deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1698
Published: 2008-04-08
Description: Cross-site scripting (XSS) vulnerability in gallery.php in Simple Gallery 2.2 allows remote attackers to inject arbitrary web script or HTML via the album parameter to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29646; http://www.securityfocus.com/bid/28596; https://exchange.xforce.ibmcloud.com/vulnerabilities/41622
CVE: CVE-2008-1699
Published: 2008-04-08
Description: SQL injection vulnerability in permalink.php in Desi Quintans Writer's Block CMS 3.8a allows remote attackers to execute arbitrary SQL commands via the PostID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29652; http://securityreason.com/securityalert/3803; http://www.securityfocus.com/archive/1/490376/100/0/threaded
CVE: CVE-2008-0711
Published: 2008-04-08
Description: Unspecified vulnerability in the embedded management console in HP iLO-2 Management Processors (iLO-2 MP), as used in Integrity Servers rx2660, rx3600, and rx6600, and Integrity Blade Server model bl860c, allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1792&w=2; http://secunia.com/advisories/29718; http://securityreason.com/securityalert/3804
CVE: CVE-2008-1617
Published: 2008-04-08
Description: Double free vulnerability in Web TransferCtrl Class 8,2,1,4 (iManFile.cab), as used in WorkSite Web 8.2 before SP1 P2, allows remote attackers to execute arbitrary code via JavaScript that sets the Server property to a string, then sets the string to null.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/29733; http://www.mwrinfosecurity.com/publications/mwri_interwoven-worksite-activex-control-remote-code-execution_2008-03-10.pdf; http://www.securityfocus.com/bid/28628
CVE: CVE-2008-1686
Published: 2008-04-08
Description: Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://blog.kfish.org/2008/04/release-libfishsound-091.html; http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html; http://lists.xiph.org/pipermail/speex-dev/2008-April/006636.html
CVE: CVE-2008-1700
Published: 2008-04-08
Description: The Web TransferCtrl Class 8,2,1,4 (iManFile.cab), as used in WorkSite Web 8.2 before SP1 P2, allows remote attackers to cause a denial of service (memory consumption) via a large number of SendNrlLink directives, which opens a separate window for each directive.
CVSS Score: 7.1 (HIGH)
CWE: CWE-770
References: http://www.mwrinfosecurity.com/publications/mwri_interwoven-worksite-activex-control-remote-code-execution_2008-03-10.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/41757; http://www.mwrinfosecurity.com/publications/mwri_interwoven-worksite-activex-control-remote-code-execution_2008-03-10.pdf
CVE: CVE-2008-1701
Published: 2008-04-08
Description: Novell NetWare 6.5 allows attackers to cause a denial of service (ABEND) via a crafted Macintosh iPrint client request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/29587; http://www.securityfocus.com/bid/28561; http://www.securitytracker.com/id?1019750
CVE: CVE-2008-1702
Published: 2008-04-08
Description: Absolute path traversal vulnerability in dload.php in the my_gallery 2.3 plugin for e107 allows remote attackers to obtain sensitive information via a full pathname in the file parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-22
References: http://secunia.com/advisories/29493; http://securityreason.com/securityalert/3801; http://www.securityfocus.com/archive/1/490041/100/0/threaded
CVE: CVE-2008-0083
Published: 2008-04-08
Description: The (1) VBScript (VBScript.dll) and (2) JScript (JScript.dll) scripting engines 5.1 and 5.6, as used in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2, do not properly decode script, which allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0729&w=2; http://secunia.com/advisories/29712; http://www.securityfocus.com/bid/28551
CVE: CVE-2008-0087
Published: 2008-04-08
Description: The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows remote attackers to spoof DNS responses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0729&w=2; http://secunia.com/advisories/29696; http://www.securityfocus.com/archive/1/490575/100/0/threaded
CVE: CVE-2008-1083
Published: 2008-04-08
Description: Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow, aka "GDI Heap Overflow Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-119, CWE-190
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0168.html; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=681; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0729&w=2
CVE: CVE-2008-1084
Published: 2008-04-08
Description: Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, through Vista SP1, and Server 2008 allows local users to execute arbitrary code via unknown vectors related to improper input validation.  NOTE: it was later reported that one affected function is NtUserFnOUTSTRING in win32k.sys.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0729&w=2; http://milw0rm.com/sploits/2008-ms08-25-exploit.zip; http://secunia.com/advisories/29720
CVE: CVE-2008-1085
Published: 2008-04-08
Description: Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6 through SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream that triggers memory corruption, as demonstrated using an invalid MIME-type that does not have a registered handler.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0729&w=2; http://secunia.com/advisories/27707; http://secunia.com/secunia_research/2007-100/advisory/
CVE: CVE-2008-1086
Published: 2008-04-08
Description: The HxTocCtrl ActiveX control (hxvz.dll), as used in Microsoft Internet Explorer 5.01 SP4 and 6 SP1, in Windows XP SP2, Server 2003 SP1 and SP2, Vista SP1, and Server 2008, allows remote attackers to execute arbitrary code via malformed arguments, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=680; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0729&w=2; http://secunia.com/advisories/29714
CVE: CVE-2008-1087
Published: 2008-04-08
Description: Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0729&w=2; http://secunia.com/advisories/29704; http://www.osvdb.org/44215
CVE: CVE-2008-1088
Published: 2008-04-08
Description: Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a crafted Project file, related to improper validation of "memory resource allocations."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0729&w=2; http://secunia.com/advisories/29690; http://www.kb.cert.org/vuls/id/155563
CVE: CVE-2008-1089
Published: 2008-04-08
Description: Unspecified vulnerability in Microsoft Visio 2002 SP2, 2003 SP2 and SP3, and 2007 up to SP1 allows user-assisted remote attackers to execute arbitrary code via a Visio file containing crafted object header data, aka "Visio Object Header Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0729&w=2; http://secunia.com/advisories/29691; http://www.securityfocus.com/bid/28555
CVE: CVE-2008-1090
Published: 2008-04-08
Description: Unspecified vulnerability in Microsoft Visio 2002 SP2, 2003 SP2 and SP3, and 2007 up to SP1 allows user-assisted remote attackers to execute arbitrary code via a crafted .DXF file, aka "Visio Memory Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0729&w=2; http://secunia.com/advisories/29691; http://www.securityfocus.com/bid/28556
CVE: CVE-2008-1656
Published: 2008-04-09
Description: Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29748; http://securitytracker.com/id?1019806; http://www.adobe.com/support/security/bulletins/apsb08-12.html
CVE: CVE-2008-1687
Published: 2008-04-09
Description: The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/29671; http://secunia.com/advisories/29729; http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.510612
CVE: CVE-2008-1688
Published: 2008-04-09
Description: Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option.  NOTE: it is not clear when this issue crosses privilege boundaries.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/44272; http://secunia.com/advisories/29671; http://secunia.com/advisories/29729
CVE: CVE-2008-1705
Published: 2008-04-09
Description: Format string vulnerability in the logging function in IBM solidDB 06.00.1018 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the (1) user name, (2) peer name, and possibly unspecified other fields.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/soliduro-adv.txt; http://aluigi.org/poc/soliduro.zip; http://secunia.com/advisories/29512
CVE: CVE-2008-1706
Published: 2008-04-09
Description: Uncontrolled array index in IBM solidDB 06.00.1018 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large value in a certain 32-bit field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/soliduro-adv.txt; http://aluigi.org/poc/soliduro.zip; http://secunia.com/advisories/29512
CVE: CVE-2008-1707
Published: 2008-04-09
Description: IBM solidDB 06.00.1018 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a packet with an 0x11 value in a certain "type" field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/soliduro-adv.txt; http://aluigi.org/poc/soliduro.zip; http://secunia.com/advisories/29512
CVE: CVE-2008-1708
Published: 2008-04-09
Description: IBM solidDB 06.00.1018 and earlier does not validate a certain field that specifies an amount of memory to allocate, which allows remote attackers to cause a denial of service (daemon exit) via a packet with a large value in this field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/soliduro-adv.txt; http://aluigi.org/poc/soliduro.zip; http://secunia.com/advisories/29512
CVE: CVE-2008-1709
Published: 2008-04-09
Description: Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN) file with a long malformed Project line beginning with a 'Project("{}") =' sequence, probably a different vector than CVE-2008-0250.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/41826; https://www.exploit-db.com/exploits/5349; https://exchange.xforce.ibmcloud.com/vulnerabilities/41826
CVE: CVE-2008-1710
Published: 2008-04-09
Description: Untrusted search path vulnerability in chnfsmnt in IBM AIX 6.1 allows local users to gain privileges via a modified PATH environment variable.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29518; http://securitytracker.com/id?1019693; http://www-01.ibm.com/support/docview.wss?uid=isg1IZ20391
CVE: CVE-2008-1711
Published: 2008-04-09
Description: Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/29667; https://exchange.xforce.ibmcloud.com/vulnerabilities/41820; https://www.exploit-db.com/exploits/5364
CVE: CVE-2007-0071
Published: 2008-04-09
Description: Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.html; http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf; http://isc.sans.org/diary.html?storyid=4465
CVE: CVE-2007-6019
Published: 2008-04-09
Description: Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a modified DeclareFunction2 Actionscript tag, which prevents an object from being instantiated properly.
CVSS Score: 9.3 (HIGH)
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html; http://secunia.com/advisories/29763
CVE: CVE-2008-1655
Published: 2008-04-09
Description: Unspecified vulnerability in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, makes it easier for remote attackers to conduct DNS rebinding attacks via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html; http://secunia.com/advisories/29763
CVE: CVE-2008-1712
Published: 2008-04-09
Description: PHP remote file inclusion vulnerability in includes/functions_weblog.php in mxBB mx_blogs 2.0.0 beta allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28515; https://exchange.xforce.ibmcloud.com/vulnerabilities/41819; https://www.exploit-db.com/exploits/5323
CVE: CVE-2008-1713
Published: 2008-04-09
Description: MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application crash) via a long string to IMAP port (143/tcp).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/29629; http://www.securityfocus.com/bid/28559; https://exchange.xforce.ibmcloud.com/vulnerabilities/41581
CVE: CVE-2008-1714
Published: 2008-04-09
Description: SQL injection vulnerability in show.php in FaScript FaPhoto 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29628; http://www.securityfocus.com/bid/28545; https://exchange.xforce.ibmcloud.com/vulnerabilities/41557
CVE: CVE-2008-1715
Published: 2008-04-09
Description: SQL injection vulnerability in content/user.php in AuraCMS 2.2.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the country parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29593; http://www.securityfocus.com/bid/28499; https://exchange.xforce.ibmcloud.com/vulnerabilities/41529
CVE: CVE-2008-1716
Published: 2008-04-09
Description: Cross-site scripting (XSS) vulnerability in WoltLab Community Framework (WCF) 1.0.6 in WoltLab Burning Board 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the (1) page and (2) form parameters, which are not properly handled when they are reflected back in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0161.html; http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061271.html; http://secunia.com/advisories/29719
CVE: CVE-2008-1717
Published: 2008-04-09
Description: WoltLab Community Framework (WCF) 1.0.6 in WoltLab Burning Board 3.0.5 allows remote attackers to obtain the full path via invalid (1) page and (2) form parameters, which leaks the path from an exception handler when a valid class cannot be found.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0161.html; http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061271.html; http://secunia.com/advisories/29719
CVE: CVE-2007-5399
Published: 2008-04-10
Description: Multiple heap-based buffer overflows in emlsr.dll in the EML reader in Autonomy (formerly Verity) KeyView 10.3.0.0, as used by IBM Lotus Notes, allow remote attackers to execute arbitrary code via a long (1) To, (2) Cc, (3) Bcc, (4) From, (5) Date, (6) Subject, (7) Priority, (8) Importance, or (9) X-MSMail-Priority header; (10) a long string at the beginning of an RFC2047 encoded-word in a header; (11) a long text string in an RFC2047 encoded-word in a header; or (12) a long Subject header, related to creation of an associated filename.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28209; http://secunia.com/advisories/28210; http://secunia.com/secunia_research/2007-91/advisory/
CVE: CVE-2007-5405
Published: 2008-04-10
Description: Multiple buffer overflows in kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes, Symantec Mail Security, and activePDF DocConverter, allow remote attackers to execute arbitrary code via a .ag file with (1) a long ENCODING attribute in a *BEGIN tag, (2) a long token, or (3) the initial *BEGIN tag.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27763; http://secunia.com/advisories/28140; http://secunia.com/advisories/28209
CVE: CVE-2007-5406
Published: 2008-04-10
Description: kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes, Symantec Mail Security, and activePDF DocConverter, does not properly parse long tokens, which allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted .ag file.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/27763; http://secunia.com/advisories/28140; http://secunia.com/advisories/28209
CVE: CVE-2007-6020
Published: 2008-04-10
Description: Multiple stack-based buffer overflows in foliosr.dll in the Folio Flat File speed reader in Autonomy (formerly Verity) KeyView 10.3.0.0, as used by IBM Lotus Notes, Symantec Mail Security, and activePDF DocConverter, allow remote attackers to execute arbitrary code via a long attribute value in a (1) DI, (2) FD, (3) FT, (4) JD, (5) JL, (6) LE, (7) OB, (8) OD, (9) OL, (10) PN, (11) PS, (12) PW, (13) RD, (14) QL, or (15) TS tag in a .fff file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27763; http://secunia.com/advisories/28140; http://secunia.com/advisories/28209
CVE: CVE-2008-0066
Published: 2008-04-10
Description: Multiple buffer overflows in htmsr.dll in the HTML speed reader in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes 7.0.2 and 7.0.3, allow remote attackers to execute arbitrary code via an HTML document with (1) "large chunks of data," or a long URL in the (2) BACKGROUND attribute of a BODY element or (3) SRC attribute of an IMG element.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28140; http://secunia.com/advisories/28209; http://secunia.com/advisories/28210
CVE: CVE-2008-1101
Published: 2008-04-10
Description: Buffer overflow in kvdocve.dll in the KeyView document viewing engine in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes 7.0.2 and 7.0.3, allows remote attackers to execute arbitrary code via a long pathname, as demonstrated by a long SRC attribute of an IMG element in an HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28140; http://secunia.com/advisories/28209; http://secunia.com/advisories/28210
CVE: CVE-2008-1718
Published: 2008-04-10
Description: Buffer overflow in mimesr.dll in Autonomy (formerly Verity) KeyView, as used in IBM Lotus Notes before 8.0, might allow user-assisted remote attackers to execute arbitrary code via an e-mail message with a crafted Text mail (MIME) attachment.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21298453; https://exchange.xforce.ibmcloud.com/vulnerabilities/41856; http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21298453
CVE: CVE-2008-1719
Published: 2008-04-10
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Nuke ET 3.2 and 3.4 allow remote attackers to perform actions as administrators, as demonstrated by inserting an XSS sequence into a document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/29651; http://www.mrzayas.es/2008/04/07/xsrf-en-nuke-et-3x/; https://exchange.xforce.ibmcloud.com/vulnerabilities/41851
CVE: CVE-2008-1720
Published: 2008-04-10
Description: Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2557&w=2; http://rsync.samba.org/ftp/rsync/security/rsync-3.0.1-xattr-alloc.diff
CVE: CVE-2008-1721
Published: 2008-04-10
Description: Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-681
References: http://bugs.python.org/issue2586; http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/29889
CVE: CVE-2008-1722
Published: 2008-04-10
Description: Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/29809; http://secunia.com/advisories/29902; http://secunia.com/advisories/30078