Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2008-4668 State: PUBLISHED Published: 2008-10-22T10:00:00 Last Updated: 2024-08-07T10:24:20.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/45490 - https://www.exploit-db.com/exploits/6618 - http://www.securityfocus.com/bid/31458 - http://securityreason.com/securityalert/4464
CVE ID: CVE-2008-4669 State: PUBLISHED Published: 2008-10-22T10:00:00 Last Updated: 2024-08-07T10:24:20.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in search.php in Dan Fletcher Recipe Script allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/31442/exploit - https://exchange.xforce.ibmcloud.com/vulnerabilities/45489 - http://www.securityfocus.com/bid/31442
CVE ID: CVE-2008-4670 State: PUBLISHED Published: 2008-10-22T10:00:00 Last Updated: 2024-08-07T10:24:20.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in search.php in Ed Pudol Clickbank Portal allows remote attackers to inject arbitrary web script or HTML via the search box. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/45483 - http://www.securityfocus.com/bid/31438 - http://www.securityfocus.com/bid/31438/exploit
CVE ID: CVE-2008-4671 State: PUBLISHED Published: 2008-10-22T10:00:00 Last Updated: 2024-08-07T10:24:20.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in wp-admin/wp-blogs.php in Wordpress MU (WPMU) before 2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) s and (2) ip_address parameters. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/45512 - http://secunia.com/advisories/32060 - http://www.securityfocus.com/bid/31482 - http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064748.html
CVE ID: CVE-2008-4672 State: PUBLISHED Published: 2008-10-22T10:00:00 Last Updated: 2024-08-07T10:24:20.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in search_results.php in buymyscripts Lyrics Script allows remote attackers to inject arbitrary web script or HTML via the k parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/45474 - http://www.securityfocus.com/bid/31437/exploit - http://www.securityfocus.com/bid/31437
CVE ID: CVE-2008-4673 State: PUBLISHED Published: 2008-10-22T10:00:00 Last Updated: 2024-08-07T10:24:20.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Calendar 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the (1) path[docroot] and (2) component parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/2701 - http://secunia.com/advisories/32053 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45500 - http://www.securityfocus.com/bid/31471 - https://www.exploit-db.co
/exchange.xforce.ibmcloud.com/vulnerabilities/45500 - http://www.securityfocus.com/bid/31471 - https://www.exploit-db.com/exploits/6623 - http://securityreason.com/securityalert/4461
CVE ID: CVE-2008-4674 State: PUBLISHED Published: 2008-10-22T10:00:00 Last Updated: 2024-08-07T10:24:20.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in realestate-index.php in Conkurent Real Estate Manager 1.01 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in browse mode. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/4469 - http://www.securityfocus.com/bid/31443 - http://secunia.com/advisories/32049 - https://www.exploit-db.com/exploits/6599 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45499
CVE ID: CVE-2008-4675 State: PUBLISHED Published: 2008-10-22T10:00:00 Last Updated: 2024-08-07T10:24:21.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in PHPcounter 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the name parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/4465 - https://www.exploit-db.com/exploits/6611 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45493 - http://www.securityfocus.com/bid/31451
CVE ID: CVE-2008-4676 State: PUBLISHED Published: 2008-10-22T10:00:00 Last Updated: 2024-08-07T10:24:20.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Citrix XenApp (formerly Presentation Server) 4.5 Feature Pack 1 and earlier, Presentation Server 4.0, and Access Essentials 1.0, 1.5, and 2.0 allows local users to gain privileges via unknown attack vectors related to creating an unspecified file. NOTE: this might be the same issue as CVE-2008-3485, but the vendor advisory is too vague to be certain. Additional Analyst Notes: - CVE Program Container: References: - http://support.citrix.com/article/CTX116310 - http://www.securityfocus.com/bid/31484
E Program Container: References: - http://support.citrix.com/article/CTX116310 - http://www.securityfocus.com/bid/31484 - http://www.securitytracker.com/id?1020954 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45507 - http://secunia.com/advisories/32017 - http://www.vupen.com/english/advisories/2008/2702
CVE ID: CVE-2008-4677 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:21.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're
TE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/30670 - http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html - http://secunia.com/advisories/31464 - https://bugzilla.redhat.com/show_bug.cgi?id=461750 - http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6 - http://www.openwall.com/lists/oss-security/2008/10/20/2 - http://www.openwall.com/lists/oss-security/2008/1
c4981d34e6 - http://www.openwall.com/lists/oss-security/2008/10/20/2 - http://www.openwall.com/lists/oss-security/2008/10/16/2 - http://www.securityfocus.com/archive/1/495436 - http://www.vupen.com/english/advisories/2008/2379 - http://secunia.com/advisories/34418 - http://www.openwall.com/lists/oss-security/2008/10/06/4 - http://www.securityfocus.com/archive/1/495432 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:236 - http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/44419
CVE ID: CVE-2008-4678 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:20.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP_Request_Parser method in the HTTP Transport component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 allows remote attackers to cause a denial of service (controller 0C4 abend and application hang) via a long HTTP Host header, related to "storage overlay" on the stack and a "parse failure." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/2871 - http://www-01.ibm.com/support/docview.wss?uid=swg27006876 - http://secunia.com/advisories/32296 -
advisories/2008/2871 - http://www-01.ibm.com/support/docview.wss?uid=swg27006876 - http://secunia.com/advisories/32296 - http://www.securityfocus.com/bid/31839 - http://www-1.ibm.com/support/docview.wss?uid=swg1PK69371 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45993
CVE ID: CVE-2008-4679 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:21.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists (CRL), does not call the setRevocationEnabled method on the PKIXBuilderParameters object, which prevents the "Java security method" from checking the revocation status of X.509 certificates and allows remote attackers to bypass intended access restrictions via a SOAP message with a revoked certificate. Additional Analyst
emote attackers to bypass intended access restrictions via a SOAP message with a revoked certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg27007951 - http://www.vupen.com/english/advisories/2008/2871 - http://www-01.ibm.com/support/docview.wss?uid=swg27006876 - http://www-1.ibm.com/support/docview.wss?uid=swg1PK61258 - http://secunia.com/advisories/32296 - http://www.securityfocus.com/bid/31839 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46002
CVE ID: CVE-2008-4680 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:20.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: packet-usb.c in the USB dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via a malformed USB Request Block (URB). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/499154/100/0/threaded - http://support.avaya.com/elmodocs2/security/ASA-2009-082.htm - http://secunia.com/advisories/32355 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2922 - http://wiki.rpath.com/Advisories:rPSA-2008-0336 - htt
32355 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2922 - http://wiki.rpath.com/Advisories:rPSA-2008-0336 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9605 - http://www.wireshark.org/security/wnpa-sec-2008-06.html - http://secunia.com/advisories/34144 - http://www.securityfocus.com/bid/31838 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15091 - http://www.redhat.com/support/errata/RHSA-2009-0313.html - http://www.vupen.com/english/advisories/2008/2872 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:215 - http://securitytracker.com/id?1021069
CVE ID: CVE-2008-4681 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:20.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Bluetooth RFCOMM dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via unknown packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/499154/100/0/threaded - http://support.avaya.com/elmodocs2/security/ASA-2009-082.htm - http://secunia.com/advisories/32355 - http://wiki.rpath.com/Advisories:rPSA-2008-0336 - http://www.wireshark.org/security/wnpa-sec-2008-06.html
ories/32355 - http://wiki.rpath.com/Advisories:rPSA-2008-0336 - http://www.wireshark.org/security/wnpa-sec-2008-06.html - http://secunia.com/advisories/34144 - http://www.securityfocus.com/bid/31838 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14853 - http://www.redhat.com/support/errata/RHSA-2009-0313.html - http://www.vupen.com/english/advisories/2008/2872 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46014 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:215 - http://securitytracker.com/id?1021069 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11194
CVE ID: CVE-2008-4682 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:20.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application abort) via a malformed Tamos CommView capture file (aka .ncf file) with an "unknown/unexpected packet type" that triggers a failed assertion. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/499154/100/0/threaded - http://support.avaya.com/elmodocs2/security/ASA-2009-082.htm - http://secunia.com/advisories/32355 - http://wiki.rpath.com/Advisories:rPSA-2008-0336 - http
security/ASA-2009-082.htm - http://secunia.com/advisories/32355 - http://wiki.rpath.com/Advisories:rPSA-2008-0336 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14705 - http://securityreason.com/securityalert/4462 - http://shinnok.evonet.ro/vulns_html/wireshark.html - http://www.wireshark.org/security/wnpa-sec-2008-06.html - http://secunia.com/advisories/34144 - http://www.securityfocus.com/bid/31838 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2926 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10955 - http://www.redhat.com/support/errata/RHSA-2009-0313.html - http://www.vupen.com/english/advisories
.oval%3Adef%3A10955 - http://www.redhat.com/support/errata/RHSA-2009-0313.html - http://www.vupen.com/english/advisories/2008/2872 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:215 - http://securitytracker.com/id?1021069 - https://www.exploit-db.com/exploits/6622 - http://www.securityfocus.com/bid/31468 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45505
CVE ID: CVE-2008-4683 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:20.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissect_btacl function in packet-bthci_acl.c in the Bluetooth ACL dissector in Wireshark 0.99.2 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via a packet with an invalid length, related to an erroneous tvb_memcpy call. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/499154/100/0/threaded - http://support.avaya.com/elmodocs2/security/ASA-2009-082.htm - http://secunia.com/advisories/32355 - http://wiki.rpath.com/Advisor
port.avaya.com/elmodocs2/security/ASA-2009-082.htm - http://secunia.com/advisories/32355 - http://wiki.rpath.com/Advisories:rPSA-2008-0336 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14982 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9821 - http://www.wireshark.org/security/wnpa-sec-2008-06.html - http://secunia.com/advisories/34144 - http://www.securityfocus.com/bid/31838 - http://secunia.com/advisories/32944 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1513 - http://www.redhat.com/support/errata/RHSA-2009-0313.html - http://www.vupen.com/english/advisories/2008/2872 - http://www.mandriva.com/s
t.com/support/errata/RHSA-2009-0313.html - http://www.vupen.com/english/advisories/2008/2872 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:215 - http://securitytracker.com/id?1021069 - http://www.debian.org/security/2008/dsa-1673
CVE ID: CVE-2008-4684 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:20.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: packet-frame in Wireshark 0.99.2 through 1.0.3 does not properly handle exceptions thrown by post dissectors, which allows remote attackers to cause a denial of service (application crash) via a certain series of packets, as demonstrated by enabling the (1) PRP or (2) MATE post dissector. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/499154/100/0/threaded - http://support.avaya.com/elmodocs2/security/ASA-2009-082.htm - http://secunia.com/advisories/32355 - http://wiki.r
ded - http://support.avaya.com/elmodocs2/security/ASA-2009-082.htm - http://secunia.com/advisories/32355 - http://wiki.rpath.com/Advisories:rPSA-2008-0336 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2549 - http://www.wireshark.org/security/wnpa-sec-2008-06.html - http://secunia.com/advisories/34144 - http://www.securityfocus.com/bid/31838 - http://secunia.com/advisories/32944 - http://www.redhat.com/support/errata/RHSA-2009-0313.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14767 - http://www.vupen.com/english/advisories/2008/2872 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10223 - http://w
ries/2008/2872 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10223 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:215 - http://securitytracker.com/id?1021069 - http://www.debian.org/security/2008/dsa-1673
CVE ID: CVE-2008-4685 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:21.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the dissect_q931_cause_ie function in packet-q931.c in the Q.931 dissector in Wireshark 0.10.3 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via certain packets that trigger an exception. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/499154/100/0/threaded - http://support.avaya.com/elmodocs2/security/ASA-2009-082.htm - http://secunia.com/advisories/32355 - http://wiki.rpath.com/Advisories:
.avaya.com/elmodocs2/security/ASA-2009-082.htm - http://secunia.com/advisories/32355 - http://wiki.rpath.com/Advisories:rPSA-2008-0336 - http://www.wireshark.org/security/wnpa-sec-2008-06.html - http://secunia.com/advisories/34144 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2870 - http://www.securityfocus.com/bid/31838 - http://secunia.com/advisories/32944 - http://www.redhat.com/support/errata/RHSA-2009-0313.html - http://www.vupen.com/english/advisories/2008/2872 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:215 - http://securitytracker.com/id?1021069 - http://www.debian.org/security/2008/dsa-1673 - https://oval.cisecurity.org/repository/search/definition/oval%3Ao
21069 - http://www.debian.org/security/2008/dsa-1673 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10788
CVE ID: CVE-2008-4686 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:20.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2008/10/22/6 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14630 - http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=d859e6b9
y/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14630 - http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=d859e6b9537af2d7326276f70de25a840f554dc3 - http://www.openwall.com/lists/oss-security/2008/10/19/2 - http://www.securityfocus.com/bid/31867
CVE ID: CVE-2008-4687 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:20.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.gentoo.org/show_bug.cgi?id=242722 - http://secunia.com/advisories/32975 - http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/utility_api.php?r1=5679&r2=5678&pathrev=5679 -
t.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/utility_api.php?r1=5679&r2=5678&pathrev=5679 - http://www.securityfocus.com/bid/31789 - http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml - http://www.mantisbt.org/bugs/view.php?id=0009704 - http://www.mantisbt.org/bugs/changelog_page.php - https://www.exploit-db.com/exploits/44611/ - http://secunia.com/advisories/32314 - http://www.openwall.com/lists/oss-security/2008/10/19/1 - https://www.exploit-db.com/exploits/6768 - https://exchange.xforce.ibmcloud.com/vulnerabilities/45942 - http://securityreason.com/securityalert/4470
CVE ID: CVE-2008-4688 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:20.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified issue number. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/32243 - http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384 - http://www.securityfocus.com/bid
tisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384 - http://www.securityfocus.com/bid/31868 - http://secunia.com/advisories/32975 - http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml - http://www.mantisbt.org/bugs/changelog_page.php - http://www.openwall.com/lists/oss-security/2008/10/20/1 - http://www.mantisbt.org/bugs/view.php?id=9321
CVE ID: CVE-2008-4689 State: PUBLISHED Published: 2008-10-22T17:00:00 Last Updated: 2024-08-07T10:24:20.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/32975 - http://www.mantisbt.org/bugs/file_download.php?file_id=1988&type=bug - http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml - http://www.mantisbt.org/bugs/view.php?id=9664 - http://www.mantisbt.org/bugs/changelog_page.php - https://exchange.xforce.ibmcloud.com/vulnerabilities/46084 - http://
- http://www.mantisbt.org/bugs/changelog_page.php - https://exchange.xforce.ibmcloud.com/vulnerabilities/46084 - http://www.openwall.com/lists/oss-security/2008/10/20/1