Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
6a3ea98797 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41501 - http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00007.html - http://secunia.com/advisories/32799 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9555 - http://secunia.com/advisories/32315
CVE ID: CVE-2008-1515 State: PUBLISHED Published: 2008-04-01T17:00:00 Last Updated: 2024-08-07T08:24:42.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SOAP interface in OTRS 2.1.x before 2.1.8 and 2.2.x before 2.2.6 allows remote attackers to "read and modify objects" via SOAP requests, related to "Missing security checks." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/29622 - http://secunia.com/advisories/29859 - http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html - http://otrs.org/advisory/OSA-2008-01-en/ - http://www.securityfocus.com/bid/28647 - http://secunia.com/advisories/29585 - https://www.r
/advisory/OSA-2008-01-en/ - http://www.securityfocus.com/bid/28647 - http://secunia.com/advisories/29585 - https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00284.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/41577
CVE ID: CVE-2008-1517 State: PUBLISHED Published: 2009-05-13T15:14:00 Last Updated: 2024-08-07T08:24:42.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Array index error in the xnu (Mach) kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (system shutdown) via unspecified vectors related to workqueues. Additional Analyst Notes: - CVE Program Container: References: - http://support.apple.com/kb/HT3549 - http://www.securitytracker.com/id?1022213 - http://secunia.com/advisories/35074 - http://lists.apple.com/archives/security-announce/2009/May/msg00002.html - http://labs.idefense.com/intelligence/vulnerabilities/display
le.com/archives/security-announce/2009/May/msg00002.html - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=797 - http://www.us-cert.gov/cas/techalerts/TA09-133A.html - http://www.vupen.com/english/advisories/2009/1297 - https://exchange.xforce.ibmcloud.com/vulnerabilities/50489
CVE ID: CVE-2008-1518 State: PUBLISHED Published: 2008-06-05T20:21:00 Last Updated: 2024-08-07T08:24:42.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in kl1.sys in Kaspersky Anti-Virus 6.0 and 7.0 and Internet Security 6.0 and 7.0 allows local users to gain privileges via an IOCTL 0x800520e8 call. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1020195 - http://www.vupen.com/english/advisories/2008/1739 - http://www.kaspersky.com/technews?id=203038727 - http://secunia.com/advisories/30534 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42849 - http://labs.idefense.com/intelligence/vulnerabilit
/30534 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42849 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=704 - http://securitytracker.com/id?1020196
CVE ID: CVE-2008-1521 State: PUBLISHED Published: 2008-03-26T10:00:00 Last Updated: 2024-08-07T08:24:42.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to gain privileges by accessing administrative URIs, as demonstrated by rpSysAdmin.html. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/489009/100/0/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf
CVE ID: CVE-2008-1522 State: PUBLISHED Published: 2008-03-26T10:00:00 Last Updated: 2024-08-07T08:24:42.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), have (1) "user" as their default password for the "user" account and (2) "1234" as their default password for the "admin" account, which makes it easier for remote attackers to obtain access. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/489009/100/0/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_ZyXEL_Gatew
/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/41508
CVE ID: CVE-2008-1523 State: PUBLISHED Published: 2008-03-26T10:00:00 Last Updated: 2024-08-07T08:24:42.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain ISP and Dynamic DNS credentials by sending a direct request for (1) WAN.html, (2) wzPPPOE.html, and (3) rpDyDNS.html, and then reading the HTML source. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/489009/100/0/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_
89009/100/0/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/41509
CVE ID: CVE-2008-1524 State: PUBLISHED Published: 2008-03-26T10:00:00 Last Updated: 2024-08-07T08:24:42.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has "public" as its default community for both (1) read and (2) write operations, which allows remote attackers to perform administrative actions via SNMP, as demonstrated by reading the Dynamic DNS service password or inserting an XSS sequence into the system.sysName.0 variable, which is displayed on the System Status page. Additional Analyst Notes: - CVE Program Container: References: - http://www.secur
s displayed on the System Status page. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/489009/100/0/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf
CVE ID: CVE-2008-1525 State: PUBLISHED Published: 2008-03-26T10:00:00 Last Updated: 2024-08-07T08:24:42.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default SNMP configuration on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has a Trusted Host value of 0.0.0.0, which allows remote attackers to send SNMP requests from any source IP address. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/489009/100/0/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf
CVE ID: CVE-2008-1526 State: PUBLISHED Published: 2008-03-26T10:00:00 Last Updated: 2024-08-07T08:24:42.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/489009/100/0/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf
CVE ID: CVE-2008-1527 State: PUBLISHED Published: 2008-03-26T10:00:00 Last Updated: 2024-08-07T08:24:42.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), support authentication over HTTP via a hash string in the hiddenPassword field, which allows remote attackers to obtain access via a replay attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/489009/100/0/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf
CVE ID: CVE-2008-1528 State: PUBLISHED Published: 2008-03-26T10:00:00 Last Updated: 2024-08-07T08:24:42.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain authentication data by making direct HTTP requests and then reading the HTML source, as demonstrated by a request for (1) RemMagSNMP.html, which discloses SNMP communities; or (2) WLAN.html, which discloses WEP keys. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/489009/100/0/threaded - http://www.gnucitizen.org/projec
Container: References: - http://www.securityfocus.com/archive/1/489009/100/0/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/41511
CVE ID: CVE-2008-1529 State: PUBLISHED Published: 2008-03-26T10:00:00 Last Updated: 2024-08-07T08:24:42.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL Prestige routers have a minimum password length for the admin account that is too small, which makes it easier for remote attackers to guess passwords via brute force methods. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/489009/100/0/threaded - http://www.gnucitizen.org/projects/router-hacking-challenge/ - http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/41513
CVE ID: CVE-2008-1530 State: PUBLISHED Published: 2008-03-27T23:00:00 Last Updated: 2024-08-07T08:24:42.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/1056/references - http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/41547 - http://www.ocert.
rmail/gnupg-announce/2008q1/000272.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/41547 - http://www.ocert.org/advisories/ocert-2008-1.html - http://www.securityfocus.com/bid/28487 - https://bugs.g10code.com/gnupg/issue894 - https://bugs.gentoo.org/show_bug.cgi?id=214990 - http://secunia.com/advisories/29568
CVE ID: CVE-2008-1531 State: PUBLISHED Published: 2008-03-27T23:00:00 Last Updated: 2024-08-07T08:24:42.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost. Additional Analyst Notes: - CVE Program Container: References: - http://trac.lighttpd.net/trac/ticket/285#comment:21 - https://issues.rpath.com/browse/RPL-2407 - https://bugs.gentoo.org/show_bug.cgi?id=2148
net/trac/ticket/285#comment:21 - https://issues.rpath.com/browse/RPL-2407 - https://bugs.gentoo.org/show_bug.cgi?id=214892 - http://www.debian.org/security/2008/dsa-1540 - http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html - http://www.osvdb.org/43788 - http://trac.lighttpd.net/trac/changeset/2136 - https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00562.html - http://security.gentoo.org/glsa/glsa-200804-08.xml - http://trac.lighttpd.net/trac/ticket/285#comment:18 - http://secunia.com/advisories/30023 - http://secunia.com/advisories/29505 - http://www.securityfocus.com/archive/1/490323/100/0/threaded - http://wiki.rpath.com/wiki/Advisories:rPSA-200
es/29505 - http://www.securityfocus.com/archive/1/490323/100/0/threaded - http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0132 - http://www.securityfocus.com/bid/28489 - http://secunia.com/advisories/29636 - http://www.vupen.com/english/advisories/2008/1063/references - http://secunia.com/advisories/29544 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41545 - http://secunia.com/advisories/29649 - http://trac.lighttpd.net/trac/changeset/2140 - http://trac.lighttpd.net/trac/changeset/2139 - https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00587.html
CVE ID: CVE-2008-1532 State: PUBLISHED Published: 2008-03-28T00:00:00 Last Updated: 2024-08-07T08:24:42.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Perlbal before 1.70, when buffered upload is enabled, allows remote attackers to cause a denial of service (crash) via a zero-byte chunked upload. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2008/1045/references - https://exchange.xforce.ibmcloud.com/vulnerabilities/41538 - http://search.cpan.org/src/BRADFITZ/Perlbal-1.70/CHANGES - https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00672.html - http://www.securityfocus.com/bid/28491 - http://secuni
t.com/archives/fedora-package-announce/2008-March/msg00672.html - http://www.securityfocus.com/bid/28491 - http://secunia.com/advisories/29565 - https://bugzilla.redhat.com/show_bug.cgi?id=439054 - http://bugs.gentoo.org/show_bug.cgi?id=214784 - http://secunia.com/advisories/29619 - https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00665.html
CVE ID: CVE-2008-1533 State: PUBLISHED Published: 2008-03-28T00:00:00 Last Updated: 2024-08-07T08:24:42.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the XML-RPC Blogger API plugin in Joomla! 1.5 allows remote attackers to perform unauthorized article operations on articles via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41563 - http://secunia.com/advisories/28861 - http://www.securityfocus.com/bid/27719 - http://www.joomla.org/content/view/4560/1/
CVE ID: CVE-2008-1534 State: PUBLISHED Published: 2008-03-28T18:00:00 Last Updated: 2024-08-07T08:24:42.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in PowerPHPBoard 1.00b allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) settings[footer] parameter to footer.inc.php and the (2) settings[header] parameter to header.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41403 - http://securityreason.com/securityalert/3782 - https://www.exploit-db.com/exploits/5303 - http://www.securityfocus.com/archive/1/490011/1
ason.com/securityalert/3782 - https://www.exploit-db.com/exploits/5303 - http://www.securityfocus.com/archive/1/490011/100/0/threaded - http://www.securityfocus.com/bid/28421 - http://www.vupen.com/english/advisories/2008/0992/references
CVE ID: CVE-2008-1535 State: PUBLISHED Published: 2008-03-28T18:00:00 Last Updated: 2024-08-07T08:24:42.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Matti Kiviharju rekry (aka com_rekry or rekry!Joom) 1.0.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the op_id parameter in a view action to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41385 - http://secunia.com/advisories/29510 - https://www.exploit-db.com/exploits/5297 - http://www.securityfocus.com/bid/28422
CVE ID: CVE-2008-1536 State: PUBLISHED Published: 2008-03-28T18:00:00 Last Updated: 2024-08-07T08:24:42.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in Pictures Pro (aka Tim Grissett) Photo Cart 4.1 allows remote attackers to inject arbitrary web script or HTML via the amessage parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28430 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41409 - http://www.picturespro.com/community/forums/photo_cart/index.php?see=viewTopic&topic=29679508032407
nerabilities/41409 - http://www.picturespro.com/community/forums/photo_cart/index.php?see=viewTopic&topic=296795080324075103 - http://secunia.com/advisories/29490
CVE ID: CVE-2008-1537 State: PUBLISHED Published: 2008-03-28T18:00:00 Last Updated: 2024-08-07T08:24:42.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/490008/100/0/threaded - https://www.exploit-db.com/exploits/5302 - https://exch
- http://www.securityfocus.com/archive/1/490008/100/0/threaded - https://www.exploit-db.com/exploits/5302 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41393 - http://securityreason.com/securityalert/3783 - http://secunia.com/advisories/29480 - http://www.securityfocus.com/bid/28418
CVE ID: CVE-2008-1538 State: PUBLISHED Published: 2008-03-28T18:00:00 Last Updated: 2024-08-07T08:24:42.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in searchAction.do in ManageEngine EventLog Analyzer 5 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Fixed in EventLog Analyzer 10.0 Build 10000. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/41408 - http://secunia.com/advisories/29524
CVE ID: CVE-2008-1539 State: PUBLISHED Published: 2008-03-28T18:00:00 Last Updated: 2024-08-07T08:24:42.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in includes/dynamic_titles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/5295 - http://www.securityfocus.com/bid/28410 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41387
CVE ID: CVE-2008-1540 State: PUBLISHED Published: 2008-03-28T18:00:00 Last Updated: 2024-08-07T08:24:42.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Datsogallery (com_datsogallery) 1.3.1 module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/28361 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41348
CVE ID: CVE-2008-1541 State: PUBLISHED Published: 2008-03-28T18:00:00 Last Updated: 2024-08-07T08:24:42.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in cgi-bin/his-webshop.pl in HIS Webshop 2.50 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/5304 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41407 - http://www.securityfocus.com/bid/28425 - http://www.securityfocus.com/archive/1/490016/100/0/threaded - http://www.vupen.com/english/advisories/2008/0991/references - http://secunia.com/advisories
e/1/490016/100/0/threaded - http://www.vupen.com/english/advisories/2008/0991/references - http://secunia.com/advisories/29478 - http://securityreason.com/securityalert/3784
CVE ID: CVE-2008-1542 State: PUBLISHED Published: 2008-03-28T23:00:00 Last Updated: 2024-08-07T08:24:42.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root account, which allows remote attackers to obtain administrative access via a telnet login, a different vulnerability than CVE-2008-1262. Additional Analyst Notes: - CVE Program Container: References: - http://airspan4wimax.googlepages.com/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/41437 - http://www.kb.cert.org/vuls/id/446403
CVE ID: CVE-2008-1543 State: PUBLISHED Published: 2008-03-28T23:00:00 Last Updated: 2024-08-07T08:24:42.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262. Additional Analyst Notes: - CVE Program Container: References: - http://www.sharemethods.net/nepal/servlet/open?keeppath=false&aid=29820 - https://exchange.xforce.ibmcloud.com/vulnerabilities/41567
CVE ID: CVE-2008-1544 State: PUBLISHED Published: 2008-03-28T23:00:00 Last Updated: 2024-08-07T08:24:42.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and
Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header. Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-031 - http://www.mindedsecurity.com/MSA02240108.html - http://secunia.com/advisories/29453 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5291 - http://www.vupen.com/english/advisories/2008/1778 - http://www.securitytracker.com/id?1020226 - http://www.us-cert.gov/cas/techalerts/TA08-162B.html - http://marc.info/?l=bugtraq&m=121380194
ytracker.com/id?1020226 - http://www.us-cert.gov/cas/techalerts/TA08-162B.html - http://marc.info/?l=bugtraq&m=121380194923597&w=2 - http://www.securityfocus.com/bid/28379 - http://www.securityfocus.com/archive/1/489954/100/0/threaded - http://www.vupen.com/english/advisories/2008/0980 - http://marc.info/?l=bugtraq&m=121380194923597&w=2 - http://securityreason.com/securityalert/3785