deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0097
Published: 2008-01-08
Description: Format string vulnerability in the log function in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the username field, as demonstrated by a certain LoginPassword message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/gswsshit-adv.txt; http://secunia.com/advisories/28307; http://securityreason.com/securityalert/3517
CVE: CVE-2008-0098
Published: 2008-01-08
Description: Buffer overflow in RealPlayer 11 build 6.0.14.748 allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: As of 20080103, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://gleg.net/realplayer11.html; http://lists.immunitysec.com/pipermail/dailydave/2008-January/004811.html; http://secunia.com/advisories/28276
CVE: CVE-2008-0099
Published: 2008-01-08
Description: Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the searchtext parameter to search.php, and unspecified other vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27118; https://www.exploit-db.com/exploits/4831; http://www.securityfocus.com/bid/27118
CVE: CVE-2008-0100
Published: 2008-01-08
Description: Stack-based buffer overflow in the Scene::errorf function in Scene.cpp in White_Dune 0.29 beta791 and earlier allows remote attackers to execute arbitrary code via a long string in a .WRL file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/whitedunboffs-adv.txt; http://secunia.com/advisories/28287; http://securityreason.com/securityalert/3516
CVE: CVE-2008-0101
Published: 2008-01-08
Description: Format string vulnerability in the swDebugf function in DuneApp.cpp in White_Dune 0.29 beta791 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a .WRL file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/whitedunboffs-adv.txt; http://secunia.com/advisories/28287; http://securityreason.com/securityalert/3516
CVE: CVE-2007-6671
Published: 2008-01-08
Description: SQL injection vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Password parameter, a different product than CVE-2006-6021. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://aria-security.net/forum/showthread.php?p=1189; http://osvdb.org/39766; http://secunia.com/advisories/28283
CVE: CVE-2007-6672
Published: 2008-01-08
Description: Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jira.codehaus.org/browse/JETTY-386#action_117699; http://jira.codehaus.org/browse/JETTY/fixforversion/13950; http://osvdb.org/39855
CVE: CVE-2007-6673
Published: 2008-01-08
Description: Cross-site scripting (XSS) vulnerability in Makale Scripti allows remote attackers to inject arbitrary web script or HTML via the ara parameter to the default URI under Ara/ in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28262; http://www.packetstormsecurity.org/0712-exploits/makale-xss.txt; http://www.securityfocus.com/bid/27067
CVE: CVE-2008-0129
Published: 2008-01-08
Description: SQL injection vulnerability in starnet/addons/slideshow_full.php in Site@School 2.3.10 and earlier allows remote attackers to execute arbitrary SQL commands via the album_name parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27120; https://exchange.xforce.ibmcloud.com/vulnerabilities/39417; https://www.exploit-db.com/exploits/4832
CVE: CVE-2008-0130
Published: 2008-01-08
Description: SQL injection vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Username parameter, a different vulnerability than CVE-2007-6671.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39766; http://secunia.com/advisories/28283; https://exchange.xforce.ibmcloud.com/vulnerabilities/39326
CVE: CVE-2008-0131
Published: 2008-01-08
Description: Cross-site scripting (XSS) vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different product than CVE-2006-6022.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28283; http://www.securityfocus.com/bid/27121; http://secunia.com/advisories/28283
CVE: CVE-2008-0132
Published: 2008-01-08
Description: Pragma FortressSSH 5.0 Build 4 Revision 293 and earlier handles long input to sshd.exe by creating an error-message window and waiting for the administrator to click in this window before terminating the sshd.exe process, which allows remote attackers to cause a denial of service (connection slot exhaustion) via a flood of SSH connections with long data objects, as demonstrated by (1) a long list of keys and (2) a long username.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400
References: http://aluigi.altervista.org/adv/pragmassh-adv.txt; http://aluigi.org/poc/pragmassh.zip; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0448&w=2
CVE: CVE-2007-6388
Published: 2008-01-08
Description: Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307562; http://httpd.apache.org/security/vulnerabilities_13.html; http://httpd.apache.org/security/vulnerabilities_20.html
CVE: CVE-2007-6422
Published: 2008-01-08
Description: The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://httpd.apache.org/security/vulnerabilities_22.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html; http://secunia.com/advisories/28526
CVE: CVE-2007-6421
Published: 2008-01-08
Description: Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307562; http://httpd.apache.org/security/vulnerabilities_22.html; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2007-6674
Published: 2008-01-08
Description: Cross-site scripting (XSS) vulnerability in Default.asp in RapidShare Database allows remote attackers to inject arbitrary web script or HTML via the Arayalim parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28189; http://www.packetstormsecurity.org/0801-exploits/rapidshare-xss.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/39491
CVE: CVE-2007-6675
Published: 2008-01-08
Description: The b_system_comments_show function in htdocs/modules/system/blocks/system_blocks.php in XOOPS before 2.0.18 does not check permissions, which allows remote attackers to read the comments in restricted modules.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28264; http://sourceforge.net/project/shownotes.php?group_id=41586&release_id=564689; http://sourceforge.net/tracker/index.php?func=detail&aid=1808484&group_id=41586&atid=430840
CVE: CVE-2007-6676
Published: 2008-01-08
Description: The default configuration of Uber Uploader (UU) 5.3.6 and earlier does not block uploads of (1) .html, (2) .asp, and other possibly dangerous extensions, which allows remote attackers to use these extensions in uploads via (a) uu_file_upload.php, related to uu_file_upload.js and (b) uber_uploader_file.php, related to uber_uploader_file.js, a different issue than CVE-2007-0123.  NOTE: the vendor disputes the severity of the issue, noting that it is the administrator's responsibility to "add file extensions that you may or may not want uploaded."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://osvdb.org/43535; http://securityreason.com/securityalert/3519; http://www.securityfocus.com/archive/1/485235/100/100/threaded
CVE: CVE-2008-0133
Published: 2008-01-08
Description: Multiple SQL injection vulnerabilities in Tribisur 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to cat_main.php and the (2) cat parameter to forum.php in a liste action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28362; http://www.securityfocus.com/bid/27149; https://exchange.xforce.ibmcloud.com/vulnerabilities/39443
CVE: CVE-2008-0134
Published: 2008-01-08
Description: Cross-site scripting (XSS) vulnerability in Forums/setup.asp in Snitz Forums 2000 3.4.06 and earlier allows remote attackers to inject arbitrary web script or HTML via the MAIL parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hackerscenter.com/archive/view.asp?id=28145; http://secunia.com/advisories/28284; http://www.packetstormsecurity.org/0801-exploits/snitz-multi.txt
CVE: CVE-2008-0135
Published: 2008-01-08
Description: Snitz Forums 2000 3.4.06 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for forum/snitz_forums_2000.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://hackerscenter.com/archive/view.asp?id=28145; http://www.packetstormsecurity.org/0801-exploits/snitz-multi.txt; http://www.securityfocus.com/archive/1/485836/100/200/threaded
CVE: CVE-2008-0136
Published: 2008-01-08
Description: Snitz Forums 2000 3.4.05 allows remote attackers to obtain sensitive information via a direct request to forum/whereami.asp, which reveals the database path.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://hackerscenter.com/archive/view.asp?id=28145; http://www.packetstormsecurity.org/0801-exploits/snitz-multi.txt; http://www.securityfocus.com/archive/1/485836/100/200/threaded
CVE: CVE-2008-0137
Published: 2008-01-08
Description: PHP remote file inclusion vulnerability in config.inc.php in SNETWORKS PHP CLASSIFIEDS 5.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_escape parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.vupen.com/english/advisories/2008/0053; https://exchange.xforce.ibmcloud.com/vulnerabilities/39468; https://www.exploit-db.com/exploits/4838
CVE: CVE-2008-0138
Published: 2008-01-08
Description: PHP remote file inclusion vulnerability in xoopsgallery/init_basic.php in the mod_gallery module for XOOPS, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27155; https://exchange.xforce.ibmcloud.com/vulnerabilities/39461; https://www.exploit-db.com/exploits/4847
CVE: CVE-2008-0139
Published: 2008-01-08
Description: Eval injection vulnerability in loudblog/inc/parse_old.php in Loudblog 0.8.0 and earlier allows remote attackers to execute arbitrary PHP code via the template parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28336; http://www.securityfocus.com/bid/27157; https://exchange.xforce.ibmcloud.com/vulnerabilities/39445
CVE: CVE-2008-0140
Published: 2008-01-08
Description: Directory traversal vulnerability in error.php in Uebimiau Webmail 2.7.10 and 2.7.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the selected_theme parameter, a different vector than CVE-2007-3172.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://www.attrition.org/pipermail/vim/2008-January/001867.html; http://www.securityfocus.com/bid/27154; https://exchange.xforce.ibmcloud.com/vulnerabilities/39460
CVE: CVE-2008-0141
Published: 2008-01-08
Description: actions.php in WebPortal CMS 0.6-beta generates predictable passwords containing only the time of day, which makes it easier for remote attackers to obtain access to any account via a lostpass action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: http://www.securityfocus.com/bid/27145; https://exchange.xforce.ibmcloud.com/vulnerabilities/39486; https://www.exploit-db.com/exploits/4835
CVE: CVE-2008-0142
Published: 2008-01-08
Description: Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL commands via the user_name parameter to actions.php, and unspecified other vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/4835; https://www.exploit-db.com/exploits/4835
CVE: CVE-2008-0143
Published: 2008-01-08
Description: PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM Broadcaster, allows remote attackers to execute arbitrary PHP code via a URL in the commonpath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28355; http://www.securityfocus.com/bid/27137; http://www.spacialaudio.com/news/index.html
CVE: CVE-2008-0144
Published: 2008-01-08
Description: PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.  NOTE: this can also be leveraged for local file inclusion using directory traversal sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8283&w=2; http://secunia.com/advisories/28328; http://www.securityfocus.com/bid/27136
CVE: CVE-2008-0145
Published: 2008-01-08
Description: Unspecified vulnerability in glob in PHP before 4.4.8, when open_basedir is enabled, has unknown impact and attack vectors.  NOTE: this issue reportedly exists because of a regression related to CVE-2007-4663.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://bugs.php.net/bug.php?id=41655; http://secunia.com/advisories/28318; http://secunia.com/advisories/28936
CVE: CVE-2008-0146
Published: 2008-01-08
Description: Cross-site scripting (XSS) vulnerability in the error page in W3-mSQL allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the top-level URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51235; http://secunia.com/advisories/28294; http://securityreason.com/securityalert/3521
CVE: CVE-2007-0066
Published: 2008-01-08
Description: The kernel in Microsoft Windows 2000 SP4, XP SP2, and Server 2003, when ICMP Router Discovery Protocol (RDP) is enabled, allows remote attackers to cause a denial of service via fragmented router advertisement ICMP packets that trigger an out-of-bounds read, aka "Windows Kernel TCP/IP/ICMP Vulnerability."
CVSS Score: 7.1 (HIGH)
References: http://blogs.technet.com/swi/archive/2008/01/08/ms08-001-part-2-the-case-of-the-moderate-icmp-mitigations.aspx; http://secunia.com/advisories/28297; http://securitytracker.com/id?1019166
CVE: CVE-2007-0069
Published: 2008-01-08
Description: Unspecified vulnerability in the kernel in Microsoft Windows XP SP2, Server 2003, and Vista allows remote attackers to cause a denial of service (CPU consumption) and possibly execute arbitrary code via crafted (1) IGMPv3 and (2) MLDv2 packets that trigger memory corruption, aka "Windows Kernel TCP/IP/IGMPv3 and MLDv2 Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://blogs.technet.com/swi/archive/2008/01/08/ms08-001-part-3-the-case-of-the-igmp-network-critical.aspx; http://secunia.com/advisories/28297; http://securitytracker.com/id?1019166
CVE: CVE-2007-5352
Published: 2008-01-08
Description: Unspecified vulnerability in Local Security Authority Subsystem Service (LSASS) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows local users to gain privileges via a crafted local procedure call (LPC) request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/28341; http://securitytracker.com/id?1019165; http://www.kb.cert.org/vuls/id/410025
CVE: CVE-2007-5360
Published: 2008-01-08
Description: Buffer overflow in OpenPegasus Management server, when compiled to use PAM and with PEGASUS_USE_PAM_STANDALONE_PROC defined, as used in VMWare ESX Server 3.0.1 and 3.0.2, might allow remote attackers to execute arbitrary code via vectors related to PAM authentication, a different vulnerability than CVE-2008-0003.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01438409; http://lists.vmware.com/pipermail/security-announce/2008/000002.html; http://secunia.com/advisories/28358
CVE: CVE-2008-0003
Published: 2008-01-08
Description: Stack-based buffer overflow in the PAMBasicAuthenticator::PAMCallback function in OpenPegasus CIM management server (tog-pegasus), when compiled to use PAM and without PEGASUS_USE_PAM_STANDALONE_PROC defined, might allow remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2007-5360.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01438409; http://lists.vmware.com/pipermail/security-announce/2008/000014.html; http://osvdb.org/40082
CVE: CVE-2007-5665
Published: 2008-01-09
Description: STEngine.exe 3.5.0.20 in Novell ZENworks Endpoint Security Management (ESM) 3.5, and other ESM versions before 3.5.0.82, dynamically creates scripts in a world-writable directory when generating diagnostic reports, which allows local users to gain privileges, as demonstrated by creating a cmd.exe binary in the diagnostic report directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=635; http://secunia.com/advisories/28351; http://www.securityfocus.com/bid/27146
CVE: CVE-2007-5761
Published: 2008-01-09
Description: The NantSys device 5.0.0.115 in Motorola netOctopus 5.1.2 build 1011 has weak permissions for the \\.\NantSys device interface (nantsys.sys), which allows local users to gain privileges or cause a denial of service (system crash), as demonstrated by modifying the SYSENTER_EIP_MSR CPU Model Specific Register (MSR) value.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=636; http://secunia.com/advisories/28366; http://securitytracker.com/id?1019161
CVE: CVE-2008-0147
Published: 2008-01-09
Description: SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via (1) the user_email parameter and possibly (2) username parameter in a Members action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28301; http://www.securityfocus.com/bid/27180; https://exchange.xforce.ibmcloud.com/vulnerabilities/39525
CVE: CVE-2008-0148
Published: 2008-01-09
Description: TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell commands via the cmd parameter in a direct request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/28291; https://exchange.xforce.ibmcloud.com/vulnerabilities/39531; https://www.exploit-db.com/exploits/4861
CVE: CVE-2008-0149
Published: 2008-01-09
Description: TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/28291; https://www.exploit-db.com/exploits/4861; http://secunia.com/advisories/28291
CVE: CVE-2008-0150
Published: 2008-01-09
Description: Unspecified vulnerability in the LDAP authentication feature in Aruba Mobility Controller 2.3.6.15, 2.5.2.11, 2.5.4.25, 2.5.5.7, 3.1.1.3, and 2.4.8.11-FIPS or earlier allows remote attackers to bypass authentication mechanisms and obtain management or VPN interface access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/28357; http://securityreason.com/securityalert/3529; http://www.arubanetworks.com/support/alerts/aid-122207.asc
CVE: CVE-2008-0151
Published: 2008-01-09
Description: Heap-based buffer overflow in Foxit WAC Server 2.1.0.910, 2.0 Build 3503, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Telnet request with long options.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/waccaz-adv.txt; http://aluigi.altervista.org/adv/wachof-adv.txt; http://secunia.com/advisories/28272
CVE: CVE-2008-0152
Published: 2008-01-09
Description: SLnet.exe in SeattleLab SLNet RF Telnet Server 4.1.1.3758 and earlier allows user-assisted remote attackers to cause a denial of service (crash) via unspecified telnet options, which triggers a NULL pointer dereference.  NOTE: the crash is not user-assisted when the server is running in debug mode.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/slnetmsg-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0448&w=2; http://secunia.com/advisories/28316
CVE: CVE-2008-0153
Published: 2008-01-09
Description: telnetd.exe in Pragma TelnetServer 7.0.4.589 allows remote attackers to cause a denial of service (process crash and resource exhaustion) via a crafted TELOPT PRAGMA LOGON telnet option, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/pragmatel-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0448&w=2; http://www.securityfocus.com/bid/27143
CVE: CVE-2008-0154
Published: 2008-01-09
Description: SQL injection vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to execute arbitrary SQL commands the c parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27190; https://exchange.xforce.ibmcloud.com/vulnerabilities/39529; https://www.exploit-db.com/exploits/4865
CVE: CVE-2008-0155
Published: 2008-01-09
Description: Cross-site scripting (XSS) vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to inject arbitrary web script or HTML via the c parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/27190; https://exchange.xforce.ibmcloud.com/vulnerabilities/39526; https://www.exploit-db.com/exploits/4865
CVE: CVE-2008-0156
Published: 2008-01-09
Description: Absolute path traversal vulnerability in index.php in Million Dollar Script 2.0.14 allows remote attackers to read arbitrary files via encoded "/" (%2F) sequences in the link parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/3524; http://www.securityfocus.com/archive/1/485882/100/0/threaded; http://www.securityfocus.com/bid/27174
CVE: CVE-2008-0157
Published: 2008-01-09
Description: SQL injection vulnerability in FlexBB 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb_temp_id parameter in a cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28373; http://www.securityfocus.com/bid/27164; https://exchange.xforce.ibmcloud.com/vulnerabilities/39475