deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2469
Published: 2008-10-23
Description: Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?format=multiple&id=242254; http://secunia.com/advisories/32396; http://secunia.com/advisories/32450
CVE: CVE-2008-3815
Published: 2008-10-23
Description: Unspecified vulnerability in Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)3, 7.1 before 7.1(2)78, 7.2 before 7.2(4)16, 8.0 before 8.0(4)6, and 8.1 before 8.1(1)13, when configured as a VPN using Microsoft Windows NT Domain authentication, allows remote attackers to bypass VPN authentication via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/32360; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a183ba.shtml; http://www.securityfocus.com/bid/31864
CVE: CVE-2008-3816
Published: 2008-10-23
Description: Unspecified vulnerability in Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.2(4)9 and 7.2(4)10 allows remote attackers to cause a denial of service (device reload) via a crafted IPv6 packet.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/32391; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a183ba.shtml; http://www.securityfocus.com/bid/31863
CVE: CVE-2008-3817
Published: 2008-10-23
Description: Memory leak in Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 8.0 before 8.0(4) and 8.1 before 8.1(2) allows remote attackers to cause a denial of service (memory consumption) via an unspecified sequence of packets, related to the "initialization code for the hardware crypto accelerator."
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/32392; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a183ba.shtml; http://www.securityfocus.com/bid/31865
CVE: CVE-2008-3862
Published: 2008-10-23
Description: Stack-based buffer overflow in CGI programs in the server in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1374, and 8.0 SP1 Patch 1 before build 3110, allows remote attackers to execute arbitrary code via an HTTP POST request containing crafted form data, related to "parsing CGI requests."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32005; http://secunia.com/secunia_research/2008-40/; http://securityreason.com/securityalert/4489
CVE: CVE-2008-3863
Published: 2008-10-23
Description: Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html; http://rhn.redhat.com/errata/RHSA-2008-1021.html
CVE: CVE-2008-4250
Published: 2008-10-23
Description: The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://blogs.securiteam.com/index.php/archives/1150; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1213&w=2; http://secunia.com/advisories/32326
CVE: CVE-2008-4694
Published: 2008-10-23
Description: Unspecified vulnerability in Opera before 9.60 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a redirect that specifies a crafted URL.
CVSS Score: 9.3 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html; http://secunia.com/advisories/32177; http://secunia.com/advisories/32394
CVE: CVE-2008-4695
Published: 2008-10-23
Description: Opera before 9.60 allows remote attackers to obtain sensitive information and have unspecified other impact by predicting the cache pathname of a cached Java applet and then launching this applet from the cache, leading to applet execution within the local-machine context.
CVSS Score: 9.3 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html; http://secunia.com/advisories/32177; http://secunia.com/advisories/32394
CVE: CVE-2008-4696
Published: 2008-10-23
Description: Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identifier (aka the "optional fragment"), which is not properly escaped before storage in the History Search database (aka md.dat).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html; http://secunia.com/advisories/32299; http://secunia.com/advisories/32394
CVE: CVE-2008-4697
Published: 2008-10-23
Description: The Fast Forward feature in Opera before 9.61, when a page is located in a frame, executes a javascript: URL in the context of the outermost page instead of the page that contains this URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html; http://secunia.com/advisories/32299; http://secunia.com/advisories/32394
CVE: CVE-2008-4698
Published: 2008-10-23
Description: Opera before 9.61 does not properly block scripts during preview of a news feed, which allows remote attackers to create arbitrary new feed subscriptions and read the contents of arbitrary feeds.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html; http://secunia.com/advisories/32299; http://secunia.com/advisories/32394
CVE: CVE-2008-4722
Published: 2008-10-23
Description: Unspecified vulnerability in Sun Integrated Lights-Out Manager (ILOM) 2.0.1.5 through 2.0.4.26 allows remote authenticated users to (1) access the service processor (SP) and cause a denial of service (shutdown or reboot), or (2) access the host operating system and have an unspecified impact, via unknown vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32298; http://sunsolve.sun.com/search/document.do?assetkey=1-26-243486-1; http://www.securityfocus.com/bid/31861
CVE: CVE-2008-4723
Published: 2008-10-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 3.0.1 through 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an ftp:// URL for an HTML document within a (1) JPG, (2) PDF, or (3) TXT file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/31855; http://www.securityfocus.com/bid/31855
CVE: CVE-2008-4724
Published: 2008-10-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Google Chrome 0.2.149.30 allow remote attackers to inject arbitrary web script or HTML via an ftp:// URL for an HTML document within a (1) JPG, (2) PDF, or (3) TXT file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/31855; http://www.securityfocus.com/bid/31855
CVE: CVE-2008-4725
Published: 2008-10-23
Description: Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly escaped before storage in the History Search database (aka md.dat), a different vector than CVE-2008-4696.  NOTE: some of these issues were addressed before 9.60.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32299; http://securityreason.com/securityalert/4504; http://www.openwall.com/lists/oss-security/2008/10/21/6
CVE: CVE-2008-4726
Published: 2008-10-24
Description: Stack-based buffer overflow in the SFTP subsystem in GoodTech SSH 6.4 allows remote authenticated users to execute arbitrary code via a long string to the (1) open (aka SSH_FXP_OPEN), (2) unlink, (3) opendir, and other unspecified parameters.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32375; http://securityreason.com/securityalert/4498; http://www.securityfocus.com/archive/1/497745/100/0/threaded
CVE: CVE-2008-4727
Published: 2008-10-24
Description: Cross-site scripting (XSS) vulnerability in the contact update page (ss/bwgkoemr.P_UpdateEmrgContacts) in SunGard Banner Student 7.3 allows remote attackers to inject arbitrary web script or HTML via the addr1 parameter.  NOTE: this might be resultant from a CSRF vulnerability, but there are insufficient details to be sure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/27490.html; http://osvdb.org/41077; http://osvdb.org/41078
CVE: CVE-2008-4728
Published: 2008-10-24
Description: Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in Hummingbird Deployment Wizard 2008 allow remote attackers to execute arbitrary programs via the (1) Run and (2) PerformUpdateAsync methods, and (3) modify arbitrary registry values via the SetRegistryValueAsString method.  NOTE: the SetRegistryValueAsString method could be leveraged for code execution by specifying executable file values to Startup folders.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/32337; http://www.securityfocus.com/bid/31799; http://www.shinnai.net/xplits/TXT_2XfQ1sHruhjaoePszNTG.html
CVE: CVE-2008-4729
Published: 2008-10-24
Description: Stack-based buffer overflow in Hummingbird.XWebHostCtrl.1 ActiveX control (hclxweb.dll) in Hummingbird Xweb ActiveX Control 13.0 and earlier allows remote attackers to execute arbitrary code via a long PlainTextPassword property.  NOTE: code execution might not be possible in 13.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/32319; http://securityreason.com/securityalert/4505; http://www.securityfocus.com/bid/31783
CVE: CVE-2008-4730
Published: 2008-10-24
Description: Cross-site scripting (XSS) vulnerability in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openid_trust_root parameter and an inconsistent openid_return_to parameter, which is not properly handled in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4484; http://www.securityfocus.com/archive/1/496930/100/0/threaded; http://securityreason.com/securityalert/4484
CVE: CVE-2008-4731
Published: 2008-10-24
Description: Multiple unspecified vulnerabilities in YaCy before 0.61 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://freshmeat.net/projects/yacy/?branch_id=51198&release_id=286006; http://secunia.com/advisories/32159; http://www.securityfocus.com/bid/31657
CVE: CVE-2008-4732
Published: 2008-10-24
Description: SQL injection vulnerability in ajax_comments.php in the WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://chxsecurity.org/advisories/adv-3-full.txt; http://secunia.com/advisories/32253; http://securityreason.com/securityalert/4492
CVE: CVE-2008-4733
Published: 2008-10-24
Description: Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) replytotext, (2) quotetext, (3) originallypostedby, (4) sep, (5) maxtags, (6) tagsep, (7) tagheadersep, (8) taglabel, and (9) tagheaderlabel parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://chxsecurity.org/advisories/adv-3-full.txt; http://secunia.com/advisories/32253; http://securityreason.com/securityalert/4492
CVE: CVE-2008-4734
Published: 2008-10-24
Description: Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to perform unauthorized actions as administrators via a request that sets the wpcr_hidden_form_input parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://chxsecurity.org/advisories/adv-3-full.txt; http://secunia.com/advisories/32253; http://securityreason.com/securityalert/4492
CVE: CVE-2008-4735
Published: 2008-10-24
Description: PHP remote file inclusion vulnerability in header.php in Concord Asset, Software, and Ticket system (CoAST) 0.95 allows remote attackers to execute arbitrary PHP code via a URL in the sections_file parameter.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32050; http://www.securityfocus.com/bid/31461; https://www.exploit-db.com/exploits/6598
CVE: CVE-2008-4736
Published: 2008-10-24
Description: SQL injection vulnerability in index.php in RPG.Board 0.8 Beta2 and earlier allows remote attackers to execute arbitrary SQL commands via the showtopic parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0901&w=2; http://securityreason.com/securityalert/4483; http://www.securityfocus.com/bid/31417
CVE: CVE-2008-4737
Published: 2008-10-24
Description: Cross-site scripting (XSS) vulnerability in wholite.cgi in WhoDomLite 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the dom parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32085; http://www.osvdb.org/48630; http://www.securityfocus.com/bid/31436
CVE: CVE-2008-4738
Published: 2008-10-24
Description: SQL injection vulnerability in gallery.php in MyCard 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32039; http://securityreason.com/securityalert/4476; http://www.securityfocus.com/bid/31447
CVE: CVE-2008-4739
Published: 2008-10-24
Description: Directory traversal vulnerability in index.php in PlugSpace 0.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the navi parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32033; http://securityreason.com/securityalert/4475; http://www.securityfocus.com/bid/31457
CVE: CVE-2006-7234
Published: 2008-10-27
Description: Untrusted search path vulnerability in Lynx before 2.8.6rel.4 allows local users to execute arbitrary code via malicious (1) .mailcap and (2) mime.types files in the current working directory.
CVSS Score: 4.6 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=396949; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html; http://secunia.com/advisories/32407
CVE: CVE-2008-4740
Published: 2008-10-27
Description: Directory traversal vulnerability in templater.php in the ZZ_Templater module in TinyCMS 1.1.2, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the config[template] parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://1scripts.net/php-scripts/index.php?p=6; http://secunia.com/advisories/31569; http://securityreason.com/securityalert/4506
CVE: CVE-2008-4741
Published: 2008-10-27
Description: Directory traversal vulnerability in index.php in FAR-PHP 1.00, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the c parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2734&w=2; http://secunia.com/advisories/31563; http://securityreason.com/securityalert/4507
CVE: CVE-2008-4742
Published: 2008-10-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in interface/Login.php in TimeTrex 2.2.11 allow remote attackers to inject arbitrary web script or HTML via the (1) password and (2) user_name parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2008-08/0224.html; http://www.hackerscenter.com/index.php?/HSC-Research-Group/Advisories/HSC-TimeTrex-Time-and-Attendance-Cookie-Theft.html; http://www.securityfocus.com/archive/1/495643/100/0/threaded
CVE: CVE-2008-4743
Published: 2008-10-27
Description: SQL injection vulnerability in index.php in QuidaScript FAQ Management Script allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32052; http://www.packetstormsecurity.org/0808-exploits/faqman-sql.txt; http://www.securityfocus.com/bid/30775
CVE: CVE-2008-4744
Published: 2008-10-27
Description: SQL injection vulnerability in product_detail.php in DXShopCart 4.30mc allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.packetstormsecurity.org/0808-exploits/dxshopcart-sql.txt; http://www.securityfocus.com/bid/30772; https://exchange.xforce.ibmcloud.com/vulnerabilities/44582
CVE: CVE-2008-4745
Published: 2008-10-27
Description: Cross-site scripting (XSS) vulnerability in emailFriend.asp in Uniwin eCart Professional 2.0.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31545; http://www.uniwin.com/eCart_revisions.asp; https://exchange.xforce.ibmcloud.com/vulnerabilities/44610
CVE: CVE-2008-4746
Published: 2008-10-27
Description: Multiple SQL injection vulnerabilities in Uniwin eCart Professional 2.0.17 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to (1) search.asp and (2) cartUtil.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31545; http://www.uniwin.com/eCart_revisions.asp; https://exchange.xforce.ibmcloud.com/vulnerabilities/44609
CVE: CVE-2008-4747
Published: 2008-10-27
Description: Unspecified vulnerability in the search feature in Sun Java System LDAP JDK before 4.20 allows context-dependent attackers to obtain sensitive information via unknown attack vectors related to the LDAP JDK library.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/32327; http://sunsolve.sun.com/search/document.do?assetkey=1-26-242246-1; http://www.securityfocus.com/bid/31905
CVE: CVE-2008-4748
Published: 2008-10-27
Description: Format string vulnerability in the URI handler in KVirc 3.4.0, when set as the default application for processing IRC URIs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in the irc:// URI.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/32410; http://securityreason.com/securityalert/4508; http://www.securityfocus.com/bid/31912
CVE: CVE-2008-4749
Published: 2008-10-27
Description: Multiple insecure method vulnerabilities in the VImpX.VImpAX ActiveX control (VImpX.ocx) 4.8.8.0 in DB Software Laboratory VImp X, possibly 4.7.7, allow remote attackers to overwrite arbitrary files via (1) the LogFile property and ClearLogFile method, and (2) the SaveToFile method.
CVSS Score: 9.3 (HIGH)
References: http://securityreason.com/securityalert/4509; http://www.securityfocus.com/bid/31907; https://exchange.xforce.ibmcloud.com/vulnerabilities/46096
CVE: CVE-2008-4750
Published: 2008-10-27
Description: Stack-based buffer overflow in the VImpX.VImpAX ActiveX control (VImpX.ocx) 4.8.8.0 in DB Software Laboratory VImp X, possibly 4.7.7, allows remote attackers to execute arbitrary code via a long LogFile property.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4509; http://www.securityfocus.com/bid/31907; https://exchange.xforce.ibmcloud.com/vulnerabilities/46095
CVE: CVE-2008-4751
Published: 2008-10-27
Description: Cross-site scripting (XSS) vulnerability in index.php in iPei Guestbook 2.0 allows remote attackers to inject arbitrary web script or HTML via the pg parameter, a different vector than CVE-2005-4597.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0810-exploits/ipei-xss.txt; http://secunia.com/advisories/32429; http://securityreason.com/securityalert/4510
CVE: CVE-2008-4752
Published: 2008-10-27
Description: TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login cookie to admin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32405; http://securityreason.com/securityalert/4511; http://www.securityfocus.com/bid/31919
CVE: CVE-2008-4753
Published: 2008-10-27
Description: SQL injection vulnerability in EditUrl.php in AJ Square RSS Reader allows remote attackers to execute arbitrary SQL commands via the url parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4512; http://www.securityfocus.com/bid/31910; https://exchange.xforce.ibmcloud.com/vulnerabilities/46088
CVE: CVE-2008-4754
Published: 2008-10-27
Description: SQL injection vulnerability in forum.php in Scripts for Sites (SFS) Ez Forum allows remote attackers to execute arbitrary SQL commands via the forum parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32397; http://securityreason.com/securityalert/4513; http://www.securityfocus.com/bid/31924
CVE: CVE-2008-4755
Published: 2008-10-28
Description: SQL injection vulnerability in gotourl.php in PozScripts Classified Auctions Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32373; http://securityreason.com/securityalert/4521; http://www.securityfocus.com/bid/31925
CVE: CVE-2008-4756
Published: 2008-10-28
Description: Cross-site scripting (XSS) vulnerability in add_prest_date.php in PHP-Daily allows remote attackers to inject arbitrary web script or HTML via the date parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/31915; https://exchange.xforce.ibmcloud.com/vulnerabilities/46128; https://www.exploit-db.com/exploits/6833
CVE: CVE-2008-4757
Published: 2008-10-28
Description: Multiple SQL injection vulnerabilities in PHP-Daily allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) add_postit.php (b) delete.php, and (c) mod_prest_date.php; and the (2) prev parameter to (d) prest_detail.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31915; https://exchange.xforce.ibmcloud.com/vulnerabilities/46125; https://www.exploit-db.com/exploits/6833
CVE: CVE-2008-4758
Published: 2008-10-28
Description: Directory traversal vulnerability in download_file.php in PHP-Daily allows remote attackers to read arbitrary local files via a .. (dot dot) in the fichier parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4527; http://www.securityfocus.com/bid/31915; https://exchange.xforce.ibmcloud.com/vulnerabilities/46126
CVE: CVE-2008-4759
Published: 2008-10-28
Description: Directory traversal vulnerability in download.php in BuzzyWall 1.3.1 allows remote attackers to read arbitrary local files via a .. (dot dot) in the id parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4520; http://www.securityfocus.com/bid/31914; http://www.vupen.com/english/advisories/2008/2925