Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2008-4257 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4258 State: PUBLISHED Published: 2008-12-10T13:33:00 Last Updated: 2024-08-07T10:08:34.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not properly validate parameters during calls to navigation methods, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Parameter Validation Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/3385 - http://www.securitytracker.com/id?1021371 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre
- http://www.securitytracker.com/id?1021371 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5231 - http://www.us-cert.gov/cas/techalerts/TA08-344A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-073
CVE ID: CVE-2008-4259 State: PUBLISHED Published: 2008-12-10T13:33:00 Last Updated: 2024-08-07T10:08:35.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 7 sometimes attempts to access uninitialized memory locations, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, related to a WebDAV request for a file with a long name, aka "HTML Objects Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/3385 - http://www.zerodayinitiative.com/advisories/ZDI-08-087 - https://oval.cisecurity.org/repository/se
dvisories/2008/3385 - http://www.zerodayinitiative.com/advisories/ZDI-08-087 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5706 - http://www.securitytracker.com/id?1021371 - http://www.us-cert.gov/cas/techalerts/TA08-344A.html - http://www.zerodayinitiative.com/advisories/ZDI-08-087/ - http://www.securityfocus.com/archive/1/499065/100/0/threaded - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-073
CVE ID: CVE-2008-4260 State: PUBLISHED Published: 2008-12-10T13:33:00 Last Updated: 2024-08-07T10:08:35.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 7 sometimes attempts to access a deleted object, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Uninitialized Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/3385 - http://www.securitytracker.com/id?1021371 - http://www.us-cert.gov/cas/techalerts/TA08-344A.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.m
://www.us-cert.gov/cas/techalerts/TA08-344A.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5903 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-073
CVE ID: CVE-2008-4261 State: PUBLISHED Published: 2008-12-10T13:33:00 Last Updated: 2024-08-07T10:08:35.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Microsoft Internet Explorer 5.01 SP4, 6 SP1 on Windows 2000, and 6 on Windows XP and Server 2003 does not properly handle extraneous data associated with an object embedded in a web page, which allows remote attackers to execute arbitrary code via crafted HTML tags that trigger memory corruption, aka "HTML Rendering Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/3385 - http://labs.idefense.com/intelli
VE Program Container: References: - http://www.vupen.com/english/advisories/2008/3385 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=761 - http://www.securitytracker.com/id?1021371 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5829 - http://www.us-cert.gov/cas/techalerts/TA08-344A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-073
CVE ID: CVE-2008-4262 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4263 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4264 State: PUBLISHED Published: 2008-12-10T13:33:00 Last Updated: 2024-08-07T10:08:34.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed formula, which triggers "pointer corruption" during the loading of formulas from this spreadsheet, aka "File Format Parsing Vulnerability."
ers "pointer corruption" during the loading of formulas from this spreadsheet, aka "File Format Parsing Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5556 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-074 - http://www.vupen.com/english/advisories/2008/3386 - http://www.securitytracker.com/id?1021368 - http://www.us-cert.gov/cas/techalerts/TA08-344A.html - http://www.securityfocus.com/bid/32621
CVE ID: CVE-2008-4265 State: PUBLISHED Published: 2008-12-10T13:33:00 Last Updated: 2024-08-07T10:08:34.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Office Excel 2000 SP3 allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed object, which triggers memory corruption during the loading of records from this spreadsheet, aka "File Format Parsing Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-074 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5614 - http://www.vup
/ms08-074 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5614 - http://www.vupen.com/english/advisories/2008/3386 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=763 - http://www.securitytracker.com/id?1021368 - http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE ID: CVE-2008-4266 State: PUBLISHED Published: 2008-12-10T13:33:00 Last Updated: 2024-08-07T10:08:34.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Array index vulnerability in Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP3; Excel Viewer 2003 Gold and SP3; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via an Excel spreadsheet with a NAME record that contains an invalid index value, which triggers stack corruption, aka "Excel Global Array Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/secunia_research/2008-36/ - https:/
Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/secunia_research/2008-36/ - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-074 - http://www.vupen.com/english/advisories/2008/3386 - http://www.securityfocus.com/archive/1/499055/100/0/threaded - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5808 - http://www.securitytracker.com/id?1021368 - http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE ID: CVE-2008-4267 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4268 State: PUBLISHED Published: 2008-12-10T13:33:00 Last Updated: 2024-08-07T10:08:35.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Windows Search component in Microsoft Windows Vista Gold and SP1 and Server 2008 does not properly free memory during a save operation for a Windows Search file, which allows remote attackers to execute arbitrary code via a crafted saved-search file, aka "Windows Saved Search Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-075 - http://www.securitytracker.com/id?1021366 - http://secunia.com/advisories/33053 - http
securitybulletins/2008/ms08-075 - http://www.securitytracker.com/id?1021366 - http://secunia.com/advisories/33053 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5853 - http://www.vupen.com/english/advisories/2008/3387 - http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE ID: CVE-2008-4269 State: PUBLISHED Published: 2008-12-10T13:33:00 Last Updated: 2024-08-07T10:08:35.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: The search-ms protocol handler in Windows Explorer in Microsoft Windows Vista Gold and SP1 and Server 2008 uses untrusted parameter data obtained from incorrect parsing, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Windows Search Parsing Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-075 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef
s/securitybulletins/2008/ms08-075 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6110 - http://www.securitytracker.com/id?1021366 - http://secunia.com/advisories/33053 - http://www.vupen.com/english/advisories/2008/3387 - http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE ID: CVE-2008-4270 State: REJECTED Published: 2008-12-30T19:00:00Z Last Updated: 2024-09-17T00:37:01.022Z Description: No description available.
CVE ID: CVE-2008-4271 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4272 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4273 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4274 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4275 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4276 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4277 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2008-4278 State: PUBLISHED Published: 2008-10-06T18:00:00 Last Updated: 2024-08-07T10:08:35.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMware VirtualCenter 2.5 before Update 3 build 119838 on Windows displays a user's password in cleartext when the password contains unspecified special characters, which allows physically proximate attackers to steal the password. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=122331139823057&w=2 - http://secunia.com/advisories/32179 - http://www.vupen.com/english/advisories/2008/2740 - http://www.securitytracker.com/id?1020992 - http://secunia.com/advisories/32180 - http://www.v
sh/advisories/2008/2740 - http://www.securitytracker.com/id?1020992 - http://secunia.com/advisories/32180 - http://www.vmware.com/security/advisories/VMSA-2008-0016.html - http://www.securityfocus.com/bid/31569 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45664 - http://www.securityfocus.com/archive/1/497041/100/0/threaded
CVE ID: CVE-2008-4279 State: PUBLISHED Published: 2008-10-06T18:00:00 Last Updated: 2024-08-07T10:08:34.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CPU hardware emulation for 64-bit guest operating systems in VMware Workstation 6.0.x before 6.0.5 build 109488 and 5.x before 5.5.8 build 108000; Player 2.0.x before 2.0.5 build 109488 and 1.x before 1.0.8; Server 1.x before 1.0.7 build 108231; and ESX 2.5.4 through 3.5 allows authenticated guest OS users to gain additional guest OS privileges by triggering an exception that causes the virtual CPU to perform an indirect jump to a non-canonical address. Additional Analyst Notes: - CVE Program Container: References: - http:
form an indirect jump to a non-canonical address. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=122331139823057&w=2 - http://secunia.com/advisories/32157 - http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/064860.html - http://secunia.com/advisories/32179 - http://www.vupen.com/english/advisories/2008/2740 - http://secunia.com/advisories/32180 - http://www.vmware.com/security/advisories/VMSA-2008-0016.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/45668 - http://www.securityfocus.com/bid/31569 - http://www.securitytracker.com/id?1020991 - http://www.securityfocus.com/archive/1/497041/100/0/threaded - https://oval.cis
p://www.securitytracker.com/id?1020991 - http://www.securityfocus.com/archive/1/497041/100/0/threaded - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5929
CVE ID: CVE-2008-4281 State: PUBLISHED Published: 2008-11-10T11:00:00 Last Updated: 2024-08-07T10:08:35.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in VMWare ESXi 3.5 before ESXe350-200810401-O-UG and ESX 3.5 before ESX350-200810201-UG allows administrators with the Datastore.FileManagement privilege to gain privileges via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://lists.vmware.com/pipermail/security-announce/2008/000042.html - http://www.securityfocus.com/bid/32172 - http://www.securityfocus.com/archive/1/498138/100/0/threaded - https://oval.cisecurity.org/repository/search/definition/oval%3A
www.securityfocus.com/archive/1/498138/100/0/threaded - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6425 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46418 - http://secunia.com/advisories/32624 - http://www.securitytracker.com/id?1021155 - http://www.vmware.com/security/advisories/VMSA-2008-0018.html - http://www.vupen.com/english/advisories/2008/3052
CVE ID: CVE-2008-4283 State: PUBLISHED Published: 2009-02-10T22:13:00 Last Updated: 2024-08-07T10:08:35.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-1.ibm.com/support/docview.wss?uid=isg1SE35864 - http://www-1.ibm.com/support/docview.wss?uid=swg1PK69929 - http://www.securityfocus.com/bid/33700 - https://exchange.xforce.ibmcloud.com/vulnerab
ort/docview.wss?uid=swg1PK69929 - http://www.securityfocus.com/bid/33700 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47199
CVE ID: CVE-2008-4284 State: PUBLISHED Published: 2009-02-10T22:13:00 Last Updated: 2024-08-07T10:08:34.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the ibm_security_logout servlet in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.x versions, 6.0.x before 6.0.2.33, and 6.1.x before 6.1.0.23 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage feature. Additional Analyst Notes: - CVE Program Container: References: - http://www-1.ibm.com/support/docview.wss?uid=swg24021527 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47200 - http://www.securityfocus.com/bid
view.wss?uid=swg24021527 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47200 - http://www.securityfocus.com/bid/33700 - http://www-1.ibm.com/support/docview.wss?uid=swg21320242
CVE ID: CVE-2008-4285 State: PUBLISHED Published: 2009-02-17T17:00:00 Last Updated: 2024-08-07T10:08:35.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Performance Monitoring Infrastructure (PMI) feature in the Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19, when a component statistic is enabled, allows attackers to cause a denial of service (daemon crash) via vectors related to "a gradual degradation in performance." Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg27007951 - https://exchange.xforce.ibmcloud.com/vulnerabili
ferences: - http://www-01.ibm.com/support/docview.wss?uid=swg27007951 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48698 - http://www-01.ibm.com/support/docview.wss?uid=swg24019260
CVE ID: CVE-2008-4292 State: PUBLISHED Published: 2008-09-27T00:00:00 Last Updated: 2024-08-07T10:08:35.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors. NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a security section of the advisory. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/2416 - http://secunia.com/advisories/32538 - http://my.opera.com/yngve/blog/2008/06/27/nobody-checks-the-padlock-debunked-by-opera-users - https://exchange.
/32538 - http://my.opera.com/yngve/blog/2008/06/27/nobody-checks-the-padlock-debunked-by-opera-users - https://exchange.xforce.ibmcloud.com/vulnerabilities/45589 - http://www.opera.com/docs/changelogs/mac/952/ - http://www.opera.com/docs/changelogs/solaris/952/ - http://my.opera.com/community/forums/topic.dml?id=241988&t=1222404671&page=1 - http://www.opera.com/docs/changelogs/windows/952/ - http://www.opera.com/docs/changelogs/linux/952/ - http://www.openwall.com/lists/oss-security/2008/09/24/4 - http://www.openwall.com/lists/oss-security/2008/09/19/2 - http://secunia.com/advisories/31549 - http://bugs.gentoo.org/show_bug.cgi?id=235298 - http://www.opera.com/docs/changelogs/freebsd/952/ - h
advisories/31549 - http://bugs.gentoo.org/show_bug.cgi?id=235298 - http://www.opera.com/docs/changelogs/freebsd/952/ - http://security.gentoo.org/glsa/glsa-200811-01.xml
CVE ID: CVE-2008-4293 State: PUBLISHED Published: 2008-09-27T00:00:00 Last Updated: 2024-08-07T10:08:34.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Opera before 9.52 on Windows, when registered as a protocol handler, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors in which Opera is launched by other applications. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/2416 - https://exchange.xforce.ibmcloud.com/vulnerabilities/44547 - http://www.securityfocus.com/bid/30768 - http://www.opera.com/docs/changelogs/windows/952
ud.com/vulnerabilities/44547 - http://www.securityfocus.com/bid/30768 - http://www.opera.com/docs/changelogs/windows/952/ - http://secunia.com/advisories/31549 - http://www.opera.com/support/search/view/892/
CVE ID: CVE-2008-4294 State: PUBLISHED Published: 2008-09-27T00:00:00 Last Updated: 2024-08-07T10:08:34.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation, as demonstrated by a root session that is still valid after a subsequent read-only session has begun. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/2690 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45419 - http://secunia.com/advisories/32036 - http://www.security
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45419 - http://secunia.com/advisories/32036 - http://www.securityfocus.com/bid/31414 - http://www-01.ibm.com/support/docview.wss?uid=swg24018932 - http://www-1.ibm.com/support/docview.wss?uid=swg1IZ21888
CVE ID: CVE-2008-4295 State: PUBLISHED Published: 2008-09-27T00:00:00 Last Updated: 2024-08-07T10:08:35.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name, which allows remote attackers to cause a denial of service (device reboot) by configuring a Bluetooth device with a long hci name and (1) connecting directly to the Windows Mobile system or (2) waiting for the Windows Mobile system to scan for nearby devices. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmclo
scan for nearby devices. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/45463 - http://secunia.com/advisories/32066 - http://www.securityfocus.com/bid/31420 - https://www.exploit-db.com/exploits/6582
CVE ID: CVE-2008-4296 State: PUBLISHED Published: 2008-09-27T00:00:00 Last Updated: 2024-08-07T10:08:34.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Cisco Linksys WRT350N with firmware 1.0.3.7 has "admin" as its default password for the "admin" account, which makes it easier for remote attackers to obtain access. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/4319 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45588 - http://www.securityfocus.com/archive/1/496756/100/0/threaded
CVE ID: CVE-2008-4297 State: PUBLISHED Published: 2008-09-27T00:00:00 Last Updated: 2024-08-07T10:08:35.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request. Additional Analyst Notes: - CVE Program Container: References: - http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0276 - https://issues.rpath.com/browse/RPL-2753 - http://www.vupen.com/english/advisories/2008/2604 - http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html - http://marc.info/?l=oss-security&m=1
2604 - http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html - http://marc.info/?l=oss-security&m=122169840003798&w=2 - http://secunia.com/advisories/32182 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45229 - http://www.selenic.com/mercurial/wiki/index.cgi/WhatsNew#head-905b8adb3420a77d92617e06590055bd8952e02b - http://www.securityfocus.com/archive/1/496488/100/0/threaded - http://www.securityfocus.com/bid/31223