deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0177
Published: 2008-02-07
Description: The ipcomp6_input function in sys/netinet6/ipcomp_input.c in the KAME project before 20071201 does not properly check the return value of the m_pulldown function, which allows remote attackers to cause a denial of service (system crash) via an IPv6 packet with an IPComp header.
CVSS Score: 7.8 (HIGH)
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet6/ipcomp_input.c?f=u&only_with_tag=netbsd-3-1; http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html; http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
CVE: CVE-2008-0213
Published: 2008-02-07
Description: Unspecified vulnerability in a certain ActiveX control for HP Virtual Rooms (HPVR) 6 and earlier allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3371&w=2; http://www.securitytracker.com/id?1019311; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3371&w=2
CVE: CVE-2008-0007
Published: 2008-02-08
Description: Linux kernel before 2.6.22.17, when using certain drivers that register a fault handler that does not perform range checks, allows local users to access kernel memory via an out-of-range offset.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00007.html; http://lists.vmware.com/pipermail/security-announce/2008/000023.html
CVE: CVE-2008-0043
Published: 2008-02-08
Description: Format string vulnerability in Apple iPhoto before 7.1.2 allows remote attackers to execute arbitrary code via photocast subscriptions.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://docs.info.apple.com/article.html?artnum=307398; http://lists.apple.com/archives/security-announce/2008/Feb/msg00000.html; http://secunia.com/advisories/28805
CVE: CVE-2008-0214
Published: 2008-02-08
Description: Multiple unspecified vulnerabilities in HP Select Identity 4.00, 4.01, 4.11, 4.12, 4.13, and 4.20 allow remote authenticated users to gain access via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1443&w=2; http://secunia.com/advisories/28844; http://www.securityfocus.com/bid/27667
CVE: CVE-2008-0554
Published: 2008-02-08
Description: Buffer overflow in the readImageData function in giftopnm.c in netpbm before 10.27 in netpbm before 10.27 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GIF image, a similar issue to CVE-2006-4484.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464056; http://secunia.com/advisories/29079; http://secunia.com/advisories/30280
CVE: CVE-2008-0640
Published: 2008-02-08
Description: Symantec Ghost Solution Suite 1.1 before 1.1 patch 2, 2.0.0, and 2.0.1 does not authenticate connections between the console and the Ghost Management Agent, which allows remote attackers to execute arbitrary commands via unspecified RPC requests in conjunction with ARP spoofing.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/28853; http://www.securityfocus.com/bid/27644; http://www.securitytracker.com/id?1019356
CVE: CVE-2008-0659
Published: 2008-02-08
Description: Stack-based buffer overflow in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.5.70 and earlier, as used in MySpace MySpaceUploader.ocx 1.0.0.4, allows remote attackers to execute arbitrary code via a long Action property.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blogs.aurigma.com/post/2008/01/Another-security-problem---oh%2c-not-again.aspx; http://seclists.org/fulldisclosure/2008/Jan/0593.html; http://secunia.com/advisories/28715
CVE: CVE-2008-0660
Published: 2008-02-08
Description: Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2008/Feb/0023.html; http://secunia.com/advisories/28707; http://secunia.com/advisories/28713
CVE: CVE-2008-0661
Published: 2008-02-08
Description: Buffer overflow in dBpowerAMP Audio Player Release 2 allows remote attackers to execute arbitrary code via a .M3U file with a long URI. NOTE: this might be the same issue as CVE-2004-1569.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://securityreason.com/securityalert/3623; http://www.securityfocus.com/archive/1/487605/100/0/threaded; http://www.securityfocus.com/bid/27635
CVE: CVE-2008-0662
Published: 2008-02-08
Description: The Auto Local Logon feature in Check Point VPN-1 SecuRemote/SecureClient NGX R60 and R56 for Windows caches credentials under the Checkpoint\SecuRemote registry key, which has Everyone/Full Control permissions, which allows local users to gain privileges by reading and reusing the credentials.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://digihax.com/; http://secunia.com/advisories/28820; http://securityreason.com/securityalert/3627
CVE: CVE-2008-0663
Published: 2008-02-08
Description: Novell Challenge Response Client (LCM) 2.7.5 and earlier, as used with Novell Client for Windows 4.91 SP4, allows users with physical access to a locked system to obtain contents of the clipboard by pasting the contents into the Challenge Question field.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/28792; http://www.securityfocus.com/bid/27631; http://www.securitytracker.com/id?1019304
CVE: CVE-2008-0664
Published: 2008-02-08
Description: The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28823; http://secunia.com/advisories/28920; http://secunia.com/advisories/30960
CVE: CVE-2008-0412
Published: 2008-02-08
Description: The browser engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to the (1) nsTableFrame::GetFrameAtOrBefore, (2) nsAccessibilityService::GetAccessible, (3) nsBindingManager::GetNestedInsertionPoint, (4) nsXBLPrototypeBinding::AttributeChanged, (5) nsColumnSetFrame::GetContentInsertionFrame, and (6) nsLineLayout::TrimTrailingWhiteSpaceIn methods, and other vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://browser.netscape.com/releasenotes/; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html; http://secunia.com/advisories/28754
CVE: CVE-2008-0413
Published: 2008-02-08
Description: The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via (1) a large switch statement, (2) certain uses of watch and eval, (3) certain uses of the mousedown event listener, and other vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://browser.netscape.com/releasenotes/; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html; http://secunia.com/advisories/28754
CVE: CVE-2008-0414
Published: 2008-02-08
Description: Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows user-assisted remote attackers to trick the user into uploading arbitrary files via label tags that shift focus to a file input field, aka "focus spoofing."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://browser.netscape.com/releasenotes/; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html; http://secunia.com/advisories/28758
CVE: CVE-2008-0415
Published: 2008-02-08
Description: Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to execute script outside of the sandbox and conduct cross-site scripting (XSS) attacks via multiple vectors including the XMLDocument.load function, aka "JavaScript privilege escalation bugs."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://browser.netscape.com/releasenotes/; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html; http://secunia.com/advisories/28754
CVE: CVE-2008-0417
Published: 2008-02-08
Description: CRLF injection vulnerability in Mozilla Firefox before 2.0.0.12 allows remote user-assisted web sites to corrupt the user's password store via newlines that are not properly handled when the user saves a password.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://browser.netscape.com/releasenotes/; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html; http://secunia.com/advisories/28766
CVE: CVE-2008-0418
Published: 2008-02-08
Description: Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and stylesheet files via the chrome: URI scheme, as demonstrated by stealing session information from sessionstore.js.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://browser.netscape.com/releasenotes/; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html; http://secunia.com/advisories/28622/
CVE: CVE-2008-0419
Published: 2008-02-08
Description: Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows remote attackers to steal navigation history and cause a denial of service (crash) via images in a page that uses designMode frames, which triggers memory corruption related to resize handles.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://browser.netscape.com/releasenotes/; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html; http://secunia.com/advisories/28754
CVE: CVE-2008-0591
Published: 2008-02-09
Description: Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by using a timer to change the window focus, aka the "dialog refocus bug" or "ffclick2".
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html; http://browser.netscape.com/releasenotes/; http://lcamtuf.coredump.cx/ffclick2/
CVE: CVE-2008-0592
Published: 2008-02-09
Description: Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8 allows user-assisted remote attackers to cause a denial of service via a plain .txt file with a "Content-Disposition: attachment" and an invalid "Content-Type: plain/text," which prevents Firefox from rendering future plain text files within the browser.
CVSS Score: 4.3 (MEDIUM)
References: http://browser.netscape.com/releasenotes/; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html; http://secunia.com/advisories/28754
CVE: CVE-2008-0593
Published: 2008-02-09
Description: Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypass the Same Origin Policy and read sensitive information from the original URL, such as with Single-Signon systems.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://browser.netscape.com/releasenotes/; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html; http://secunia.com/advisories/28754
CVE: CVE-2008-0594
Published: 2008-02-09
Description: Mozilla Firefox before 2.0.0.12 does not always display a web forgery warning dialog if the entire contents of a web page are in a DIV tag that uses absolute positioning, which makes it easier for remote attackers to conduct phishing attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://browser.netscape.com/releasenotes/; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html; http://secunia.com/advisories/28864
CVE: CVE-2008-0665
Published: 2008-02-11
Description: wml_backend/p1_ipp/ipp.src in Website META Language (WML) 2.0.11 allows local users to overwrite arbitrary files via a symlink attack on the ipp.$$.tmp temporary file.
CVSS Score: 3.6 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463907; http://secunia.com/advisories/28829; http://secunia.com/advisories/28856
CVE: CVE-2008-0666
Published: 2008-02-11
Description: Website META Language (WML) 2.0.11 allows local users to overwrite arbitrary files via a symlink attack on (1) the /tmp/pe.tmp.$$ temporary file used by wml_contrib/wmg.cgi and (2) temporary files used by wml_backend/p3_eperl/eperl_sys.c.
CVSS Score: 3.6 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463907; http://secunia.com/advisories/28829; http://secunia.com/advisories/28856
CVE: CVE-2008-0667
Published: 2008-02-11
Description: The DOC.print function in the Adobe JavaScript API, as used by Adobe Acrobat and Reader before 8.1.2, allows remote attackers to configure silent non-interactive printing, and trigger the printing of an arbitrary number of copies of a document.  NOTE: this issue might be subsumed by CVE-2008-0655.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://kb.adobe.com/selfservice/viewContent.do?externalId=kb403079&sliceId=1; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00007.html; http://secunia.com/advisories/28802
CVE: CVE-2008-0668
Published: 2008-02-11
Description: The excel_read_HLINK function in plugins/excel/ms-excel-read.c in Gnome Office Gnumeric before 1.8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file containing XLS HLINK opcodes, possibly because of an integer signedness error that leads to an integer overflow.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=208356; http://bugzilla.gnome.org/show_bug.cgi?id=505330; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00001.html
CVE: CVE-2007-5333
Published: 2008-02-12
Description: Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.  NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
CVE: CVE-2007-6286
Published: 2008-02-12
Description: Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2337&w=2
CVE: CVE-2008-0002
Published: 2008-02-12
Description: Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2337&w=2
CVE: CVE-2008-0669
Published: 2008-02-12
Description: Cross-site scripting (XSS) vulnerability in search.cgi in Sift Unity allows remote attackers to inject arbitrary web script or HTML via the qt parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28841; http://www.securityfocus.com/bid/27684; http://secunia.com/advisories/28841
CVE: CVE-2008-0670
Published: 2008-02-12
Description: SQL injection vulnerability in index.php in the Noticias (com_noticias) 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detalhe action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27691; https://www.exploit-db.com/exploits/5081; http://www.securityfocus.com/bid/27691
CVE: CVE-2008-0671
Published: 2008-02-12
Description: Stack-based buffer overflow in the add_line_buffer function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to execute arbitrary code via a long chat message, related to conversion from LF to CRLF.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/rintintin-adv.txt; http://secunia.com/advisories/28833; http://security.gentoo.org/glsa/glsa-201111-07.xml
CVE: CVE-2008-0672
Published: 2008-02-12
Description: The process_chat_input function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to cause a denial of service (application crash) via a YES message without a newline character, which triggers a NULL dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/rintintin-adv.txt; http://secunia.com/advisories/28833; http://security.gentoo.org/glsa/glsa-201111-07.xml
CVE: CVE-2008-0673
Published: 2008-02-12
Description: TinTin++ 1.97.9 and WinTin++ 1.97.9 open files on the basis of an inbound file-transfer request, before the user has an opportunity to decline the request, which allows remote attackers to truncate arbitrary files in the top level of a home directory.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/rintintin-adv.txt; http://secunia.com/advisories/28833; http://security.gentoo.org/glsa/glsa-201111-07.xml
CVE: CVE-2008-0675
Published: 2008-02-12
Description: SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pre-1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the node_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3631; http://www.securityfocus.com/archive/1/487436/100/0/threaded; http://www.securityfocus.com/bid/27569
CVE: CVE-2008-0676
Published: 2008-02-12
Description: Cross-site scripting (XSS) vulnerability in search.php in A-Blog 2 allows remote attackers to inject arbitrary web script or HTML via the words parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/27594; https://www.exploit-db.com/exploits/5050; http://www.securityfocus.com/bid/27594
CVE: CVE-2008-0677
Published: 2008-02-12
Description: SQL injection vulnerability in blog.php in A-Blog 2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a news action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27594; https://www.exploit-db.com/exploits/5050; http://www.securityfocus.com/bid/27594
CVE: CVE-2008-0678
Published: 2008-02-12
Description: SQL injection vulnerability in index.php in BlogPHP 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a page action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28756; http://www.securityfocus.com/bid/27591; https://www.exploit-db.com/exploits/5042
CVE: CVE-2008-0679
Published: 2008-02-12
Description: Cross-site scripting (XSS) vulnerability in index.php in BlogPHP 2.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28756; http://www.securityfocus.com/bid/27591; https://www.exploit-db.com/exploits/5042
CVE: CVE-2008-0680
Published: 2008-02-12
Description: SNMPd in MikroTik RouterOS 3.2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP SET request.
CVSS Score: 7.8 (HIGH)
References: http://hellknights.void.ru/shados/snmp_sploit.c; http://secunia.com/advisories/28762; http://www.securityfocus.com/bid/27599
CVE: CVE-2008-0681
Published: 2008-02-12
Description: SQL injection vulnerability in index.php in PHPShop 0.8.1 allows remote attackers to execute arbitrary SQL commands via the product_id parameter, as demonstrated by a shop/flypage action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/3628; http://www.securityfocus.com/archive/1/487435/100/0/threaded; http://www.securityfocus.com/bid/27570
CVE: CVE-2008-0682
Published: 2008-02-12
Description: SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pierre.sudarovich.free.fr/index.php/2006/02/28/ajax-shoutbox/; http://secunia.com/advisories/28767; http://www.securityfocus.com/bid/27583
CVE: CVE-2008-0683
Published: 2008-02-12
Description: SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27586; https://www.exploit-db.com/exploits/5053; http://www.securityfocus.com/bid/27586
CVE: CVE-2008-0684
Published: 2008-02-12
Description: Cross-site scripting (XSS) vulnerability in ViewCat.php in iTechClassifieds 3.0 allows remote attackers to inject arbitrary web script or HTML via the CatID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1835&w=2; http://secunia.com/advisories/28773; http://www.securityfocus.com/bid/27574
CVE: CVE-2008-0685
Published: 2008-02-12
Description: SQL injection vulnerability in ViewCat.php in iTechClassifieds 3.0 allows remote attackers to execute arbitrary SQL commands via the CatID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1835&w=2; http://secunia.com/advisories/28773; http://www.securityfocus.com/bid/27574
CVE: CVE-2008-0686
Published: 2008-02-12
Description: SQL injection vulnerability in index.php in the NeoReferences (com_neoreferences) 1.3.1 and 1.3.3 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28736; http://www.securityfocus.com/bid/27564; https://exchange.xforce.ibmcloud.com/vulnerabilities/40167
CVE: CVE-2008-0687
Published: 2008-02-12
Description: Cross-site scripting (XSS) vulnerability in siteadmin/editor_files/includes/load_message.php in the Youtube Clone Script allows remote attackers to inject arbitrary web script or HTML via the lang[please_wait] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28775; http://securityreason.com/securityalert/3635; http://www.securityfocus.com/archive/1/487432/100/0/threaded