Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
upport/docview.wss?uid=swg1IZ06972 - http://secunia.com/advisories/29022 - http://www.appsecinc.com/resources/alerts/db2/2008-02.shtml - http://securityreason.com/securityalert/3841
CVE ID: CVE-2008-1998 State: PUBLISHED Published: 2008-04-28T18:21:00 Last Updated: 2024-08-07T08:41:00.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06976 - http://www-1.ibm.com/support/docview.wss?uid=swg1IZ10776 - http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06977 - http://www.appsecinc.com/resources/alerts/db2/2008-03.shtml - http://securityreason.
pport/docview.wss?uid=swg1IZ06977 - http://www.appsecinc.com/resources/alerts/db2/2008-03.shtml - http://securityreason.com/securityalert/3840 - http://www.securityfocus.com/archive/1/491073/100/0/threaded - http://secunia.com/advisories/29784 - http://www.securityfocus.com/bid/28836 - http://secunia.com/advisories/29022 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41960
CVE ID: CVE-2008-1999 State: PUBLISHED Published: 2008-04-28T18:21:00 Last Updated: 2024-08-07T08:41:00.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apple Safari 3.1.1 allows remote attackers to spoof the address bar by placing many "invisible" characters in the userinfo subcomponent of the authority component of the URL (aka the user field), as demonstrated by %E3%80%80 sequences. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/1347 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41981 - http://es.geocities.com/jplopezy/pruebasafari3.html - http://www.securityfocus.com/archive/1/491192/100/0/threaded - h
- http://es.geocities.com/jplopezy/pruebasafari3.html - http://www.securityfocus.com/archive/1/491192/100/0/threaded - http://securityreason.com/securityalert/3833 - http://secunia.com/advisories/29900
CVE ID: CVE-2008-20001 State: PUBLISHED Published: 2025-08-30T13:42:39.028Z Last Updated: 2025-11-22T12:29:07.871Z Vendors: activePDF Products: WebGrabber Problem Types: CWE-121 Description: activePDF WebGrabber version 3.8.2.0 contains a stack-based buffer overflow vulnerability in the GetStatus() method of the APWebGrb.ocx ActiveX control. By passing an overly long string to this method, a remote attacker can execute arbitrary code in the context of the vulnerable process. Although the control is not marked safe for scripting, exploitation is possible via crafted HTML content in Internet Explorer under permissive security settings. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
tent in Internet Explorer under permissive security settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/activepdf_webgrabber.rb - https://www.exploit-db.com/exploits/16635 - https://web.archive.org/web/20081219180353/http://www.activepdf.com/products/serverproducts/webgrabber/ - https://support.activepdf.com/support/solutions/35000139131 - https://documentation.activepdf.com/WebGrabber_GS/b_installation/New_Installation.html - https://www.vulncheck.com/advisories/activepdf-webgrabber-activex-control-buffer-overflow
CVE ID: CVE-2008-2000 State: PUBLISHED Published: 2008-04-28T18:21:00 Last Updated: 2024-08-07T08:41:00.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls document.write in an infinite loop. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/1347 - http://es.geocities.com/jplopezy/pruebasafari3.html - http://www.securityfocus.com/archive/1/491192/100/0/threaded - http://securityreason.com/securityalert/3833 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41985
CVE ID: CVE-2008-2001 State: PUBLISHED Published: 2008-04-28T18:21:00 Last Updated: 2024-08-07T08:41:00.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via a file:///%E2 link that triggers an out-of-bounds access, possibly due to a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/1347 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41984 - http://es.geocities.com/jplopezy/pruebasafari3.html - http://www.securityfocus.com/archive/1/491192/100/0/threaded - http://securityreason.com/securityalert
ebasafari3.html - http://www.securityfocus.com/archive/1/491192/100/0/threaded - http://securityreason.com/securityalert/3833
CVE ID: CVE-2008-2002 State: PUBLISHED Published: 2008-04-28T18:21:00 Last Updated: 2024-08-07T08:41:00.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities on Motorola Surfboard with software SB5100-2.3.3.0-SCM00-NOSH allow remote attackers to (1) cause a denial of service (device reboot) via the "Restart Cable Modem" value in the BUTTON_INPUT parameter to configdata.html, and (2) cause a denial of service (hard reset) via the "Reset All Defaults" value in the BUTTON_INPUT parameter to configdata.html. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3839 - http://ww
dditional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3839 - http://www.vupen.com/english/advisories/2008/1390/references - http://www.rooksecurity.com/blog/?p=4 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42091 - http://www.kb.cert.org/vuls/id/643049 - http://secunia.com/advisories/30026 - http://www.securityfocus.com/archive/1/491143/100/0/threaded
CVE ID: CVE-2008-2003 State: PUBLISHED Published: 2008-04-28T18:21:00 Last Updated: 2024-08-07T08:41:00.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: BadBlue 2.72 Personal Edition stores multiple programs in the web document root with insufficient access control, which allows remote attackers to (1) cause a denial of service via multiple invocations of uninst.exe, and have an unknown impact via (2) badblue.exe and (3) dyndns.exe. NOTE: this can be leveraged for arbitrary remote code execution in conjunction with CVE-2007-6378. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3832 - https://exchange.xforce.ibmcloud.com/
VE Program Container: References: - http://securityreason.com/securityalert/3832 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42090 - http://www.securityfocus.com/archive/1/491282/100/0/threaded
CVE ID: CVE-2008-2004 State: PUBLISHED Published: 2008-05-12T22:00:00 Last Updated: 2024-08-07T08:41:00.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: The drive_init function in QEMU 0.9.1 determines the format of a raw disk image based on the header, which allows local guest users to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35062 - http://www.redhat.com/support/errata/RHSA-2008-0194.html - http://www.securityfocus.com/bid/29101 - http://lists.gnu.org/archive/html/qemu-devel/2008-04/msg00675.
2008-0194.html - http://www.securityfocus.com/bid/29101 - http://lists.gnu.org/archive/html/qemu-devel/2008-04/msg00675.html - http://www.mandriva.com/security/advisories?name=MDVSA-2008:162 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11021 - http://www.ubuntu.com/usn/usn-776-1 - http://svn.savannah.gnu.org/viewvc/?view=rev&root=qemu&revision=4277 - http://secunia.com/advisories/29963 - http://secunia.com/advisories/29129 - http://secunia.com/advisories/30111 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42268 - http://www.novell.com/linux/security/advisories/2008_13_sr.html - http://secunia.com/advisories/30717
CVE ID: CVE-2008-2005 State: PUBLISHED Published: 2008-05-06T15:00:00 Last Updated: 2024-08-07T08:41:00.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary code via a large length value in a Registration packet to TCP port 5413, which causes a memory allocation failure. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/596268 - http://www.coresecurity.com/?action=item&id=2187 - https://ex
ner: References: - http://www.kb.cert.org/vuls/id/596268 - http://www.coresecurity.com/?action=item&id=2187 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42221 - http://www.securityfocus.com/bid/28974 - https://www.exploit-db.com/exploits/6474 - http://www.securitytracker.com/id?1019966 - http://www.securityfocus.com/archive/1/491623/100/0/threaded - http://secunia.com/advisories/30063
CVE ID: CVE-2008-2006 State: PUBLISHED Published: 2008-05-22T10:00:00 Last Updated: 2024-08-07T08:41:00.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a .ics file containing (1) a large 16-bit integer on a TRIGGER line, or (2) a large integer in a COUNT field on an RRULE line. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/1601 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42569 - http://www.secu
ww.vupen.com/english/advisories/2008/1601 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42569 - http://www.securityfocus.com/bid/28632 - http://www.coresecurity.com/?action=item&id=2219 - http://www.securityfocus.com/archive/1/492682/100/0/threaded - http://www.securityfocus.com/archive/1/492638/100/100/threaded - http://securityreason.com/securityalert/3901 - http://www.securitytracker.com/id?1020094 - http://www.securityfocus.com/bid/28629 - http://www.securityfocus.com/archive/1/492414/100/0/threaded
CVE ID: CVE-2008-2007 State: REJECTED Published: 2008-05-22T10:00:00 Last Updated: 2008-06-06T09:00:00 Description: No description available.
CVE ID: CVE-2008-2008 State: PUBLISHED Published: 2008-04-29T10:00:00 Last Updated: 2024-08-07T08:41:00.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Display Names message feature in Cerulean Studios Trillian Basic and Pro 3.1.9.0 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long nickname in an MSN protocol message. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/29952 - http://securityreason.com/securityalert/3849 - http://www.securityfocus.com/bid/28925 - http://www.vupen.com/english/advisories/2008/1368/references - http://www.securityfocus.com/archive/1/
s.com/bid/28925 - http://www.vupen.com/english/advisories/2008/1368/references - http://www.securityfocus.com/archive/1/491281/100/0/threaded
CVE ID: CVE-2008-2009 State: PUBLISHED Published: 2008-05-16T06:54:00 Last Updated: 2024-08-07T08:41:00.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=444443 - http://www.redhat.com/support/errata/RHSA-2008-0271.html - http://www.securitytracker.com/id?1020029 - http://www.ubuntu.com/usn/USN-861-1 - http://www.
rata/RHSA-2008-0271.html - http://www.securitytracker.com/id?1020029 - http://www.ubuntu.com/usn/USN-861-1 - http://www.vupen.com/english/advisories/2008/1510/references - http://secunia.com/advisories/30247 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42521
CVE ID: CVE-2008-2010 State: PUBLISHED Published: 2008-04-29T23:00:00 Last Updated: 2024-08-07T08:41:00.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Apple QuickTime Player on Windows XP SP2 and Vista SP1 allows remote attackers to execute arbitrary code via a crafted QuickTime media file. NOTE: as of 20080429, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/42098 - http://www.gnucitizen.or
E Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/42098 - http://www.gnucitizen.org/blog/quicktime-0day-for-vista-and-xp/ - http://www.securitytracker.com/id?1019950 - http://www.securityfocus.com/bid/28959
CVE ID: CVE-2008-2011 State: PUBLISHED Published: 2008-04-29T23:00:00 Last Updated: 2024-08-07T08:41:00.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the National Rail Enquiries Live Departure Boards gadget before 1.1 allows remote National Rail Enquiries servers or man-in-the-middle attackers to inject arbitrary web script or HTML, and execute arbitrary code, via a response body, as demonstrated by a SCRIPT element that references a vbscript: URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28933 - http://www.mwrinfosecurity.com/publications/mwri_national-rail-enquiries-gadget
http://www.securityfocus.com/bid/28933 - http://www.mwrinfosecurity.com/publications/mwri_national-rail-enquiries-gadget-advisory_2008-04-24.pdf - http://www.mwrinfosecurity.com/news/1690.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/42043
CVE ID: CVE-2008-2012 State: PUBLISHED Published: 2008-04-30T00:00:00 Last Updated: 2024-08-07T08:41:00.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in the PostSchedule 1.0 module for PostNuke allows remote attackers to execute arbitrary SQL commands via the eid parameter in an event action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28931 - https://www.exploit-db.com/exploits/5495 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42010
CVE ID: CVE-2008-2013 State: PUBLISHED Published: 2008-04-30T00:00:00 Last Updated: 2024-08-07T08:41:00.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in the pnFlashGames 1.5 through 2.5 module for PostNuke, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a display action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28948 - https://www.exploit-db.com/exploits/5500 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42019
CVE ID: CVE-2008-2014 State: PUBLISHED Published: 2008-04-30T01:00:00 Last Updated: 2024-08-07T08:41:00.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox 3.0 beta 5 allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls document.write in an infinite loop. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/491354/100/0/threaded - http://securityreason.com/securityalert/3835 - http://www.securityfocus.com/archive/1/491355/100/0/threaded - http://www.securityfocus.com/archive/1/491197/100/0/threaded - http://es.geocities.com/jplopezy/pruebamozilla.html - http://www
www.securityfocus.com/archive/1/491197/100/0/threaded - http://es.geocities.com/jplopezy/pruebamozilla.html - http://www.securityfocus.com/archive/1/491196/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/42154
CVE ID: CVE-2008-2015 State: PUBLISHED Published: 2008-04-30T01:00:00 Last Updated: 2024-08-07T08:41:00.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) CompactSave and (2) SaveSession method in one control, and the (3) saveRecordedExploreToFile method in a different control. NOTE: this can be leveraged for code execution by writing to a Startup folder. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/5496 - http://www
. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/5496 - http://www.securityfocus.com/bid/28940 - http://www.securitytracker.com/id?1019948 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42077
CVE ID: CVE-2008-2016 State: PUBLISHED Published: 2008-04-30T01:00:00 Last Updated: 2024-08-07T08:41:00.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter to the default URI under install/. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/491369/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/42144 - http://secur
ityfocus.com/archive/1/491369/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/42144 - http://securityreason.com/securityalert/3837
CVE ID: CVE-2008-2017 State: PUBLISHED Published: 2008-04-30T01:00:00 Last Updated: 2024-08-07T08:41:00.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the operation parameter to the default URI under install/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/491369/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/42144 - http://securityreason.com/securityalert/3837
CVE ID: CVE-2008-2018 State: PUBLISHED Published: 2008-04-30T01:00:00 Last Updated: 2024-08-07T08:41:00.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '{' and '}' characters, which allows remote authenticated users to obtain sensitive information via a comment containing a macro, as demonstrated by a "{user.password}" comment in the profile of the admin user. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/42143 - http://www.securityfocus.com/bid/28954 - https://www.exploit-db.c
//exchange.xforce.ibmcloud.com/vulnerabilities/42143 - http://www.securityfocus.com/bid/28954 - https://www.exploit-db.com/exploits/5506
CVE ID: CVE-2008-2019 State: PUBLISHED Published: 2008-04-30T01:00:00 Last Updated: 2024-08-07T08:41:00.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple Machines Forum (SMF), probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file (aka audio) CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances. NOTE: this issue reportedly exists because of an insufficient fix for CVE-2007-3308. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/42150 - http://securityreason.com/securityalert/3836 - http://www.
https://exchange.xforce.ibmcloud.com/vulnerabilities/42150 - http://securityreason.com/securityalert/3836 - http://www.securityfocus.com/bid/28866 - http://www.securityfocus.com/archive/1/491128/100/0/threaded - http://www.rooksecurity.com/blog/?p=6 - http://www.simplemachines.org/community/index.php?P=c3696c2022b54fa50c5f341bf5710aa3&topic=236816.0
CVE ID: CVE-2008-2020 State: PUBLISHED Published: 2008-04-30T01:00:00 Last Updated: 2024-08-07T08:41:00.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux 2.3, (5) e107 0.7.11, (6) WebZE 0.5.9, (7) Open Media Collectors Database (aka OpenDb) 1.5.0b4, and (8) Labgab 1.1 uses a code_bg.jpg background image and the PHP ImageString function in a way that produces an insufficient number of different images, which allows remote attackers to pass the CAPTCHA test via an automated attack using a table of all po
different images, which allows remote attackers to pass the CAPTCHA test via an automated attack using a table of all possible image checksums and their corresponding digit strings. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/491127/100/0/threaded - http://securityreason.com/securityalert/3834 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42152 - http://www.securityfocus.com/bid/28877 - http://www.rooksecurity.com/blog/?p=6
CVE ID: CVE-2008-2021 State: PUBLISHED Published: 2008-04-30T10:00:00 Last Updated: 2024-08-07T08:41:00.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in Lhaplus before 1.57 allows remote attackers to execute arbitrary code via a long comment field in a ZOO archive. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/1369/references - http://www.fourteenforty.jp/research/advisory.cgi?FFRRA-20080428 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42032 - http://jvn.jp/jp/JVN%2374468481/index.html - http://www7a.biglobe.ne.jp/~schezo/ - http://secunia.com/advisories/29972 - http://www.s
/jp/JVN%2374468481/index.html - http://www7a.biglobe.ne.jp/~schezo/ - http://secunia.com/advisories/29972 - http://www.securityfocus.com/bid/28953
CVE ID: CVE-2008-2022 State: PUBLISHED Published: 2008-04-30T10:00:00 Last Updated: 2024-08-07T08:41:00.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mulatiple cross-site scripting (XSS) vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) toid parameter to send-private-message.asp and the (2) redirect parameter to admin/impersonate.asp. NOTE: vector 2 requires authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/5507 - http://secunia.com/advisories/29979 - http://www.bugreport.ir/?/37 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42040 -
cunia.com/advisories/29979 - http://www.bugreport.ir/?/37 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42040 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42042 - http://www.securityfocus.com/bid/28961