Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2008-6841 State: PUBLISHED Published: 2009-07-01T12:26:00 Last Updated: 2024-08-07T11:42:00.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in the Green Mountain Information Technology and Consulting Database Query (com_dbquery) component 1.4.1.1 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to classes/DBQ/admin/common.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6003 - http://www.securityfocus.com/bid/30093 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43615
CVE ID: CVE-2008-6842 State: PUBLISHED Published: 2009-07-02T10:00:00 Last Updated: 2024-08-07T11:42:00.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the post parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/34415 - https://www.exploit-db.com/exploits/8271 - https://exchange.xforce.ibmcloud.com/vulnerabilities/49378 - http://www.securityfocus.com/bid/34207
CVE ID: CVE-2008-6843 State: PUBLISHED Published: 2009-07-02T10:00:00 Last Updated: 2024-08-07T11:42:00.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a .. (dot dot) in the sup3r parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46991 - http://www.securityfocus.com/archive/1/498814/100/0/threaded - http://www.securityfocus.com/bid/32578
CVE ID: CVE-2008-6844 State: PUBLISHED Published: 2009-07-02T10:00:00 Last Updated: 2024-08-07T11:42:00.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47216 - http://www.osvdb.org/52708 - http://www.securityfocus.com/bid/32762 - http://ez.no/develope
.com/vulnerabilities/47216 - http://www.osvdb.org/52708 - http://www.securityfocus.com/bid/32762 - http://ez.no/developer/security/security_advisories/ez_publish_4_0/ezsa_2008_003_insufficient_form_handling_made_privilege_escalation_possible - https://www.exploit-db.com/exploits/7406
CVE ID: CVE-2008-6845 State: PUBLISHED Published: 2009-07-02T10:00:00 Last Updated: 2024-08-07T11:42:00.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unpack feature in ClamAV 0.93.3 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a corrupted LZH file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/499078/100/0/threaded - http://www.securityfocus.com/bid/32752 - http://www.ivizsecurity.com/security-advisory-iviz-sr-08011.html - http://osvdb.org/51963
CVE ID: CVE-2008-6846 State: PUBLISHED Published: 2009-07-02T10:00:00 Last Updated: 2024-08-07T11:42:00.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in avast! Linux Home Edition 1.0.5, 1.0.5-1, and 1.0.8 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via a malformed (1) ISO or (2) RPM file. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/52016 - http://www.securityfocus.com/bid/32747 - http://www.securityfocus.com/archive/1/499080/100/0/threaded - http://www.vupen.com/english/advisories/2008/3460 - https://exchange.xforce.ibmcloud.com/vulnerabilities/4
/0/threaded - http://www.vupen.com/english/advisories/2008/3460 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47251 - http://www.ivizsecurity.com/security-advisory-iviz-sr-08013.html
CVE ID: CVE-2008-6847 State: PUBLISHED Published: 2009-07-02T10:00:00 Last Updated: 2024-08-07T11:42:00.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Employee/emp_login.asp in Pre ASP Job Board allows remote attackers to inject arbitrary web script or HTML via the msg parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32572 - http://packetstormsecurity.org/0812-exploits/preaspjob-xsscm.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/47007
CVE ID: CVE-2008-6848 State: PUBLISHED Published: 2009-07-07T18:35:00 Last Updated: 2024-08-07T11:42:00.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to inject arbitrary web script or HTML via the category parameter in a select action. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47590 - https://www.exploit-db.com/exploits/7561 - http://osvdb.org/50989 - http://www.securityfocus.com/bid/33001 - http://secunia.com/advisories/33304 - http://www.vupen.com/english/advisories/2008/3510
CVE ID: CVE-2008-6849 State: PUBLISHED Published: 2009-07-07T18:35:00 Last Updated: 2024-08-07T11:42:00.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a via a link that is listed by userfiles/number_shell.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7561 - http://osvdb.org/50988 - http://www.securityfocus.com/bid/32995 - http://secunia.com/advisories/33304 - http://www.vupen.com/english/advisories/2008/3510 - https://ex
cus.com/bid/32995 - http://secunia.com/advisories/33304 - http://www.vupen.com/english/advisories/2008/3510 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47591
CVE ID: CVE-2008-6850 State: PUBLISHED Published: 2009-07-07T18:35:00 Last Updated: 2024-08-07T11:42:00.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/51053 - http://secunia.com/advisories/33295 - http://www.securityfocus.com/bid/33058 - http://www.php-fusion.co.uk/news.php?readmore=443 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47665
CVE ID: CVE-2008-6851 State: PUBLISHED Published: 2009-07-07T18:35:00 Last Updated: 2024-08-07T11:42:00.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in page.php in PHP Link Directory (phpLD) 3.3, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the name parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32989 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47580 - https://www.exploit-db.com/exploits/7558
CVE ID: CVE-2008-6852 State: PUBLISHED Published: 2009-07-07T18:35:00 Last Updated: 2024-08-07T11:42:00.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33008 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47604 - https://www.exploit-db.com/exploits/7572
CVE ID: CVE-2008-6853 State: PUBLISHED Published: 2009-07-07T18:35:00 Last Updated: 2024-08-07T11:42:00.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in modules/poll/index.php in AIST NetCat 3.0 and 3.12 allows remote attackers to execute arbitrary SQL commands via the PollID parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33048 - https://www.exploit-db.com/exploits/7611 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47632
CVE ID: CVE-2008-6854 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:42:00.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6902 - http://www.securityfocus.com/bid/32028 - http://secunia.com/advisories/32472 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46303
CVE ID: CVE-2008-6855 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:42:00.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a certain cookie. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6901 - http://www.securityfocus.com/bid/32027 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46302 - http://secunia.com/advisories/32472
CVE ID: CVE-2008-6856 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:42:00.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xigla Software Absolute News Manager.NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46301 - http://www.securityfocus.com/bid/32024 - https://www.exploit-db.com/exploits/6900 - http://secunia.com/advisories/32472
CVE ID: CVE-2008-6857 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:42:00.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute Podcast .NET 1.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32003 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46241 - http://osvdb.org/49467 - https://www.exploit-db.com/exploits/6882 - http://secunia.com/advisories/32472
CVE ID: CVE-2008-6858 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:42:00.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6890 - http://www.securityfocus.com/bid/32023 - http://secunia.com/advisories/32472 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46244
CVE ID: CVE-2008-6859 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:42:00.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/6893 - http://www.securityfocus.com/bid/32025 - http://secunia.com/advisories/32472 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46247
CVE ID: CVE-2008-6860 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:42:00.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xigla Software Absolute Poll Manager XE 4.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46242 - https://www.exploit-db.com/exploits/6883 - http://www.securityfocus.com/bid/32005
CVE ID: CVE-2008-6861 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:42:00.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32029 - https://www.exploit-db.com/exploits/6904 - http://secunia.com/advisories/32472 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46304
CVE ID: CVE-2008-6862 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:42:00.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/32472 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46243 - http://www.securityfocus.com/bid/32026 - https://www.exploit-db.com/exploits/6889
CVE ID: CVE-2008-6863 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:49:00.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xigla Software Absolute Form Processor .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46245 - http://www.securityfocus.com/bid/32009 - https://www.exploit-db.com/exploits/6891 - http://secunia.com/advisories/32472
CVE ID: CVE-2008-6864 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:49:02.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/32010 - https://www.exploit-db.com/exploits/6892 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46246 - http://secunia.com/advisories/32472
CVE ID: CVE-2008-6865 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:49:00.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in modules.php in the Sectionsnew module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printpage action. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51735 - http://www.securityfocus.com/archive/1/497939/100/0/threaded - http://osvdb.org/51890
CVE ID: CVE-2008-6866 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:49:00.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in modules.php in the Current_Issue module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a summary action. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51736 - http://osvdb.org/51889 - http://www.securityfocus.com/archive/1/497944/100/0/threaded
CVE ID: CVE-2008-6867 State: PUBLISHED Published: 2009-07-14T14:00:00 Last Updated: 2024-08-07T11:49:00.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in content.php in Scripts For Sites (SFS) EZ Career allows remote attackers to execute arbitrary SQL commands via the topic parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/46275 - http://osvdb.org/49486 - http://secunia.com/advisories/32527 - https://www.exploit-db.com/exploits/6919 - http://www.securityfocus.com/bid/32037
CVE ID: CVE-2008-6868 State: PUBLISHED Published: 2009-07-23T19:00:00 Last Updated: 2024-08-07T11:49:01.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in default/login.php in EditeurScripts EsBaseAdmin 2.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/34284 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52436 - http://www.securityfocus.com/bid/34112 - http://packetstorm.linuxsecurity.com/0903-exploits/editeurscripts-xss.txt - https://e
/www.securityfocus.com/bid/34112 - http://packetstorm.linuxsecurity.com/0903-exploits/editeurscripts-xss.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/49237
CVE ID: CVE-2008-6869 State: PUBLISHED Published: 2009-07-23T19:00:00 Last Updated: 2024-08-07T11:49:02.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for config/oramon.ini. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7286 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46967 - http://www.vupen.com/english/advisories/2008/3305
CVE ID: CVE-2008-6870 State: PUBLISHED Published: 2009-07-23T19:00:00 Last Updated: 2024-08-07T11:49:02.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information via a direct request to (1) config.asp and (2) users.asp. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47107 - https://www.exploit-db.com/exploits/7348
CVE ID: CVE-2008-6871 State: PUBLISHED Published: 2009-07-23T19:00:00 Last Updated: 2024-08-07T11:49:01.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Merlix Educate Server stores db.mdb under the web root with insufficient access control, which allows remote attackers to obtain unspecified sensitive information via a direct request. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/50524 - http://secunia.com/advisories/33018 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47108 - https://www.exploit-db.com/exploits/7348
CVE ID: CVE-2008-6872 State: PUBLISHED Published: 2009-07-23T19:00:00 Last Updated: 2024-08-07T11:49:01.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASPThai.NET ASPThai Forums 8.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/aspthaiForum.mdb. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/32912 - https://www.exploit-db.com/exploits/7292 - http://www.osvdb.org/50329 - http://www.vupen.com/english/advisories/2008/3301 - https://exchange.xforce.ibmcloud.com/vulnerabilities/46960
CVE ID: CVE-2008-6873 State: PUBLISHED Published: 2009-07-23T19:00:00 Last Updated: 2024-08-07T11:49:00.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the TabOpenQuickTab1 parameter to (1) popaccounts.aspx, (2) addressbook.aspx, and (3) emails.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7288 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52444 - http://www.vupen.com/english/advisories/2008/3303
CVE ID: CVE-2008-6874 State: PUBLISHED Published: 2009-07-24T16:00:00 Last Updated: 2024-08-07T11:49:02.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in ASP SiteWare autoDealer 1 and 2 allow remote attackers to execute arbitrary SQL commands via the iType parameter in (1) Auto1/type.asp or (2) auto2/type.asp. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47365 - https://www.exploit-db.com/exploits/7463 - http://secunia.com/advisories/23572 - http://www.securityfocus.com/bid/32812
CVE ID: CVE-2008-6875 State: PUBLISHED Published: 2009-07-24T16:00:00 Last Updated: 2024-08-07T11:49:02.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in default.asp in ASP Product Catalog allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-5220. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/36894 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52433 - http://www.vupen.com/english/advisories/2007/3345 - http://www.securityfocus.com/bid/25884 - http://marc.info/?l=bugtraq&m=122901307932738&w=2 - http://osvdb.o
/2007/3345 - http://www.securityfocus.com/bid/25884 - http://marc.info/?l=bugtraq&m=122901307932738&w=2 - http://osvdb.org/51976
CVE ID: CVE-2008-6876 State: PUBLISHED Published: 2009-07-24T18:00:00 Last Updated: 2024-08-07T11:49:01.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in login.php in EsPartenaires 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52437 - http://secunia.com/advisories/34284 - http://www.securityfocus.com/bid/34112 - http://packetstorm.linuxsecurity.com/0903-exploits/editeurscripts-xss.txt - https://exchange.xforce.ibmclo
m/bid/34112 - http://packetstorm.linuxsecurity.com/0903-exploits/editeurscripts-xss.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/49237
CVE ID: CVE-2008-6877 State: PUBLISHED Published: 2009-07-27T14:22:00 Last Updated: 2024-08-07T11:49:02.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loader_file parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/31039 - http://www.attrition.org/pipermail/vim/2008-July/002028.htm
ntainer: References: - http://secunia.com/advisories/31039 - http://www.attrition.org/pipermail/vim/2008-July/002028.html - http://osvdb.org/46912 - http://www.zen-cart.com/forum/showthread.php?t=102802 - https://www.exploit-db.com/exploits/6038 - http://www.securityfocus.com/bid/30179