Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2008-6514 State: PUBLISHED Published: 2009-03-24T14:00:00 Last Updated: 2024-08-07T11:34:46.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Expo plugin in Compiz Fusion 0.7.8 allows local users with physical access to drag the screen saver aside and access the locked desktop by using Expo mouse shortcuts, a related issue to CVE-2007-3920. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/34465 - https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00878.html - http://bugzilla.gnome.org/show_bug.cgi?id=561567 - http://www.securityfocus.com/bid/32712 - http://secunia.com/advisories/33077 - http://gitw
.org/show_bug.cgi?id=561567 - http://www.securityfocus.com/bid/32712 - http://secunia.com/advisories/33077 - http://gitweb.compiz-fusion.org/?p=fusion/plugins/expo%3Ba=commit%3Bh=f97a9fa6f0ad578f674d1f248bd7bef90e3260e0 - https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00860.html - https://bugs.launchpad.net/ubuntu/+source/compiz-fusion-plugins-main/+bug/247088 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47172
CVE ID: CVE-2008-6515 State: PUBLISHED Published: 2009-03-24T14:00:00 Last Updated: 2024-08-07T11:34:46.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Fritz Berger yet another php photo album - next generation (yappa-ng) allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/49494 - http://packetstormsecurity.org/0812-exploits/yappang-xss.txt - http://www.securityfocus.com/bid/32623
CVE ID: CVE-2008-6516 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:47.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in phpKF-Portal 1.10 allow remote attackers to include arbitrary files via a .. (dot dot) in the (1) tema_dizin parameter to baslik.php and (2) portal_ayarlarportal_dili parameter to anket_yonetim.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/44263 - http://www.securityfocus.com/bid/30566
CVE ID: CVE-2008-6517 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:47.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in NewsHOWLER 1.03 Beta allows remote attackers to execute arbitrary SQL commands via the news_user cookie parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30732 - http://www.securityfocus.com/archive/1/495548/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/44519 - http://osvdb.org/52236
CVE ID: CVE-2008-6518 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:46.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the profile feature in VidiScript allows registered remote authenticated users to execute arbitrary code by uploading a PHP file as an Avatar, then accessing the avatar via a direct request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6259 - http://www.securityfocus.com/bid/30721 - https://exchange.xforce.ibmcloud.com/vulnerabilities/44525
CVE ID: CVE-2008-6519 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:46.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a Long Running Web Process (LRWP) request, which triggers incorrect logging code involving the sendfmt function in the SMT kernel. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41644 - http://www.securityfocus.com/bid/28603 -
er: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41644 - http://www.securityfocus.com/bid/28603 - https://www.exploit-db.com/exploits/5354 - http://www.bratax.be/advisories/b013.html
CVE ID: CVE-2008-6520 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:47.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple format string vulnerabilities in the SSI filter in Xitami Web Server 2.5c2, and possibly other versions, allow remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a URI that ends in (1) .ssi, (2) .shtm, or (3) .shtml, which triggers incorrect logging code involving the sendfmt function in the SMT kernel. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28603 - http://www.bratax.be/advisories/b0
otes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28603 - http://www.bratax.be/advisories/b013.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/41645
CVE ID: CVE-2008-6521 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:46.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: index.php in Terracotta (aka OpenTerracotta) 0.6.1 allows remote attackers to obtain sensitive information via an invalid File parameter, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41571 - http://www.securityfocus.com/archive/1/490341/100/0/threaded
CVE ID: CVE-2008-6522 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:46.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in the RenderFile function in ContentRender.class.php in Terracotta (aka OpenTerracotta) 0.6.1, and possibly other versions, allow remote attackers to list arbitrary directories and read arbitrary files via a .. (dot dot) in the (1) CurrentDirectory and (2) File parameters to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28550 - http://www.securityfocus.com/archive/1/490341/100/0/threaded - https://exchange.xforce.ibmclo
urityfocus.com/bid/28550 - http://www.securityfocus.com/archive/1/490341/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/41572
CVE ID: CVE-2008-6523 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:46.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie. NOTE: this can be leveraged with a separate vulnerability in resetpass.php to modify passwords for arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/5466 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41947 - http://www.securityfocus.com/bid/28854
CVE ID: CVE-2008-6524 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:47.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: resetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change the passwords of arbitrary users via a modified uid parameter. NOTE: this can be leveraged with a separate vulnerability in auth.php to modify passwords without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/5466 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41947 - https://exchange.xforce.ibmcloud.com/vulnerabilities/49580 - http://www.securityfocus.com/b
.com/vulnerabilities/41947 - https://exchange.xforce.ibmcloud.com/vulnerabilities/49580 - http://www.securityfocus.com/bid/28854
CVE ID: CVE-2008-6525 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:47.003Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Admin Panel in Nice PHP FAQ Script (Knowledge base Script) allows remote attackers to execute arbitrary SQL commands via the Password parameter (aka the pass field). Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7018 - http://www.securityfocus.com/bid/32150 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46402
CVE ID: CVE-2008-6526 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:47.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in BosDev BosClassifieds allows remote attackers to execute arbitrary SQL commands via the cat_id parameter, a different vector than CVE-2008-1838. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46308 - https://www.exploit-db.com/exploits/6962 - http://www.securityfocus.com/bid/32075
CVE ID: CVE-2008-6527 State: PUBLISHED Published: 2009-03-25T18:00:00 Last Updated: 2024-08-07T11:34:46.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in forum.asp in GO4I.NET ASP Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the iFor parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46514 - https://www.exploit-db.com/exploits/6930 - http://www.securityfocus.com/bid/32066
CVE ID: CVE-2008-6528 State: PUBLISHED Published: 2009-03-26T14:00:00 Last Updated: 2024-08-07T11:34:47.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: NTFS TmaxSoft JEUS 5 before Fix 26 allows remote attackers to read the source code for scripts by appending ::$DATA to the URL, which accesses the alternate data stream. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47303 - http://www.securityfocus.com/bid/32804 - https://www.exploit-db.com/exploits/7442 - http://www.securityfocus.com/archive/1/499235/100/0/threaded - http://secunia.com/advisories/33123 - http://www.securityfocus.com/archive/1/499236/100/0
hive/1/499235/100/0/threaded - http://secunia.com/advisories/33123 - http://www.securityfocus.com/archive/1/499236/100/0/threaded
CVE ID: CVE-2008-6529 State: PUBLISHED Published: 2009-03-26T20:28:00 Last Updated: 2024-08-07T11:34:46.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inject arbitrary web script or HTML via the r parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32761 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47214 - https://www.exploit-db.com/exploits/7408
CVE ID: CVE-2008-6530 State: PUBLISHED Published: 2009-03-26T20:28:00 Last Updated: 2024-08-07T11:34:47.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32760 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47215 - https://www.exploit-db.com/exploits/7408
CVE ID: CVE-2008-6531 State: PUBLISHED Published: 2009-03-26T20:28:00 Last Updated: 2024-08-07T11:34:47.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33084 - http://www.osvdb.org/52707 - http://www.securityfocus.com/bid/32746 - http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-12-09 - https://exchange.xforce.ibmcloud.
746 - http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-12-09 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47211
CVE ID: CVE-2008-6532 State: PUBLISHED Published: 2009-03-26T20:28:00 Last Updated: 2024-08-07T11:34:46.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modify the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00767.html - http://www.vupen.com/english/advisories/2008/3414 - http://secunia
fedora-package-announce/2008-December/msg00767.html - http://www.vupen.com/english/advisories/2008/3414 - http://secunia.com/advisories/33147 - http://secunia.com/advisories/33112 - http://drupal.org/node/345441 - https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00740.html - http://www.osvdb.org/50661 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47260
CVE ID: CVE-2008-6533 State: PUBLISHED Published: 2009-03-26T20:28:00 Last Updated: 2024-08-07T11:34:47.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00767.html - http://www.vupen.com/english/advisories/2008/3414 - http://secunia.com/advisories/33147 - http://secunia.com/adviso
ml - http://www.vupen.com/english/advisories/2008/3414 - http://secunia.com/advisories/33147 - http://secunia.com/advisories/33112 - http://drupal.org/node/345441 - https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00740.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/47259 - http://www.osvdb.org/50662
CVE ID: CVE-2008-6534 State: PUBLISHED Published: 2009-03-26T20:28:00 Last Updated: 2024-08-07T11:34:47.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands via a custom SITE command containing shell metacharacters such as "&" (ampersand) in the middle of an argument. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7355 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47099 - http://www.securityfocus.com/bid/32656 - http://vuln.sg/nullftpserver1107-en.html - http://secunia.com/advisorie
47099 - http://www.securityfocus.com/bid/32656 - http://vuln.sg/nullftpserver1107-en.html - http://secunia.com/advisories/32999 - http://www.vupen.com/english/advisories/2008/3367 - http://www.osvdb.org/50486 - http://www.vwsolutions.com/knowledgeBase/releaseNotes.aspx?productId=14
CVE ID: CVE-2008-6535 State: PUBLISHED Published: 2009-03-26T20:28:00 Last Updated: 2024-08-07T11:34:46.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the administrative password via a direct request with a modified NewAdmin parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33036 - https://www.exploit-db.com/exploits/7367 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47203 - http://osvdb.org/50682
CVE ID: CVE-2008-6536 State: PUBLISHED Published: 2009-03-30T01:00:00 Last Updated: 2024-08-07T11:34:46.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats (c10). Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/0914/references - http://secunia.com/advisories/29434 - http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/41247 - http://osvdb.org/43649 - http://www.ee.oulu.fi/research/ouspg/p
s://exchange.xforce.ibmcloud.com/vulnerabilities/41247 - http://osvdb.org/43649 - http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/ - http://www.securityfocus.com/bid/28285 - http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
CVE ID: CVE-2008-6537 State: PUBLISHED Published: 2009-03-30T01:00:00 Last Updated: 2024-08-07T11:34:46.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the administrator password via the setup "do" action to LightNEasy.php, which is cleared from $_GET but later accessed using $_REQUEST. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41768 - http://secunia.com/advisories/29757 - http://osvdb.org/44397 - https://www.exploit-db.com/exploits/5425
CVE ID: CVE-2008-6538 State: PUBLISHED Published: 2009-03-30T01:00:00 Last Updated: 2024-08-07T11:34:46.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41384 - http://www.securityfocus.com/bid/28426 - https://www.exploit-db.com/exploits/5298
CVE ID: CVE-2008-6539 State: PUBLISHED Published: 2009-03-30T01:00:00 Last Updated: 2024-08-07T11:34:46.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitrary administrators and inject arbitrary Python code into destar_cfg.py via a crafted pin parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/5305
CVE ID: CVE-2008-6540 State: PUBLISHED Published: 2009-03-30T01:00:00 Last Updated: 2024-08-07T11:34:46.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41399 - http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno12/tabid/1148/Default.aspx - http://www.securit
399 - http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno12/tabid/1148/Default.aspx - http://www.securityfocus.com/bid/28391 - http://secunia.com/advisories/29488 - http://www.securityfocus.com/archive/1/489957/100/0/threaded - http://osvdb.org/43720
CVE ID: CVE-2008-6541 State: PUBLISHED Published: 2009-03-30T01:00:00 Last Updated: 2024-08-07T11:34:47.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno11/tabid/1147/Default.aspx - http://secunia.com/advisories/29488 - http://osvdb.org/43719 - http://www.securityfocus.com/bid/28438
CVE ID: CVE-2008-6542 State: PUBLISHED Published: 2009-03-30T01:00:00 Last Updated: 2024-08-07T11:34:46.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files. Additional Analyst Notes: - CVE Program Container: References: - http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno13/tabid/1149/Default.aspx - https://exchange.xforce.ibmcloud.com/vulnerabilities/49767 - http://secunia.com/ad
ulletinno13/tabid/1149/Default.aspx - https://exchange.xforce.ibmcloud.com/vulnerabilities/49767 - http://secunia.com/advisories/29488 - http://www.securityfocus.com/bid/28438 - http://osvdb.org/43721
CVE ID: CVE-2008-6543 State: PUBLISHED Published: 2009-03-30T01:00:00 Last Updated: 2024-08-07T11:34:47.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in ComScripts TEAM Quick Classifieds 1.0 via the DOCUMENT_ROOT parameter to (1) index.php3, (2) locate.php3, (3) search_results.php3, (4) classifieds/index.php3, and (5) classifieds/view.php3; (6) index.php3, (7) manager.php3, (8) pass.php3, (9) remember.php3 (10) sign-up.php3, (11) update.php3, (12) userSet.php3, and (13) verify.php3 in controlcenter/; (14) alterCats.php3, (15) alterFeatured.php3, (16) alterHomepage.php3, (17) alterNews.php3, (18) alterTheme.php3, (19) color_
alterCats.php3, (15) alterFeatured.php3, (16) alterHomepage.php3, (17) alterNews.php3, (18) alterTheme.php3, (19) color_help.php3, (20) createdb.php3, (21) createFeatured.php3, (22) createHomepage.php3, (23) createL.php3, (24) createM.php3, (25) createNews.php3, (26) createP.php3, (27) createS.php3, (28) createT.php3, (29) index.php3, (30) mailadmin.php3, and (31) setUp.php3 in controlpannel/; (32) include/sendit.php3 and (33) include/sendit2.php3; and possibly (34) include/adminHead.inc, (35) include/usersHead.inc, and (36) style/default.scheme.inc. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/42469 - http://www.securi
s: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/42469 - http://www.securityfocus.com/bid/28417/exploit - http://www.securityfocus.com/bid/28417
CVE ID: CVE-2008-6544 State: PUBLISHED Published: 2009-03-30T01:00:00 Last Updated: 2024-08-07T11:34:47.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in Simple Machines Forum (SMF) 1.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) settings[default_theme_dir] parameter to Sources/Subs-Graphics.php and (2) settings[default_theme_dir] parameter to Sources/Themes.php. NOTE: CVE and multiple third parties dispute this issue because the files contain a protection mechanism against direct request Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bu
irect request Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2008-03/0426.html - http://archives.neohapsis.com/archives/bugtraq/2008-03/0425.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/41518 - http://www.securityfocus.com/bid/28493 - http://archives.neohapsis.com/archives/bugtraq/2008-03/0431.html - http://osvdb.org/51301