Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2008-7122 State: PUBLISHED Published: 2009-08-31T10:00:00 Last Updated: 2024-08-07T11:56:14.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple insecure method vulnerabilities in an ActiveX control in (epRegPro.ocx) in Evans Programming Registry Pro allow remote attackers to read and modify sensitive registry keys via the (1) About, (2) CreateKey, (3) DeleteBranch, (4) DeleteKey, (5) DeleteValue, (6) EnumKeys, (7) EnumValues, (8) QueryType, (9) QueryValue, (10) RenameKey, and (11) SetValue methods. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/5271 - http://www.securityfocus.com/bid/28287
CVE ID: CVE-2008-7123 State: PUBLISHED Published: 2009-08-31T10:00:00 Last Updated: 2024-08-07T11:56:14.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte (%00) in the login parameter in an ajout action, which bypasses the regular expression check. Additional Analyst Notes: - CVE Program Container: References: - http://www.zkup.fr/actualite-zkup/maj-critique-v203v204.html - http://osvdb.org/43082 - https://www.exploit-db.com/exploits/5220 - http://secunia.com/advisories/29276 - http://www
l - http://osvdb.org/43082 - https://www.exploit-db.com/exploits/5220 - http://secunia.com/advisories/29276 - http://www.securityfocus.com/bid/28149
CVE ID: CVE-2008-7124 State: PUBLISHED Published: 2009-08-31T10:00:00 Last Updated: 2024-08-07T11:56:14.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator. Additional Analyst Notes: - CVE Program Container: References: - http://www.zkup.fr/actualite-zkup/maj-critique-v203v204.html - http://osvdb.org/43081 - https://www.exploit-db.com/exploits/5220 - http://secunia.com/advisories/29276 - http://www.securityfocus.com/bid/28149 - https://www.exp
it-db.com/exploits/5220 - http://secunia.com/advisories/29276 - http://www.securityfocus.com/bid/28149 - https://www.exploit-db.com/exploits/5219 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41068
CVE ID: CVE-2008-7125 State: PUBLISHED Published: 2009-08-31T10:00:00 Last Updated: 2024-08-07T11:56:14.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: pphoto in Ariadne before 2.6 allows remote authenticated users with certain privileges to execute arbitrary shell commands via vectors related to PINP programs and the annotate command. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/40989 - http://osvdb.org/43055 - http://www.securityfocus.com/bid/28093 - http://www.ariadne-cms.org/download/changes/ - http://secunia.com/advisories/29191
CVE ID: CVE-2008-7126 State: PUBLISHED Published: 2009-08-31T10:00:00 Last Updated: 2024-08-07T11:56:14.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet with a large string length value to UDP port 14000, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/43057 - https://exchange.xforce.ibmcloud.com/vulnerabilities/40978 - http://aluigi.altervista.org/adv/visibroken-adv.txt - http://archives.neo
ge.xforce.ibmcloud.com/vulnerabilities/40978 - http://aluigi.altervista.org/adv/visibroken-adv.txt - http://archives.neohapsis.com/archives/fulldisclosure/2008-03/0018.html - http://secunia.com/advisories/29213 - http://www.vupen.com/english/advisories/2008/0748/references - http://www.securityfocus.com/bid/28084
CVE ID: CVE-2008-7127 State: PUBLISHED Published: 2009-08-31T10:00:00 Last Updated: 2024-08-07T11:56:14.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) via a crafted packet with a large string length value to UDP port 14000, which triggers a memory allocation failure that is not properly handled. Additional Analyst Notes: - CVE Program Container: References: - http://aluigi.altervista.org/adv/visibroken-adv.txt - http://archives.neohapsis.com/archives/fulldisclosure/2008-03/0018.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/40983
es.neohapsis.com/archives/fulldisclosure/2008-03/0018.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/40983 - http://osvdb.org/43058 - http://secunia.com/advisories/29213 - http://www.vupen.com/english/advisories/2008/0748/references - http://www.securityfocus.com/bid/28084
CVE ID: CVE-2008-7128 State: PUBLISHED Published: 2009-08-31T10:00:00 Last Updated: 2024-08-07T11:56:14.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/0917/references - https://exchange.xforce.ibmcloud.com/vulnerabilities/41253 - http://polarssl.org/?archive#001c
CVE ID: CVE-2008-7129 State: PUBLISHED Published: 2009-08-31T10:00:00 Last Updated: 2024-08-07T11:56:14.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: XySSL before 0.9 allows remote attackers to cause a denial of service (infinite loop) via an X.509 certificate that does not pass the RSA signature check during verification. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/0917 - http://osvdb.org/49101 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41255 - http://polarssl.org/?archive#001c
CVE ID: CVE-2008-7130 State: PUBLISHED Published: 2009-08-31T10:00:00 Last Updated: 2024-08-07T11:56:14.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to upload arbitrary files via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41211 - http://sourceforge.net/forum/forum.php?forum_id=797405 - http://www.securityfocus.com/bid/28253 - http://osvdb.org/43113 - http://secunia.com/advisories/29367
CVE ID: CVE-2008-7131 State: PUBLISHED Published: 2009-08-31T10:00:00 Last Updated: 2024-08-07T11:56:14.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to gain access to a database via a link to a victim who is already connected to the database. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/forum/forum.php?forum_id=797405 - http://osvdb.org/43114 - http://www.securityfocus.com/bid/28253 - http://secunia.com/advisories/29367 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41212
CVE ID: CVE-2008-7132 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in Nuked-Klan 1.3 beta allows remote attackers to inject arbitrary web script or HTML via the nuked_nude parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41591 - http://www.securityfocus.com/bid/28527 - http://downloads.securityfocus.com/vulnerabilities/exploits/28527.html
CVE ID: CVE-2008-7133 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in onlinetools.org EasyImageCatalogue 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) search and (2) d index.php parameters to index.php, (3) dir parameter to thumber.php, and the d parameter to (4) describe.php and (5) addcomment.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.securityfocus.c
ird party information. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.securityfocus.com/vulnerabilities/exploits/28164.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/41187 - http://www.securityfocus.com/bid/28164
CVE ID: CVE-2008-7134 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter, (2) message parameter in a login action, (3) category parameter in a browse action, (4) now parameter, or (5) search parameter in a search_results action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: Re
own; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28219 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41198 - http://download.redgalaxy.net/?nav=home
CVE ID: CVE-2008-7135 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a long argument to the IsChecked method, a different vector than CVE-2008-7136. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41014 - http://www.securiteam.com/exploits/5WP0115NPU.html - http://www.securityfocus.com/bid/28086
CVE ID: CVE-2008-7136 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a long argument to the (1) RequestURL, (2) GetPropertyById, or (3) SetPropertyById method, different vectors than CVE-2008-7135. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28118 - http://www.securiteam.com/exploits/5WP0115NPU.html - https://www.exploit-db.com/exploits/5217
CVE ID: CVE-2008-7137 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: WS-Proxy in Eye-Fi 1.1.2 allows remote attackers to cause a denial of service (crash) via an empty query string to port 59278 and other unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28085 - http://osvdb.org/42720 - http://www.securityfocus.com/archive/1/489045/100/0/threaded - http://www.informit.com/articles/article.aspx?p=1177111&seqNum=3 - http://secunia.com/advisories/29221 - https://exchange.xforce.ibmcloud.com/vulnerabilities/40996
CVE ID: CVE-2008-7138 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Manager in Eye-Fi 1.1.2 generates predictable snonce values based on the time of day, which allows remote attackers to bypass authentication and upload arbitrary images by guessing the snonce. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28085 - http://www.securityfocus.com/archive/1/489045/100/0/threaded - http://secunia.com/advisories/29221 - http://osvdb.org/42719 - http://www.informit.com/articles/article.aspx?p=1177111&seqNum=2
CVE ID: CVE-2008-7139 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in WS-Proxy in Eye-Fi 1.1.2 allow remote attackers to hijack the authentication of users for requests that modify configuration via a SOAPAction parameter of (1) urn:SetOptions for autostart, (2) urn:SetDesktopSync for file upload, or (3) urn:SetFolderConfig for file download location or modification of authentication credentials; and (4) urn:AddNetwork for adding an arbitrary Service Set Identifier (SSID) to hijack the image upload. Additional Analyst Notes: - CVE Pro
rk for adding an arbitrary Service Set Identifier (SSID) to hijack the image upload. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28085 - http://www.securityfocus.com/archive/1/489045/100/0/threaded - http://www.informit.com/articles/article.aspx?p=1177111 - http://secunia.com/advisories/29221 - https://exchange.xforce.ibmcloud.com/vulnerabilities/40995 - http://osvdb.org/42718
CVE ID: CVE-2008-7140 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in @lex Guestbook 4.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) language_setup parameter to setup.php or (2) test parameter to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: a third party has been reported that the test parameter is not used in @lex Guestbook. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.securi
is not used in @lex Guestbook. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.securityfocus.com/vulnerabilities/exploits/28519.html - http://www.juniper.net/security/auto/vulnerabilities/vuln28519.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/41566 - http://www.securityfocus.com/bid/28519
CVE ID: CVE-2008-7141 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in setup.php in @lex Poll 2.1 allows remote attackers to inject arbitrary web script or HTML via the language_setup parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41564 - http://www.securityfocus.com/bid/28520 - http://downloads.securityfocus.com/vulnerabilities/exploits/28520.html
CVE ID: CVE-2008-7142 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary directories via the showtree parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/489747/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/41266 - http://osvdb.org/51582 - http://www.securityfocus.com/bid/28300/exploit - http://www.securityfocus.com/bid/28300
CVE ID: CVE-2008-7143 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/51121 - http://www.securityfocus.com/archive/1/489815/100/0/threaded
CVE ID: CVE-2008-7144 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in RARLAB WinRAR before 3.71 have unknown impact and attack vectors related to crafted (1) ACE, (2) ARJ, (3) BZ2, (4) CAB, (5) GZ, (6) LHA, (7) RAR, (8) TAR, or (9) ZIP files, as demonstrated by the OUSPG PROTOS GENOME test suite for Archive Formats. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/29407 - http://osvdb.org/43439 - http://www.vupen.com/english/advisories/2008/0916/references - http://www.cert.fi/haavoittuvuudet/joint-advisory-arc
9 - http://www.vupen.com/english/advisories/2008/0916/references - http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/41251 - http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/
CVE ID: CVE-2008-7145 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in index.php in CoronaMatrix phpAddressBook 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28456 - http://www.securityfocus.com/archive/1/490097/100/0/threaded - http://osvdb.org/51050
CVE ID: CVE-2008-7146 State: PUBLISHED Published: 2009-09-01T16:00:00Z Last Updated: 2024-09-17T02:05:38.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: IntraLearn Software IntraLearn 2.1, and possibly other versions before 4.2.3, allows remote attackers to obtain sensitive information via a direct request to (1) Knowledge_Impact_Course.htm, (2) LRN-formatted_Course.htm, or (3) Create_Course.htm in help/1/Instructor/, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/42993 - http://osvdb.org/42992 - http://osvdb.org/ref/42/intralearn-21-multiple.txt - http://osvdb.org/42991
CVE ID: CVE-2008-7147 State: PUBLISHED Published: 2009-09-01T16:00:00Z Last Updated: 2024-09-16T23:51:44.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in IntraLearn Software IntraLearn 2.1, and possibly other versions before 4.2.3, allow remote attackers to inject arbitrary web script or HTML via the (1) outline and (2) course parameters to library/description_link.cfm, or the (3) records_to_display and (4) the_start parameters to library/courses_catalog.cfm. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/42989 - http://osvdb.org/ref/42/intralearn-21-multiple.txt - http://osvdb.org/42988
CVE ID: CVE-2008-7148 State: PUBLISHED Published: 2009-09-01T16:00:00Z Last Updated: 2024-09-16T17:57:58.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Synfig Animation Studio before 0.61.08 allows attackers to execute arbitrary code via a crafted .sif file. Additional Analyst Notes: - CVE Program Container: References: - http://synfig.org/Releases/0.61.08 - http://osvdb.org/48854
CVE ID: CVE-2008-7149 State: PUBLISHED Published: 2009-09-01T16:00:00Z Last Updated: 2024-09-16T17:48:56.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in AgileWiki before 0.10.1 has unknown impact and attack vectors related to passwords. Additional Analyst Notes: - CVE Program Container: References: - http://freshmeat.net/projects/agilewiki/releases/273210 - http://osvdb.org/43171
CVE ID: CVE-2008-7150 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Refine by Taxonomy 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a taxonomy term, which is not properly handled by refine_by_taxo when displaying tags. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41035 - http://drupal.org/node/230460 - http://drupal.org/node/230470
CVE ID: CVE-2008-7151 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Live 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to hijack the authentication of unspecified privileged users for requests that can be leveraged to execute arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/236607 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41754 - http://drupal.org/node/236609
CVE ID: CVE-2008-7152 State: PUBLISHED Published: 2009-09-01T16:00:00 Last Updated: 2024-08-07T11:56:14.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in Specimen Image Database (SID), when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the dir parameter to (1) client.php or (2) taxonservice.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28142/exploit - http://www.securityfocus.com/bid/28142 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41097
CVE ID: CVE-2008-7153 State: PUBLISHED Published: 2009-09-02T17:00:00 Last Updated: 2024-08-07T11:56:14.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Accept-Language HTTP header. NOTE: this can be leveraged to execute arbitrary PHP code using the INTO DUMPFILE command. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/27211 - http://osvdb.org/40138 - http://www.docebo.org/doceboCms/bugtracker/18_124/bugdetails/appid_24-bugid_198/bugtracker.
1 - http://osvdb.org/40138 - http://www.docebo.org/doceboCms/bugtracker/18_124/bugdetails/appid_24-bugid_198/bugtracker.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/39589 - https://www.exploit-db.com/exploits/4891 - https://www.exploit-db.com/exploits/4879 - http://secunia.com/advisories/28378
CVE ID: CVE-2008-7154 State: PUBLISHED Published: 2009-09-02T17:00:00 Last Updated: 2024-08-07T11:56:14.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docebo 3.5.0.3 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) class/class.conf_fw.php, (2) class.module/class.event_manager.php, (3) lib/lib.domxml5.php, or (4) menu/menu_over.php in doceboCore/; or (5) class/class.conf_cms.php, (6) lib/lib.compose.php, (7) modules/chat/teleskill.php, or (8) class/class.admin_menu_cms.php in doceboCms/; which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://www.docebo.org/