unknown attack vectors.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: desktop_server, citrix_presentation_server, access_essentials, metaframe_presentation_server
Related CWEs: CWE-264
References: http://secunia.com/advisories/30271, http://support.citrix.com/article/CTX116941, http://www.securityfocus.com/bid/29232
CWE: CWE-264
CVE-2008-2693
Stack-based buffer overflow in the BITIFF.BITiffCtrl.1 ActiveX control in BITiff.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to execute arbitrary code via a long first argument to the SetByteOrder method.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: barcode_sdk
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://secunia.com/advisories/30548, https://exchange.xforce.ibmcloud.com/vulnerabilities/42897, https://www.exploit-db.com/exploits/5746
CWE: CWE-119
CVE-2008-4345
SQL injection vulnerability in download.php in WebPortal CMS 0.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the aid parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webportal_cms
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/31784, http://www.securityfocus.com/bid/31156, http://www.vupen.com/english/advisories/2008/2560
CWE: CWE-89
CVE-2008-6859
Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: absolute_control_panel_xe
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://secunia.com/advisories/32472, http://www.securityfocus.com/bid/32025, https://exchange.xforce.ibmcloud.com/vulnerabilities/46247
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2008-6323
SQL injection vulnerability in forummessages.cfm in CFMSource CF_Auction allows remote attackers to execute arbitrary SQL commands via the categorynbr parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cf_auction
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/32767, https://www.exploit-db.com/exploits/7414, http://www.securityfocus.com/bid/32767
CWE: CWE-89
CVE-2008-6270
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL command via the user parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: apoll
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/32079, https://exchange.xforce.ibmcloud.com/vulnerabilities/46286, https://exchange.xforce.ibmcloud.com/vulnerabilities/48982
CWE: CWE-89
CVE-2008-1004
Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the Web Inspector.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: safari
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://docs.info.apple.com/article.html?artnum=307563, http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html, http://secunia.com/advisories/29393
CWE: CWE-79
CVE-2008-3370
SQL injection vulnerability in the CUA Login Module in EMC Centera Universal Access (CUA) 4.0_4735.p4 allows remote attackers to execute arbitrary SQL commands via the user (user name) field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: centera_universal_access
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://marc.info/?l=full-disclosure&m=121684757516717&w=2, http://secunia.com/advisories/31215, http://securityreason.com/securityalert/4066
CWE: CWE-89
CVE-2008-6229
Cross-site scripting (XSS) vulnerability in the administrative interface in Drupal Content Construction Kit (CCK) 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal, allows remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via (1) field labels and (2) content-type names.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: content_construction_kit
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://drupal.org/node/330546, http://secunia.com/advisories/32572, http://secunia.com/advisories/32615
CWE: CWE-79
CVE-2008-3974
Unspecified vulnerability in the Oracle OLAP component in Oracle Database 9.0.2.8 and 9.2.0.8DV allows remote authenticated users to affect availability, related to SYS.OLAPIMPL_T.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Affected Products: database_9i
References: http://osvdb.org/51347, http://secunia.com/advisories/33525, http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html
CVE-2008-4478
Multiple integer overflows in dhost.exe in Novell eDirectory 8.8 before 8.8.3, and 8.73 before 8.7.3.10 ftf1, allow remote attackers to execute arbitrary code via a crafted (1) Content-Length header in a SOAP request or (2) Netware Core Protocol opcode 0x0F message, which triggers a heap-based buffer overflow.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: edirectory
Related CWEs: CWE-189
References: http://secunia.com/advisories/32111, http://securityreason.com/securityalert/4406, http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037180.html
CWE: CWE-189
CVE-2008-1371
Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the d_root parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N
Affected Products: drake_cms
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://www.securityfocus.com/bid/28165, http://www.securityfocus.com/bid/28165/exploit, https://exchange.xforce.ibmcloud.com/vulnerabilities/41345
CWE: CWE-22
CVE-2008-2017
Directory traversal vulnerability in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the operation parameter to the default URI under install/.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: chicomas
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://securityreason.com/securityalert/3837, http://www.securityfocus.com/archive/1/491369/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/42144
CWE: CWE-22
CVE-2008-5774
Multiple SQL injection vulnerabilities in ASPSiteWare HomeBuilder 1.0 and 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) iType parameter to (a) type.asp and (b) type2.asp and the (2) iPro parameter to (c) detail.asp.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: homebuilder
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/33172, http://www.securityfocus.com/bid/32812, https://exchange.xforce.ibmcloud.com/vulnerabilities/47319
CWE: CWE-89
CVE-2008-5310
SQL injection vulnerability in image.php in NetArt Media Car Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: car_portal
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/32844, http://securityreason.com/securityalert/4677, http://www.securityfocus.com/bid/32426
CWE: CWE-89
CVE-2008-4448
Cross-site request forgery (CSRF) vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to perform unauthorized actions as an administrator, including file deletion and creation, via a link or IMG tag to the (1) overkill, (2) futils, or (3) edit actions.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: h-sphere
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://packetstormsecurity.org/0810-exploits/webshell431-xssxsrf.txt, http://secunia.com/advisories/32086, https://exchange.xforce.ibmcloud.com/vulnerabilities/45614
CWE: CWE-352
CVE-2008-1379
Integer overflow in the fbShmPutImage function in the MIT-SHM extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to read arbitrary process memory via crafted values for a Pixmap width and height.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:N/A:N
Affected Products: x11
Related CWEs: CWE-189
References: ftp://ftp.freedesktop.org/pub/xorg/X11R7.3/patches/xorg-xserver-1.4-cve-2008-1379.diff, http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01543321, http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=722
CWE: CWE-189
CVE-2008-6069
SQL injection vulnerability in e107chat.php in the eChat plugin 4.2 for e107, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the nick parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: e107, echat_plugin
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/30561, http://www.securityfocus.com/archive/1/493126/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/42883
CWE: CWE-89
CVE-2008-0611
SQL injection vulnerability in rmgs/images.php in the RMSOFT Gallery System 2.0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xoops, gallery_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/27623, https://www.exploit-db.com/exploits/5062, http://www.securityfocus.com/bid/27623
CWE: CWE-89
CVE-2008-1295
SQL injection vulnerability in archives.php in Gregory Kokanosky (aka Greg's Place) phpMyNewsletter 0.8 beta 5 and earlier allows remote attackers to execute arbitrary SQL commands via the msg_id parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: phpmynewsletter
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://www.securityfocus.com/bid/28189, https://exchange.xforce.ibmcloud.com/vulnerabilities/41197, https://www.exploit-db.com/exploits/5231
CWE: CWE-89
CVE-2008-6361
Directory traversal vulnerability in index.php in InSun Feed CMS 1.7.3 19Beta allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the lang parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: feedcms
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://www.securityfocus.com/bid/32783, http://www.securityfocus.com/bid/32783/exploit, https://exchange.xforce.ibmcloud.com/vulnerabilities/47276
CWE: CWE-22
CVE-2008-0988
Off-by-one error in the Libsystem strnstr API in libc on Apple Mac OS X 10.4.11 allows context-dependent attackers to cause a denial of service (crash) via crafted arguments that trigger a buffer over-read.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: mac_os_x_server, mac_os_x
Related CWEs: CWE-189
References: http://docs.info.apple.com/article.html?artnum=307562, http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html, http://secunia.com/advisories/29420
CWE: CWE-189
CVE-2008-1787
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Poplar Gedcom Viewer 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) text and (2) ul parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: poplar_gedcom_viewer
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://downloads.securityfocus.com/vulnerabilities/exploits/28608.html, http://secunia.com/advisories/23761, http://www.securityfocus.com/bid/28608
CWE: CWE-79
CVE-2008-0661
Buffer overflow in dBpowerAMP Audio Player Release 2 allows remote attackers to execute arbitrary code via a .M3U file with a long URI. NOTE: this might be the same issue as CVE-2004-1569.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: dbpoweramp_audio_player
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://securityreason.com/securityalert/3623, http://www.securityfocus.com/archive/1/487605/100/0/threaded, http://www.securityfocus.com/bid/27635
CWE: CWE-119
CVE-2008-0067
Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) long string parameters to the OpenView5.exe CGI program; (2) a long string parameter to the OpenView5.exe CGI program, related to ov.dll; or a long string parameter to the (3) getcvdata.exe, (4) ovlaunch.exe, or (5) Toolbar.exe CGI program.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: openview_network_node_manager
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://marc.info/?l=bugtraq&m=123247393715913&w=2, http://secunia.com/advisories/28074, http://secunia.com/secunia_research/2008-13/
CWE: CWE-119
CVE-2008-5558
Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service (crash) via authentication attempts involving (1) an unknown user or (2) a user using hostname matching.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: open_source, asterisk_business_edition
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://downloads.digium.com/pub/security/AST-2008-012.html, http://osvdb.org/50675, http://secunia.com/advisories/32956
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2008-0402
Unspecified vulnerability in IBM WebSphere Business Modeler Basic and Advanced 6.0.2.1 before Interim Fix 11 allows remote authenticated users to bypass intended access restrictions and delete unspecified repository resources via unknown vectors, even when they are not administrators or members of the repository's owning group.
CVSS v2.0 Score: 6.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Affected Products: websphere_business_modeler
Related CWEs: CWE-264
References: http://secunia.com/advisories/28586, http://www-1.ibm.com/support/docview.wss?uid=swg24018060, http://www-1.ibm.com/support/docview.wss?uid=swg24018061
CWE: CWE-264
CVE-2008-3219
The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: fedora, drupal
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://drupal.org/node/280571, http://secunia.com/advisories/31079, http://www.openwall.com/lists/oss-security/2008/07/10/3
CWE: CWE-79
CVE-2008-4697
The Fast Forward feature in Opera before 9.61, when a page is located in a frame, executes a javascript: URL in the context of the outermost page instead of the page that contains this URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: opera_browser
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html, http://secunia.com/advisories/32299, http://secunia.com/advisories/32394
CWE: CWE-79
CVE-2008-6153
SQL injection vulnerability in Photo.asp in Jay Patel Pixel8 Web Photo Album 3.0 allows remote attackers to execute arbitrary SQL commands via the AlbumID parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pixel8_web_photo_album
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/33373, http://www.securityfocus.com/bid/33069, https://exchange.xforce.ibmcloud.com/vulnerabilities/47662
CWE: CWE-89
CVE-2008-2087
SQL injection vulnerability in search_result.php in Softbiz Web Host Directory Script, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the host_id parameter, a different vector than CVE-2005-3817.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: web_hosting_directory_script
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://advisories.echo.or.id/adv/adv89-K-159-2008.txt, http://secunia.com/advisories/29983, http://securityreason.com/securityalert/3855
CWE: CWE-89
CVE-2008-2350
Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via (1) .. (dot dot) or (2) C: folder sequences in the file parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: bcoos
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://lostmon.blogspot.com/2008/05/bcoos-highlightphp-traversal-file.html, http://secunia.com/advisories/30035, http://www.securityfocus.com/bid/29275
CWE: CWE-22
CVE-2008-3435
LinkedIn Browser Toolbar 3.0.3.1100 and earlier does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: browser_toolbar
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html, http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf, http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2008-0395
Kayako SupportSuite 3.11.01 allows remote attackers to obtain server configuration information via a direct request to syncml/index.php, which prints the contents of the $_SERVER superglobal.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: supportsuite
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://secunia.com/advisories/28613, http://securityreason.com/securityalert/3573, http://www.securityfocus.com/archive/1/486762/100/0/threaded
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2008-6052
PreProjects Pre E-Learning Portal stores db_elearning.mdb under the web root with insufficient access control, which allows remote attackers to obtain passwords via a direct request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: pre_e-learning_portal
Related CWEs: CWE-264
References: http://packetstorm.linuxsecurity.com/0812-exploits/prelearn-disclose.txt, http://secunia.com/advisories/33197, https://exchange.xforce.ibmcloud.com/vulnerabilities/47437
CWE: CWE-264
CVE-2008-2809
Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:P
Affected Products: geckb, navigator, seamonkey, firefox
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html, http://nils.toedtmann.net/pub/subjectAltName.txt, http://rhn.redhat.com/errata/RHSA-2008-0616.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-5318
Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-2008-3653.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: tikiwiki_cms//groupware
References: http://info.tikiwiki.org/tiki-read_article.php?articleId=41, http://secunia.com/advisories/32341, http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/2.0/changelog.txt?view=markup
CVE-2008-6003
SQL injection vulnerability in sellers_othersitem.php in AJ Auction Pro Platinum 2 allows remote attackers to execute arbitrary SQL commands via the seller_id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: aj_auction
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/45430, https://www.exploit-db.com/exploits/6561, https://exchange.xforce.ibmcloud.com/vulnerabilities/45430
CWE: CWE-89
CVE-2008-6600
Cross-site scripting (XSS) vulnerability in the search feature in XMLPortal 3.0 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: xmlportal
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://osvdb.org/44289, http://osvdb.org/ref/44/xmlportal-xss.txt, http://osvdb.org/44289
CWE: CWE-79
CVE-2008-1323
Cross-site request forgery (CSRF) vulnerability in index.php in WoltLab Burning Board Lite (wBB) 2 Beta 1 allows remote attackers to delete threads as other users via the ThreadDelete action.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: burning_board_lite
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://securityreason.com/securityalert/3739, http://www.securityfocus.com/archive/1/489294/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/41098
CWE: CWE-352
CVE-2008-2188
Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) bookCopyright and (2) ver parameters to (a) footer.php, and the (3) bookName, (4) bookMetaTags, and (5) estiloCSS parameters to (b) header.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: blackbook
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://securityreason.com/securityalert/3873, http://www.securityfocus.com/archive/1/491549/100/0/threaded, http://www.securityfocus.com/bid/29015
CWE: CWE-79
CVE-2008-1126
PHP remote file inclusion vulnerability in main.php in Barryvan Compo Manager 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the pageURL parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: barryvan_compo_manager
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://www.securityfocus.com/bid/28035, https://www.exploit-db.com/exploits/5202, http://www.securityfocus.com/bid/28035
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2008-6523
auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie.  NOTE: this can be leveraged with a separate vulnerability in resetpass.php to modify passwords for arbitrary users.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openinvoice
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://www.securityfocus.com/bid/28854, https://exchange.xforce.ibmcloud.com/vulnerabilities/41947, https://www.exploit-db.com/exploits/5466
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2008-5123
SQL injection vulnerability in admin.php in CCleague Pro 1.2 allows remote attackers to execute arbitrary SQL commands via the u parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: ccleague
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/30796, http://securityreason.com/securityalert/4604, http://www.securityfocus.com/bid/29876
CWE: CWE-89
CVE-2008-3286
SWAT 4 1.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via a (1) VERIFYCONTENT or (2) GAMECONFIG command sent to the server before user session initialization, which triggers a NULL pointer dereference; or (3) a GAMESPYRESPONSE command followed by a long RS string.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: swat_4
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://aluigi.altervista.org/adv/swat4x-adv.txt, http://aluigi.org/fakep/unrealfp.zip, http://secunia.com/advisories/31158
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2008-1482
Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via (1) a crafted .FLV file, which triggers an overflow in demuxers/demux_flv.c; (2) a crafted .MOV file, which triggers an overflow in demuxers/demux_qt.c; (3) a crafted .RM file, which triggers an overflow in demuxers/demux_real.c; (4) a crafted .MVE file, which triggers an overflow in demuxers/demux_wc3movie.c; (5) a crafted .MKV file, which triggers an overflow in demuxers/ebml.c; or (6) a crafted .CAK file, which triggers an overflow in demuxers/demux_film.c.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: xine-lib
Related CWEs: CWE-189, CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://aluigi.altervista.org/adv/xinehof-adv.txt, http://aluigi.org/poc/xinehof.zip, http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html
CWE: CWE-189, CWE-119