deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5267
Published: 2008-11-28
Description: SQL injection vulnerability in answer.php in Experts 1.0.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the question_id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4654; http://www.securityfocus.com/bid/29642; https://exchange.xforce.ibmcloud.com/vulnerabilities/42954
CVE: CVE-2008-5268
Published: 2008-11-28
Description: SQL injection vulnerability in content/forums/reply.asp in ASPPortal allows remote attackers to execute arbitrary SQL commands via the Topic_Id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4653; http://www.securityfocus.com/archive/1/493302/100/0/threaded; http://www.securityfocus.com/bid/29631
CVE: CVE-2008-5269
Published: 2008-11-28
Description: SQL injection vulnerability in index.php in pSys 0.7.0 alpha allows remote attackers to execute arbitrary SQL commands via the shownews parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4652; https://exchange.xforce.ibmcloud.com/vulnerabilities/42916; https://www.exploit-db.com/exploits/5745
CVE: CVE-2008-5270
Published: 2008-11-28
Description: SQL injection vulnerability in view.topics.php in Yuhhu Superstar 2008 allows remote attackers to execute arbitrary SQL commands via the board parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4651; http://www.securityfocus.com/bid/29647; https://www.exploit-db.com/exploits/5783
CVE: CVE-2008-5271
Published: 2008-11-28
Description: Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the section parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30602; http://www.securityfocus.com/bid/29644; https://exchange.xforce.ibmcloud.com/vulnerabilities/42970
CVE: CVE-2008-5272
Published: 2008-11-28
Description: Multiple directory traversal vulnerabilities in Fred Stuurman SyndeoCMS 2.6.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the template parameter to (1) starnet/editors/fckeditor/studenteditor.php; (2) starnet/modules/sn_news/edit_content.php, reached through starnet/index.php; and (3) starnet/modules/sn_newsletter/edit_content.php, reached through starnet/index.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30602; http://securityreason.com/securityalert/4660; http://www.securityfocus.com/bid/29644
CVE: CVE-2008-5273
Published: 2008-11-28
Description: SQL injection vulnerability in viewnews.asp in Todd Woolums ASP News Management 2.2 allows remote attackers to execute arbitrary SQL commands via the newsID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30593; http://securityreason.com/securityalert/4658; http://www.securityfocus.com/bid/29638
CVE: CVE-2008-5274
Published: 2008-11-28
Description: Todd Woolums ASP News Management 2.2 allows remote attackers to obtain news items via a direct request to (1) rss.asp, (2) viewheadings.asp, or (3) viewnews.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30593; https://exchange.xforce.ibmcloud.com/vulnerabilities/47032; http://secunia.com/advisories/30593
CVE: CVE-2008-5275
Published: 2008-11-28
Description: Multiple directory traversal vulnerabilities in the (a) "Unzip archive" and (b) "Upload files and archives" functionality in net2ftp 0.96 stable and 0.97 beta allow remote attackers to create, read, or delete arbitrary files via a .. (dot dot) in a filename within a (1) TAR or (2) ZIP archive.  NOTE: this can be leveraged for code execution by creating a .php file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30611; http://vuln.sg/net2ftp096-en.html; http://www.securityfocus.com/bid/29664
CVE: CVE-2008-5278
Published: 2008-11-28
Description: Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header (HTTP_HOST variable).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/50214; http://secunia.com/advisories/32882; http://secunia.com/advisories/32966
CVE: CVE-2008-5279
Published: 2008-11-29
Description: The Local ZIM Server (zcs.exe) in Zilab Chat and Instant Messaging (ZIM) Server 2.1 and earlier allow remote attackers to execute arbitrary code via (1) heap-based buffer overflows involving multiple vectors including a long room name and a long source account, and (2) a stack-based buffer overflow with a long username in an information request.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/zilabzcsx-adv.txt; http://aluigi.org/poc/zilabzcsx.zip; http://secunia.com/advisories/29062
CVE: CVE-2008-5280
Published: 2008-11-29
Description: The Local ZIM Server in Zilab Chat and Instant Messaging (ZIM) Server 2.0 and 2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted requests without required parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/zilabzcsx-adv.txt; http://aluigi.org/poc/zilabzcsx.zip; http://secunia.com/advisories/29062
CVE: CVE-2008-5281
Published: 2008-11-29
Description: Heap-based buffer overflow in Titan FTP Server 6.05 build 550 allows remote attackers to execute arbitrary code via a long DELE command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.org/0802-exploits/titan-heap-py.txt; http://www.securityfocus.com/bid/27611; http://packetstormsecurity.org/0802-exploits/titan-heap-py.txt
CVE: CVE-2008-5282
Published: 2008-11-29
Description: Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code via (1) a link with a long HREF attribute, and (2) a DIV tag with a long id attribute.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/50282; http://osvdb.org/50283; http://secunia.com/advisories/32848
CVE: CVE-2008-5283
Published: 2008-11-29
Description: Google Hack Honeypot (GHH) File Upload Manager 1.3 allows remote attackers to delete uploaded files via unknown vectors related to the delall action to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. CVE analysis suggests that the most recent version as of 20081128 is 1.2, and the File Upload Manager does not have a "delall" action.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/27877; http://www.securityfocus.com/bid/27877
CVE: CVE-2008-5284
Published: 2008-11-29
Description: The web server in IEA Software RadiusNT and RadiusX 5.1.38 and other versions before 5.1.44, Emerald 5.0.49 and other versions before 5.0.52, Air Marshal 2.0.4 and other versions before 2.0.8, and Radius test client (aka Radlogin) 4.0.20 and earlier, allows remote attackers to cause a denial of service (crash) via an HTTP Content-Length header with a negative value, which triggers a single byte overwrite of memory using a NULL terminator.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/emerdal-adv.txt; http://secunia.com/advisories/28846; http://www.iea-software.com/docs/Emerald5/changes.txt
CVE: CVE-2008-4314
Published: 2008-12-01
Description: smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests, related to a "cut&paste error" that causes an improper bounds check to be performed.
CVSS Score: 8.5 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9515&w=2; http://osvdb.org/50230
CVE: CVE-2008-5285
Published: 2008-12-01
Description: Wireshark 1.0.4 and earlier allows remote attackers to cause a denial of service via a long SMTP request, which triggers an infinite loop.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065840.html; http://secunia.com/advisories/32840; http://secunia.com/advisories/34144
CVE: CVE-2008-5286
Published: 2008-12-01
Description: Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html; http://secunia.com/advisories/32962; http://secunia.com/advisories/33101
CVE: CVE-2008-5287
Published: 2008-12-01
Description: SQL injection vulnerability in catagorie.php in Werner Hilversum FAQ Manager 1.2 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50185; http://secunia.com/advisories/32868; http://securityreason.com/securityalert/4664
CVE: CVE-2008-5288
Published: 2008-12-01
Description: PHP remote file inclusion vulnerability in include/header.php in Werner Hilversum FAQ Manager 1.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the config_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/50184; http://secunia.com/advisories/32868; http://securityreason.com/securityalert/4665
CVE: CVE-2008-5289
Published: 2008-12-01
Description: SQL injection vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32866; http://securityreason.com/securityalert/4666; http://www.securityfocus.com/bid/32474
CVE: CVE-2008-5290
Published: 2008-12-01
Description: Cross-site scripting (XSS) vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32866; http://securityreason.com/securityalert/4666; http://www.securityfocus.com/bid/32474
CVE: CVE-2008-5291
Published: 2008-12-01
Description: Directory traversal vulnerability in code/track.php in FuzzyLime 3.03 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter, a different vector than CVE-2007-4805 and CVE-2008-3165.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32865; http://securityreason.com/securityalert/4667; http://www.securityfocus.com/bid/32475
CVE: CVE-2008-5292
Published: 2008-12-01
Description: SQL injection vulnerability in view_snaps.php in VideoGirls BiZ allows remote attackers to execute arbitrary SQL commands via the type parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50309; http://secunia.com/advisories/32808; http://securityreason.com/securityalert/4668
CVE: CVE-2008-5293
Published: 2008-12-01
Description: SQL injection vulnerability in index.php in WebStudio eHotel allows remote attackers to execute arbitrary SQL commands via the pageid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50201; http://secunia.com/advisories/32874; http://securityreason.com/securityalert/4669
CVE: CVE-2008-5294
Published: 2008-12-01
Description: SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL commands via the pageid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50200; http://secunia.com/advisories/32873; http://securityreason.com/securityalert/4670
CVE: CVE-2008-5295
Published: 2008-12-01
Description: SQL injection vulnerability in index.php in Jamit Job Board 3.4.10 allows remote attackers to execute arbitrary SQL commands via the show_emp parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32797; http://securityreason.com/securityalert/4671; http://www.securityfocus.com/bid/32478
CVE: CVE-2008-5296
Published: 2008-12-01
Description: Gallery 1.5.x before 1.5.10 and 1.6 before 1.6-RC3, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative via unspecified cookies.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://gallery.menalto.com/last_official_G1_releases; http://osvdb.org/50089; http://secunia.com/advisories/32817
CVE: CVE-2008-5297
Published: 2008-12-01
Description: Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary code via a crafted response to a DNS update request, related to a missing length check in the GetNextLine function.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506179; http://git.debian.org/?p=collab-maint/no-ip.git%3Ba=commit%3Bh=60ed93621ff36d9731ba5d9f9336d6eb91122302; http://secunia.com/advisories/32761
CVE: CVE-2008-5298
Published: 2008-12-01
Description: chm2pdf 0.9 uses temporary files in directories with fixed names, which allows local users to cause a denial of service (chm2pdf failure) of other users by creating those directories ahead of time.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501959; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053501.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053510.html
CVE: CVE-2008-5299
Published: 2008-12-01
Description: chm2pdf 0.9 allows user-assisted local users to delete arbitrary files via a symlink attack on .chm files in the (1) /tmp/chm2pdf/work or (2) /tmp/chm2pdf/orig temporary directories.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501959; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053501.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053510.html
CVE: CVE-2008-5300
Published: 2008-12-01
Description: Linux kernel 2.6.28 allows local users to cause a denial of service ("soft lockup" and process loss) via a large number of sendmsg function calls, which does not block during AF_UNIX garbage collection and triggers an OOM condition, a different vulnerability than CVE-2008-5029.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=473259; http://marc.info/?l=linux-netdev&m=[PII_REDACTED]3564&w=2; http://marc.info/?l=linux-netdev&m=[PII_REDACTED]5944&w=2
CVE: CVE-2008-5301
Published: 2008-12-01
Description: Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32768; http://secunia.com/advisories/36904; http://www.dovecot.org/list/dovecot/2008-November/035259.html
CVE: CVE-2008-5302
Published: 2008-12-01
Description: Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448.  It is different from CVE-2008-5303 due to affected versions.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286922#36; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
CVE: CVE-2008-5303
Published: 2008-12-01
Description: Race condition in the rmtree function in File::Path 1.08 (lib/File/Path.pm) in Perl 5.8.8 allows local users to to delete arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5302 due to affected versions.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286922#36; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
CVE: CVE-2008-5306
Published: 2008-12-02
Description: SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary SQL commands via the login_lg parameter (username).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32841; http://securityreason.com/securityalert/4674; http://www.securityfocus.com/bid/32429
CVE: CVE-2008-5307
Published: 2008-12-02
Description: SQL injection vulnerability in admin/index.php in PG Roommate Finder Solution allows remote attackers to execute arbitrary SQL commands via the login_lg parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32841; http://securityreason.com/securityalert/4678; http://www.securityfocus.com/bid/32430
CVE: CVE-2008-5308
Published: 2008-12-02
Description: The Simple Forum 3.1d module for LoveCMS 1.6.2 Final does not properly restrict access to administrator functions, which allows remote attackers to change the administrator password via a direct request to modules/simpleforum/admin/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/50067; http://secunia.com/advisories/32758; http://securityreason.com/securityalert/4676
CVE: CVE-2008-5309
Published: 2008-12-02
Description: SQL injection vulnerability in NetArt Media Real Estate Portal 1.2 allows remote attackers to execute arbitrary SQL commands via the ad_id parameter in the re_send_email module to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4675; http://www.securityfocus.com/bid/32445; https://exchange.xforce.ibmcloud.com/vulnerabilities/46808
CVE: CVE-2008-5310
Published: 2008-12-02
Description: SQL injection vulnerability in image.php in NetArt Media Car Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32844; http://securityreason.com/securityalert/4677; http://www.securityfocus.com/bid/32426
CVE: CVE-2008-5311
Published: 2008-12-02
Description: SQL injection vulnerability in image.php in NetArt Media Blog System 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4679; http://www.securityfocus.com/bid/32441; http://www.vupen.com/english/advisories/2008/3240
CVE: CVE-2008-3057
Published: 2008-12-03
Description: Octeth Oempro 3.5.5.1, and possibly other versions before 4, does not set the secure flag for the PHPSESSID cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://octeth.com/blog/category/oempro4/; http://osvdb.org/ref/50/oempro.txt; http://www.osvdb.org/50321
CVE: CVE-2008-3058
Published: 2008-12-03
Description: Multiple SQL injection vulnerabilities in Octeth Oempro 3.5.5.1, and possibly other versions before 4, allow remote attackers to execute arbitrary SQL commands via the FormValue_Email parameter (aka Email field) to index.php in (1) member/, (2) client/, or (3) admin/; or (4) the FormValue_SearchKeywords parameter to client/campaign_track.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://octeth.com/blog/category/oempro4/; http://osvdb.org/ref/50/oempro.txt; http://www.osvdb.org/50322
CVE: CVE-2008-3059
Published: 2008-12-03
Description: member/settings_account.php in Octeth Oempro 3.5.5.1, and possibly other versions before 4, uses cleartext to transmit a password entered in the FormValue_Password field, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to the "Settings - Account Information" tab.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://octeth.com/blog/category/oempro4/; http://osvdb.org/ref/50/oempro.txt; http://www.osvdb.org/50324
CVE: CVE-2008-5276
Published: 2008-12-03
Description: Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=d19de4e9f2211cbe5bde00726b66c47a424f4e07; http://secunia.com/advisories/32942; http://secunia.com/advisories/33315
CVE: CVE-2008-5312
Published: 2008-12-03
Description: mailscanner 4.55.10 and other versions before 4.74.16-1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files used by the (1) f-prot-autoupdate, (2) clamav-autoupdate, (3) panda-autoupdate.new, (4) trend-autoupdate.new, and (5) rav-autoupdate.new scripts in /etc/MailScanner/autoupdate/, a different vulnerability than CVE-2008-5140.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506353#44; http://secunia.com/advisories/33117; http://www.mailscanner.info/ChangeLog
CVE: CVE-2008-5313
Published: 2008-12-03
Description: mailscanner 4.68.8 and other versions before 4.74.16-1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files used by the (1) f-prot-autoupdate, (2) clamav-autoupdate, (3) avast-autoupdate, and (4) f-prot-6-autoupdate scripts in /etc/MailScanner/autoupdate/; the (5) bitdefender-wrapper, (6) kaspersky-wrapper, (7) clamav-wrapper, and (8) rav-wrapper scripts in /etc/MailScanner/wrapper/; the (9) Quarantine.pm, (10) TNEF.pm, (11) MessageBatch.pm, (12) WorkArea.pm, and (13) SA.pm scripts in /usr/share/MailScanner/MailScanner/; (14) /usr/sbin/MailScanner; and (15) scripts that load the /etc/MailScanner/mailscanner.conf.with.mcp configuration file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506353#44; http://secunia.com/advisories/33117; http://www.mailscanner.info/ChangeLog
CVE: CVE-2008-5314
Published: 2008-12-03
Description: Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted JPEG file, related to the cli_check_jpeg_exploit, jpeg_check_photoshop, and jpeg_check_photoshop_8bim functions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html; http://lurker.clamav.net/message/20[PII_REDACTED]41.55b1e092.en.html
CVE: CVE-2008-5315
Published: 2008-12-03
Description: Directory traversal vulnerability in the web interface in Apple iPhone Configuration Web Utility 1.0 on Windows allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2008-12/0061.html; http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065822.html; http://secunia.com/advisories/32852