deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5127
Published: 2008-11-18
Description: Ocean12 Contact Manager Pro 1.02 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12con.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstorm.linuxsecurity.com/0810-exploits/ocean12-database.txt; http://secunia.com/advisories/32409; https://exchange.xforce.ibmcloud.com/vulnerabilities/46133
CVE: CVE-2008-5128
Published: 2008-11-18
Description: Ocean12 Membership Manager Pro stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12member.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstorm.linuxsecurity.com/0810-exploits/ocean12-database.txt; http://secunia.com/advisories/32409; https://exchange.xforce.ibmcloud.com/vulnerabilities/46133
CVE: CVE-2008-5129
Published: 2008-11-18
Description: Ocean12 Poll Manager Pro 1.00 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12poll.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstorm.linuxsecurity.com/0810-exploits/ocean12-database.txt; http://secunia.com/advisories/32409; https://exchange.xforce.ibmcloud.com/vulnerabilities/46133
CVE: CVE-2008-5130
Published: 2008-11-18
Description: Ocean12 Calendar Manager Gold 2.04 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12cal.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstorm.linuxsecurity.com/0810-exploits/ocean12-database.txt; http://secunia.com/advisories/32409; https://exchange.xforce.ibmcloud.com/vulnerabilities/46133
CVE: CVE-2008-5131
Published: 2008-11-18
Description: Multiple SQL injection vulnerabilities in Develop It Easy News And Article System 1.4 allow remote attackers to execute arbitrary SQL commands via (1) the aid parameter to article_details.php, and the (2) username and (3) password to the admin panel (admin/index.php).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32595; http://securityreason.com/securityalert/4607; http://www.securityfocus.com/bid/32144
CVE: CVE-2008-5132
Published: 2008-11-18
Description: SQL injection vulnerability in inc/ajax/ajax_rating.php in MemHT Portal 4.0.1 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49903; http://secunia.com/advisories/32632; http://securityreason.com/securityalert/4608
CVE: CVE-2008-5133
Published: 2008-11-18
Description: ipnat in IP Filter in Sun Solaris 10 and OpenSolaris before snv_96, when running on a DNS server with Network Address Translation (NAT) configured, improperly changes the source port of a packet when the destination port is the DNS port, which allows remote attackers to bypass an intended CVE-2008-1447 protection mechanism and spoof the responses to DNS queries sent by named.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/32625; http://sunsolve.sun.com/search/document.do?assetkey=1-26-245206-1; http://www.vupen.com/english/advisories/2008/3129
CVE: CVE-2008-5134
Published: 2008-11-18
Description: Buffer overflow in the lbs_process_bss function in drivers/net/wireless/libertas/scan.c in the libertas subsystem in the Linux kernel before 2.6.27.5 allows remote attackers to have an unknown impact via an "invalid beacon/probe response."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://article.gmane.org/gmane.linux.kernel.wireless.general/23049; http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=48735d8d8bd701b1e0cd3d49c21e5e385ddcb077; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00006.html
CVE: CVE-2008-5135
Published: 2008-11-18
Description: os-prober in os-prober 1.17 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/mounted-map or (2) /tmp/raided-map temporary file.  NOTE: the vendor disputes this issue, stating "the insecure code path should only ever run inside a d-i environment, which has no non-root users.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://lists.debian.org/debian-devel/2008/08/msg00296.html; http://lists.debian.org/debian-devel/2008/08/msg00285.html
CVE: CVE-2008-5136
Published: 2008-11-18
Description: tkusr in tkusr 0.82 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/tkusr.pgm temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://www.securityfocus.com/bid/32406; http://lists.debian.org/debian-devel/2008/08/msg00285.html
CVE: CVE-2008-5137
Published: 2008-11-18
Description: tkman in tkman 2.2 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/tkman##### or (2) /tmp/ll temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://www.securityfocus.com/bid/32407; http://lists.debian.org/debian-devel/2008/08/msg00285.html
CVE: CVE-2008-5138
Published: 2008-11-18
Description: passwdehd in libpam-mount 0.43 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/passwdehd.##### temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html; http://secunia.com/advisories/32780
CVE: CVE-2008-5139
Published: 2008-11-18
Description: updatejail in jailer 0.4 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/#####.updatejail temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://secunia.com/advisories/32943; http://secunia.com/advisories/32959
CVE: CVE-2008-5140
Published: 2008-11-18
Description: trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/opr.ini.##### or (2) /tmp/lpt*.zip temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506353#44; http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://secunia.com/advisories/32730
CVE: CVE-2008-5141
Published: 2008-11-18
Description: flamethrower in flamethrower 0.1.8 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/multicast.tar.##### temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506350; http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://secunia.com/advisories/32891
CVE: CVE-2008-5142
Published: 2008-11-18
Description: sendbug in freebsd-sendpr 3.113+5.3 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on a /tmp/pr.##### temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://www.securityfocus.com/bid/32381; http://lists.debian.org/debian-devel/2008/08/msg00285.html
CVE: CVE-2008-5143
Published: 2008-11-18
Description: mgt-helper in multi-gnome-terminal 1.6.2 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/*.debug or (2) /tmp/*.env temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://www.securityfocus.com/bid/32415; http://lists.debian.org/debian-devel/2008/08/msg00285.html
CVE: CVE-2008-5144
Published: 2008-11-18
Description: nvidia-cg-toolkit-installer in nvidia-cg-toolkit 2.0.0015 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/nvidia-cg-toolkit-manifest temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://www.securityfocus.com/bid/32411; http://lists.debian.org/debian-devel/2008/08/msg00285.html
CVE: CVE-2008-5145
Published: 2008-11-18
Description: ltpmenu in ltp 20060918 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/runltp.mainmenu.##### temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://www.securityfocus.com/bid/32414; https://exchange.xforce.ibmcloud.com/vulnerabilities/46715
CVE: CVE-2008-5146
Published: 2008-11-18
Description: add-accession-numbers in ctn 3.0.6 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/accession temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; http://lists.debian.org/debian-devel/2008/08/msg00347.html
CVE: CVE-2008-5147
Published: 2008-11-18
Description: test-pipe-to-pyodconverter.org.sh in docvert 2.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/outer.odt temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; http://www.securityfocus.com/bid/32418
CVE: CVE-2008-5148
Published: 2008-11-18
Description: sch2eaglepos.sh in geda-gnetlist 1.4.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/##### temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://secunia.com/advisories/32806; http://secunia.com/advisories/32875
CVE: CVE-2008-5149
Published: 2008-11-18
Description: fwd_check.sh in libncbi6 6.1.20080302 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/##### temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; http://www.securityfocus.com/bid/32401
CVE: CVE-2008-5150
Published: 2008-11-18
Description: sample.sh in maildirsync 1.1 allows local users to append data to arbitrary files via a symlink attack on a /tmp/maildirsync-*.#####.log temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; http://www.securityfocus.com/bid/32403
CVE: CVE-2008-5151
Published: 2008-11-18
Description: test_parser.py in mayavi 1.5 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/err.log temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; http://lists.debian.org/debian-devel/2008/08/msg00347.html
CVE: CVE-2008-5152
Published: 2008-11-18
Description: inmail-show in mh-book 200605 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/inmail#####.log or (2) /tmp/inmail#####.stdin temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; http://www.securityfocus.com/bid/32399
CVE: CVE-2008-5153
Published: 2008-11-18
Description: spell-check-logic.cgi in Moodle 1.8.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/spell-check-debug.log, (2) /tmp/spell-check-before, or (3) /tmp/spell-check-after temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://secunia.com/advisories/33955; http://uvw.ru/report.sid.txt
CVE: CVE-2008-5154
Published: 2008-11-18
Description: bluetooth.rc in p3nfs 5.19 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/blue.log temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://secunia.com/advisories/32818; http://uvw.ru/report.sid.txt
CVE: CVE-2008-5155
Published: 2008-11-18
Description: mail2sms.sh in smsclient 2.0.8z allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/header.##### or (2) /tmp/body.##### temporary file, or append data to arbitrary files via a symlink attack on the (3) /tmp/sms.log temporary file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; http://www.securityfocus.com/bid/32405
CVE: CVE-2008-5156
Published: 2008-11-18
Description: si_mkbootserver in systemimager-server 3.6.3 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/*.inetd.conf or (2) /tmp/pxe.conf.*.tmp temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; http://www.securityfocus.com/bid/32370
CVE: CVE-2008-5157
Published: 2008-11-18
Description: tau 2.16.4 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/makefile.tau.*.##### or (2) /tmp/makefile.tau*.##### temporary file, related to the (a) tau_cxx, (b) tau_f90, and (c) tau_cc scripts.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506348; http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://secunia.com/advisories/32821
CVE: CVE-2008-5158
Published: 2008-11-18
Description: Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to bypass authentication and perform administrative actions via vectors involving "simply skipping the auth stage."
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://aluigi.org/adv/wincomalpd-adv.txt; http://aluigi.org/poc/wincomalpd.zip; http://secunia.com/advisories/28763
CVE: CVE-2008-5159
Published: 2008-11-18
Description: Integer overflow in the remote administration protocol processing in Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to cause a denial of service (crash) via a large string length argument, which triggers memory corruption.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://aluigi.org/adv/wincomalpd-adv.txt; http://aluigi.org/poc/wincomalpd.zip; http://secunia.com/advisories/28763
CVE: CVE-2008-5160
Published: 2008-11-18
Description: Unspecified vulnerability in MyServer 0.8.11 allows remote attackers to cause a denial of service (daemon crash) via multiple invalid requests with the HTTP GET, DELETE, OPTIONS, and possibly other methods, related to a "204 No Content error."
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/4609; http://www.securityfocus.com/bid/27981; https://www.exploit-db.com/exploits/5184
CVE: CVE-2008-5161
Published: 2008-11-19
Description: Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://isc.sans.org/diary.html?storyid=5366; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
CVE: CVE-2008-5163
Published: 2008-11-19
Description: Multiple SQL injection vulnerabilities in The Rat CMS Pre-Alpha 2 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewarticle.php and (2) viewarticle2.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4612; http://www.securityfocus.com/archive/1/493684/100/0/threaded; http://www.securityfocus.com/bid/29959
CVE: CVE-2008-5164
Published: 2008-11-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in The Rat CMS Pre-Alpha 2 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) viewarticle.php and (b) viewarticle2.php and the (2) PATH_INFO to viewarticle.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4612; http://www.securityfocus.com/archive/1/493684/100/0/threaded; http://www.securityfocus.com/bid/29959
CVE: CVE-2008-5165
Published: 2008-11-19
Description: Multiple SQL injection vulnerabilities in eTicket 1.5.7 allow remote attackers to execute arbitrary SQL commands via the pri parameter to (1) index.php, (2) open.php, (3) open_raw.php, and (4) newticket.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30877; http://www.digitrustgroup.com/advisories/web-application-security-eticket2.html; http://www.eticketsupport.com/announcements/170_is_in_the_building-t91.0.html
CVE: CVE-2008-5166
Published: 2008-11-19
Description: SQL injection vulnerability in riddle.php in Riddles Website 1.2.1 allows remote attackers to execute arbitrary SQL commands via the riddleid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30862; http://securityreason.com/securityalert/4615; http://www.securityfocus.com/bid/29966
CVE: CVE-2008-5167
Published: 2008-11-19
Description: PHP remote file inclusion vulnerability in layout/default/params.php in Boonex Orca 2.0 and 2.0.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the gConf[dir][layouts] parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30855; http://securityreason.com/securityalert/4616; http://www.securityfocus.com/bid/29974
CVE: CVE-2008-5168
Published: 2008-11-19
Description: SQL injection vulnerability in tip.php in Tips Complete Website 1.2.0 allows remote attackers to execute arbitrary SQL commands via the tipid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30861; http://securityreason.com/securityalert/4614; http://www.securityfocus.com/bid/29967
CVE: CVE-2008-5169
Published: 2008-11-19
Description: SQL injection vulnerability in drinks/drink.php in Drinks Complete Website 2.1.0 allows remote attackers to execute arbitrary SQL commands via the drinkid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30859; http://securityreason.com/securityalert/4617; http://www.securityfocus.com/bid/29969
CVE: CVE-2008-5170
Published: 2008-11-19
Description: SQL injection vulnerability in item.php in Cheats Complete Website 1.1.1 allows remote attackers to execute arbitrary SQL commands via the itemid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30838; http://securityreason.com/securityalert/4618; http://www.securityfocus.com/bid/29970
CVE: CVE-2008-5171
Published: 2008-11-19
Description: Multiple directory traversal vulnerabilities in admin/minibb/index.php in phpBLASTER CMS 1.0 RC1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) DB, (2) lang, and (3) skin parameters.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29983; https://www.exploit-db.com/exploits/5952; http://www.securityfocus.com/bid/29983
CVE: CVE-2008-5172
Published: 2008-11-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Yazd Forum Software 3.x allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to (a) search.jsp, and the (2) msg parameter to (b) error.jsp and (c) userAccount.jsp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30760; http://www.securityfocus.com/bid/29980; https://exchange.xforce.ibmcloud.com/vulnerabilities/46744
CVE: CVE-2008-5173
Published: 2008-11-19
Description: Unspecified vulnerability in testMaker before 3.0p16 allows remote authenticated users to execute arbitrary PHP code via unspecified attack vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30870; http://sourceforge.net/project/shownotes.php?release_id=609679; http://www.securityfocus.com/bid/29978
CVE: CVE-2008-5174
Published: 2008-11-19
Description: SQL injection vulnerability in joke.php in Jokes Complete Website 2.1.3 allows remote attackers to execute arbitrary SQL commands via the jokeid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30860; http://securityreason.com/securityalert/4613; http://www.securityfocus.com/bid/29968
CVE: CVE-2008-5175
Published: 2008-11-19
Description: Directory traversal vulnerability in the FTP client in AceFTP Freeware 3.80.3 and AceFTP Pro 3.80.3 allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response to a LIST command, a related issue to CVE-2002-1345.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30792; http://vuln.sg/aceftp3803-en.html; http://www.securityfocus.com/bid/29989
CVE: CVE-2008-5176
Published: 2008-11-20
Description: Multiple buffer overflows in Client Software WinCom LPD Total 3.0.2.623 and earlier allow remote attackers to execute arbitrary code via (1) a long 0x02 command to the remote administration service on TCP port 13500 or (2) a long invalid control filename to LPDService.exe on TCP port 515.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/wincomalpd-adv.txt; http://aluigi.org/poc/wincomalpd.zip; http://secunia.com/advisories/28763
CVE: CVE-2008-5177
Published: 2008-11-20
Description: Stack-based buffer overflow in the DtbClsLogin function in Yosemite Backup 8.7 allows remote attackers to (1) execute arbitrary code on a Linux platform, related to libytlindtb.so; or (2) cause a denial of service (application crash) and possibly execute arbitrary code on a Windows platform, related to ytwindtb.dll; via a long username field during authentication.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/49743; http://osvdb.org/49744; http://secunia.com/advisories/32262
CVE: CVE-2008-5178
Published: 2008-11-20
Description: Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute arbitrary code via a long file:// URI.  NOTE: this might overlap CVE-2008-5680.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2008-11/0110.html; http://osvdb.org/49882; http://secunia.com/advisories/32752
CVE: CVE-2008-5179
Published: 2008-11-20
Description: Unspecified vulnerability in Microsoft Office Communications Server (OCS), Office Communicator, and Windows Live Messenger allows remote attackers to cause a denial of service (crash) via a crafted Real-time Transport Control Protocol (RTCP) receiver report packet.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/32341; http://www.securitytracker.com/id?1021294; http://www.voipshield.com/research-details.php?id=132
CVE: CVE-2008-5180
Published: 2008-11-20
Description: Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests, which trigger the creation of many sessions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://secunia.com/advisories/32940; http://www.exploit-db.com/exploits/12079; http://www.securityfocus.com/bid/39221