deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2075
Published: 2008-05-05
Description: Cross-site scripting (XSS) vulnerability in pic.php in AstroCam 2.5.0 through 2.7.3 allows remote attackers to inject arbitrary web script or HTML via the picfile parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://astrocam.svn.sourceforge.net/viewvc/astrocam/BUGS?view=markup; http://astrocam.svn.sourceforge.net/viewvc/astrocam/CHANGELOG?view=markup; http://astrocam.svn.sourceforge.net/viewvc/astrocam/v2.x/pic.php?r1=125&r2=126
CVE: CVE-2008-2076
Published: 2008-05-05
Description: Directory traversal vulnerability in admin.php in ActualScripts ActualAnalyzer Lite 2.78 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the style parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30052; http://www.securityfocus.com/bid/29007; https://exchange.xforce.ibmcloud.com/vulnerabilities/42128
CVE: CVE-2008-2077
Published: 2008-05-05
Description: Unspecified vulnerability in Plain Black WebGUI 7.4.34 has unknown impact and attack vectors related to "data form list view."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29985; http://sourceforge.net/project/shownotes.php?release_id=595907&group_id=51417; http://www.plainblack.com/getwebgui/advisories/webgui-7_4_35-stable-released
CVE: CVE-2008-2078
Published: 2008-05-05
Description: Robocode before 1.6.0 allows user-assisted remote attackers to "access the internals of the Robocode game" via unspecified vectors related to the AWT Event Queue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30043; http://sourceforge.net/project/shownotes.php?release_id=596393; http://www.securityfocus.com/bid/29016
CVE: CVE-2008-2079
Published: 2008-05-05
Description: MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://bugs.mysql.com/bug.php?id=32167; http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html; http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-60.html
CVE: CVE-2008-0599
Published: 2008-05-05
Description: The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-131
References: http://cvs.php.net/viewvc.cgi/php-src/sapi/cgi/cgi_main.c?r1=1.267.2.15.2.50.2.12&r2=1.267.2.15.2.50.2.13&diff_format=u; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01476437; http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html
CVE: CVE-2008-2050
Published: 2008-05-05
Description: Stack-based buffer overflow in the FastCGI SAPI (fastcgi.c) in PHP before 5.2.6 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://cvs.php.net/viewvc.cgi/php-src/sapi/cgi/fastcgi.c?r1=1.44&r2=1.45&diff_format=u; http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
CVE: CVE-2008-2051
Published: 2008-05-05
Description: The escapeshellcmd API function in PHP before 5.2.6 has unknown impact and context-dependent attack vectors related to "incomplete multibyte chars."
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html; http://secunia.com/advisories/30048
CVE: CVE-2008-2081
Published: 2008-05-05
Description: Directory traversal vulnerability in index.php in Siteman 2.0.x2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the module parameter.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://ircrash.com/english/index.php?topic=29.0; http://www.securityfocus.com/bid/28943; https://exchange.xforce.ibmcloud.com/vulnerabilities/42021
CVE: CVE-2008-2082
Published: 2008-05-05
Description: Cross-site scripting (XSS) vulnerability in index.php in Siteman 2.0.x2 allows remote attackers to inject arbitrary web script or HTML via the module parameter, which leaks the path in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ircrash.com/english/index.php?topic=29.0; http://www.securityfocus.com/bid/28943; https://exchange.xforce.ibmcloud.com/vulnerabilities/42020
CVE: CVE-2008-2083
Published: 2008-05-05
Description: SQL injection vulnerability in directory.php in Prozilla Hosting Index, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://advisories.echo.or.id/adv/adv88-K-159-2008.txt; http://secunia.com/advisories/29936; http://securityreason.com/securityalert/3853
CVE: CVE-2008-2084
Published: 2008-05-05
Description: SQL injection vulnerability in topics.php in the MyArticles 0.6 beta-1 module for RunCMS allows remote attackers to execute arbitrary SQL commands via the topic_id parameter in a listarticles action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28952; https://exchange.xforce.ibmcloud.com/vulnerabilities/42016; https://www.exploit-db.com/exploits/5505
CVE: CVE-2008-2005
Published: 2008-05-06
Description: The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary code via a large length value in a Registration packet to TCP port 5413, which causes a memory allocation failure.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/30063; http://www.coresecurity.com/?action=item&id=2187; http://www.kb.cert.org/vuls/id/596268
CVE: CVE-2008-2080
Published: 2008-05-06
Description: Stack-based buffer overflow in the Read32s_64 function in src/lib/cdfread64.c in the NASA Goddard Space Flight Center Common Data Format (CDF) library before 3.2.1 allows context-dependent attackers to execute arbitrary code via a .cdf file with crafted length tags.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html; http://secunia.com/advisories/30053; http://secunia.com/advisories/30169
CVE: CVE-2008-2087
Published: 2008-05-06
Description: SQL injection vulnerability in search_result.php in Softbiz Web Host Directory Script, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the host_id parameter, a different vector than CVE-2005-3817.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://advisories.echo.or.id/adv/adv89-K-159-2008.txt; http://secunia.com/advisories/29983; http://securityreason.com/securityalert/3855
CVE: CVE-2008-2088
Published: 2008-05-06
Description: SQL injection vulnerability in admin/news.php in PHP Forge 3.0 beta 2 allows remote attackers to execute arbitrary SQL commands via the id parameter in the news module to admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28950; http://www.vupen.com/english/advisories/2008/1386/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/42017
CVE: CVE-2008-2089
Published: 2008-05-06
Description: Unspecified vulnerability in the SCTP protocol implementation in Sun Solaris 10 allows remote attackers to cause a denial of service (panic) via a crafted SCTP packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-16
References: http://secunia.com/advisories/29973; http://sunsolve.sun.com/search/document.do?assetkey=1-26-236321-1; http://www.securityfocus.com/bid/29023
CVE: CVE-2008-2090
Published: 2008-05-06
Description: Unspecified vulnerability in the SCTP protocol implementation in Sun Solaris 10 allows remote attackers to cause a denial of service (CPU consumption and network traffic amplification) via a crafted SCTP packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/29973; http://sunsolve.sun.com/search/document.do?assetkey=1-26-236521-1; http://www.securityfocus.com/bid/29024
CVE: CVE-2008-2091
Published: 2008-05-06
Description: Directory traversal vulnerability in ipn.php in KubeLabs Kubelance 1.6.4 allows remote attackers to include and execute arbitrary local files via the i parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28873; http://www.vupen.com/english/advisories/2008/1341/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41905
CVE: CVE-2008-2092
Published: 2008-05-06
Description: Linksys SPA-2102 Phone Adapter 3.3.6 allows remote attackers to cause a denial of service (crash) via a long ping packet ("ping of death"). NOTE: the severity of this issue has been disputed since there are limited attack scenarios.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0425&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6325&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9268&w=2
CVE: CVE-2008-2093
Published: 2008-05-06
Description: SQL injection vulnerability in the Profiler (com_comprofiler) component in Community Builder for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the user parameter in a userProfile action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28911; https://exchange.xforce.ibmcloud.com/vulnerabilities/42008; https://www.exploit-db.com/exploits/5491
CVE: CVE-2008-2094
Published: 2008-05-06
Description: SQL injection vulnerability in article.php in the Article module for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3856; http://www.securityfocus.com/archive/1/491150/100/0/threaded; http://www.securityfocus.com/bid/28879
CVE: CVE-2008-2095
Published: 2008-05-06
Description: SQL injection vulnerability in index.php in the FlippingBook (com_flippingbook) 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28886; http://www.vupen.com/english/advisories/2008/1342/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41942
CVE: CVE-2008-2096
Published: 2008-05-07
Description: SQL injection vulnerability in BackLinkSpider allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to a site-specific component name such as link.php or backlinkspider.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/3857; http://www.securityfocus.com/archive/1/491612/100/0/threaded; http://www.securityfocus.com/bid/29054
CVE: CVE-2008-2103
Published: 2008-05-07
Description: Cross-site scripting (XSS) vulnerability in Bugzilla 2.17.2 and later allows remote attackers to inject arbitrary web script or HTML via the id parameter to the "Format for Printing" view or "Long Format" bug list.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30064; http://secunia.com/advisories/30167; http://www.bugzilla.org/security/2.20.5/
CVE: CVE-2008-2104
Published: 2008-05-07
Description: The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a request to the XML-RPC interface, which bypasses the canconfirm check.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30064; http://www.bugzilla.org/security/2.20.5/; http://www.securityfocus.com/bid/29038
CVE: CVE-2008-2105
Published: 2008-05-07
Description: email_in.pl in Bugzilla 2.23.4, 3.0.x before 3.0.4, and 3.1.x before 3.1.4 allows remote authenticated users to more easily spoof the changer of a bug via a @reporter command in the body of an e-mail message, which overrides the e-mail address as normally obtained from the From e-mail header.  NOTE: since From headers are easily spoofed, this only crosses privilege boundaries in environments that provide additional verification of e-mail addresses.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/30064; http://secunia.com/advisories/30167; http://www.bugzilla.org/security/2.20.5/
CVE: CVE-2008-2106
Published: 2008-05-07
Description: Call of Duty 4 (CoD4) 1.5 and earlier allows remote authenticated users to cause a denial of service (crash) via a type 7 stats packet, which triggers a memcpy with a negative value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/cod4statz-adv.txt; http://secunia.com/advisories/30050; http://securityreason.com/securityalert/3858
CVE: CVE-2008-2107
Published: 2008-05-07
Description: The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 32-bit systems, performs a multiplication using values that can produce a zero seed in rare circumstances, which allows context-dependent attackers to predict subsequent values of the rand and mt_rand functions and possibly bypass protection mechanisms that rely on an unknown initial seed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0103.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html; http://secunia.com/advisories/30757
CVE: CVE-2008-2108
Published: 2008-05-07
Description: The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-331
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0103.html; http://secunia.com/advisories/30757; http://secunia.com/advisories/30828
CVE: CVE-2008-2109
Published: 2008-05-07
Description: field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which triggers an infinite loop.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=210564; http://secunia.com/advisories/30173; http://secunia.com/advisories/30182
CVE: CVE-2008-2110
Published: 2008-05-07
Description: Unrestricted file upload vulnerability in qtofm.php in QTOFileManager 1.0 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/3860; http://www.securityfocus.com/archive/1/491699/100/0/threaded; http://www.securityfocus.com/archive/1/491756/100/0/threaded
CVE: CVE-2008-2111
Published: 2008-05-07
Description: The ActiveX Control (yNotifier.dll) in Yahoo! Assistant 3.6 and earlier allows remote attackers to execute arbitrary code via unspecified vectors in the Ynoifier COM object that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/30115; http://secway.org/advisory/AD20080506EN.txt; http://www.securityfocus.com/bid/29065
CVE: CVE-2007-5001
Published: 2008-05-08
Description: Linux kernel before 2.4.21 allows local users to cause a denial of service (kernel panic) via asynchronous input or output on a FIFO special file.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://lists.vmware.com/pipermail/security-announce/2008/000023.html; http://osvdb.org/44987; http://secunia.com/advisories/30110
CVE: CVE-2007-5498
Published: 2008-05-08
Description: The Xen hypervisor block backend driver for Linux kernel 2.6.18, when running on a 64-bit host with a 32-bit paravirtualized guest, allows local privileged users in the guest OS to cause a denial of service (host OS crash) via a request that specifies a large number of blocks.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/30116; http://secunia.com/advisories/32918; http://www.redhat.com/support/errata/RHSA-2008-0233.html
CVE: CVE-2007-6282
Published: 2008-05-08
Description: The IPsec implementation in Linux kernel before 2.6.25 allows remote routers to cause a denial of service (crash) via a fragmented ESP packet in which the first fragment does not contain the entire ESP header and IV.
CVSS Score: 7.1 (HIGH)
CWE: CWE-16
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00002.html
CVE: CVE-2008-1615
Published: 2008-05-08
Description: Linux kernel 2.6.18, and possibly other versions, when running on AMD64 architectures, allows local users to cause a denial of service (crash) via certain ptrace calls.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00002.html
CVE: CVE-2008-1659
Published: 2008-05-08
Description: Unspecified vulnerability in HP LDAP-UX vB.04.10 through vB.04.15 allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01447010; http://secunia.com/advisories/30132; http://www.securityfocus.com/bid/29078
CVE: CVE-2008-1669
Published: 2008-05-08
Description: Linux kernel before 2.6.25.2 does not apply a certain protection mechanism for fcntl functionality, which allows local users to (1) execute code in parallel or (2) exploit a race condition to obtain "re-ordered access to the descriptor table."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-94, CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.html
CVE: CVE-2008-2042
Published: 2008-05-08
Description: The Javascript API in Adobe Acrobat Professional 7.0.9 and possibly 8.1.1 exposes a dangerous method, which allows remote attackers to execute arbitrary commands or trigger a buffer overflow via a crafted PDF file that invokes app.checkForUpdate with a malicious callback function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30840; http://securityreason.com/securityalert/3861; http://securitytracker.com/id?1019971
CVE: CVE-2008-2112
Published: 2008-05-08
Description: Unspecified vulnerability in Sun Ray Kiosk Mode 4.0 allows local and remote authenticated Sun Ray administrators to gain root privileges via unknown vectors related to utconfig.
CVSS Score: 8.5 (HIGH)
References: http://secunia.com/advisories/30130; http://sunsolve.sun.com/search/document.do?assetkey=1-26-236944-1; http://www.securityfocus.com/bid/29092
CVE: CVE-2008-2113
Published: 2008-05-08
Description: SQL injection vulnerability in annuaire.php in PHPEasyData 1.5.4 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30076; http://www.securityfocus.com/bid/29068; https://exchange.xforce.ibmcloud.com/vulnerabilities/42230
CVE: CVE-2008-2114
Published: 2008-05-08
Description: SQL injection vulnerability in emall/search.php in Pre Shopping Mall 1.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29067; https://exchange.xforce.ibmcloud.com/vulnerabilities/42227; https://www.exploit-db.com/exploits/5551
CVE: CVE-2008-2115
Published: 2008-05-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) te and (2) dir parameters in a tempedit action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3864; http://www.securityfocus.com/archive/1/491702/100/0/threaded; http://www.securityfocus.com/bid/29063
CVE: CVE-2008-2116
Published: 2008-05-08
Description: Multiple directory traversal vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to read arbitrary local files via a .. (dot dot) in the (1) te and (2) dir parameters in a tempedit action.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/3864; http://www.securityfocus.com/archive/1/491702/100/0/threaded; http://www.securityfocus.com/bid/29063
CVE: CVE-2008-2117
Published: 2008-05-08
Description: Cross-site scripting (XSS) vulnerability in pages/news.page.inc in Project Alumni 1.0.9 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a news action to index.php, a different vector than CVE-2007-6126.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3863; http://www.securityfocus.com/archive/1/491552/100/0/threaded; http://www.securityfocus.com/bid/29019
CVE: CVE-2008-2118
Published: 2008-05-08
Description: SQL injection vulnerability in info.php in Project Alumni 1.0.9 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3863; http://www.securityfocus.com/archive/1/491552/100/0/threaded; http://www.securityfocus.com/bid/29019
CVE: CVE-2008-2120
Published: 2008-05-09
Description: Unspecified vulnerability in Sun Java System Application Server 7 2004Q2 before Update 6, Web Server 6.1 before SP8, and Web Server 7.0 before Update 1 allows remote attackers to obtain source code of JSP files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/30122; http://sunsolve.sun.com/search/document.do?assetkey=1-26-201255-1; http://www.securityfocus.com/bid/29088
CVE: CVE-2008-2121
Published: 2008-05-09
Description: The TCP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to cause a denial of service (CPU consumption and new connection timeouts) via a TCP SYN flood attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-16
References: http://secunia.com/advisories/30125; http://secunia.com/advisories/30131; http://sunsolve.sun.com/search/document.do?assetkey=1-26-200864-1
CVE: CVE-2008-2122
Published: 2008-05-09
Description: IBM Rational Build Forge 7.0.2 allows remote attackers to cause a denial of service (CPU consumption) via a port scan, which spawns multiple bfagent server processes that attempt to read data from closed sockets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://secunia.com/advisories/30081; http://www-1.ibm.com/support/docview.wss?uid=swg21303877; http://www.securityfocus.com/bid/29036
CVE: CVE-2008-2123
Published: 2008-05-09
Description: Cross-site scripting (XSS) vulnerability in WGate in SAP Internet Transaction Server (ITS) 6.20 allows remote attackers to inject arbitrary web script or HTML via (1) a "<>" sequence in the ~service parameter to wgate.dll, or (2) Javascript splicing in the query string, a different vector than CVE-2006-5114.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30128; http://www.portcullis-security.com/275.php; http://www.securityfocus.com/bid/29103