Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2008-3193 State: PUBLISHED Published: 2008-07-16T18:00:00 Last Updated: 2024-08-07T09:28:41.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in jSite 1.0 OE allows remote attackers to execute arbitrary SQL commands via the page parameter to the default URI. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/31049 - https://www.exploit-db.com/exploits/6057 - http://securityreason.com/securityalert/3999 - http://www.securityfocus.com/bid/30206 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43745
CVE ID: CVE-2008-3194 State: PUBLISHED Published: 2008-07-16T18:00:00 Last Updated: 2024-08-07T09:28:41.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php in pluck 4.5.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) langpref, (2) file, (3) blogpost, or (4) cat parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/2104/references - https://www.exploit-db.com/exploits/6074 - http://securityreason.com/securityalert/3996 - https://exchange.xforce.ibmcloud.com/vulnerabilities/437
/exploits/6074 - http://securityreason.com/securityalert/3996 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43741 - http://secunia.com/advisories/31088 - http://www.securityfocus.com/bid/30218 - http://www.pluck-cms.org/releasenotes.php#4.5.2 - http://www.bugreport.ir/index_48.htm
CVE ID: CVE-2008-3195 State: PUBLISHED Published: 2008-09-17T18:06:00 Last Updated: 2024-08-07T09:28:41.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/31849 - https://www.exploit-db.com/exploits/6269 - http://securityreason.com/securityalert/4265 - http://secunia.com/advisories/31964 -
www.exploit-db.com/exploits/6269 - http://securityreason.com/securityalert/4265 - http://secunia.com/advisories/31964 - http://www.kb.cert.org/vuls/id/RGII-7JEQ7L - http://www.vupen.com/english/advisories/2008/2586 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45183 - http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195 - http://twiki.org/cgi-bin/view/Codev/TWikiRelease04x02x03#4_2_3_Bugfix_Highlights - https://exchange.xforce.ibmcloud.com/vulnerabilities/45182 - http://www.kb.cert.org/vuls/id/362012
CVE ID: CVE-2008-3196 State: PUBLISHED Published: 2008-07-16T18:00:00 Last Updated: 2024-08-07T09:28:41.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: skeleton.c in yacc does not properly handle reduction of a rule with an empty right hand side, which allows context-dependent attackers to cause an out-of-bounds stack access when the yacc stack pointer points to the end of the stack. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=openbsd-cvs&m=121553036432044&w=2 - http://secunia.com/advisories/31073 - http://marc.info/?l=openbsd-cvs&m=121553004431393&w=2 - http://www.vupen.com/english/advisories/2008/2151/references
CVE ID: CVE-2008-3197 State: PUBLISHED Published: 2008-07-16T18:00:00 Last Updated: 2024-08-07T09:28:41.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the "Creating a Database" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2008:202 - http://www.phpmyadmin.n
ogram Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2008:202 - http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 - http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00590.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/43846 - http://sourceforge.net/project/shownotes.php?release_id=613660 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5 - http://yehg.net/lab/pr0js/advisories/XSRF_ConvertCharset_inPhpMyAdmin2.11.7.pdf - http://www.openwall.com/lists/oss-security/2008/07/15/6 - http://yehg.net/lab/pr0js/advisories/XSRF_Cre
dmin2.11.7.pdf - http://www.openwall.com/lists/oss-security/2008/07/15/6 - http://yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00652.html - http://www.debian.org/security/2008/dsa-1641 - http://secunia.com/advisories/33822 - http://www.vupen.com/english/advisories/2008/2116/references - http://secunia.com/advisories/31097 - http://secunia.com/advisories/31115
CVE ID: CVE-2008-3198 State: PUBLISHED Published: 2008-07-17T10:00:00 Last Updated: 2024-08-07T09:28:41.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933. Additional Analyst Notes: - CVE Program Container: References: - http://www.mozilla.org/security/announce/2008/mfsa2008-35.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/44199 - http://www.securityfocus.com/bid/30244 - https://bugzilla.mozilla.org/show_bug
orce.ibmcloud.com/vulnerabilities/44199 - http://www.securityfocus.com/bid/30244 - https://bugzilla.mozilla.org/show_bug.cgi?id=441169
CVE ID: CVE-2008-3199 State: PUBLISHED Published: 2008-07-17T10:00:00 Last Updated: 2024-08-07T09:28:41.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in ReSIProcate before 1.3.4 allow remote attackers to cause a denial of service (stack consumption) via unknown network traffic with a large "bytes-in-memory/bytes-on-wire ratio." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/31251 - https://exchange.xforce.ibmcloud.com/vulnerabilities/44015 - http://www.resiprocate.org/ReSIProcate_1.3.4_Release - http://www.securityfocus.com/bid/30399
CVE ID: CVE-2008-3200 State: PUBLISHED Published: 2008-07-17T10:00:00 Last Updated: 2024-08-07T09:28:41.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in vlc_forum.php in Avlc Forum as of 20080715 allows remote attackers to execute arbitrary SQL commands via the id parameter in an affich_message action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6058 - http://www.securityfocus.com/bid/30202 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43740 - http://securityreason.com/securityalert/4005
CVE ID: CVE-2008-3201 State: PUBLISHED Published: 2008-07-17T10:00:00 Last Updated: 2024-08-07T09:28:41.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Pagefusion 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) acct_fname and (2) acct_lname parameters in an edit action, and the (3) PID, (4) PGID, and (5) rez parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/31050 - http://www.securityfocus.com/bid/30155 - http:
VE Program Container: References: - http://secunia.com/advisories/31050 - http://www.securityfocus.com/bid/30155 - http://downloads.securityfocus.com/vulnerabilities/exploits/30155.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/43711
CVE ID: CVE-2008-3202 State: PUBLISHED Published: 2008-07-17T10:00:00 Last Updated: 2024-08-07T09:28:41.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in Xomol CMS 1.2 allows remote attackers to inject arbitrary web script or HTML via the current_url parameter in a tellafriend action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/44058 - http://www.securityfocus.com/bid/30156 - http://secunia.com/advisories/31015 - http://downloads.securi
abilities/44058 - http://www.securityfocus.com/bid/30156 - http://secunia.com/advisories/31015 - http://downloads.securityfocus.com/vulnerabilities/exploits/30156.html
CVE ID: CVE-2008-3203 State: PUBLISHED Published: 2008-07-17T10:00:00 Last Updated: 2024-08-07T09:28:41.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: js/pages/pages_data.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to add, edit, and delete web content via a modified id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6033 - http://www.securityfocus.com/bid/30169 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43682 - http://www.auracms.org/ - http://secunia.com/advisories/31000
CVE ID: CVE-2008-3204 State: PUBLISHED Published: 2008-07-17T10:00:00 Last Updated: 2024-08-07T09:28:41.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in tops_top.php in E-topbiz Million Pixels 3 allows remote attackers to execute arbitrary SQL commands via the id_cat parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/31059 - http://securityreason.com/securityalert/4006 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43729 - https://www.exploit-db.com/exploits/6044 - http://www.securityfocus.com/bid/30190
CVE ID: CVE-2008-3205 State: PUBLISHED Published: 2008-07-17T10:00:00 Last Updated: 2024-08-07T09:28:41.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in index.php in Easy-Script Wysi Wiki Wyg 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the c parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/4007 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43717 - http://secunia.com/advisories/31061 - https://www.exploit-db.com/exploits/6042 - http://www.securityfocus.com/bid/30183
CVE ID: CVE-2008-3206 State: PUBLISHED Published: 2008-07-18T15:00:00 Last Updated: 2024-08-07T09:28:41.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in browse.groups.php in Yuhhu Pubs Black Cat allows remote attackers to execute arbitrary SQL commands via the category parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/31077 - http://www.securityfocus.com/archive/1/494319/100/0/threaded - http://www.securityfocus.com/bid/30221 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43782 - http://securityreason.com/securityalert/4008
CVE ID: CVE-2008-3207 State: PUBLISHED Published: 2008-07-18T15:00:00 Last Updated: 2024-08-07T09:28:41.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in cms/modules/form.lib.php in Pragyan CMS 2.6.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the (1) sourceFolder or (2) moduleFolder parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30235 - https://www.exploit-db.com/exploits/6078 - http://securityreason.com/securityalert/4010 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43777 - http://secunia.com/advisories/31
n.com/securityalert/4010 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43777 - http://secunia.com/advisories/31101
CVE ID: CVE-2008-3208 State: PUBLISHED Published: 2008-07-18T15:00:00 Last Updated: 2024-08-07T09:28:41.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple DNS Plus 4.1, 5.0, and possibly other versions before 5.1.101 allows remote attackers to cause a denial of service via multiple DNS reply packets. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/43767 - https://www.exploit-db.com/exploits/6059 - http://securityreason.com/securityalert/4011 - http://www.blackhat.org.il/index.php/simple-dns-plus-5041-remote-denial-of-service-exploit/ - http://www.securityfocus.com/bid/30207 - http://www.simpledns.com/kb
e-dns-plus-5041-remote-denial-of-service-exploit/ - http://www.securityfocus.com/bid/30207 - http://www.simpledns.com/kb.aspx?kbid=1246 - http://www.securityfocus.com/archive/1/494304/100/0/threaded
CVE ID: CVE-2008-3209 State: PUBLISHED Published: 2008-07-18T15:00:00 Last Updated: 2024-08-07T09:28:41.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the OpenGifFile function in BiGif.dll in Black Ice Document Imaging SDK 10.95 allows remote attackers to execute arbitrary code via a long string argument to the GetNumberOfImagesInGifFile method in the BIImgFrm Control ActiveX control in biimgfrm.ocx. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/4012 - https://www.exploit-db.com/exploits/6083 - http://www.securityfocu
ces: - http://securityreason.com/securityalert/4012 - https://www.exploit-db.com/exploits/6083 - http://www.securityfocus.com/bid/30243 - http://secunia.com/advisories/31095 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43830
CVE ID: CVE-2008-3210 State: PUBLISHED Published: 2008-07-18T15:00:00 Last Updated: 2024-08-07T09:28:41.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2, as used by repro, allows remote attackers to cause a denial of service (daemon crash) via a SIP (1) INVITE or (2) OPTIONS message with a long domain name in a request URI, which triggers an assert error. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/43770 - http://www.resiprocate.org/ReSIProcate_1.3.3_Release - https://www.exploit-db.com/exploits/6046 - http://secunia.com/advisories/31058 - http://securityreason.
_1.3.3_Release - https://www.exploit-db.com/exploits/6046 - http://secunia.com/advisories/31058 - http://securityreason.com/securityalert/4013 - http://www.securityfocus.com/bid/30194 - http://labs.mudynamics.com/advisories/MU-200807-01.txt
CVE ID: CVE-2008-3211 State: PUBLISHED Published: 2008-07-18T15:00:00 Last Updated: 2024-08-07T09:28:41.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scripteen Free Image Hosting Script 1.2 and 1.2.1 allows remote attackers to bypass authentication and gain administrative access by setting the cookid cookie value to 1. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/2106/references - http://www.securityfocus.com/bid/30217 - http://securityreason.com/securityalert/4014 - http://secunia.com/advisories/31083 - https://www.exploit-db.com/exploits/6070 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43771
CVE ID: CVE-2008-3212 State: PUBLISHED Published: 2008-07-18T15:00:00 Last Updated: 2024-08-07T09:28:41.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Scripteen Free Image Hosting Script 1.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to admin/login.php, or the (3) uname or (4) pass parameter to login.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30216 - http://secunia.com/advisories/31083 - https://exch
ram Container: References: - http://www.securityfocus.com/bid/30216 - http://secunia.com/advisories/31083 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43772
CVE ID: CVE-2008-3213 State: PUBLISHED Published: 2008-07-18T15:00:00 Last Updated: 2024-08-07T09:28:41.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in secciones/tablon/tablon.php in WebCMS Portal Edition allows remote attackers to execute arbitrary SQL commands via the id parameter to portal/index.php in a tablon action. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30204 - http://securityreason.com/securityalert/4009 - https://www.exploit-db.com/exploits/6056 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43739 - h
tyalert/4009 - https://www.exploit-db.com/exploits/6056 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43739 - http://secunia.com/advisories/31047
CVE ID: CVE-2008-3214 State: PUBLISHED Published: 2008-07-18T16:00:00 Last Updated: 2024-08-07T09:28:41.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: dnsmasq 2.25 allows remote attackers to cause a denial of service (daemon crash) by (1) renewing a nonexistent lease or (2) sending a DHCPREQUEST for an IP address that is not in the same network, related to the DHCP NAK response from the daemon. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/dnsmasq/+bug/47438 - http://www.openwall.com/lists/oss-security/2008/07/12/3 - http://www.openwall.com/lists/oss-security/2008/07/08/8 - https://exchange.xforce.ibmcloud.com/vuln
urity/2008/07/12/3 - http://www.openwall.com/lists/oss-security/2008/07/08/8 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43929 - http://freshmeat.net/projects/dnsmasq/?branch_id=1991&release_id=217681 - http://www.openwall.com/lists/oss-security/2008/07/01/8 - http://www.openwall.com/lists/oss-security/2008/06/30/7 - http://www.thekelleys.org.uk/dnsmasq/CHANGELOG - http://www.openwall.com/lists/oss-security/2008/07/02/4 - http://www.openwall.com/lists/oss-security/2008/07/03/4
CVE ID: CVE-2008-3215 State: PUBLISHED Published: 2008-07-18T16:00:00 Last Updated: 2024-08-07T09:28:41.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an out-of-bounds memory access. NOTE: this issue exists because of an incomplete fix for CVE-2008-2713. Additional Analyst Notes: - CVE Program Container: References: - https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1000#c4 - http://secunia.com/advisories/31437 - http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html - http://www.openwall.com/lists/oss-security/2008/07/1
ists.apple.com/archives/security-announce//2008/Sep/msg00005.html - http://www.openwall.com/lists/oss-security/2008/07/15/1 - http://www.us-cert.gov/cas/techalerts/TA08-260A.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/44200 - http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html - http://www.vupen.com/english/advisories/2008/2584 - http://svn.clamav.net/websvn/diff.php?repname=clamav-devel&path=/branches/0.93/libclamav/petite.c&rev=3920 - http://secunia.com/advisories/31882 - http://secunia.com/advisories/31091 - http://lurker.clamav.net/message/20080707.155612.ad411b00.en.html - http://security.gentoo.org/glsa/glsa-200808-07.xml - http://www.mandriva.com
/message/20080707.155612.ad411b00.en.html - http://security.gentoo.org/glsa/glsa-200808-07.xml - http://www.mandriva.com/security/advisories?name=MDVSA-2008:166 - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00617.html - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00606.html - http://www.openwall.com/lists/oss-security/2008/07/08/5
CVE ID: CVE-2008-3216 State: PUBLISHED Published: 2008-07-18T16:00:00 Last Updated: 2024-08-07T09:28:41.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: The save function in br/prefmanager.d in projectl 1.001 creates a projectL.prf file in the current working directory, which allows local users to overwrite arbitrary files via a symlink attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2008/07/09/8 - http://bugs.debian.org/489988 - https://exchange.xforce.ibmcloud.com/vulnerabilities/44059
CVE ID: CVE-2008-3217 State: PUBLISHED Published: 2008-07-18T16:00:00 Last Updated: 2024-08-07T09:28:41.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator for source port selection, which makes it easier for remote attack vectors to conduct DNS cache poisoning. NOTE: this is related to incomplete integration of security improvements associated with addressing CVE-2008-1637. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2008/07/16/12 - http://wiki.powerdns.com/cgi-bin/trac.fcgi/changeset/1179 - http://secunia.com/advisories/31311 -
curity/2008/07/16/12 - http://wiki.powerdns.com/cgi-bin/trac.fcgi/changeset/1179 - http://secunia.com/advisories/31311 - http://www.openwall.com/lists/oss-security/2008/07/09/10 - http://www.openwall.com/lists/oss-security/2008/07/10/6 - http://doc.powerdns.com/changelog.html#CHANGELOG-RECURSOR-3-1-6 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43925 - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01353.html - http://www.securityfocus.com/bid/30782
CVE ID: CVE-2008-3218 State: PUBLISHED Published: 2008-07-18T16:00:00 Last Updated: 2024-08-07T09:28:41.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30168 - http://drupal.org/node/280571 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43704 - https://bugzilla.redhat.com/show_bug.cgi?id=45484
/280571 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43704 - https://bugzilla.redhat.com/show_bug.cgi?id=454849 - https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html - http://secunia.com/advisories/31079 - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html - http://www.openwall.com/lists/oss-security/2008/07/10/3 - https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html
CVE ID: CVE-2008-3219 State: PUBLISHED Published: 2008-07-18T16:00:00 Last Updated: 2024-08-07T09:28:41.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30168 - http://drupal.org/node/280571 - https://bugzilla.redhat.com/show_bug.cgi?id=454849 - https://www.redhat.com/archives/fedora-package-announce/2008-August