Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2008-6810 State: PUBLISHED Published: 2009-05-17T16:00:00 Last Updated: 2024-08-07T11:42:00.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in admin/checklogin.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allow remote attackers to execute arbitrary SQL commands via the (1) myusername (username) and (2) password parameters. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7263 - http://secunia.com/advisories/32430 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46914
CVE ID: CVE-2008-6811 State: PUBLISHED Published: 2009-05-17T16:00:00 Last Updated: 2024-08-07T11:42:00.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/plugins/wp-shopping-cart/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/31982 - https://www.exploit-db.com/exploits/6867 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46224
CVE ID: CVE-2008-6812 State: PUBLISHED Published: 2009-05-21T18:00:00 Last Updated: 2024-08-07T11:42:00.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in bukutamu.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQL commands via the det parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/5999 - http://www.securityfocus.com/bid/30080 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43683
CVE ID: CVE-2008-6813 State: PUBLISHED Published: 2009-05-21T18:00:00 Last Updated: 2024-08-07T11:42:00.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQL commands via the id_kat parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/43684 - http://www.securityfocus.com/bid/30079 - https://www.exploit-db.com/exploits/5998
CVE ID: CVE-2008-6814 State: PUBLISHED Published: 2009-05-28T14:00:00 Last Updated: 2024-08-07T11:42:00.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in image_upload.php in the SimpleBoard (com_simpleboard) component 1.0.1 and earlier for Mambo allows remote attackers to execute arbitrary code by uploading a file with an executable extension and an image/jpeg content type, then accessing this file via a direct request to the file in components/com_simpleboard/, a different vulnerability than CVE-2006-3528. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46223 - https
Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46223 - https://www.exploit-db.com/exploits/6868 - http://www.securityfocus.com/bid/31981
CVE ID: CVE-2008-6815 State: PUBLISHED Published: 2009-05-28T14:00:00 Last Updated: 2024-08-07T11:42:00.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: mykdownload.php in MyKtools 2.4 does not require administrative authentication, which allows remote attackers to read a database backup by making a direct request, and then sending an unspecified request to the download page for the backup. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46145 - https://www.exploit-db.com/exploits/6855 - http://www.securityfocus.com/bid/31950
CVE ID: CVE-2008-6816 State: PUBLISHED Published: 2009-05-28T14:00:00 Last Updated: 2024-08-07T11:42:00.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: Eaton MGEOPS Network Shutdown Module before 3.10 Build 13 allows remote attackers to execute arbitrary code by adding a custom action to the MGE frontend via pane_actionbutton.php, and then executing this action via exec_action.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.nruns.com/security_advisory_eaton_mge_ops_network_shutdown_module_authentication_bypass.php - https://exchange.xforce.ibmcloud.com/vulnerabilities/46131 - http://download.mgeops.com/install/win32/nsm/release_note_nsm_320.tx
xchange.xforce.ibmcloud.com/vulnerabilities/46131 - http://download.mgeops.com/install/win32/nsm/release_note_nsm_320.txt - http://www.securityfocus.com/archive/1/497824/100/100/threaded - http://www.securityfocus.com/bid/31933 - http://secunia.com/advisories/32456 - http://osvdb.org/50051
CVE ID: CVE-2008-6817 State: PUBLISHED Published: 2009-06-01T14:00:00 Last Updated: 2024-08-07T11:42:00.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mole Group Lastminute Script 4.0 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/43646
CVE ID: CVE-2008-6818 State: PUBLISHED Published: 2009-06-01T14:00:00 Last Updated: 2024-08-07T11:42:00.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/43645
CVE ID: CVE-2008-6819 State: PUBLISHED Published: 2009-06-01T19:00:00Z Last Updated: 2024-09-16T19:41:23.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: win32k.sys in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (system crash) via vectors related to CreateWindow, TranslateMessage, and DispatchMessage, possibly a race condition between threads, a different vulnerability than CVE-2008-1084. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35121 - http://bugtraq.ru/cgi-bin/forum.mcgi?type=sb&b=2&m=152274 - http://www.s
ces: - http://www.securityfocus.com/bid/35121 - http://bugtraq.ru/cgi-bin/forum.mcgi?type=sb&b=2&m=152274 - http://www.securityfocus.com/data/vulnerabilities/exploits/35121.c
CVE ID: CVE-2008-6820 State: PUBLISHED Published: 2009-06-03T20:35:00 Last Updated: 2024-08-07T11:42:00.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: The db2fmp process in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 on Windows runs with "OS privilege," which has unknown impact and attack vectors, a different vulnerability than CVE-2008-3856. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT - http://www.securityfocus.com/bid/31058 - http://www-01.ibm.com/support/docview.wss?uid=swg21318189 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR30227 - http:/
/www-01.ibm.com/support/docview.wss?uid=swg21318189 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR30227 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR30026 - http://osvdb.org/48149 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR30228
CVE ID: CVE-2008-6821 State: PUBLISHED Published: 2009-06-03T20:35:00 Last Updated: 2024-08-07T11:42:00.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the DAS server in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 might allow attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors, a different vulnerability than CVE-2007-3676 and CVE-2008-3853. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT - http://www-01.ibm.com/support/docview.wss?uid=swg21318189 - http://www-01.ibm.com/support/docv
st/db2_v82/APARLIST.TXT - http://www-01.ibm.com/support/docview.wss?uid=swg21318189 - http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22004 - http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22188 - http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22190 - http://secunia.com/advisories/31787 - http://www.securityfocus.com/bid/35408 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51108
CVE ID: CVE-2008-6822 State: PUBLISHED Published: 2009-06-04T16:00:00 Last Updated: 2024-08-07T11:42:00.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in uploadp.php in New Earth Programming Team (NEPT) imgupload (aka Image Uploader) 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and a modified content type, then accessing this file via a direct request, as demonstrated by an upload with an image/jpeg content type. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploi
rd party information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6830 - http://osvdb.org/49428 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46089 - http://www.securityfocus.com/bid/31909 - http://secunia.com/advisories/32412
CVE ID: CVE-2008-6823 State: PUBLISHED Published: 2009-06-04T16:00:00 Last Updated: 2024-08-07T11:42:00.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify the network configuration via certain parameters to goform/formWanTcpipSetup or (2) modify credentials via certain parameters to goform/formPasswordSetup. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilitie
up. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46255 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46256 - http://osvdb.org/49466 - http://www.securityfocus.com/bid/32008 - http://www.osvdb.org/49465 - http://www.securityfocus.com/archive/1/497997/100/0/threaded - https://www.exploit-db.com/exploits/6899 - http://secunia.com/advisories/32421 - http://www.louhinetworks.fi/advisory/alink_081028.txt - http://www.a-link.com/WL54AP3.html
CVE ID: CVE-2008-6824 State: PUBLISHED Published: 2009-06-04T16:00:00 Last Updated: 2024-08-07T11:42:00.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: The management interface on the A-LINK WL54AP3 and WL54AP2 access points has a blank default password for the admin account, which makes it easier for remote attackers to obtain access. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/497997/100/0/threaded - https://www.exploit-db.com/exploits/6899 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51199 - http://www.louhinetworks.fi/advisory/alink_081028.txt
CVE ID: CVE-2008-6825 State: PUBLISHED Published: 2009-06-05T21:00:00 Last Updated: 2024-08-07T11:42:00.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the langChoice parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/43686 - https://www.exploit-db.com/exploits/6026 - http://archives.neohapsis.com/archives/fulldisclosure/2008-07/0101.html - http://www.securityfocus.com/bid/30135 - http://osvdb.org/50421
CVE ID: CVE-2008-6826 State: PUBLISHED Published: 2009-06-08T19:00:00 Last Updated: 2024-08-07T11:42:00.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: dhtml.pl in MHF Media Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter, as demonstrated using the (1) advert_top.htm or (2) advert_login.htm pages. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6845 - http://secunia.com/advisories/32402 - http://www.securityfocus.com/bid/31923 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46121 - http://osvdb.org/49406
CVE ID: CVE-2008-6827 State: PUBLISHED Published: 2009-06-08T19:00:00 Last Updated: 2024-08-07T11:42:00.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1021071 - http://
on. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1021071 - http://marc.info/?l=bugtraq&m=122460544316205&w=2 - http://www.symantec.com/avcenter/security/Content/2008.10.20a.html - http://secunia.com/advisories/31773 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46006 - http://www.vupen.com/english/advisories/2008/2876 - http://osvdb.org/49426 - http://www.insomniasec.com/advisories/ISVA-081020.1.htm - http://www.securityfocus.com/bid/31766
CVE ID: CVE-2008-6828 State: PUBLISHED Published: 2009-06-08T19:00:00 Last Updated: 2024-08-07T11:42:00.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 stores the Application Identity Account password in memory in cleartext, which allows local users to gain privileges and modify clients of the Deployment Solution Server. Additional Analyst Notes: - CVE Program Container: References: - http://securityresponse.symantec.com/avcenter/security/Content/2008.10.20b.html - http://secunia.com/advisories/31773 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46007 - http://www.vupen.com/english/advisories/2008/2876 - htt
3 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46007 - http://www.vupen.com/english/advisories/2008/2876 - http://www.securityfocus.com/bid/31767 - http://www.securitytracker.com/id?1021072
CVE ID: CVE-2008-6829 State: PUBLISHED Published: 2009-06-08T19:00:00 Last Updated: 2024-08-07T11:42:00.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a LIST command that starts with a "/\/" (forward slash, backward slash, forward slash). NOTE: this might be the same issue as CVE-2008-2031. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6834 - http://www.vupen.com/english/advisories/2008/2927
CVE ID: CVE-2008-6830 State: PUBLISHED Published: 2009-06-08T19:00:00 Last Updated: 2024-08-07T11:42:00.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: The disconnection feature in Citrix Web Interface 5.0 and 5.0.1 for Java Application Servers does not properly terminate a user's web interface session, which allows attackers with access to the same browser instance to gain access to the user's Web Interface session. NOTE: the attacker must also have valid credentials to the Web Interface. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46135 - http://osvdb.org/49387 - http://www.vupen.com/english/advisorie
s://exchange.xforce.ibmcloud.com/vulnerabilities/46135 - http://osvdb.org/49387 - http://www.vupen.com/english/advisories/2008/2946 - http://www.securitytracker.com/id?1021110 - http://support.citrix.com/article/CTX118768 - http://secunia.com/advisories/32444 - http://www.securityfocus.com/bid/31943
CVE ID: CVE-2008-6831 State: PUBLISHED Published: 2009-06-08T19:00:00 Last Updated: 2024-08-07T11:42:00.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname (Full Name) parameter in the ViewProfile page or (2) returnUrl parameter in a form, as demonstrated using secure/AddComment!default.jspa (aka "Add Comment"). Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/49415 - http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-10-29 - http://www.securityfocus.c
.org/49415 - http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-10-29 - http://www.securityfocus.com/bid/31967 - http://osvdb.org/49416 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46168 - http://secunia.com/advisories/32113 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46167
CVE ID: CVE-2008-6832 State: PUBLISHED Published: 2009-06-08T19:00:00 Last Updated: 2024-08-07T11:42:00.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46169 - http://www.securityfocus.com/bid/31967 - http://osvdb.org/49417 - http://secunia.com/advisories/32113
CVE ID: CVE-2008-6833 State: PUBLISHED Published: 2009-06-22T20:00:00 Last Updated: 2024-08-07T11:42:00.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a files array element for a blogs action, as demonstrated by the files[0] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/43941 - https://www.exploit-db.com/exploits/6060 - http://osvdb.org/49873 - http://secunia.com/advisories/30930
CVE ID: CVE-2008-6834 State: PUBLISHED Published: 2009-06-22T20:00:00 Last Updated: 2024-08-07T11:42:00.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.01 and 3.01a allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the s parameter to code/commupdate.php in a count action or (2) the heads parameter to code/newsheads.php. NOTE: the blog.php vector is already covered by CVE-2008-3164. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6016
CVE ID: CVE-2008-6835 State: PUBLISHED Published: 2009-06-27T18:00:00Z Last Updated: 2024-09-16T17:15:08.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in OpenID 5.x before 5.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30165 - http://osvdb.org/46938 - http://drupal.org/node/280592 - http://drupal.org/node/280593 - http://secunia.com/advisories/31027
CVE ID: CVE-2008-6836 State: PUBLISHED Published: 2009-06-27T18:00:00Z Last Updated: 2024-09-16T23:51:04.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in OpenID 5.x before 5x.-1.2, a module for Drupal, allows remote attackers to hijack the authentication of unspecified victims to delete OpenID identities via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30165 - http://osvdb.org/46939 - http://drupal.org/node/280592 - http://drupal.org/node/280593 - http://secunia.com/advisories/31027
CVE ID: CVE-2008-6837 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T11:42:00.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Zoph 0.7.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different issue than CVE-2008-3258. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30116 - http://www.securityfocus.com/bid/30116/exploit - https://exchange.xforce.ibmcloud.com/vulnerabilities/43693
CVE ID: CVE-2008-6838 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T11:42:00.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in search.php in Zoph 0.7.2.1 allows remote attackers to inject arbitrary web script or HTML via the _off parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/43691 - http://www.securityfocus.com/bid/30116 - http://www.securityfocus.com/bid/30116/exploit
CVE ID: CVE-2008-6839 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T11:42:00.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in TGS Content Management 0.3.2r2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg and (2) goodmsg parameters to (a) login.php and (b) index.php, and the (3) dir and (4) id parameters to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.securityfocus.com/vulnerabilities/exploits/30157.html -
Notes: - CVE Program Container: References: - http://downloads.securityfocus.com/vulnerabilities/exploits/30157.html - http://www.securityfocus.com/bid/30157 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43708
CVE ID: CVE-2008-6840 State: PUBLISHED Published: 2009-07-01T12:26:00 Last Updated: 2024-08-07T11:42:00.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[pear_dir] parameter to (a) Mail/RFC822.php, (b) Net/Socket.php, (c) XML/Parser.php, (d) XML/Tree.php, (e) Mail/mimeDecode.php, (f) Console/Getopt.php, (g) System.php, (h) Log.php, and (i) File.php in includes/pear/; the CONFIG[pear_dir] parameter to (j) includes/prepend.php, and (k) includes/cachedConfig.php; and the (2) CONFIG[includes] parameter to (l) prepend.php and (m) emai
s/prepend.php, and (k) includes/cachedConfig.php; and the (2) CONFIG[includes] parameter to (l) prepend.php and (m) email.list.search.php in includes/. NOTE: the CONFIG[pear_dir] parameter to includes/mailaccess/pop3.php is already covered by CVE-2006-2666. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30162 - http://packetstormsecurity.org/0807-exploits/vwebmail-rfi.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/46680