Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2008-6878 State: PUBLISHED Published: 2009-07-27T14:22:00 Last Updated: 2024-08-07T11:49:00.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/31039 - http://www.attrition.org/pipermail/
Notes: - CVE Program Container: References: - http://secunia.com/advisories/31039 - http://www.attrition.org/pipermail/vim/2008-July/002028.html - http://www.zen-cart.com/forum/showthread.php?t=102802 - https://www.exploit-db.com/exploits/6038 - http://www.securityfocus.com/bid/30179 - http://osvdb.org/46913
CVE ID: CVE-2008-6879 State: PUBLISHED Published: 2009-07-30T19:00:00Z Last Updated: 2024-09-17T04:14:44.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/31523 - http://osvdb.org/51151 - http://svn.apache.org/viewvc?view=rev&revision=668737 - http://www.securityfocus.com/bid/33110 - http://issues.apache.org/roller/browse/ROL-1766
CVE ID: CVE-2008-6880 State: PUBLISHED Published: 2009-07-30T19:00:00 Last Updated: 2024-08-07T11:49:02.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in joke.php in EasySiteNetwork Free Jokes Website allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32908 - http://www.securityfocus.com/archive/1/499351/100/0/threaded - http://osvdb.org/52032 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47468
CVE ID: CVE-2008-6881 State: PUBLISHED Published: 2009-07-30T19:00:00 Last Updated: 2024-08-07T11:49:02.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Live Chat (com_livechat) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the last parameter to (1) getChat.php, (2) getChatRoom.php, and (3) getSavedChatRooms.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32803 - https://www.exploit-db.com/exploits/7441 - http://secunia.com/advisories/33122 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47304
CVE ID: CVE-2008-6882 State: PUBLISHED Published: 2009-07-30T19:00:00 Last Updated: 2024-08-07T11:49:02.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32803 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47305 - https://www.exploit-db.com/exploits/7441
CVE ID: CVE-2008-6883 State: PUBLISHED Published: 2009-07-30T19:08:00 Last Updated: 2024-08-07T11:49:02.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the last parameter to getChatRoom.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32803 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52442 - https://www.exploit-db.com/exploits/7441 - http://secunia.com/a
s://exchange.xforce.ibmcloud.com/vulnerabilities/52442 - https://www.exploit-db.com/exploits/7441 - http://secunia.com/advisories/33122 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47304
CVE ID: CVE-2008-6884 State: PUBLISHED Published: 2009-07-31T20:00:00 Last Updated: 2024-08-07T11:49:02.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in XOOPS 2.3.1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsConfig[language] parameter to (1) blocks.php and (2) main.php in xoops_lib/modules/protector/. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/50573 - http://www.securityfocus.com/bid/32685 - http://secunia.com/advisories/33048 - https://www.exploit-db.com/exploits/7380 - http://www.xoops.org/modules/ne
32685 - http://secunia.com/advisories/33048 - https://www.exploit-db.com/exploits/7380 - http://www.xoops.org/modules/news/article.php?storyid=4563 - http://marc.info/?l=bugtraq&m=122875395329794&w=2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47153 - http://www.xoops.org/modules/news/article.php?storyid=4540 - http://osvdb.org/50572
CVE ID: CVE-2008-6885 State: PUBLISHED Published: 2009-07-31T20:00:00Z Last Updated: 2024-09-17T02:16:11.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in pmlite.php in XOOPS 2.3.1 and 2.3.2a allows remote attackers to inject arbitrary web script or HTML via a STYLE attribute in a URL BBcode tag in a private message. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=122875449930810&w=2 - http://www.securityfocus.com/bid/32685 - http://secunia.com/advisories/33048 - http://www.osvdb.org/50574 - http://www.xoops.org/modules/news/article.php?storyid=4563 - http://www.xoops.org/modules/news/art
www.osvdb.org/50574 - http://www.xoops.org/modules/news/article.php?storyid=4563 - http://www.xoops.org/modules/news/article.php?storyid=4540
CVE ID: CVE-2008-6886 State: PUBLISHED Published: 2009-08-03T14:00:00 Last Updated: 2024-08-07T11:49:01.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=122765140110581&w=2 - http://www.secfault.org/?p=78 - http://www.osvdb.org/50273 - http://www.securityfocus.com/bid/32473 - http://secunia.com/advisories/32883 - https://exchange.xforce.ibmcloud.com/vul
http://www.securityfocus.com/bid/32473 - http://secunia.com/advisories/32883 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46884 - http://www.vupen.com/english/advisories/2008/3288
CVE ID: CVE-2008-6887 State: PUBLISHED Published: 2009-08-03T14:00:00 Last Updated: 2024-08-07T11:49:01.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in detailad.asp in Pre Classified Listings 1.0 allows remote attackers to execute arbitrary SQL commands via the siteid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/0812-exploits/preclass-sqlxss.txt - http://www.securityfocus.com/bid/32566 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47006
CVE ID: CVE-2008-6888 State: PUBLISHED Published: 2009-08-03T14:00:00 Last Updated: 2024-08-07T11:49:02.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in signup.asp in Pre Classified Listings 1.0 allows remote attackers to inject arbitrary web script or HTML via the address parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47005 - http://packetstormsecurity.org/0812-exploits/preclass-sqlxss.txt - http://www.securityfocus.com/bid/32567
CVE ID: CVE-2008-6889 State: PUBLISHED Published: 2009-08-03T14:00:00 Last Updated: 2024-08-07T11:49:02.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Merchantsadd.asp in ASPReferral 5.3 allows remote attackers to execute arbitrary SQL commands via the AccountID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7274 - http://www.securityfocus.com/bid/32534 - http://secunia.com/advisories/32928 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46957 - http://www.osvdb.org/50379
CVE ID: CVE-2008-6890 State: PUBLISHED Published: 2009-08-03T14:00:00 Last Updated: 2024-08-07T11:49:02.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in messages.asp in ASP Forum Script allows remote attackers to execute arbitrary SQL commands via the message_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47000 - http://www.securityfocus.com/bid/32571 - http://packetstormsecurity.org/0812-exploits/aspforum-cmsqlxss.txt
CVE ID: CVE-2008-6891 State: PUBLISHED Published: 2009-08-03T14:00:00 Last Updated: 2024-08-07T11:49:02.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ASP Forum Script allow remote attackers to inject arbitrary web script or HTML via the (1) forum_id parameter to (a) new_message.asp and (b) messages.asp, and the (2) query string to default.asp. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47002 - http://www.securityfocus.com/bid/32571 - http://packetstormsecurity.org/0812-exploits/aspforum-cmsqlxss.txt
CVE ID: CVE-2008-6892 State: PUBLISHED Published: 2009-08-03T18:00:00 Last Updated: 2024-08-07T11:49:02.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in lire/index.php in Peel 3.1 allows remote attackers to execute arbitrary SQL commands via the rubid parameter. NOTE: this might be the same issue as CVE-2005-3572. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33073 - http://osvdb.org/50604 - http://www.securityfocus.com/bid/32715 - https://www.exploit-db.com/exploits/7395
CVE ID: CVE-2008-6893 State: PUBLISHED Published: 2009-08-03T18:00:00 Last Updated: 2024-08-07T11:49:02.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Alt-N MDaemon WorldClient 10.0.2, when Internet Explorer 7 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted img tag. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/50648 - http://www.securityfocus.com/bid/32776 - http://secunia.com/advisories/32885 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47209 - http://files.altn.com/MDaemon/Release/RelNotes_en.txt
CVE ID: CVE-2008-6894 State: PUBLISHED Published: 2009-08-03T18:00:00 Last Updated: 2024-08-07T11:49:02.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fName and (2) fPassword parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32709 - http://secunia.com/advisories/33060 - http://marc.info/?l=full-disclosure&m=122868146707468&w=2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47167 - http://osvdb.org/50599
CVE ID: CVE-2008-6895 State: PUBLISHED Published: 2009-08-03T18:00:00 Last Updated: 2024-08-07T11:49:02.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: 3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demonstrated by vulnerability scans from Nessus or SAINT. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52450 - http://marc.info/?l=full-disclosure&m=122868146707468&w=2
CVE ID: CVE-2008-6896 State: PUBLISHED Published: 2009-08-03T18:00:00 Last Updated: 2024-08-07T11:49:02.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=full-disclosure&m=122868146707468&w=2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52452
CVE ID: CVE-2008-6897 State: PUBLISHED Published: 2009-08-05T22:00:00 Last Updated: 2024-08-07T11:49:02.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in Getleft.exe in Andres Garcia Getleft 1.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) "a" HTML tag; a long src attribute in (2) embed, (3) img, or (4) script tags; (5) a long background attribute in a body tag; and other unspecified tags. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7564 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47597 - http://www.securityfocus.com/
xploit-db.com/exploits/7564 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47597 - http://www.securityfocus.com/bid/32994
CVE ID: CVE-2008-6898 State: PUBLISHED Published: 2009-08-05T22:00:00 Last Updated: 2024-08-07T11:49:02.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the XHTTP Module 4.1.0.0 in the ActiveX control for SaschArt SasCam Webcam Server 2.6.5 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long argument to the Get method and other unspecified methods. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47654 - http://www.securityfocus.com/bid/33053 - http://www.exploit-db.com/exploits/14195 - https://www.exploit-db.com/exploits/7617
CVE ID: CVE-2008-6899 State: PUBLISHED Published: 2009-08-05T22:00:00 Last Updated: 2024-08-07T11:49:02.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in freeSSHd 1.2.1 allow remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a long (1) open, (2) unlink, (3) mkdir, (4) rmdir, or (5) stat SFTP command. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52434 - http://www.securityfocus.com/bid/32972 - http://www.bmgsec.com.au/advisories/freeSSHd-bof.txt - http://www.securityfocus.com/archive/1/499486/100/0/threaded
CVE ID: CVE-2008-6900 State: PUBLISHED Published: 2009-08-06T00:00:00 Last Updated: 2024-08-07T11:49:02.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in "Add Pen/Author Name" feature in addpen.php in AvailScript Article Script allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in photos/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32821 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47374 - http://secunia.com/advisories/31816 - https://www.exploit-db.com/exploits/74
xforce.ibmcloud.com/vulnerabilities/47374 - http://secunia.com/advisories/31816 - https://www.exploit-db.com/exploits/7456
CVE ID: CVE-2008-6901 State: PUBLISHED Published: 2009-08-06T00:00:00 Last Updated: 2024-08-07T11:49:02.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in 2532designs 2532|Gigs 1.2.2 Stable, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to (1) settings.php, (2) deleteuser.php, (3) mini_calendar.php, (4) manage_venues.php, and (5) manage_gigs.php, a different vector than CVE-2007-4585. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7510 - http://ww
5. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7510 - http://www.securityfocus.com/bid/32911 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47465 - http://secunia.com/advisories/26585
CVE ID: CVE-2008-6902 State: PUBLISHED Published: 2009-08-06T00:00:00 Last Updated: 2024-08-07T11:49:02.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in upload_flyer.php in 2532designs 2532|Gigs 1.2.2 Stable allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in flyers/. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7510 - http://www.securityfocus.com/bid/32911 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47466 - http://secunia.com/advisories/26585
CVE ID: CVE-2008-6903 State: PUBLISHED Published: 2009-08-06T00:00:00 Last Updated: 2024-08-07T11:49:02.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sophos Anti-Virus for Windows before 7.6.3, Anti-Virus for Windows NT/9x before 4.7.18, Anti-Virus for OS X before 4.9.18, Anti-Virus for Linux before 6.4.5, Anti-Virus for UNIX before 7.0.5, Anti-Virus for Unix and Netware before 4.37.0, Sophos EM Library, and Sophos small business solutions, when CAB archive scanning is enabled, allows remote attackers to cause a denial of service (segmentation fault) via a "fuzzed" CAB archive file, as demonstrated by the OUSPG PROTOS GENOME test suite for Archive Formats. Additional Analys
"fuzzed" CAB archive file, as demonstrated by the OUSPG PROTOS GENOME test suite for Archive Formats. Additional Analyst Notes: - CVE Program Container: References: - http://www.ivizsecurity.com/security-advisory-iviz-sr-08015.html - http://secunia.com/advisories/33177 - http://www.sophos.com/support/knowledgebase/article/50611.html - http://www.securitytracker.com/id?1021476 - http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html - http://marc.info/?l=bugtraq&m=122893252316489&w=2 - http://www.vupen.com/english/advisories/2008/3458 - http://osvdb.org/50863 - http://www.securityfocus.com/bid/32748
CVE ID: CVE-2008-6904 State: PUBLISHED Published: 2009-08-06T01:00:00 Last Updated: 2024-08-07T11:49:02.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Sophos SAVScan 4.33.0 for Linux, and possibly other products and versions, allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via crafted files that have been packed with (1) armadillo, (2) asprotect, or (3) asprotectSKE. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52443 - http://www.ivizsecurity.com/security-advisory-iviz-sr-08015.html - http://www.sophos.c
cloud.com/vulnerabilities/52443 - http://www.ivizsecurity.com/security-advisory-iviz-sr-08015.html - http://www.sophos.com/support/knowledgebase/article/50611.html - http://marc.info/?l=bugtraq&m=122893252316489&w=2 - http://www.securityfocus.com/bid/32748
CVE ID: CVE-2008-6905 State: PUBLISHED Published: 2009-08-06T17:00:00 Last Updated: 2024-08-07T11:49:02.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in index.php in BabbleBoard 1.1.6 allows remote authenticated users to hijack the authentication of administrators for requests that delete (1) categories or (2) groups; (3) ban users; or (4) delete users via the admin page. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33174 - http://osvdb.org/50721 - https://www.exploit-db.com/exploits/7475 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47396
CVE ID: CVE-2008-6906 State: PUBLISHED Published: 2009-08-06T17:00:00 Last Updated: 2024-08-07T11:49:02.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in BabbleBoard 1.1.6 allows remote attackers to inject arbitrary web script or HTML via the username. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47403 - https://www.exploit-db.com/exploits/7475 - http://www.securityfocus.com/bid/32840
CVE ID: CVE-2008-6907 State: PUBLISHED Published: 2009-08-06T17:00:00 Last Updated: 2024-08-07T11:49:02.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in checkuser.php in 2532designs 2532|Gigs 1.2.2 Stable, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, as accessible from a form generated by index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7511 - http://secunia.com/advisories/26585 - http://www.securityfocus.com/bid/32913 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47491
CVE ID: CVE-2008-6908 State: PUBLISHED Published: 2009-08-06T17:00:00 Last Updated: 2024-08-07T11:49:02.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, uses an insecure hash when signing requests, which allows remote attackers to impersonate other users and gain privileges. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/50743 - http://www.securityfocus.com/bid/32894 - http://drupal.org/node/348295 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47458
CVE ID: CVE-2008-6909 State: PUBLISHED Published: 2009-08-06T18:00:00 Last Updated: 2024-08-07T11:49:02.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52438 - http://osvdb.org/50743 - http://www.securityfocus.com/bid/32894 - http://drupal.org/node/348295 - https://exc
es/52438 - http://osvdb.org/50743 - http://www.securityfocus.com/bid/32894 - http://drupal.org/node/348295 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47458
CVE ID: CVE-2008-6910 State: PUBLISHED Published: 2009-08-06T18:00:00 Last Updated: 2024-08-07T11:49:02.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/50743 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52441 - http://www.securityfocus.com/bid/32894 - http://drupal.org/node/348295