deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1340
Published: 2008-03-20
Description: Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.0.x before 6.0.3, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 allows attackers to cause a denial of service (host OS crash) via crafted VMCI calls that trigger "memory exhaustion and memory corruption."
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://lists.vmware.com/pipermail/security-announce/2008/000008.html; http://security.gentoo.org/glsa/glsa-201209-25.xml; http://securityreason.com/securityalert/3755
CVE: CVE-2008-1361
Published: 2008-03-20
Description: VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges via an unspecified manipulation that causes the authd process to connect to an arbitrary named pipe, a different vulnerability than CVE-2008-1362.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.vmware.com/pipermail/security-announce/2008/000008.html; http://security.gentoo.org/glsa/glsa-201209-25.xml; http://securityreason.com/securityalert/3755
CVE: CVE-2008-1362
Published: 2008-03-20
Description: VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges or cause a denial of service by impersonating the authd process through an unspecified use of an "insecurely created named pipe," a different vulnerability than CVE-2008-1361.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.vmware.com/pipermail/security-announce/2008/000008.html; http://security.gentoo.org/glsa/glsa-201209-25.xml; http://securityreason.com/securityalert/3755
CVE: CVE-2008-1363
Published: 2008-03-20
Description: VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges via an unspecified manipulation of a config.ini file located in an Application Data folder, which can be used for "hijacking the VMX process."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.vmware.com/pipermail/security-announce/2008/000008.html; http://security.gentoo.org/glsa/glsa-201209-25.xml; http://securityreason.com/securityalert/3755
CVE: CVE-2008-1364
Published: 2008-03-20
Description: Unspecified vulnerability in the DHCP service in VMware Workstation 5.5.x before 5.5.6, VMware Player 1.0.x before 1.0.6, VMware ACE 1.0.x before 1.0.5, VMware Server 1.0.x before 1.0.5, and VMware Fusion 1.1.x before 1.1.1 allows attackers to cause a denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://lists.vmware.com/pipermail/security-announce/2008/000008.html; http://security.gentoo.org/glsa/glsa-201209-25.xml; http://securityreason.com/securityalert/3755
CVE: CVE-2008-1392
Published: 2008-03-20
Description: The default configuration of VMware Workstation 6.0.2, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 makes the console of the guest OS accessible through anonymous VIX API calls, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://lists.vmware.com/pipermail/security-announce/2008/000008.html; http://security.gentoo.org/glsa/glsa-201209-25.xml; http://securityreason.com/securityalert/3755
CVE: CVE-2008-1393
Published: 2008-03-20
Description: Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords; http://plone.org/products/plone/roadmap/48?; http://securityreason.com/securityalert/3754
CVE: CVE-2008-1394
Published: 2008-03-20
Description: Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://plone.org/about/security/overview/security-overview-of-plone/; http://securityreason.com/securityalert/3754; http://www.procheckup.com/Hacking_Plone_CMS.pdf
CVE: CVE-2008-1395
Published: 2008-03-20
Description: Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/3754; http://www.procheckup.com/Hacking_Plone_CMS.pdf; http://www.securityfocus.com/archive/1/489544/100/0/threaded
CVE: CVE-2008-1396
Published: 2008-03-20
Description: Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://securityreason.com/securityalert/3754; http://www.procheckup.com/Hacking_Plone_CMS.pdf; http://www.securityfocus.com/archive/1/489544/100/0/threaded
CVE: CVE-2008-1397
Published: 2008-03-20
Description: Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service (site-to-site VPN tunnel outage), and possibly intercept network traffic, by configuring the local RFC1918 IP address to be the same as one of this tunnel's endpoint RFC1918 IP addresses, and then using SecuRemote to connect to a network interface at the other endpoint.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://puresecurity.com.au/index.php?action=fullnews&id=5; http://secunia.com/advisories/29394; http://www.kb.cert.org/vuls/id/992585
CVE: CVE-2008-1012
Published: 2008-03-20
Description: Unspecified vulnerability in Apple AirPort Extreme Base Station Firmware 7.3.1 allows remote attackers to cause a denial of service (file sharing hang) via a crafted AFP request, related to "input validation."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2008/Mar/msg00002.html; http://secunia.com/advisories/29447; http://support.apple.com/kb/HT1226
CVE: CVE-2008-1398
Published: 2008-03-20
Description: SQL injection vulnerability in online.php in AuraCMS 2.0 through 2.2.1 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field (HTTP_X_FORWARDED_FOR environment variable) in an HTTP header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28257; https://exchange.xforce.ibmcloud.com/vulnerabilities/41217; https://www.exploit-db.com/exploits/5256
CVE: CVE-2008-1399
Published: 2008-03-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Clansphere 2008 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29534; http://www.securityfocus.com/bid/28224; https://exchange.xforce.ibmcloud.com/vulnerabilities/41190
CVE: CVE-2008-1400
Published: 2008-03-20
Description: Directory traversal vulnerability in the Net Inspector HTTP Server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) or "../" (dot dot slash) in the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/netinsp-adv.txt; http://secunia.com/advisories/29421; http://www.securityfocus.com/archive/1/489704/100/0/threaded
CVE: CVE-2008-1401
Published: 2008-03-20
Description: Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to execute arbitrary code via format string specifiers in the URI, which is recorded in a log file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/netinsp-adv.txt; http://secunia.com/advisories/29421; http://www.securityfocus.com/archive/1/489704/100/0/threaded
CVE: CVE-2008-1402
Published: 2008-03-20
Description: MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to cause a (1) denial of service (exception and crash) via a UDP packet to the SNMP Trap Service (MgWTrap3.exe) or (2) denial of service (device freeze or memory consumption) via a malformed request to the Net Inspector Server (niengine).
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/netinsp-adv.txt; http://secunia.com/advisories/29421; http://www.securityfocus.com/archive/1/489704/100/0/threaded
CVE: CVE-2008-1403
Published: 2008-03-20
Description: Stack-based buffer overflow in the TFTP server in BootManage TFTPD 1.99 and earlier in BootManage Administrator 7.1 and earlier allows remote attackers to execute arbitrary code via a request with a long filename.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/bootixtftpd-adv.txt; http://secunia.com/advisories/29404; http://www.securityfocus.com/archive/1/489705/100/0/threaded
CVE: CVE-2008-1404
Published: 2008-03-20
Description: SQL injection vulnerability in index.php in the Viso (Industry Book) 2.04 and 2.03 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the kid parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29389; http://www.securityfocus.com/bid/28255; https://exchange.xforce.ibmcloud.com/vulnerabilities/41216
CVE: CVE-2008-1405
Published: 2008-03-20
Description: PHP remote file inclusion vulnerability in code/display.php in fuzzylime (cms) 3.01 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://irk4z.wordpress.com/2008/03/15/fuzzylime-cms-301-remote-file-inclusion-vulnerability/; http://secunia.com/advisories/29417; http://www.vupen.com/english/advisories/2008/0912/references
CVE: CVE-2008-1406
Published: 2008-03-20
Description: SQL injection vulnerability in annonces-p-f.php in the MyAnnonces 1.8 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the lid parameter in an ImprAnn action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29384; http://www.securityfocus.com/bid/28254; https://exchange.xforce.ibmcloud.com/vulnerabilities/41214
CVE: CVE-2008-1407
Published: 2008-03-20
Description: SQL injection vulnerability in index.php in the WebChat 1.60 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the roomid parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29390; http://www.securityfocus.com/bid/28256; https://exchange.xforce.ibmcloud.com/vulnerabilities/41213
CVE: CVE-2008-1408
Published: 2008-03-20
Description: SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 (2.204) FIX 4 allows remote attackers to execute arbitrary SQL commands via the id parameter in a banner_out action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://irk4z.wordpress.com/2008/03/16/phpbp-rc3-2204-fix4-remote-sql-injection-vulnerability/; http://secunia.com/advisories/29411; http://www.phpbp.com/filedownload-phpbp2-RC3-204-fix5_22.html
CVE: CVE-2008-1409
Published: 2008-03-20
Description: Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the theme parameter to (1) index.php, (2) editpassword.php, and (3) avatar.php in usercp/; (4) custompage.php; (5) errors/404.php; (6) memberslist.php and (7) profile.php in members/; (8) index.php and (9) fullview.php in news/; and (10) nopermission.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28273; http://www.vupen.com/english/advisories/2008/0909/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41238
CVE: CVE-2008-1410
Published: 2008-03-20
Description: Directory traversal vulnerability in the PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to read arbitrary files via directory traversal sequences to the TFTP service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/acropxe-adv.txt; http://secunia.com/advisories/29305; http://securityreason.com/securityalert/3758
CVE: CVE-2008-1411
Published: 2008-03-20
Description: The PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to cause a denial of service (crash) via an incomplete TFTP request, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/acropxe-adv.txt; http://secunia.com/advisories/29305; http://securityreason.com/securityalert/3758
CVE: CVE-2008-1412
Published: 2008-03-20
Description: Unspecified vulnerability in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, allows remote attackers to execute arbitrary code or cause a denial of service (hang or crash) via a malformed archive that triggers an unhandled exception, as demonstrated by the PROTOS GENOME test suite for Archive Formats.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/29397; http://support.f-secure.com/enu/corporate/downloads/hotfixes/av-cs-hotfixes.shtml; http://support.f-secure.com/enu/corporate/downloads/hotfixes/av-mimesweeper-hotfixes.shtml
CVE: CVE-2008-1413
Published: 2008-03-20
Description: Cross-site scripting (XSS) vulnerability in search.php in SNewsCMS Rus 2.1 through 2.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3757; http://www.securityfocus.com/archive/1/489686/100/0/threaded; http://www.securityfocus.com/bid/28262
CVE: CVE-2008-1414
Published: 2008-03-20
Description: Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the tab parameter to (1) index.php, as demonstrated using mixed case and encoded whitespace characters in the tag; or (2) clientinfo.php, (3) invoices.php, (4) smartlinks.php, and (5) todo.php, as demonstrated using a META tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29416; http://securityreason.com/securityalert/3756; http://www.securityfocus.com/archive/1/489689/100/0/threaded
CVE: CVE-2008-1415
Published: 2008-03-20
Description: Directory traversal vulnerability in index.php in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to read arbitrary files via "../..//" (modified dot dot) sequences in the tab parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/3756; http://www.securityfocus.com/archive/1/489689/100/0/threaded; http://www.securityfocus.com/bid/28263
CVE: CVE-2008-1416
Published: 2008-03-20
Description: Multiple PHP remote file inclusion vulnerabilities in PHPauction GPL 2.51 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) converter.inc.php, (2) messages.inc.php, and (3) settings.inc.php in includes/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29422; http://www.securityfocus.com/bid/28284; http://www.vupen.com/english/advisories/2008/0908/references
CVE: CVE-2008-1417
Published: 2008-03-20
Description: The prerm script in axyl 2.1.7 allows local users to overwrite arbitrary files via a symlink attack on the axyl.conf temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471227; https://exchange.xforce.ibmcloud.com/vulnerabilities/41406; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471227
CVE: CVE-2008-1425
Published: 2008-03-20
Description: SQL injection vulnerability in index.php in the gallery module in Easy-Clanpage 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a kate action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29430; http://www.securityfocus.com/bid/28309; https://exchange.xforce.ibmcloud.com/vulnerabilities/41303
CVE: CVE-2008-1426
Published: 2008-03-20
Description: SQL injection vulnerability in album.asp in KAPhotoservice allows remote attackers to execute arbitrary SQL commands via the albumid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29433; http://www.securityfocus.com/archive/1/489891/100/0/threaded; http://www.securityfocus.com/bid/28306
CVE: CVE-2008-1427
Published: 2008-03-20
Description: SQL injection vulnerability in the Joobi Acajoom (com_acajoom) 1.1.5 and 1.2.5 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mailingid parameter in a mailing view action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29429; http://www.securityfocus.com/bid/28305; https://exchange.xforce.ibmcloud.com/vulnerabilities/41290
CVE: CVE-2008-1428
Published: 2008-03-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-beta7 module for Drupal allow remote attackers to inject arbitrary web script or HTML via a text attribute value for a product.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/233492; http://www.vupen.com/english/advisories/2008/0867/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41184
CVE: CVE-2008-1429
Published: 2008-03-20
Description: Secure Internet Live Conferencing (SILC) Server before 1.1.1 allows remote attackers to cause a denial of service (daemon crash) via a NEW_CLIENT packet without a nickname.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/29459; http://secunia.com/advisories/29946; http://security.gentoo.org/glsa/glsa-200804-27.xml
CVE: CVE-2008-1430
Published: 2008-03-20
Description: SQL injection vulnerability in links.asp in ASPapp allows remote attackers to execute arbitrary SQL commands via the CatId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/5276; https://www.exploit-db.com/exploits/5276
CVE: CVE-2008-1431
Published: 2008-03-20
Description: RaidSonic NAS-4220-B with 2.6.0-n(2007-10-11) firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://secunia.com/advisories/29401; http://securityreason.com/securityalert/3760; http://www.securityfocus.com/archive/1/489690/100/0/threaded
CVE: CVE-2008-1432
Published: 2008-03-20
Description: Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, a related issue to CVE-2008-1299.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29441; http://secunia.com/advisories/29441
CVE: CVE-2008-1201
Published: 2008-03-24
Description: Multiple unspecified vulnerabilities in FLA file parsing in Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 on Windows allow user-assisted remote attackers to execute arbitrary code via a crafted .FLA file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://ruder.cdut.net/blogview.asp?logID=241; http://secunia.com/advisories/29455; http://www.adobe.com/support/security/advisories/apsa08-03.html
CVE: CVE-2008-1289
Published: 2008-03-24
Description: Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the process_sdp function in channels/chan_sip.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://downloads.digium.com/pub/security/AST-2008-002.html; http://labs.musecurity.com/advisories/MU-200803-01.txt; http://secunia.com/advisories/29426
CVE: CVE-2008-1290
Published: 2008-03-24
Description: ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380; http://bugs.gentoo.org/show_bug.cgi?id=212288; http://secunia.com/advisories/29176
CVE: CVE-2008-1291
Published: 2008-03-24
Description: ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380; http://bugs.gentoo.org/show_bug.cgi?id=212288; http://secunia.com/advisories/29176
CVE: CVE-2008-1292
Published: 2008-03-24
Description: ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380; http://bugs.gentoo.org/show_bug.cgi?id=212288; http://secunia.com/advisories/29176
CVE: CVE-2008-1390
Published: 2008-03-24
Description: The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.
CVSS Score: 9.3 (HIGH)
CWE: CWE-255
References: http://downloads.digium.com/pub/security/AST-2008-005.html; http://secunia.com/advisories/29449; http://secunia.com/advisories/29470
CVE: CVE-2008-1458
Published: 2008-03-24
Description: Cross-site scripting (XSS) vulnerability in index.php in CS-Cart 1.3.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a products search action.  NOTE: it was also reported that 1.3.5-SP2 trial edition is also affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29468; http://securityreason.com/securityalert/3762; http://www.securityfocus.com/archive/1/489857/100/0/threaded