deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-7111
Published: 2009-08-28
Description: The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 does not restrict the filenames or extensions of uploaded files, which makes it easier for remote attackers to execute arbitrary code or overwrite files by leveraging CVE-2008-7110 and CVE-2008-7109.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31631; http://www.informit.com/guides/content.aspx?g=security&seqNum=320; http://www.securityfocus.com/archive/1/495772/100/0/threaded
CVE: CVE-2008-7112
Published: 2009-08-28
Description: The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to cause a denial of service (hang or crash) via invalid field length values in a malformed (1) document or (2) request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/31631; http://www.informit.com/guides/content.aspx?g=security&seqNum=321; https://exchange.xforce.ibmcloud.com/vulnerabilities/44719
CVE: CVE-2008-7113
Published: 2009-08-28
Description: The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 uses a small space of predictable user identification numbers for access control, which allows remote attackers to upload documents via a brute force attack.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/31631; http://www.informit.com/guides/content.aspx?g=security&seqNum=321; https://exchange.xforce.ibmcloud.com/vulnerabilities/44719
CVE: CVE-2008-7114
Published: 2009-08-28
Description: SQL injection vulnerability in members_search.php in iFusion Services iFdate 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the name field.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30850; https://exchange.xforce.ibmcloud.com/vulnerabilities/44668; https://www.exploit-db.com/exploits/6315
CVE: CVE-2008-7115
Published: 2009-08-28
Description: The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attackers to bypass authentication and gain administrator privileges via a direct request to (1) statusprocess.exe, (2) system_all.exe, or (3) restore.exe in cgi-bin/.  NOTE: the setup_dns.exe vector is already covered by CVE-2008-1244.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31665; http://www.securitytracker.com/id?1020747; https://exchange.xforce.ibmcloud.com/vulnerabilities/44874
CVE: CVE-2008-7116
Published: 2009-08-28
Description: SQL injection vulnerability in the admin panel (admin/) in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the username.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30945; https://exchange.xforce.ibmcloud.com/vulnerabilities/44817; https://www.exploit-db.com/exploits/6339
CVE: CVE-2008-7117
Published: 2009-08-28
Description: eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) files via a certain request with the file parameter set to style.css.  NOTE: this can probably be leveraged for cross-site scripting (XSS) attacks.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/30945; https://exchange.xforce.ibmcloud.com/vulnerabilities/44822; https://www.exploit-db.com/exploits/6339
CVE: CVE-2008-7118
Published: 2009-08-28
Description: WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query logs via a direct request for logs/cron.log.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/30945; https://exchange.xforce.ibmcloud.com/vulnerabilities/44820; https://www.exploit-db.com/exploits/6339
CVE: CVE-2008-7119
Published: 2009-08-28
Description: SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30945; https://exchange.xforce.ibmcloud.com/vulnerabilities/44817; https://www.exploit-db.com/exploits/6341
CVE: CVE-2008-7120
Published: 2009-08-28
Description: SQL injection vulnerability in Mr. CGI Guy Hot Links SQL-PHP 3 and earlier allows remote attackers to execute arbitrary SQL commands via the news.php parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.packetstormsecurity.org/0809-exploits/hotlinks-sql.txt; http://www.securityfocus.com/bid/31118; http://www.packetstormsecurity.org/0809-exploits/hotlinks-sql.txt
CVE: CVE-2008-7121
Published: 2009-08-28
Description: Cross-site scripting (XSS) vulnerability in Mr. CGI Guy Hot Links SQL-PHP 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the search bar.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.packetstormsecurity.org/0809-exploits/hotlinks-sql.txt; http://www.packetstormsecurity.org/0809-exploits/hotlinks-sql.txt
CVE: CVE-2009-2695
Published: 2009-08-28
Description: The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://danwalsh.livejournal.com/30084.html; http://eparis.livejournal.com/606.html; http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git%3Ba=commit%3Bh=47d439e9fb8a81a90022cfa785bf1c36c4e2aff6
CVE: CVE-2009-3000
Published: 2009-08-28
Description: The sockfs module in the kernel in Sun Solaris 10 and OpenSolaris snv_41 through snv_122, when Network Cache Accelerator (NCA) logging is enabled, allows remote attackers to cause a denial of service (panic) via unspecified web-server traffic that triggers a NULL pointer dereference in the nl7c_http_log function, related to "improper http response handling."
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-141690-02-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-265888-1; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141690-02-1
CVE: CVE-2009-3001
Published: 2009-08-28
Description: The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel 2.6.31-rc7 and earlier does not initialize a certain data structure, which allows local users to read the contents of some kernel memory locations by calling getsockname on an AF_LLC socket.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=28e9fc592cb8c7a43e4d3147b38be6032a0e81bc; http://jon.oberheide.org/files/llc-getsockname-leak.c; http://secunia.com/advisories/37105
CVE: CVE-2009-3002
Published: 2009-08-28
Description: The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AF_APPLETALK socket, related to the atalk_getname function in net/appletalk/ddp.c; (2) an AF_IRDA socket, related to the irda_getname function in net/irda/af_irda.c; (3) an AF_ECONET socket, related to the econet_getname function in net/econet/af_econet.c; (4) an AF_NETROM socket, related to the nr_getname function in net/netrom/af_netrom.c; (5) an AF_ROSE socket, related to the rose_getname function in net/rose/af_rose.c; or (6) a raw CAN socket, related to the raw_getname function in net/can/raw.c.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=09384dfc76e526c3993c09c42e016372dc9dd22c; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=17ac2e9c58b69a1e25460a568eae1b0dc0188c25; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3d392475c873c10c10d6d96b94d092a34ebd4791
CVE: CVE-2009-3003
Published: 2009-08-28
Description: Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html; http://secunia.com/advisories/36334; https://exchange.xforce.ibmcloud.com/vulnerabilities/53005
CVE: CVE-2009-3004
Published: 2009-08-28
Description: Avant Browser 11.7 Builds 35 and 36 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.  NOTE: a related attack was reported in which an arbitrary file: URL is shown.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html; http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html
CVE: CVE-2009-3005
Published: 2009-08-28
Description: Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.  NOTE: a related attack was reported in which an arbitrary file: URL is shown.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/53008; http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html
CVE: CVE-2009-3006
Published: 2009-08-28
Description: Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/53009; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6437
CVE: CVE-2009-3007
Published: 2009-08-28
Description: Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1, allow context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document written by the attacker.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/53010; http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html
CVE: CVE-2009-3008
Published: 2009-08-28
Description: K-Meleon 1.5.3 allows context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document written by the attacker.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/53011; http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html
CVE: CVE-2008-7122
Published: 2009-08-31
Description: Multiple insecure method vulnerabilities in an ActiveX control in (epRegPro.ocx) in Evans Programming Registry Pro allow remote attackers to read and modify sensitive registry keys via the (1) About, (2) CreateKey, (3) DeleteBranch, (4) DeleteKey, (5) DeleteValue, (6) EnumKeys, (7) EnumValues, (8) QueryType, (9) QueryValue, (10) RenameKey, and (11) SetValue methods.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/bid/28287; https://www.exploit-db.com/exploits/5271; http://www.securityfocus.com/bid/28287
CVE: CVE-2008-7123
Published: 2009-08-31
Description: Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte (%00) in the login parameter in an ajout action, which bypasses the regular expression check.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/43082; http://secunia.com/advisories/29276; http://www.securityfocus.com/bid/28149
CVE: CVE-2008-7124
Published: 2009-08-31
Description: zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/43081; http://secunia.com/advisories/29276; http://www.securityfocus.com/bid/28149
CVE: CVE-2008-7125
Published: 2009-08-31
Description: pphoto in Ariadne before 2.6 allows remote authenticated users with certain privileges to execute arbitrary shell commands via vectors related to PINP programs and the annotate command.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.0 (HIGH)
CWE: CWE-78
References: http://osvdb.org/43055; http://secunia.com/advisories/29191; http://www.ariadne-cms.org/download/changes/
CVE: CVE-2008-7126
Published: 2009-08-31
Description: Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet with a large string length value to UDP port 14000, which triggers a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/visibroken-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2008-03/0018.html; http://osvdb.org/43057
CVE: CVE-2008-7127
Published: 2009-08-31
Description: osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) via a crafted packet with a large string length value to UDP port 14000, which triggers a memory allocation failure that is not properly handled.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/visibroken-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2008-03/0018.html; http://osvdb.org/43058
CVE: CVE-2008-7128
Published: 2009-08-31
Description: The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://polarssl.org/?archive#001c; http://www.vupen.com/english/advisories/2008/0917/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41253
CVE: CVE-2008-7129
Published: 2009-08-31
Description: XySSL before 0.9 allows remote attackers to cause a denial of service (infinite loop) via an X.509 certificate that does not pass the RSA signature check during verification.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/49101; http://polarssl.org/?archive#001c; http://www.vupen.com/english/advisories/2008/0917
CVE: CVE-2008-7130
Published: 2009-08-31
Description: Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to upload arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/43113; http://secunia.com/advisories/29367; http://sourceforge.net/forum/forum.php?forum_id=797405
CVE: CVE-2008-7131
Published: 2009-08-31
Description: Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to gain access to a database via a link to a victim who is already connected to the database.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/43114; http://secunia.com/advisories/29367; http://sourceforge.net/forum/forum.php?forum_id=797405
CVE: CVE-2009-3010
Published: 2009-08-31
Description: Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header.  NOTE: in some product versions, the JavaScript executes outside of the context of the HTTP site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3315/; http://websecurity.com.ua/3386/; https://exchange.xforce.ibmcloud.com/vulnerabilities/52999
CVE: CVE-2009-3011
Published: 2009-08-31
Description: Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header.  NOTE: the JavaScript executes outside of the context of the HTTP site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3315/; http://websecurity.com.ua/3386/; https://exchange.xforce.ibmcloud.com/vulnerabilities/52998
CVE: CVE-2009-3012
Published: 2009-08-31
Description: Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header.  NOTE: the JavaScript executes outside of the context of the HTTP site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3323/; http://websecurity.com.ua/3386/; http://websecurity.com.ua/3323/
CVE: CVE-2009-3013
Published: 2009-08-31
Description: Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header.  NOTE: the JavaScript executes outside of the context of the HTTP site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3323/; http://websecurity.com.ua/3386/; https://exchange.xforce.ibmcloud.com/vulnerabilities/52996
CVE: CVE-2009-3014
Published: 2009-08-31
Description: Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location HTTP response header or (2) specifying the content of a Location HTTP response header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3373/; http://websecurity.com.ua/3386/; http://www.securityfocus.com/archive/1/506163/100/0/threaded
CVE: CVE-2009-3015
Published: 2009-08-31
Description: QtWeb 3.0 Builds 001 and 003 does not properly block javascript: and data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2) entering a javascript: URI when specifying the content of a Refresh header, (3) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, (4) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header, (5) injecting a Location header that contains JavaScript sequences in a data:text/html URI, or (6) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3386/; https://exchange.xforce.ibmcloud.com/vulnerabilities/52993; http://websecurity.com.ua/3386/
CVE: CVE-2009-3016
Published: 2009-08-31
Description: Apple Safari 4.0.3 does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2) entering a javascript: URI when specifying the content of a Refresh header, (3) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3386/; https://exchange.xforce.ibmcloud.com/vulnerabilities/52992; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6475
CVE: CVE-2009-3017
Published: 2009-08-31
Description: Orca Browser 1.2 build 5 does not properly block data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header, (3) injecting a Location header that contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header; and does not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (5) injecting a Location HTTP response header or (6) specifying the content of a Location HTTP response header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3386/; http://www.securityfocus.com/archive/1/506163/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/53002