Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
a/RHSA-2008-0223.html - http://www.securityfocus.com/archive/1/491838/100/0/threaded - http://secunia.com/advisories/29860 - http://www.ubuntu.com/usn/usn-602-1 - http://secunia.com/advisories/29793 - http://secunia.com/advisories/30029 - http://secunia.com/advisories/30192 - http://www.debian.org/security/2009/dsa-1696 - https://bugzilla.mozilla.org/show_bug.cgi?id=425576 - http://www.debian.org/security/2008/dsa-1555 - http://www.redhat.com/support/errata/RHSA-2008-0222.html - http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.391769 - http://www.debian.org/security/2008/dsa-1558 - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00
- http://www.debian.org/security/2008/dsa-1558 - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00058.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10752 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41857 - http://secunia.com/advisories/29947 - http://www.vupen.com/english/advisories/2008/1251/references - http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml - http://www.securitytracker.com/id?1019873 - http://www.redhat.com/support/errata/RHSA-2008-0224.html - http://secunia.com/advisories/29911 - http://secunia.com/advisories/33434 - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00074
/29911 - http://secunia.com/advisories/33434 - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00074.html - http://www.novell.com/linux/security/advisories/2008_13_sr.html - http://secunia.com/advisories/30717
CVE ID: CVE-2008-1381 State: PUBLISHED Published: 2008-05-01T18:00:00 Last Updated: 2024-08-07T08:17:34.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00078.html - http://www.securityfocus.com/bid/28968 - http://www.awe.com/mark/blog/200804272230.html - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00085.html - http://secunia.com/a
00804272230.html - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00085.html - http://secunia.com/advisories/29995 - http://www.zoneminder.com/wiki/index.php/Change_History#Release_1.23.3 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42046 - http://secunia.com/advisories/30189
CVE ID: CVE-2008-1382 State: PUBLISHED Published: 2008-04-14T16:00:00 Last Updated: 2024-08-07T08:17:34.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html - http://www.redhat.com/support/errata/RHSA-2009-0333.html - http://secunia.com/advisories/35386 -
2008-04/msg00011.html - http://www.redhat.com/support/errata/RHSA-2009-0333.html - http://secunia.com/advisories/35386 - http://www.vupen.com/english/advisories/2008/1225/references - http://secunia.com/advisories/30157 - http://secunia.com/advisories/30174 - http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1 - http://support.apple.com/kb/HT3549 - http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html - http://www.osvdb.org/44364 - http://www.vupen.com/english/advisories/2009/1560 - http://secunia.com/advisories/34388 - http://www.vupen.com/english/advisories/2009/1462 - http://security.gentoo.org/glsa/glsa-200805-10.xml - https://www.redhat.com/archives/
com/english/advisories/2009/1462 - http://security.gentoo.org/glsa/glsa-200805-10.xml - https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00080.html - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00960.html - http://secunia.com/advisories/30486 - http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0151 - http://www.vmware.com/security/advisories/VMSA-2009-0007.html - http://www.us-cert.gov/cas/techalerts/TA08-260A.html - http://secunia.com/advisories/30402 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1 - http://secunia.com/advisories/35302 - https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00033.html - http://slac
nia.com/advisories/35302 - https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00033.html - http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.541247 - http://www.securityfocus.com/archive/1/491424/100/0/threaded - http://secunia.com/advisories/35074 - http://www.vupen.com/english/advisories/2008/2584 - http://secunia.com/advisories/29792 - http://www.securitytracker.com/id?1019840 - http://www.vupen.com/english/advisories/2009/1451 - http://lists.apple.com/archives/security-announce/2009/May/msg00002.html - http://secunia.com/advisories/31882 - http://security.gentoo.org/glsa/glsa-200804-15.xml - http://secunia.com/advisories/29992 - h
unia.com/advisories/31882 - http://security.gentoo.org/glsa/glsa-200804-15.xml - http://secunia.com/advisories/29992 - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00721.html - http://www.securityfocus.com/archive/1/503912/100/0/threaded - http://secunia.com/advisories/29678 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41800 - http://security.gentoo.org/glsa/glsa-200812-15.xml - http://www.debian.org/security/2009/dsa-1750 - http://www.ocert.org/advisories/ocert-2008-003.html - http://www.securityfocus.com/archive/1/490823/100/0/threaded - http://libpng.sourceforge.net/Advisory-1.2.26.txt - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.m
ttp://libpng.sourceforge.net/Advisory-1.2.26.txt - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10326 - http://www.us-cert.gov/cas/techalerts/TA09-133A.html - http://www.vupen.com/english/advisories/2009/1297 - http://secunia.com/advisories/33137 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6275 - http://secunia.com/advisories/34152 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:156 - http://secunia.com/advisories/35258 - http://secunia.com/advisories/30009 - http://www.securityfocus.com/bid/28770 - http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm - http://secunia.com/advisories/2
rityfocus.com/bid/28770 - http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm - http://secunia.com/advisories/29957 - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00951.html - https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00111.html
CVE ID: CVE-2008-1383 State: PUBLISHED Published: 2008-03-18T22:00:00 Last Updated: 2024-08-07T08:17:34.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/29436 - https://bugs.gentoo.org/show_bug.cgi?id=174759 - http://www.securityfocus.com/bid/28350 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41336
_bug.cgi?id=174759 - http://www.securityfocus.com/bid/28350 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41336 - http://osvdb.org/43479 - http://security.gentoo.org/glsa/glsa-200803-30.xml
CVE ID: CVE-2008-1384 State: PUBLISHED Published: 2008-03-27T17:00:00 Last Updated: 2024-08-07T08:17:34.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service and possibly have unspecified other impact via a printf format parameter with a large width specifier, related to the php_sprintf_appendstring function in formatted_print.c and probably other functions for formatted strings (aka *printf functions). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/492535/100/0/threaded - http://www.securityfocus.com/archive/1/489962/100
nces: - http://www.securityfocus.com/archive/1/492535/100/0/threaded - http://www.securityfocus.com/archive/1/489962/100/0/threaded - http://secunia.com/advisories/32746 - http://security.gentoo.org/glsa/glsa-200811-05.xml - http://cvs.php.net/viewvc.cgi/php-src/NEWS?revision=1.2027.2.547.2.1120&view=markup - http://www.debian.org/security/2008/dsa-1572 - http://secunia.com/advisories/30345 - http://www.ubuntu.com/usn/usn-628-1 - http://secunia.com/advisories/30967 - http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0176 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41386 - http://www.securityfocus.com/archive/1/492671/100/0/threaded - http://secunia.com/advisories/30411 - http://secu
41386 - http://www.securityfocus.com/archive/1/492671/100/0/threaded - http://secunia.com/advisories/30411 - http://secunia.com/advisories/30158 - http://www.mandriva.com/security/advisories?name=MDVSA-2009:023 - http://www.mandriva.com/security/advisories?name=MDVSA-2009:022 - http://www.securityfocus.com/bid/28392 - http://secunia.com/advisories/31200 - http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html - http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178 - https://issues.rpath.com/browse/RPL-2503 - http://securityreason.com/achievement_securityalert/52
CVE ID: CVE-2008-1385 State: PUBLISHED Published: 2008-04-23T10:00:00 Last Updated: 2024-08-07T08:17:34.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html - http://www.securityfocus.com/archive/1/491176/100/0/threaded - http://www.securityfocus.com/bid/28885 - http://www.vupen.com/english/advisories/2008/1348/references - http://secunia.c
http://www.securityfocus.com/bid/28885 - http://www.vupen.com/english/advisories/2008/1348/references - http://secunia.com/advisories/29942 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41965 - http://www.securitytracker.com/id?1019915 - http://int21.de/cve/CVE-2008-1385-s9y.html - http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html
CVE ID: CVE-2008-1386 State: PUBLISHED Published: 2008-04-23T10:00:00 Last Updated: 2024-08-07T08:17:34.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via (1) unspecified path fields or (2) the database host field. NOTE: the timing window for exploitation of this issue might be limited. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html - http://www.securityfocus.com/archive/1/491176/100/0/threaded - http://www.securityfocus.com/bid/2888
2008-04/0590.html - http://www.securityfocus.com/archive/1/491176/100/0/threaded - http://www.securityfocus.com/bid/28885 - http://www.vupen.com/english/advisories/2008/1348/references - http://int21.de/cve/CVE-2008-1386-s9y.html - http://www.securitytracker.com/id?1019915 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41967 - http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html
CVE ID: CVE-2008-1387 State: PUBLISHED Published: 2008-04-16T16:00:00 Last Updated: 2024-08-07T08:17:34.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive, as demonstrated by the PROTOS GENOME test suite for Archive Formats. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2008:088 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41822 - https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00249.html - http://www.securityfocus.com/archive/1/490863/100/0/threaded - http://sec
dora-package-announce/2008-May/msg00249.html - http://www.securityfocus.com/archive/1/490863/100/0/threaded - http://security.gentoo.org/glsa/glsa-200805-19.xml - http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html - https://www.clamav.net/bugzilla/show_bug.cgi?id=897 - http://up2date.astaro.com/2008/08/up2date_asg_v7300_ga_released.html - http://int21.de/cve/CVE-2008-1387-clamav.html - http://secunia.com/advisories/29891 - http://www.us-cert.gov/cas/techalerts/TA08-260A.html - http://www.securityfocus.com/bid/28784 - http://www.vupen.com/english/advisories/2008/2584 - http://secunia.com/advisories/31882 - http://secunia.com/advisories/29975 - http://www.cert.fi/haavoit
ories/2008/2584 - http://secunia.com/advisories/31882 - http://secunia.com/advisories/29975 - http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html - http://secunia.com/advisories/29863 - http://secunia.com/advisories/30328 - https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00625.html - http://www.securityfocus.com/bid/28782 - http://secunia.com/advisories/30253 - http://secunia.com/advisories/31576 - http://www.vupen.com/english/advisories/2008/1227/references - http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/ - http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00009.html - https://www.redhat.com/archives/fedora-package-ann
lists.opensuse.org/opensuse-security-announce/2008-04/msg00009.html - https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00576.html - http://kolab.org/security/kolab-vendor-notice-20.txt
CVE ID: CVE-2008-1389 State: PUBLISHED Published: 2008-09-04T16:00:00 Last Updated: 2024-08-07T08:17:34.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an "invalid memory access." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/32030 - http://www.securityfocus.com/bid/30994 - http://www.vupen.com/english/advisories/2008/2484 - http://secunia.com/advisories/31982 - http://www.securityfocus.com/bid/31681 - http://int21.de/cve/CVE-2008-1389-clamav-chd.html - http:
om/advisories/31982 - http://www.securityfocus.com/bid/31681 - http://int21.de/cve/CVE-2008-1389-clamav-chd.html - http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html - http://sourceforge.net/project/shownotes.php?group_id=86638&release_id=623661 - http://secunia.com/advisories/31725 - http://www.mandriva.com/security/advisories?name=MDVSA-2008:189 - https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00348.html - http://secunia.com/advisories/32222 - http://security.gentoo.org/glsa/glsa-200809-18.xml - http://kolab.org/security/kolab-vendor-notice-22.txt - http://www.securitytracker.com/id?1020805 - http://www.vupen.com/english/advisories/2008/278
olab-vendor-notice-22.txt - http://www.securitytracker.com/id?1020805 - http://www.vupen.com/english/advisories/2008/2780 - http://www.vupen.com/english/advisories/2008/2564 - http://secunia.com/advisories/32699 - http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html - http://support.apple.com/kb/HT3216 - http://secunia.com/advisories/31906 - https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00332.html - http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog - https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089
CVE ID: CVE-2008-1390 State: PUBLISHED Published: 2008-03-24T17:00:00 Last Updated: 2024-08-07T08:17:34.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3764 - http://www.securityfoc
lyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3764 - http://www.securityfocus.com/bid/28316 - http://www.securityfocus.com/archive/1/489819/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/41304 - http://secunia.com/advisories/29449 - http://downloads.digium.com/pub/security/AST-2008-005.html - https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html - http://www.securitytracker.com/id?1019679 - https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html - http://secunia.com/advisories/29470
CVE ID: CVE-2008-1391 State: PUBLISHED Published: 2008-03-27T17:00:00 Last Updated: 2024-08-07T08:17:34.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28479 - http://www.securityfoc
al Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28479 - http://www.securityfocus.com/archive/1/490158/100/0/threaded - http://www.vupen.com/english/advisories/2008/3444 - http://www.us-cert.gov/cas/techalerts/TA08-350A.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/41504 - http://secunia.com/advisories/33179 - http://securityreason.com/securityalert/3770 - https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.html - http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.c - http://securityreason.com/achievement_securityalert/53 - http://support.apple.com/kb/HT3338 - http://www.debian.org/security/2010/dsa-2058 -
n.com/achievement_securityalert/53 - http://support.apple.com/kb/HT3338 - http://www.debian.org/security/2010/dsa-2058 - http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html - http://www.securitytracker.com/id?1019722 - http://secunia.com/advisories/29574
CVE ID: CVE-2008-1392 State: PUBLISHED Published: 2008-03-20T00:00:00 Last Updated: 2024-08-07T08:17:34.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of VMware Workstation 6.0.2, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 makes the console of the guest OS accessible through anonymous VIX API calls, which has unknown impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://security.gentoo.org/glsa/glsa-201209-25.xml - http://securityreason.com/securityalert/3755 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41551 - http://www.vmware.com/support/ace2/doc/releasenotes_ace2.htm
ttps://exchange.xforce.ibmcloud.com/vulnerabilities/41551 - http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html - http://www.vmware.com/support/player2/doc/releasenotes_player2.html - http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html - http://www.securityfocus.com/archive/1/489739/100/0/threaded - http://lists.vmware.com/pipermail/security-announce/2008/000008.html - http://www.vmware.com/security/advisories/VMSA-2008-0005.html - http://www.securityfocus.com/bid/28276
CVE ID: CVE-2008-1393 State: PUBLISHED Published: 2008-03-20T00:00:00 Last Updated: 2024-08-07T08:17:34.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3754 - http://www.securityfocus.com/archive/1/489544/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/41427 - http://plone.org/documentation/how-to/secu
100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/41427 - http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords - http://www.procheckup.com/Hacking_Plone_CMS.pdf - http://plone.org/products/plone/roadmap/48?
CVE ID: CVE-2008-1394 State: PUBLISHED Published: 2008-03-20T00:00:00 Last Updated: 2024-08-07T08:17:34.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3754 - http://www.securityfocus.com/archive/1/489544/100/0/threaded - http://plone.org/about/security/overview/security-overview-of-plone/ - http://www.procheckup.com/Hacking_Plone_CMS.pdf - https://exchange.xforce.ibmcloud
verview/security-overview-of-plone/ - http://www.procheckup.com/Hacking_Plone_CMS.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/41425
CVE ID: CVE-2008-1395 State: PUBLISHED Published: 2008-03-20T00:00:00 Last Updated: 2024-08-07T08:17:34.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3754 - http://www.securityfocus.com/archive/1/489544/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/41423 - http://www.procheckup.com/Hacking_Plone_CMS.pdf
CVE ID: CVE-2008-1396 State: PUBLISHED Published: 2008-03-20T00:00:00 Last Updated: 2024-08-07T08:17:34.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/3754 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41421 - http://www.securityfocus.com/archive/1/489544/100/0/threaded - http://www.procheckup.com/Hacking_Plone_CMS.pdf