deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2410
Published: 2009-07-30
Description: The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password, over an ssh connection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/36018; http://www.securityfocus.com/bid/35868; https://bugzilla.redhat.com/attachment.cgi?id=355424
CVE: CVE-2009-2645
Published: 2009-07-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-2408.  Reason: This candidate is a duplicate of CVE-2009-2408.  Notes: All CVE users should reference CVE-2009-2408 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-6879
Published: 2009-07-30
Description: Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://issues.apache.org/roller/browse/ROL-1766; http://osvdb.org/51151; http://secunia.com/advisories/31523
CVE: CVE-2008-6880
Published: 2009-07-30
Description: SQL injection vulnerability in joke.php in EasySiteNetwork Free Jokes Website allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52032; http://www.securityfocus.com/archive/1/499351/100/0/threaded; http://www.securityfocus.com/bid/32908
CVE: CVE-2008-6881
Published: 2009-07-30
Description: Multiple SQL injection vulnerabilities in the Live Chat (com_livechat) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the last parameter to (1) getChat.php, (2) getChatRoom.php, and (3) getSavedChatRooms.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33122; http://www.securityfocus.com/bid/32803; https://exchange.xforce.ibmcloud.com/vulnerabilities/47304
CVE: CVE-2008-6882
Published: 2009-07-30
Description: Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/32803; https://exchange.xforce.ibmcloud.com/vulnerabilities/47305; https://www.exploit-db.com/exploits/7441
CVE: CVE-2009-2408
Published: 2009-07-30
Description: Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://isc.sans.org/diary.html?storyid=7003; http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]8936&w=2
CVE: CVE-2009-2409
Published: 2009-07-30
Description: The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time.  NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-295
References: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html; http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
CVE: CVE-2009-2646
Published: 2009-07-30
Description: Multiple unspecified vulnerabilities in the PDF distiller in the Attachment Service component in Research In Motion (RIM) BlackBerry Enterprise Server (BES) software 4.1.3 through 4.1.6 and BlackBerry Professional Software 4.1.4 allow user-assisted remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .pdf file attachment, a different vulnerability than CVE-2008-3246 and CVE-2009-0219.
CVSS Score: 9.3 (HIGH)
References: http://www.blackberry.com/btsc/KB17953; http://www.blackberry.com/btsc/KB17953
CVE: CVE-2009-2647
Published: 2009-07-30
Description: Unspecified vulnerability in Kaspersky Anti-Virus 2010 and Kaspersky Internet Security 2010 before Critical Fix 9.0.0.463 allows remote attackers to disable the Kaspersky application via unknown attack vectors unrelated to "an external script."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/56351; http://secunia.com/advisories/35978; http://www.kaspersky.com/technews?id=203038755
CVE: CVE-2009-2648
Published: 2009-07-30
Description: FlashDen Guestbook allows remote attackers to obtain configuration information via a direct request to amfphp/phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/56548; http://packetstormsecurity.org/0907-exploits/flashden-disclose.txt; http://secunia.com/advisories/36000
CVE: CVE-2009-2649
Published: 2009-07-30
Description: The IATA (ata) driver in FreeBSD 6.0 and 8.0, when read access to /dev is available, allows local users to cause a denial of service (kernel panic) via a certain IOCTL request with a large count, which triggers a malloc call with a large value.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/35645; http://www.securitytracker.com/id?1022538; https://www.exploit-db.com/exploits/9134
CVE: CVE-2009-2650
Published: 2009-07-30
Description: Heap-based buffer overflow in Sorcerer Software MultiMedia Jukebox 4.0 Build 020124 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted (1) .m3u or possibly (2) .pst file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/35860; http://www.exploit-db.com/exploits/9173; http://secunia.com/advisories/35860
CVE: CVE-2008-6883
Published: 2009-07-30
Description: SQL injection vulnerability in the Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the last parameter to getChatRoom.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33122; http://www.securityfocus.com/bid/32803; https://exchange.xforce.ibmcloud.com/vulnerabilities/47304
CVE: CVE-2009-2651
Published: 2009-07-30
Description: main/rtp.c in Asterisk Open Source 1.6.1 before 1.6.1.2 allows remote attackers to cause a denial of service (crash) via an RTP text frame without a certain delimiter, which triggers a NULL pointer dereference and the subsequent calculation of an invalid pointer.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://downloads.asterisk.org/pub/security/AST-2009-004.html; http://downloads.digium.com/pub/security/AST-2009-004-1.6.1.diff.txt; http://osvdb.org/56571
CVE: CVE-2009-1720
Published: 2009-07-31
Description: Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00000.html; http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff
CVE: CVE-2009-1721
Published: 2009-07-31
Description: The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-824
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00000.html; http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff
CVE: CVE-2009-1722
Published: 2009-07-31
Description: Heap-based buffer overflow in the compression implementation in OpenEXR 1.2.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html; http://secunia.com/advisories/36032; http://secunia.com/advisories/36096
CVE: CVE-2009-2406
Published: 2009-07-31
Description: Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6352a29305373ae6196491e6d4669f301e26492e; http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html; http://risesecurity.org/advisories/RISE-2009002.txt
CVE: CVE-2009-2407
Published: 2009-07-31
Description: Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to a large encrypted key size in a Tag 3 packet.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f151cd2c54ddc7714e2f[PII_REDACTED]76cda03a28; http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html; http://risesecurity.org/advisories/RISE-2009003.txt
CVE: CVE-2009-1863
Published: 2009-07-31
Description: Unspecified vulnerability in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors, related to a "privilege escalation vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://secunia.com/advisories/36193
CVE: CVE-2009-1864
Published: 2009-07-31
Description: Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://secunia.com/advisories/36193
CVE: CVE-2009-1865
Published: 2009-07-31
Description: Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, related to a "null pointer vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://secunia.com/advisories/36193
CVE: CVE-2009-1866
Published: 2009-07-31
Description: Stack-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/56774
CVE: CVE-2009-1867
Published: 2009-07-31
Description: Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to trick a user into (1) selecting a link or (2) completing a dialog, related to a "clickjacking vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-59
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/56775
CVE: CVE-2009-1868
Published: 2009-07-31
Description: Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors involving URL parsing.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/56776
CVE: CVE-2009-1869
Published: 2009-07-31
Description: Integer overflow in the ActionScript Virtual Machine 2 (AVM2) abcFile parser in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an AVM2 file with a large intrf_count value that triggers a dereference of an out-of-bounds pointer.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/56777
CVE: CVE-2009-1870
Published: 2009-07-31
Description: Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to obtain sensitive information via vectors involving saving an SWF file to a hard drive, related to a "local sandbox vulnerability."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/56778
CVE: CVE-2008-6884
Published: 2009-07-31
Description: Multiple directory traversal vulnerabilities in XOOPS 2.3.1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsConfig[language] parameter to (1) blocks.php and (2) main.php in xoops_lib/modules/protector/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9794&w=2; http://osvdb.org/50572; http://osvdb.org/50573
CVE: CVE-2008-6885
Published: 2009-07-31
Description: Cross-site scripting (XSS) vulnerability in pmlite.php in XOOPS 2.3.1 and 2.3.2a allows remote attackers to inject arbitrary web script or HTML via a STYLE attribute in a URL BBcode tag in a private message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0810&w=2; http://secunia.com/advisories/33048; http://www.osvdb.org/50574
CVE: CVE-2008-6886
Published: 2009-08-03
Description: RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0581&w=2; http://secunia.com/advisories/32883; http://www.osvdb.org/50273
CVE: CVE-2008-6887
Published: 2009-08-03
Description: SQL injection vulnerability in detailad.asp in Pre Classified Listings 1.0 allows remote attackers to execute arbitrary SQL commands via the siteid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0812-exploits/preclass-sqlxss.txt; http://www.securityfocus.com/bid/32566; https://exchange.xforce.ibmcloud.com/vulnerabilities/47006
CVE: CVE-2008-6888
Published: 2009-08-03
Description: Cross-site scripting (XSS) vulnerability in signup.asp in Pre Classified Listings 1.0 allows remote attackers to inject arbitrary web script or HTML via the address parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0812-exploits/preclass-sqlxss.txt; http://www.securityfocus.com/bid/32567; https://exchange.xforce.ibmcloud.com/vulnerabilities/47005
CVE: CVE-2008-6889
Published: 2009-08-03
Description: SQL injection vulnerability in Merchantsadd.asp in ASPReferral 5.3 allows remote attackers to execute arbitrary SQL commands via the AccountID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32928; http://www.osvdb.org/50379; http://www.securityfocus.com/bid/32534
CVE: CVE-2008-6890
Published: 2009-08-03
Description: SQL injection vulnerability in messages.asp in ASP Forum Script allows remote attackers to execute arbitrary SQL commands via the message_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0812-exploits/aspforum-cmsqlxss.txt; http://www.securityfocus.com/bid/32571; https://exchange.xforce.ibmcloud.com/vulnerabilities/47000
CVE: CVE-2008-6891
Published: 2009-08-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in ASP Forum Script allow remote attackers to inject arbitrary web script or HTML via the (1) forum_id parameter to (a) new_message.asp and (b) messages.asp, and the (2) query string to default.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0812-exploits/aspforum-cmsqlxss.txt; http://www.securityfocus.com/bid/32571; https://exchange.xforce.ibmcloud.com/vulnerabilities/47002
CVE: CVE-2009-2404
Published: 2009-08-03
Description: Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2009-1185.html; http://secunia.com/advisories/36088; http://secunia.com/advisories/36102
CVE: CVE-2009-2652
Published: 2009-08-03
Description: Unspecified vulnerability in Solaris Trusted Extensions in Sun Solaris 10, and OpenSolaris snv_37 through snv_120, allows remote attackers to cause a denial of service (panic) via vectors involving the parsing of labeled packets.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/36040; http://securitytracker.com/id?1022628; http://sunsolve.sun.com/search/document.do?assetkey=1-66-264808-1
CVE: CVE-2009-2653
Published: 2009-08-03
Description: The NtUserConsoleControl function in win32k.sys in Microsoft Windows XP SP2 and SP3, and Server 2003 before SP1, allows local administrators to bypass unspecified "security software" and gain privileges via a crafted call that triggers an overwrite of an arbitrary memory location.  NOTE: the vendor disputes the significance of this report, stating that 'the Administrator to SYSTEM "escalation" is not a security boundary we defend.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://blogs.technet.com/srd/archive/2009/06/11/latest-baidu-public-posting-requires-adminisrator-to-elevate.aspx; http://hi.baidu.com/azy0922/blog/item/f950cbc[PII_REDACTED]ef47783.html; http://osvdb.org/56780
CVE: CVE-2009-2654
Published: 2009-08-03
Description: Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/; http://es.geocities.com/jplopezy/firefoxspoofing.html; http://osvdb.org/56717
CVE: CVE-2009-2655
Published: 2009-08-03
Description: mshtml.dll in Microsoft Internet Explorer 7 and 8 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) by calling the JavaScript findText method with a crafted Unicode string in the first argument, and only one additional argument, as demonstrated by a second argument of -1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/9253; http://www.securityfocus.com/bid/35799; https://exchange.xforce.ibmcloud.com/vulnerabilities/52249
CVE: CVE-2008-6892
Published: 2009-08-03
Description: SQL injection vulnerability in lire/index.php in Peel 3.1 allows remote attackers to execute arbitrary SQL commands via the rubid parameter.  NOTE: this might be the same issue as CVE-2005-3572.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50604; http://secunia.com/advisories/33073; http://www.securityfocus.com/bid/32715
CVE: CVE-2008-6893
Published: 2009-08-03
Description: Cross-site scripting (XSS) vulnerability in Alt-N MDaemon WorldClient 10.0.2, when Internet Explorer 7 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted img tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://files.altn.com/MDaemon/Release/RelNotes_en.txt; http://osvdb.org/50648; http://secunia.com/advisories/32885
CVE: CVE-2008-6894
Published: 2009-08-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fName and (2) fPassword parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]7468&w=2; http://osvdb.org/50599; http://secunia.com/advisories/33060
CVE: CVE-2008-6895
Published: 2009-08-03
Description: 3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demonstrated by vulnerability scans from Nessus or SAINT.
CVSS Score: 7.8 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]7468&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/52450; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]7468&w=2
CVE: CVE-2008-6896
Published: 2009-08-03
Description: login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]7468&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/52452; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]7468&w=2