deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0167
Published: 2008-05-18
Description: The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-59
References: http://secunia.com/advisories/30088; http://secunia.com/advisories/30286; http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz
CVE: CVE-2008-2281
Published: 2008-05-18
Description: Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via an HTML document with a link containing JavaScript sequences, which are evaluated by a resource script when a user prints this document.
CVSS Score: 9.3 (HIGH)
References: http://aviv.raffon.net/2008/05/14/InternetExplorerQuotPrintTableOfLinksquotCrossZoneScriptingVulnerability.aspx; http://secunia.com/advisories/30141; http://www.securityfocus.com/bid/29217
CVE: CVE-2008-2282
Published: 2008-05-18
Description: admin.php in Internet Photoshow and Internet Photoshow Special Edition (SE) allows remote attackers to bypass authentication by setting the login_admin cookie to true.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/29227; https://exchange.xforce.ibmcloud.com/vulnerabilities/42422; https://www.exploit-db.com/exploits/5617
CVE: CVE-2008-2283
Published: 2008-05-18
Description: IDAutomation allows remote attackers to overwrite arbitrary files via the argument to the (1) SaveBarCode and (2) SaveEnhWMF methods in (a) the IDAuto.BarCode.1 ActiveX control in IDAutomationLinear6.dll (aka IDAutomation Linear BarCode) 1.6.0.6, (b) the IDAuto.Datamatrix.1 ActiveX control in IDAutomationDMATRIX6.DLL (aka IDautomation Datamatrix Barcode) 1.6.0.6, (c) the IDAuto.PDF417.1 ActiveX control in IDAutomationPDF417_6.dll (aka IDautomation PDF417 Barcode) 1.6.0.6, and (d) the IDAuto.Aztec.1 ActiveX control in IDAutomationAZTEC.dll (aka IDautomation Aztec Barcode) 1.7.1.0.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30246; http://www.securityfocus.com/bid/29204; http://www.shinnai.altervista.org/index.php?mod=02_Forum&group=Security&argument=Remote_performed_exploits&topic=[PII_REDACTED].ff.php&page=last
CVE: CVE-2008-2284
Published: 2008-05-18
Description: PHP remote file inclusion vulnerability in fusebox5.php in Fusebox 5.5.1 allows remote attackers to execute arbitrary PHP code via a URL in the FUSEBOX_APPLICATION_PATH parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30178; http://www.securityfocus.com/bid/29163; https://exchange.xforce.ibmcloud.com/vulnerabilities/42389
CVE: CVE-2008-2285
Published: 2008-05-18
Description: The ssh-vulnkey tool on Ubuntu Linux 7.04, 7.10, and 8.04 LTS does not recognize authorized_keys lines that contain options, which makes it easier for remote attackers to exploit CVE-2008-0166 by guessing a key that was not identified by this tool.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.ubuntu.com/usn/usn-612-5; https://exchange.xforce.ibmcloud.com/vulnerabilities/42568; http://www.ubuntu.com/usn/usn-612-5
CVE: CVE-2008-2286
Published: 2008-05-18
Description: SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows remote attackers to execute arbitrary SQL commands via unspecified string fields in a notification packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9965&w=2; http://osvdb.org/show/osvdb/45313; http://secunia.com/advisories/30261
CVE: CVE-2008-2287
Published: 2008-05-18
Description: Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 does not properly protect the install directory, which might allow local users to gain privileges by replacing an application component with a Trojan horse.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9965&w=2; http://secunia.com/advisories/30261; http://www.securityfocus.com/bid/29197
CVE: CVE-2008-2288
Published: 2008-05-18
Description: Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 has insufficient access control for deletion and modification of registry keys, which allows local users to cause a denial of service or obtain sensitive information.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9965&w=2; http://secunia.com/advisories/30261; http://www.securityfocus.com/bid/29196
CVE: CVE-2008-2289
Published: 2008-05-18
Description: Unspecified vulnerability in a tooltip element in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows local users to gain privileges via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9965&w=2; http://secunia.com/advisories/30261; http://www.securityfocus.com/bid/29218
CVE: CVE-2008-2290
Published: 2008-05-18
Description: Unspecified vulnerability in the Agent user interface in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows local users to gain privileges via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9965&w=2; http://secunia.com/advisories/30261; http://www.securityfocus.com/bid/29194
CVE: CVE-2008-2291
Published: 2008-05-18
Description: axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 generates credentials with a fixed salt or without any salt, which makes it easier for remote attackers to guess encrypted domain credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9965&w=2; http://secunia.com/advisories/30261; http://www.insomniasec.com/advisories/ISVA-080516.2.htm
CVE: CVE-2008-2292
Published: 2008-05-18
Description: Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large OCTETSTRING in an attribute value pair (AVP).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00000.html; http://secunia.com/advisories/30187; http://secunia.com/advisories/30615
CVE: CVE-2008-2293
Published: 2008-05-18
Description: admin.php in Multi-Page Comment System (MPCS) 1.0 and 1.1 allows remote attackers to bypass authentication and gain privileges by setting the CommentSystemAdmin cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30255; http://www.securityfocus.com/bid/29244; https://exchange.xforce.ibmcloud.com/vulnerabilities/42463
CVE: CVE-2008-2294
Published: 2008-05-18
Description: Pet Grooming Management System 2.0 allows remote attackers to gain privileges via a direct request to useradded.php with a modified user name for "admin."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30254; http://www.securityfocus.com/bid/29252; https://exchange.xforce.ibmcloud.com/vulnerabilities/42466
CVE: CVE-2008-2295
Published: 2008-05-18
Description: Cross-site scripting (XSS) vulnerability in rg_search.php in Rgboard 3.0.12, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the s_text parameter and other unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29230; https://exchange.xforce.ibmcloud.com/vulnerabilities/42432; https://www.exploit-db.com/exploits/5620
CVE: CVE-2008-2296
Published: 2008-05-18
Description: PHP remote file inclusion vulnerability in include/bbs.lib.inc.php in Rgboard 3.0.12 allows remote attackers to execute arbitrary PHP code via a URL in the site_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29230; https://exchange.xforce.ibmcloud.com/vulnerabilities/42431; https://www.exploit-db.com/exploits/5620
CVE: CVE-2008-2297
Published: 2008-05-18
Description: The admin.php file in Rantx allows remote attackers to bypass authentication and gain privileges by setting the logininfo cookie to "<?php" or "?>", which is present in the password file and probably passes an insufficient comparison.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30279; http://www.securityfocus.com/bid/29243; https://exchange.xforce.ibmcloud.com/vulnerabilities/42464
CVE: CVE-2008-2298
Published: 2008-05-18
Description: Admin.php in Web Slider 0.6 allows remote attackers to bypass authentication and gain privileges by setting the admin cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/29246; https://exchange.xforce.ibmcloud.com/vulnerabilities/42468; https://www.exploit-db.com/exploits/5629
CVE: CVE-2008-2299
Published: 2008-05-18
Description: Unspecified vulnerability in SecureICA and ICA Basic encryption of Citrix Presentation Server 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 can cause clients to use weaker encryption settings than configured by the administrator, which might allow attackers to bypass intended restrictions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/30271; http://support.citrix.com/article/CTX114893; http://www.securityfocus.com/bid/29233
CVE: CVE-2008-2300
Published: 2008-05-18
Description: Unspecified vulnerability in Citrix Presentation Server 4.5 and earlier, Citrix Access Essentials 2.0 and earlier, and Citrix Desktop Server 1.0 allows remote authenticated users to access unauthorized desktops via unknown attack vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30271; http://support.citrix.com/article/CTX116941; http://www.securityfocus.com/bid/29232
CVE: CVE-2008-2301
Published: 2008-05-18
Description: SQL injection vulnerability in Kostenloses Linkmanagementscript allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.php and (2) top_view.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30201; http://securityreason.com/securityalert/3893; http://www.securityfocus.com/archive/1/492111/100/0/threaded
CVE: CVE-2008-2334
Published: 2008-05-19
Description: Multiple SQL injection vulnerabilities in W1L3D4 Philboard 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) forumid parameter to (a) admin/philboard_admin-forumedit.asp, (b) admin/philboard_admin-forum.asp, and (c) W1L3D4_foruma_yeni_konu_ac.asp; the (2) id parameter to (d) W1L3D4_konuoku.asp and (e) W1L3D4_konuya_mesaj_yaz.asp; and the (3) topic parameter to W1L3D4_konuya_mesaj_yaz.asp, different vectors than CVE-2008-1939, CVE-2007-2641, and CVE-2007-0920.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30278; http://www.securityfocus.com/bid/29229; http://www.securityfocus.com/bid/29229/exploit
CVE: CVE-2008-2335
Published: 2008-05-19
Description: Cross-site scripting (XSS) vulnerability in search_results.php in Vastal I-Tech phpVID 1.1 and 1.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter.  NOTE: some of these details are obtained from third party information.  NOTE: it was later reported that 1.2.3 is also affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/65/45/; http://osvdb.org/show/osvdb/45171; http://packetstormsecurity.com/files/122746/PHP-VID-XSS-SQL-Injection-CRLF-Injection.html
CVE: CVE-2008-2336
Published: 2008-05-19
Description: SQL injection vulnerability in category.php in 68 Classifieds 4.0.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30273; http://www.securityfocus.com/bid/29249; https://exchange.xforce.ibmcloud.com/vulnerabilities/42465
CVE: CVE-2008-2337
Published: 2008-05-19
Description: Multiple SQL injection vulnerabilities in IMGallery 2.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kategoria parameter to (a) galeria.php and the (2) id_phot parameter to (b) popup/koment.php and (c) popup/opis.php in, different vectors than CVE-2006-3163.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29250; https://exchange.xforce.ibmcloud.com/vulnerabilities/42474; https://www.exploit-db.com/exploits/5631
CVE: CVE-2008-2338
Published: 2008-05-19
Description: Interspire ActiveKB 1.5 and earlier allows remote attackers to gain privileges by setting the auth cookie to true when accessing unspecified scripts in /admin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30265; http://www.securityfocus.com/bid/29226; http://www.securitytracker.com/id?1020035
CVE: CVE-2008-2339
Published: 2008-05-19
Description: SQL injection vulnerability in index.php in Turnkey Web Tools SunShop Shopping Cart 3.5.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in an item action, a different vector than CVE-2008-2038, CVE-2007-4597, and CVE-2007-2549.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30282; http://securityreason.com/securityalert/3894; http://www.securityfocus.com/archive/1/492120/100/0/threaded
CVE: CVE-2008-2340
Published: 2008-05-19
Description: Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) lang parameter to (a) advsearch.php, (b) archive.php, and (c) index.php, and the (2) pid parameter to (d) list_tagitems.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29251; https://exchange.xforce.ibmcloud.com/vulnerabilities/42461; https://www.exploit-db.com/exploits/5624
CVE: CVE-2008-2341
Published: 2008-05-19
Description: PHP remote file inclusion vulnerability in ch_readalso.php in News Manager 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the read_xml_include parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29251; https://exchange.xforce.ibmcloud.com/vulnerabilities/42459; https://www.exploit-db.com/exploits/5624
CVE: CVE-2008-2342
Published: 2008-05-19
Description: Directory traversal vulnerability in attachments.php in News Manager 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29251; https://exchange.xforce.ibmcloud.com/vulnerabilities/42460; https://www.exploit-db.com/exploits/5624
CVE: CVE-2008-2343
Published: 2008-05-19
Description: News Manager 2.0 allows remote attackers to bypass restrictions and obtain sensitive information via a direct request to (1) db/connect_str.php and (2) login/info.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/29251; https://exchange.xforce.ibmcloud.com/vulnerabilities/42462; https://www.exploit-db.com/exploits/5624
CVE: CVE-2008-2344
Published: 2008-05-19
Description: Cross-site scripting (XSS) vulnerability in the air_filemanager 0.6.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-20080515-2/; https://exchange.xforce.ibmcloud.com/vulnerabilities/42448; http://typo3.org/teams/security/security-bulletins/typo3-20080515-2/
CVE: CVE-2008-2345
Published: 2008-05-19
Description: Unspecified vulnerability in the air_filemanager 0.6.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary PHP code via unspecified vectors related to "insufficient file filtering."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://typo3.org/teams/security/security-bulletins/typo3-20080515-2/; https://exchange.xforce.ibmcloud.com/vulnerabilities/42449; http://typo3.org/teams/security/security-bulletins/typo3-20080515-2/
CVE: CVE-2008-0957
Published: 2008-05-20
Description: Multiple stack-based buffer overflows in the PhotoStockPlus Uploader Tool ActiveX control (PSPUploader.ocx) allow remote attackers to execute arbitrary code via unspecified initialization parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/30305; http://www.kb.cert.org/vuls/id/406937; http://www.securityfocus.com/bid/29279
CVE: CVE-2008-2346
Published: 2008-05-20
Description: AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creating an admin account via a direct request to adduser.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/29267; https://exchange.xforce.ibmcloud.com/vulnerabilities/42502; https://www.exploit-db.com/exploits/5645
CVE: CVE-2008-2347
Published: 2008-05-20
Description: MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting the userID parameter to "admin" in a direct request to admin/addUser.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/29272; https://exchange.xforce.ibmcloud.com/vulnerabilities/42507; https://www.exploit-db.com/exploits/5650
CVE: CVE-2008-2348
Published: 2008-05-20
Description: MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/29271; https://exchange.xforce.ibmcloud.com/vulnerabilities/42503; https://www.exploit-db.com/exploits/5648
CVE: CVE-2008-2349
Published: 2008-05-20
Description: Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direct request to install/newuser.php with the admin parameter set to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30062/; http://www.securityfocus.com/bid/29258; https://exchange.xforce.ibmcloud.com/vulnerabilities/42476
CVE: CVE-2008-2350
Published: 2008-05-20
Description: Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via (1) .. (dot dot) or (2) C: folder sequences in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lostmon.blogspot.com/2008/05/bcoos-highlightphp-traversal-file.html; http://secunia.com/advisories/30035; http://www.securityfocus.com/bid/29275
CVE: CVE-2008-2351
Published: 2008-05-20
Description: Multiple SQL injection vulnerabilities in index.php in CMS WebManager-Pro allow remote attackers to execute arbitrary SQL commands via the (1) lang_id and (2) menu_id parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30293; http://www.securityfocus.com/bid/29266; http://www.vupen.com/english/advisories/2008/1562/references
CVE: CVE-2008-2352
Published: 2008-05-20
Description: Directory traversal vulnerability in index.php in Smeego 1.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30138; http://www.securityfocus.com/archive/1/492227/100/0/threaded; http://www.securityfocus.com/bid/29264
CVE: CVE-2008-2353
Published: 2008-05-20
Description: Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the show parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30301; http://www.securityfocus.com/bid/29270; http://www.vupen.com/english/advisories/2008/1560/references
CVE: CVE-2008-2354
Published: 2008-05-20
Description: Unspecified vulnerability in the data export function in testMaker before 3.0p10 allows test authors to obtain access to export data via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/30251; http://sourceforge.net/project/shownotes.php?group_id=194778&release_id=599729; http://www.securityfocus.com/bid/29273
CVE: CVE-2008-2355
Published: 2008-05-20
Description: Directory traversal vulnerability in index.php in WR-Meeting 1.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the msnum parameter in a coment event.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30296; http://www.securityfocus.com/bid/29262; http://www.vupen.com/english/advisories/2008/1566/references
CVE: CVE-2008-2356
Published: 2008-05-20
Description: SQL injection vulnerability in index.php in Archangel Weblog 0.90.02 and earlier allows remote attackers to execute arbitrary SQL commands via the post_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29257; https://exchange.xforce.ibmcloud.com/vulnerabilities/42475; https://www.exploit-db.com/exploits/5635
CVE: CVE-2008-1104
Published: 2008-05-21
Description: Stack-based buffer overflow in Foxit Reader before 2.3 build 2912 allows user-assisted remote attackers to execute arbitrary code via a crafted PDF file, related to the util.printf JavaScript function and floating point specifiers in format strings.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29941; http://secunia.com/secunia_research/2008-18/advisory/; http://securityreason.com/securityalert/3899
CVE: CVE-2008-1660
Published: 2008-05-21
Description: Unspecified vulnerability in useradd on HP-UX B.11.11, B.11.23, and B.11.31 allows local users to access arbitrary files and directories via unspecified vectors.
CVSS Score: 6.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6976&w=2; http://secunia.com/advisories/30308; http://securitytracker.com/id?1020045
CVE: CVE-2008-1948
Published: 2008-05-21
Description: The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the pack_security_parameters function, aka GNUTLS-SA-2008-1-1.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b; http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00051.html; http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00055.html
CVE: CVE-2008-1949
Published: 2008-05-21
Description: The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service (NULL dereference and crash) via a TLS message containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b; http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00051.html; http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00055.html