deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-7051
Published: 2009-08-24
Description: AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direct request to (1) user.php, (2) articles.php, (3) articlesuspend.php, (4) site.php, (5) statistics.php, (6) mail.php, (7) category.php, (8) subcategory.php, (9) changepassword.php, (10) polling.php, and (11) logo.php in admin/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/32254; http://www.vupen.com/english/advisories/2008/3097; https://www.exploit-db.com/exploits/7081
CVE: CVE-2008-7052
Published: 2009-08-24
Description: Unrestricted file upload vulnerability in profile.php in Pre Projects Pre Real Estate Listings allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request to the file in re_images/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/32257; http://www.vupen.com/english/advisories/2008/3121; https://exchange.xforce.ibmcloud.com/vulnerabilities/46564
CVE: CVE-2009-2951
Published: 2009-08-24
Description: Phenotype CMS before 2.9 does not use a random salt value for password encryption, which makes it easier for context-dependent attackers to determine cleartext passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://www.phenotype-cms.com/wiki/development-changelog; https://exchange.xforce.ibmcloud.com/vulnerabilities/52856; http://www.phenotype-cms.com/wiki/development-changelog
CVE: CVE-2009-2952
Published: 2009-08-24
Description: Unspecified vulnerability in the pollwakeup function in Sun Solaris 10, and OpenSolaris before snv_51, allows local users to cause a denial of service (panic) via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-141414-09-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-265248-1; http://www.securityfocus.com/bid/36106
CVE: CVE-2009-2953
Published: 2009-08-24
Description: Mozilla Firefox 3.0.6 through 3.0.13, and 3.5.x, allows remote attackers to cause a denial of service (CPU consumption) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/3424/; http://www.securityfocus.com/archive/1/506006/100/0/threaded; http://websecurity.com.ua/3424/
CVE: CVE-2009-2954
Published: 2009-08-24
Description: Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://websecurity.com.ua/3424/; http://www.securityfocus.com/archive/1/506006/100/0/threaded; http://websecurity.com.ua/3424/
CVE: CVE-2009-2955
Published: 2009-08-24
Description: Google Chrome 1.0.154.48 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://websecurity.com.ua/3424/; http://www.securityfocus.com/archive/1/506006/100/0/threaded; http://websecurity.com.ua/3424/
CVE: CVE-2009-2956
Published: 2009-08-24
Description: The (1) Net.Commerce and (2) Net.Data components in IBM WebSphere Commerce Suite store sensitive information under the web root with insufficient access control, which allows remote attackers to discover passwords, and database and filesystem details, via direct requests for configuration files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/52616; https://exchange.xforce.ibmcloud.com/vulnerabilities/52616
CVE: CVE-2008-7053
Published: 2009-08-24
Description: LogMeIn Remote Access Utility ActiveX control (RACtrl.dll) allows remote attackers to cause a denial of service (crash) by setting the fgcolor and bgcolor properties to certain long values that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://packetstorm.foofus.com/0808-exploits/logmein-activex.txt; http://www.securityfocus.com/bid/30923; https://exchange.xforce.ibmcloud.com/vulnerabilities/44843
CVE: CVE-2008-7054
Published: 2009-08-24
Description: Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the (1) gsLanguage and (2) language_home parameters to modules/diary/showdiary.php; (3) admin_home, (4) gsLanguage, and (5) language_home parameters to modules/diary/showdiarydetail.php; (6) gsLanguage and (7) language_home parameters to modules/diary/submit_diary.php; (8) admin_home parameter to modules/news/news_summary.php; (9) nLink, (10) gsLanguage, and (11) language_home parameters to modules/news/inlinenews.php; and possibly other unspecified vectors in (12) diary/showeventlist.php, (13) gallery/showgallery.php, (14) reviews/showreviews.php, (15) gallery/showgallerydetails.php, (16) reviews/showreviewsdetails.php, (17) news/shownewsdetails.php, (18) gallery/submit_gallery.php, (19) guestbook/submit_guestbook.php, (20) reviews/submit_reviews.php, (21) news/submit_news.php, (22) diary/inlineeventlist.php, and (23) news/archivednews_summary.php in modules/, related to the lack of directory traversal protection in modules/moduleSec.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31606; http://www.osvdb.org/47773; http://www.osvdb.org/47774
CVE: CVE-2008-7055
Published: 2009-08-24
Description: module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" (doubled dot dot slash) sequences in the link parameter, which is not properly filtered using the str_replace function.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31606; http://www.securityfocus.com/archive/1/495705/100/100/threaded; http://www.securityfocus.com/bid/30821
CVE: CVE-2008-7056
Published: 2009-08-24
Description: BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain copies of the database via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/21992; http://www.securityfocus.com/bid/30788; https://exchange.xforce.ibmcloud.com/vulnerabilities/44588
CVE: CVE-2008-7057
Published: 2009-08-24
Description: Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web script via the type parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/21992; http://www.securityfocus.com/bid/30788; https://exchange.xforce.ibmcloud.com/vulnerabilities/44590
CVE: CVE-2008-7058
Published: 2009-08-24
Description: Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authentication of administrators and force a logout via adminpanel/logout.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/30788; https://exchange.xforce.ibmcloud.com/vulnerabilities/44589; https://www.exploit-db.com/exploits/6286
CVE: CVE-2008-7059
Published: 2009-08-24
Description: SQL injection vulnerability in index.php in One-News Beta 2 allows remote attackers to execute arbitrary SQL commands via the q parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/495679/100/0/threaded; http://www.securityfocus.com/bid/30804; https://exchange.xforce.ibmcloud.com/vulnerabilities/44644
CVE: CVE-2008-7060
Published: 2009-08-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in One-News Beta 2 allow remote attackers to inject arbitrary HTML and web script via the (1) title or (2) content parameters in a news item to add.php, and the (3) itemnum, (4) author, or (5) comment parameters in a comment to index.php.  NOTE: vectors 1 and 2 require user authentication.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/495679/100/0/threaded; http://www.securityfocus.com/bid/30804; https://exchange.xforce.ibmcloud.com/vulnerabilities/44645
CVE: CVE-2008-7061
Published: 2009-08-24
Description: The tooltip manager (chrome/views/tooltip_manager.cc) in Google Chrome 0.2.149.29 Build 1798 and possibly other versions before 0.2.149.30 allows remote attackers to cause a denial of service (CPU consumption or crash) via a tag with a long title attribute, which is not properly handled when displaying a tooltip, a different vulnerability than CVE-2008-6994.  NOTE: there is inconsistent information about the environments under which this issue exists.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2008/09/beta-release-0214930.html; http://src.chromium.org/viewvc/chrome/trunk/src/chrome/browser/render_widget_host_hwnd.cc?r1=1287&r2=2042&pathrev=2042; http://src.chromium.org/viewvc/chrome/trunk/src/chrome/views/tooltip_manager.cc?r1=1287&r2=2042&pathrev=2042
CVE: CVE-2008-7062
Published: 2009-08-25
Description: Unrestricted file upload vulnerability in admin/index.php in Download Manager module 1.0 for LoveCMS 1.6.2 Final allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/50276; http://secunia.com/advisories/32825; https://exchange.xforce.ibmcloud.com/vulnerabilities/46871
CVE: CVE-2008-7063
Published: 2009-08-25
Description: Ocean12 FAQ Manager Pro stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for admin/o12faq.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/46954; https://www.exploit-db.com/exploits/7258; https://exchange.xforce.ibmcloud.com/vulnerabilities/46954
CVE: CVE-2008-7064
Published: 2009-08-25
Description: Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal before 1.4.5, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "\" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/50143; http://secunia.com/advisories/32823; http://secunia.com/advisories/38670
CVE: CVE-2008-7065
Published: 2009-08-25
Description: Siemens C450 IP and C475 IP VoIP devices allow remote attackers to cause a denial of service (disconnected calls and device reboot) via a crafted SIP packet to UDP port 5060.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/50274; http://secunia.com/advisories/32827; http://www.securityfocus.com/archive/1/498599/100/0/threaded
CVE: CVE-2008-7066
Published: 2009-08-25
Description: OpenForum 0.66 Beta allows remote attackers to bypass authentication and reset passwords of other users via a direct request with the update parameter set to 1 and modified user and password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/32536; https://exchange.xforce.ibmcloud.com/vulnerabilities/46969; https://www.exploit-db.com/exploits/7291
CVE: CVE-2008-7067
Published: 2009-08-25
Description: PHP remote file inclusion vulnerability in admin/plugins/Online_Users/main.php in PageTree CMS 0.0.2 BETA 0001 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[PT_Config][dir][data] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/32510; https://exchange.xforce.ibmcloud.com/vulnerabilities/46922; https://www.exploit-db.com/exploits/7255
CVE: CVE-2008-7068
Published: 2009-08-25
Description: The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte.  NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313&r2=1.2027.2.547.2.1314&; http://securityreason.com/achievement_securityalert/58; http://www.osvdb.org/52206
CVE: CVE-2008-7069
Published: 2009-08-25
Description: All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database configuration information, including credentials, via a direct request to accms.dat.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/47121; https://www.exploit-db.com/exploits/7266; https://exchange.xforce.ibmcloud.com/vulnerabilities/47121
CVE: CVE-2008-7070
Published: 2009-08-25
Description: Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a " (quote) followed by command line switches in a (1) irc:///, (2) irc6:///, (3) ircs:///, or (4) and ircs6:/// URI.  NOTE: this might be due to an incomplete fix for CVE-2007-2951.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://retrogod.altervista.org/kvirc_342_cmd.html; http://secunia.com/advisories/32410; http://www.securityfocus.com/archive/1/498557/100/0/threaded
CVE: CVE-2008-7071
Published: 2009-08-25
Description: SQL injection vulnerability in authenticate.php in Chipmunk Topsites allows remote attackers to execute arbitrary SQL commands via the username parameter, related to login.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32469; https://exchange.xforce.ibmcloud.com/vulnerabilities/46836; https://www.exploit-db.com/exploits/7227
CVE: CVE-2008-7072
Published: 2009-08-25
Description: Cross-site scripting (XSS) vulnerability in index.php in Chipmunk Topsites allows remote attackers to inject arbitrary web script or HTML via the start parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/32470; https://exchange.xforce.ibmcloud.com/vulnerabilities/46837; https://www.exploit-db.com/exploits/7227
CVE: CVE-2008-7073
Published: 2009-08-25
Description: PHP remote file inclusion vulnerability in lib/action/rss.php in RSS module 0.1 for Pie Web M{a,e}sher, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the lib parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/32465; http://www.z0rlu.blogspot.com/2008/11/pie-web-maesher-mod-rss-01-remote-file.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/46834
CVE: CVE-2008-7074
Published: 2009-08-25
Description: Format string vulnerability in MemeCode Software i.Scribe 1.88 through 2.00 before Beta9 allows remote SMTP servers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a server response, which is not properly handled "when displaying the signon message."
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://memecode.com/site/ver.php?id=264; http://osvdb.org/50232; http://secunia.com/advisories/32906
CVE: CVE-2008-7075
Published: 2009-08-25
Description: Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbitrary SQL commands via (1) the subcatid parameter to article.list.php; or the artid parameter to (2) article.print.php, (3) article.comments.php, (4) article.publisher.php, or (5) article.download.php; and (6) the PATH_INFO to article.download.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50452; http://osvdb.org/50453; http://osvdb.org/50454
CVE: CVE-2008-7076
Published: 2009-08-25
Description: Unrestricted file upload vulnerability in user.modify.profile.php in Kalptaru Infotech Ltd. Star Articles 6.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile photo, then accessing it via a direct request to the file in authorphoto/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/50459; http://secunia.com/advisories/32887; http://www.securityfocus.com/bid/32509
CVE: CVE-2008-7077
Published: 2009-08-25
Description: Multiple SQL injection vulnerabilities in SailPlanner 0.3a allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.juniper.net/security/auto/vulnerabilities/vuln32521.html; http://www.securityfocus.com/bid/32521; https://exchange.xforce.ibmcloud.com/vulnerabilities/46932
CVE: CVE-2008-7078
Published: 2009-08-25
Description: Multiple buffer overflows in Rumpus before 6.0.1 allow remote attackers to (1) cause a denial of service (segmentation fault) via a long HTTP verb in the HTTP component; and allow remote authenticated users to execute arbitrary code via a long argument to the (2) MKD, (3) XMKD, (4) RMD, and other unspecified commands in the FTP component.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0007.html; http://secunia.com/advisories/32892; http://www.maxum.com/Rumpus/News601.html
CVE: CVE-2008-7079
Published: 2009-08-25
Description: Buffer overflow in Nero ShowTime 5.0.15.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long entry in a .M3U playlist file.  NOTE: this issue might be related to CVE-2008-0619.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/50199; http://secunia.com/advisories/32850; http://www.securityfocus.com/bid/32446
CVE: CVE-2008-7080
Published: 2009-08-25
Description: Team PHP PHP Classifieds Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request for admin/backup/datadump.sql.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/32776; http://www.osvdb.org/50153; https://exchange.xforce.ibmcloud.com/vulnerabilities/46803
CVE: CVE-2008-7081
Published: 2009-08-25
Description: userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/32500; https://exchange.xforce.ibmcloud.com/vulnerabilities/46968; http://www.securityfocus.com/bid/32500
CVE: CVE-2008-7082
Published: 2009-08-25
Description: MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/50275; http://secunia.com/advisories/32880; http://www.securityfocus.com/archive/1/498630/100/0/threaded
CVE: CVE-2008-7083
Published: 2009-08-25
Description: Multiple SQL injection vulnerabilities in ReVou Micro Blogging Twitter clone allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32525; https://exchange.xforce.ibmcloud.com/vulnerabilities/46907; https://www.exploit-db.com/exploits/7270
CVE: CVE-2009-2959
Published: 2009-08-25
Description: Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buildbot 0.7.6 through 0.7.11p1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://buildbot.net/trac#SecurityAlert; http://secunia.com/advisories/36352; http://secunia.com/advisories/36418
CVE: CVE-2009-2960
Published: 2009-08-25
Description: CuteFlow 2.10.3 and 2.11.0_c does not properly restrict access to pages/edituser.php, which allows remote attackers to modify usernames and passwords via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/36349; http://www.securityfocus.com/archive/1/506000/100/0/threaded; http://www.securityfocus.com/bid/36099
CVE: CVE-2009-2961
Published: 2009-08-25
Description: Stack-based buffer overflow in Thaddy de Konng KOL Player 1.0 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long URL in a .MP3 playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9467; https://exchange.xforce.ibmcloud.com/vulnerabilities/52629; http://www.exploit-db.com/exploits/9467
CVE: CVE-2009-2963
Published: 2009-08-25
Description: Unspecified vulnerability in the update feature in Toolbar Uninstaller 1.0.2 allows remote attackers to force the download and execution of arbitrary files via attack vectors related to a "malformed update url and a malformed update website."
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/36366; http://www.decomputeur.nl/pdf/security-risk-found.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/52607
CVE: CVE-2009-2964
Published: 2009-08-25
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818; http://download.gna.org/nasmail/nasmail-1.7.zip; http://jvn.jp/en/jp/JVN30881447/index.html
CVE: CVE-2009-2965
Published: 2009-08-25
Description: Cross-site scripting (XSS) vulnerability in entry/index.jsp in Radvision Scopia 5.7, and possibly other versions before SD 7.0.100, allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/506013/100/0/threaded; http://www.securityfocus.com/archive/1/506013/100/0/threaded
CVE: CVE-2009-2966
Published: 2009-08-25
Description: avp.exe in Kaspersky Internet Security 9.0.0.459 and Anti-Virus 9.0.0.463 allows remote attackers to cause a denial of service (CPU consumption and network connectivity loss) via an HTTP URL request that contains a large number of dot "." characters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0252.html; http://secunia.com/advisories/36405; http://securityreason.com/achievement_securityalert/66