deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3661
Published: 2008-09-23
Description: Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVSS Score: 5.0 (MEDIUM)
References: http://int21.de/cve/CVE-2008-3661-drupal.html; http://www.securityfocus.com/archive/1/496575/100/0/threaded; http://www.securityfocus.com/bid/31285
CVE: CVE-2008-4174
Published: 2008-09-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dynamic MP3 Lister 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) currentpath, (2) invert, (3) search, and (4) sort parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0809-exploits/dynamicmp3-xss.txt; http://www.securityfocus.com/bid/31151; https://exchange.xforce.ibmcloud.com/vulnerabilities/45111
CVE: CVE-2008-4175
Published: 2008-09-23
Description: Multiple SQL injection vulnerabilities in Link Bid Script 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) ucat parameter to upgrade.php and the (2) id parameter to linkadmin/edit.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31853; http://securityreason.com/securityalert/4299; http://www.securityfocus.com/bid/31191
CVE: CVE-2008-4176
Published: 2008-09-23
Description: SQL injection vulnerability in izle.asp in FoT Video scripti 1.1 beta allows remote attackers to execute arbitrary SQL commands via the oyun parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4309; http://www.securityfocus.com/bid/31166; https://exchange.xforce.ibmcloud.com/vulnerabilities/45098
CVE: CVE-2008-4177
Published: 2008-09-23
Description: SQL injection vulnerability in search.php in Pre Real Estate Listings allows remote attackers to execute arbitrary SQL commands via the c parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4310; http://www.securityfocus.com/bid/31192; https://exchange.xforce.ibmcloud.com/vulnerabilities/45151
CVE: CVE-2008-4178
Published: 2008-09-23
Description: SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0809-exploits/categoryaddon-sql.txt; http://packetstorm.linuxsecurity.com/0809-exploits/downline-sql.txt; http://packetstormsecurity.org/0809-exploits/newdownline-sql.txt
CVE: CVE-2008-4179
Published: 2008-09-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in NooMS 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) page_id parameter to smileys.php and the (2) q parameter to search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31859; http://securityreason.com/securityalert/4289; http://www.securityfocus.com/archive/1/496236/100/0/threaded
CVE: CVE-2008-4180
Published: 2008-09-23
Description: Unspecified vulnerability in db.php in NooMS 1.1 allows remote attackers to conduct brute force attacks against passwords via a username in the g_dbuser parameter and a password in the g_dbpwd parameter, and possibly a "localhost" g_dbhost parameter value, related to a "Mysql Remote Brute Force Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://securityreason.com/securityalert/4289; http://www.securityfocus.com/archive/1/496236/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/45076
CVE: CVE-2008-4181
Published: 2008-09-23
Description: Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for cPanel, when cPanel PHP Register Globals is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) or absolute pathname in the fantasticopath parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31863; http://securityreason.com/securityalert/4301; http://www.netenberg.com/forum/index.php?topic=6768.0
CVE: CVE-2008-4182
Published: 2008-09-23
Description: Cross-site scripting (XSS) vulnerability in imp/test.php in Horde Turba Contact Manager H3 2.2.1 and other versions before 2.3.1, and possibly other Horde Project products, allows remote attackers to inject arbitrary web script or HTML via the User field in an IMAP session.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.horde.org/archives/announce/2008/000465.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://packetstormsecurity.org/0809-exploits/turba-xss.txt
CVE: CVE-2008-4183
Published: 2008-09-23
Description: IntegraMOD 1.4.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a backup via a direct request to a backup/backup-yyyy-dd-mm.sql filename.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/31749; http://securityreason.com/securityalert/4300; http://www.integramod.com/forum/viewtopic.php?f=3&t=5089
CVE: CVE-2008-4184
Published: 2008-09-23
Description: Cross-site scripting (XSS) vulnerability in index.php in webCMS Portal Edition allows remote attackers to inject arbitrary web script or HTML via the patron parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31775; http://www.securityfocus.com/bid/31153; https://exchange.xforce.ibmcloud.com/vulnerabilities/45447
CVE: CVE-2008-4185
Published: 2008-09-23
Description: SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL commands via the id parameter in a documentos action, a different vector than CVE-2008-3213.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31775; http://securityreason.com/securityalert/4314; http://spanish-hackers.com/exploits/24.txt
CVE: CVE-2008-4186
Published: 2008-09-23
Description: SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL commands via the id_doc parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31775; https://exchange.xforce.ibmcloud.com/vulnerabilities/45449; http://secunia.com/advisories/31775
CVE: CVE-2008-4187
Published: 2008-09-23
Description: Directory traversal vulnerability in index.php in ProActive CMS allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4315; https://exchange.xforce.ibmcloud.com/vulnerabilities/45235; https://www.exploit-db.com/exploits/6489
CVE: CVE-2008-4188
Published: 2008-09-23
Description: Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before 1.0.2 allows remote attackers to execute arbitrary code via unknown vectors related to "injection of control characters."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/31897; http://typo3.org/extensions/repository/view/kw_secdir/1.0.2/; http://www.securityfocus.com/bid/31253
CVE: CVE-2008-4189
Published: 2008-09-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-1105.  Reason: This candidate is a duplicate of CVE-2008-1105.  Notes: All CVE users should reference CVE-2008-1105 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-4136
Published: 2008-09-24
Description: Michael Roth Software Personal FTP Server (PFT) 6.0f allows remote attackers to cause a denial of service (service crash) via multiple RETR commands, possibly involving long filenames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/31852; http://shinnok.evonet.ro/vulns_html/pftp.html; http://www.securityfocus.com/bid/31173
CVE: CVE-2008-4137
Published: 2008-09-24
Description: PHP remote file inclusion vulnerability in footer.php in PHP-Crawler 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the footer_file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/31217; http://www.securityfocus.com/bid/31217/exploit; http://www.vupen.com/english/advisories/2008/2610
CVE: CVE-2008-4138
Published: 2008-09-24
Description: PHP remote file inclusion vulnerability in skin_shop/standard/3_plugin_twindow/twindow_notice.php in TECHNOTE 7 allows remote attackers to execute arbitrary PHP code via a URL in the shop_this_skin_path parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/48166; http://secunia.com/advisories/31916; http://www.securityfocus.com/bid/31222
CVE: CVE-2008-4139
Published: 2008-09-24
Description: Cross-site scripting (XSS) vulnerability in admin.php in OpenSolution Quick.Cms.Lite 2.1 allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/31701; http://www.securityfocus.com/archive/1/496435/100/0/threaded; http://www.securityfocus.com/bid/31210
CVE: CVE-2008-4140
Published: 2008-09-24
Description: Cross-site scripting (XSS) vulnerability in admin.php in Quick.Cart 3.1 allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31938; http://www.securityfocus.com/archive/1/496477/100/0/threaded; http://www.securityfocus.com/bid/31216
CVE: CVE-2008-4141
Published: 2008-09-24
Description: Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to execute arbitrary PHP code via a URL in the web_root parameter to (1) includes/function_core.php and (2) templates/layout_lyrics.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/0809-exploits/x10media-rfi.txt; http://secunia.com/advisories/31920; http://securityreason.com/securityalert/4294
CVE: CVE-2008-4142
Published: 2008-09-24
Description: SQL injection vulnerability in article.php in E-Php CMS allows remote attackers to execute arbitrary SQL commands via the es_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31923; http://www.exploit-db.com/exploits/15410; http://www.securityfocus.com/bid/31119
CVE: CVE-2008-4143
Published: 2008-09-24
Description: SQL injection vulnerability in category_search.php in RazorCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0809-exploits/razorcommerce-sql.txt; http://secunia.com/advisories/31733; https://exchange.xforce.ibmcloud.com/vulnerabilities/45145
CVE: CVE-2008-4144
Published: 2008-09-24
Description: SQL injection vulnerability in index.php in ACG-ScriptShop E-Gold Script Shop allows remote attackers to execute arbitrary SQL commands via the cid parameter in a showcat action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31740; http://www.securityfocus.com/bid/31015; https://exchange.xforce.ibmcloud.com/vulnerabilities/44966
CVE: CVE-2008-4145
Published: 2008-09-24
Description: SQL injection vulnerability in user_read_links.php in Addalink 1.0 beta 4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.vupen.com/english/advisories/2008/2606; https://exchange.xforce.ibmcloud.com/vulnerabilities/45245; https://www.exploit-db.com/exploits/6485
CVE: CVE-2008-4146
Published: 2008-09-24
Description: Addalink 1.0 beta 4 and earlier allows remote attackers to (1) approve web-site additions via a modified approved field and (2) change the visit-counter value via a modified counter field.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://securityreason.com/securityalert/4295; http://www.vupen.com/english/advisories/2008/2606; https://exchange.xforce.ibmcloud.com/vulnerabilities/45246
CVE: CVE-2008-4147
Published: 2008-09-24
Description: Cross-site scripting (XSS) vulnerability in the Mailsave module 5.x before 5.x-3.3 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via an e-mail message with an attached file that has a modified Content-Type.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/309802; http://secunia.com/advisories/31889; http://www.securityfocus.com/bid/31232
CVE: CVE-2008-4148
Published: 2008-09-24
Description: SQL injection vulnerability in the Mailhandler module 5.x before 5.x-1.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to composing queries without using the Drupal database API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/309769; http://secunia.com/advisories/31877; http://www.securityfocus.com/bid/31230
CVE: CVE-2008-4149
Published: 2008-09-24
Description: Cross-site scripting (XSS) vulnerability in the Greg Holsclaw Link to Us module 5.x before 5.x-1.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the "Link page header" field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/309861; http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064527.html; http://secunia.com/advisories/31914
CVE: CVE-2008-4150
Published: 2008-09-24
Description: SQL injection vulnerability in picture_category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2006-3763.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4296; http://www.securityfocus.com/bid/31240; https://exchange.xforce.ibmcloud.com/vulnerabilities/45217
CVE: CVE-2008-4151
Published: 2008-09-24
Description: Directory traversal vulnerability in collect.php in CYASK 3.x allows remote attackers to read arbitrary files via a .. (dot dot) in the neturl parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4297; http://www.securityfocus.com/archive/1/496511/100/0/threaded; http://www.securityfocus.com/bid/31237
CVE: CVE-2008-4152
Published: 2008-09-24
Description: Cross-site scripting (XSS) vulnerability in the Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via a node title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/309758; http://secunia.com/advisories/31908; http://www.securityfocus.com/bid/31236
CVE: CVE-2008-4153
Published: 2008-09-24
Description: The Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, does not perform access checks for a node before displaying comments, which allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/309758; http://secunia.com/advisories/31908; http://www.securityfocus.com/bid/31236
CVE: CVE-2008-3102
Published: 2008-09-24
Description: Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://int21.de/cve/CVE-2008-3102-mantis.html; http://secunia.com/advisories/32243; http://secunia.com/advisories/32330
CVE: CVE-2008-4190
Published: 2008-09-24
Description: The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files.  NOTE: in many distributions and the upstream version, this tool has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496374; http://dev.gentoo.org/~rbu/security/debiantemp/openswan; http://secunia.com/advisories/34182
CVE: CVE-2008-4191
Published: 2008-09-24
Description: extract-table.pl in Emacspeak 26 and 28 allows local users to overwrite arbitrary files via a symlink attack on the extract-table.csv temporary file.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496431; http://dev.gentoo.org/~rbu/security/debiantemp/emacspeak; http://secunia.com/advisories/31880
CVE: CVE-2008-4193
Published: 2008-09-24
Description: Stack-based buffer overflow in SecurityGateway.dll in Alt-N Technologies SecurityGateway 1.0.1 allows remote attackers to execute arbitrary code via a long username parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://files.altn.com/securitygateway/release/relnotes_en.htm; http://secunia.com/advisories/30497; http://securityreason.com/securityalert/4302
CVE: CVE-2008-4194
Published: 2008-09-24
Description: The p_exec_query function in src/dns_query.c in pdnsd before 1.2.7-par allows remote attackers to cause a denial of service (daemon crash) via a long DNS reply with many entries in the answer section, related to a "dangling pointer bug."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.phys.uu.nl/~rombouts/pdnsd.html; http://www.phys.uu.nl/~rombouts/pdnsd/ChangeLog; http://www.vupen.com/english/advisories/2008/2582
CVE: CVE-2008-4201
Published: 2008-09-24
Description: Heap-based buffer overflow in the decodeMP4file function (frontend/main.c) in FAAD2 2.6.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MPEG-4 (MP4) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499899; http://bugs.gentoo.org/attachment.cgi?id=166174&action=view; http://bugs.gentoo.org/show_bug.cgi?id=238445
CVE: CVE-2008-3098
Published: 2008-09-24
Description: Cross-site scripting (XSS) vulnerability in admin/usercheck.php in fuzzylime (cms) before 3.03 allows remote attackers to inject arbitrary web script or HTML via the user parameter to the login form.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cms.fuzzylime.co.uk/st/content/download/; http://secunia.com/advisories/31980; http://securityreason.com/securityalert/4303
CVE: CVE-2008-3663
Published: 2008-09-24
Description: Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://int21.de/cve/CVE-2008-3663-squirrelmail.html; http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html
CVE: CVE-2008-4202
Published: 2008-09-24
Description: SQL injection vulnerability in index.php in Gonafish LinksCaffePRO 4.5 allows remote attackers to execute arbitrary SQL commands via the idd parameter in a deadlink action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31844; http://securityreason.com/securityalert/4305; http://www.securityfocus.com/bid/31187
CVE: CVE-2008-4203
Published: 2008-09-24
Description: SQL injection vulnerability in cn_users.php in CzarNews 1.20 and earlier allows remote attackers to execute arbitrary SQL commands via a recook cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4306; http://www.securityfocus.com/bid/31182; https://exchange.xforce.ibmcloud.com/vulnerabilities/45127
CVE: CVE-2008-4204
Published: 2008-09-24
Description: SQL injection vulnerability in city.asp in SoftAcid Hotel Reservation System (HRS) allows remote attackers to execute arbitrary SQL commands via the city parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4308; http://www.securityfocus.com/bid/31211; https://exchange.xforce.ibmcloud.com/vulnerabilities/45190
CVE: CVE-2008-4205
Published: 2008-09-24
Description: SQL injection vulnerability in search.php Attachmax Dolphin 2.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter in a Search action to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://e-rdc.org/v1/news.php?readmore=108; http://osvdb.org/48270; http://secunia.com/advisories/31794
CVE: CVE-2008-4206
Published: 2008-09-24
Description: PHP remote file inclusion vulnerability in config.php in Attachmax Dolphin 2.1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rel_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://e-rdc.org/v1/news.php?readmore=108; http://osvdb.org/48269; http://secunia.com/advisories/31794
CVE: CVE-2008-4207
Published: 2008-09-24
Description: Attachmax Dolphin 2.1.0 and earlier does not properly protect info.php in the main folder, which allows remote attackers to obtain sensitive information via a direct request, which invokes the phpinfo function. NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://e-rdc.org/v1/news.php?readmore=108; http://osvdb.org/48271; http://secunia.com/advisories/31794
CVE: CVE-2008-4208
Published: 2008-09-24
Description: Unspecified vulnerability in OSADS Alliance Database before 2.1 has unknown impact and attack vectors, possibly related to includes/functions.php, a different issue than CVE-2006-2874.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/31876; http://sourceforge.net/project/shownotes.php?group_id=163285&release_id=625654; http://www.securityfocus.com/bid/31198
CVE: CVE-2008-0016
Published: 2008-09-24
Description: Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a crafted UTF-8 URL in a link.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-3835
Published: 2008-09-24
Description: The nsXMLDocument::OnChannelRedirect function in Mozilla Firefox before 2.0.0.17, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-3836
Published: 2008-09-24
Description: feedWriter in Mozilla Firefox before 2.0.0.17 allows remote attackers to execute scripts with chrome privileges via vectors related to feed preview and the (1) elem.doCommand, (2) elem.dispatchEvent, (3) _setTitleText, (4) _setTitleImage, and (5) _initSubscriptionUI functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984