Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://www.infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html - http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161 - http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/48173 - http://www.trusteer.com/files/In-session-phishing-advisory-2.pdf - http://www.securityfocus.com/bid/33276
CVE ID: CVE-2008-5913 State: PUBLISHED Published: 2009-01-20T16:00:00 Last Updated: 2024-08-07T11:13:13.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/
nd an "in-session phishing attack." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/40481 - http://ubuntu.com/usn/usn-930-1 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11139 - http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html - http://www.vupen.com/english/advisories/2010/1640 - http://www.redhat.com/support/errata/RHSA-2010-0501.html - http://www.vupen.com/english/advisories/2010/1557 - http://www.infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html - http://www.mandriva.com/security/advisories?name=MDVSA-2010:125 - http://www.vupen.com/en
hishing_without_email_1.html - http://www.mandriva.com/security/advisories?name=MDVSA-2010:125 - http://www.vupen.com/english/advisories/2010/1773 - http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161 - http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html - http://www.vupen.com/english/advisories/2010/1592 - http://www.ubuntu.com/usn/usn-930-2 - http://www.vupen.com/english/advisories/2010/1551 - http://www.redhat.com/support/errata/RHSA-2010-0500.html - http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html - http://www.trusteer.com/files/In-session-phishing-advisory-2.pdf - http://www.
security-announce/2010-07/msg00005.html - http://www.trusteer.com/files/In-session-phishing-advisory-2.pdf - http://www.mozilla.org/security/announce/2010/mfsa2010-33.html - https://bugzilla.mozilla.org/show_bug.cgi?id=475585 - http://secunia.com/advisories/40401 - http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html - http://www.securityfocus.com/bid/33276 - http://secunia.com/advisories/40326 - http://support.avaya.com/css/P8/documents/100091069
CVE ID: CVE-2008-5914 State: PUBLISHED Published: 2009-01-20T16:00:00Z Last Updated: 2024-09-17T02:17:06.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unspecified function in the JavaScript implementation in Apple Safari creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes. Additional Analyst
ause it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://www.infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html - http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161 - http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html - http://www.trusteer.com/files/In-session-phishing-advisory-2.pdf - http://www.securityfocus.com/bid/33276
CVE ID: CVE-2008-5915 State: PUBLISHED Published: 2009-01-20T16:00:00Z Last Updated: 2024-09-17T03:59:56.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unspecified function in the JavaScript implementation in Google Chrome creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes. Additional Analys
cause it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://www.infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html - http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161 - http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html - http://www.trusteer.com/files/In-session-phishing-advisory-2.pdf - http://www.securityfocus.com/bid/33276
CVE ID: CVE-2008-5916 State: PUBLISHED Published: 2009-01-21T02:00:00 Last Updated: 2024-08-07T11:13:13.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47528 - http://www.openwall.com/lists/oss-security/2009/01/20/2 - http://osvdb.org/50918 - http://se
com/vulnerabilities/47528 - http://www.openwall.com/lists/oss-security/2009/01/20/2 - http://osvdb.org/50918 - http://secunia.com/advisories/33282 - http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml - http://secunia.com/advisories/34194 - http://secunia.com/advisories/33964 - http://www.openwall.com/lists/oss-security/2009/01/15/2 - http://marc.info/?l=linux-kernel&m=122975564100863&w=2: - https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01169.html - https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01170.html - http://securityreason.com/securityalert/4922 - http://marc.info/?l=git&m=122975564100860&w=2 - http://www.ubuntu.com/usn/USN-72
securityreason.com/securityalert/4922 - http://marc.info/?l=git&m=122975564100860&w=2 - http://www.ubuntu.com/usn/USN-723-1
CVE ID: CVE-2008-5917 State: PUBLISHED Published: 2009-01-21T02:00:00 Last Updated: 2024-08-07T11:13:13.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the XSS filter (framework/Text_Filter/Filter/xss.php) in Horde Application Framework 3.2.2 and 3.3, when Internet Explorer is being used, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to style attributes. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html - http://secunia.com/advisories/34418 - http://cvs.horde.org/diff.php/framework/Text_Filter/Filter
2009-03/msg00004.html - http://secunia.com/advisories/34418 - http://cvs.horde.org/diff.php/framework/Text_Filter/Filter/xss.php?r1=1.17&r2=1.18 - http://lists.horde.org/archives/announce/2008/000462.html - http://secunia.com/advisories/34609 - http://lists.horde.org/archives/announce/2008/000464.html
CVE ID: CVE-2008-5918 State: PUBLISHED Published: 2009-01-21T02:00:00 Last Updated: 2024-08-07T11:13:13.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - http://websvn.tigris.org/servlets/NewsItemView?newsItemID=2218 - http://secunia.com/advisories/34191 - https://www.exploit-db.com/exploits/6822 - http://websvn.tigris.org/issues/show_bug.cgi?id=179 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46048 - http
http://websvn.tigris.org/issues/show_bug.cgi?id=179 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46048 - http://www.gentoo.org/security/en/glsa/glsa-200903-20.xml - http://www.securityfocus.com/bid/31891 - http://securityreason.com/securityalert/4928 - http://secunia.com/advisories/32338 - http://www.gulftech.org/?node=research&article_id=00132-10202008
CVE ID: CVE-2008-5919 State: PUBLISHED Published: 2009-01-21T02:00:00 Last Updated: 2024-08-07T11:13:13.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to overwrite arbitrary files via directory traversal sequences in the rev parameter. Additional Analyst Notes: - CVE Program Container: References: - http://websvn.tigris.org/servlets/NewsItemView?newsItemID=2218 - http://secunia.com/advisories/34191 - https://www.exploit-db.com/exploits/6822 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46050 - http://websvn.tigris.org/issues/show_bug.cgi
xploits/6822 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46050 - http://websvn.tigris.org/issues/show_bug.cgi?id=179 - http://www.gentoo.org/security/en/glsa/glsa-200903-20.xml - http://www.securityfocus.com/bid/31891 - http://securityreason.com/securityalert/4928 - http://secunia.com/advisories/32338 - http://www.gulftech.org/?node=research&article_id=00132-10202008
CVE ID: CVE-2008-5920 State: PUBLISHED Published: 2009-01-21T02:00:00 Last Updated: 2024-08-07T11:13:13.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a crafted username that is processed by the preg_replace function with the eval switch. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6822 - http://www.securityfocus.com/bid/31891 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48168 - http://securityreason.com/securityalert/4928 - http://www.gulftech.org/?node=research&article_id=00132-10202008
CVE ID: CVE-2008-5921 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in albums.php in Umer Inc Songs Portal allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7439 - http://www.securityfocus.com/bid/32802 - http://securityreason.com/securityalert/4924 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47300
CVE ID: CVE-2008-5922 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Cant Find A Gaming CMS (CFAGCMS) 1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) main and (2) right parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.bugreport.ir/index_58.htm - http://www.securityfocus.com/bid/32817 - https://www.exploit-db.com/exploits/7459 - http://securityreason.com/securityalert/4926 - http://www.securityfocus.com/archive/1/499213/100/0/threaded
CVE ID: CVE-2008-5923 State: PUBLISHED Published: 2009-01-21T18:00:00Z Last Updated: 2024-09-16T17:18:17.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in default.asp in ASP-DEv XM Events Diary allows remote attackers to execute arbitrary SQL commands the cat parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32809 - http://secunia.com/advisories/33152 - http://packetstormsecurity.org/0812-exploits/aspdevxmdiary-sqldisclose.txt
CVE ID: CVE-2008-5924 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in diary_viewC.asp in ASP-DEv XM Events Diary allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33152 - http://www.securityfocus.com/bid/33499
CVE ID: CVE-2008-5925 State: PUBLISHED Published: 2009-01-21T18:00:00Z Last Updated: 2024-09-16T23:26:41.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASP-DEv XM Events Diary stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for diary.mdb. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/0812-exploits/aspdevxmdiary-sqldisclose.txt
CVE ID: CVE-2008-5926 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in login.asp in ASP-DEv Internal E-Mail System allow remote attackers to execute arbitrary SQL commands via the (1) login parameter (aka user field) or the (2) password parameter (aka pass field). NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7447 - http://securityreason.com/securityalert/4925 - http://secunia.com/advisories/33103 - http://www.securityfocus.com/bid
- http://securityreason.com/securityalert/4925 - http://secunia.com/advisories/33103 - http://www.securityfocus.com/bid/32808
CVE ID: CVE-2008-5927 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPNews 0.0.6 allow remote attackers to execute arbitrary SQL commands via the (1) checkuser parameter (aka username field) or (2) checkpass parameter (aka password field) to admin/index.php. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7443 - http://secunia.com/advisories/33114 - http://securityreason.com/securityalert/4927 - http://
loit-db.com/exploits/7443 - http://secunia.com/advisories/33114 - http://securityreason.com/securityalert/4927 - http://www.securityfocus.com/bid/32810
CVE ID: CVE-2008-5928 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in redir.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33075 - http://securityreason.com/securityalert/4929 - http://www.securityfocus.com/bid/32813 - https://www.exploit-db.com/exploits/7453 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48185
CVE ID: CVE-2008-5929 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: VP-ASP Shopping Cart 6.50 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database containing the password via a direct request for database/shopping650.mdb. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7438 - http://securityreason.com/securityalert/4930 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47298
CVE ID: CVE-2008-5930 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in admin/blog_comments.asp in The Net Guys ASPired2Blog allows remote attackers to execute arbitrary SQL commands via the BlogID parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/4931 - https://www.exploit-db.com/exploits/7436 - http://secunia.com/advisories/33134 - http://www.securityfocus.com/bid/32797 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47295
CVE ID: CVE-2008-5931 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Net Guys ASPired2Blog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing usernames and passwords via a direct request for admin/blog.mdb. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/4931 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47294 - https://www.exploit-db.com/exploits/7436 - h
tyalert/4931 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47294 - https://www.exploit-db.com/exploits/7436 - http://secunia.com/advisories/33134
CVE ID: CVE-2008-5932 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a direct request for _private/CAForum.mdb. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33100 - https://www.exploit-db.com/exploits/7450 - http://securityreason.com/securityalert/4932
CVE ID: CVE-2008-5933 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in CMS ISWEB 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the strcerca parameter (aka the input field for the cerca action) or (2) the id_oggetto parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7465 - http://securityreason.com/securityalert/4933 - http://secunia.com/advisories/33090 - http://www.securi
m/exploits/7465 - http://securityreason.com/securityalert/4933 - http://secunia.com/advisories/33090 - http://www.securityfocus.com/bid/32823
CVE ID: CVE-2008-5934 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in CMS ISWEB 3.0 allows remote attackers to execute arbitrary SQL commands via the id_sezione parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7465 - http://securityreason.com/securityalert/4933 - http://secunia.com/advisories/33090 - http://www.securityfocus.com/bid/32823
CVE ID: CVE-2008-5935 State: PUBLISHED Published: 2009-01-21T18:00:00 Last Updated: 2024-08-07T11:13:13.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Facto stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a direct request for database/facto.mdb. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/4934 - http://www.securityfocus.com/archive/1/499125/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/47278
CVE ID: CVE-2008-5936 State: PUBLISHED Published: 2009-01-22T02:00:00 Last Updated: 2024-08-07T11:13:13.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a filename in the sFileName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6734 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45831 - http://www.securityfocus.com/bid/31733
CVE ID: CVE-2008-5937 State: PUBLISHED Published: 2009-01-22T02:00:00 Last Updated: 2024-08-07T11:13:13.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: AyeView 2.20 allows user-assisted attackers to cause a denial of service (memory consumption or application crash) via a bitmap (aka .bmp) file with large height and width values. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/48183 - http://securityreason.com/securityalert/4939 - https://www.exploit-db.com/exploits/6672
CVE ID: CVE-2008-5938 State: PUBLISHED Published: 2009-01-22T11:00:00 Last Updated: 2024-08-07T11:13:13.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflect_base parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7204 - http://www.vupen.com/english/advisories/2008/3236 - http://securityreason.com/securityalert/4940 - http://svn.modxcms.com/svn/tattoo/tattoo/releases/0.9.6.3/install/changelog
tp://securityreason.com/securityalert/4940 - http://svn.modxcms.com/svn/tattoo/tattoo/releases/0.9.6.3/install/changelog.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/46797 - http://secunia.com/advisories/32824 - http://www.securityfocus.com/bid/32436
CVE ID: CVE-2008-5939 State: PUBLISHED Published: 2009-01-22T11:00:00 Last Updated: 2024-08-07T11:13:13.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but this is probably incorrect based on the original disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7204 - http://www.vupen.com/english/advisories/2008/3236 - http://securi
ferences: - https://www.exploit-db.com/exploits/7204 - http://www.vupen.com/english/advisories/2008/3236 - http://securityreason.com/securityalert/4940 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46796 - http://svn.modxcms.com/svn/tattoo/tattoo/releases/0.9.6.3/install/changelog.txt - http://www.securityfocus.com/bid/32436