deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3377
Published: 2008-07-30
Description: SQL injection vulnerability in picture.php in phpTest 0.6.3 allows remote attackers to execute arbitrary SQL commands via the image_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4070; http://www.securityfocus.com/bid/30377; https://exchange.xforce.ibmcloud.com/vulnerabilities/44029
CVE: CVE-2008-3378
Published: 2008-07-30
Description: SQL injection vulnerability in comment.php in Fizzmedia 1.51.2 allows remote attackers to execute arbitrary SQL commands via the mid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31252; http://securityreason.com/securityalert/4071; http://www.securityfocus.com/bid/30374
CVE: CVE-2008-3379
Published: 2008-07-30
Description: Cross-site scripting (XSS) vulnerability in Snark VisualPic 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the pic parameter to the default URI.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/30334; https://exchange.xforce.ibmcloud.com/vulnerabilities/43967; http://www.securityfocus.com/bid/30334
CVE: CVE-2008-3380
Published: 2008-07-30
Description: Cross-site scripting (XSS) vulnerability in ajaxp_backend.php in MyioSoft EasyBookMarker 4.0 trial edition (tr) allows remote attackers to inject arbitrary web script or HTML via the rs parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31191; http://securityreason.com/securityalert/4072; http://www.securityfocus.com/archive/1/494550/100/0/threaded
CVE: CVE-2008-3381
Published: 2008-07-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in macro/AdvancedSearch.py in moin (and MoinMoin) 1.6.3 and 1.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hg.moinmo.in/moin/1.6/rev/8686a10f1f58; http://hg.moinmo.in/moin/1.7/rev/383196922b03; http://moinmo.in/SecurityFixes
CVE: CVE-2008-3382
Published: 2008-07-30
Description: SQL injection vulnerability in mojoClassified.cgi in MojoClassifieds 2.0 allows remote attackers to execute arbitrary SQL commands via the cat_a parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31166; http://www.vupen.com/english/advisories/2008/2156/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/43931
CVE: CVE-2008-3383
Published: 2008-07-30
Description: SQL injection vulnerability in mojoAuto.cgi in MojoAuto allows remote attackers to execute arbitrary SQL commands via the cat_a parameter in a browse action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31162; http://www.vupen.com/english/advisories/2008/2159/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/43934
CVE: CVE-2008-3384
Published: 2008-07-30
Description: Multiple directory traversal vulnerabilities in help/help.php in Interact Learning Community Environment Interact 2.4.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) module and (2) file parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31150; http://securityreason.com/securityalert/4073; http://sourceforge.net/forum/forum.php?thread_id=2104908&forum_id=237160
CVE: CVE-2008-3385
Published: 2008-07-30
Description: Directory traversal vulnerability in include/head_chat.inc.php in php Help Agent 1.0 and 1.1 Full allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the content parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31099; http://securityreason.com/securityalert/4074; http://www.securityfocus.com/bid/30240
CVE: CVE-2008-3386
Published: 2008-07-30
Description: SQL injection vulnerability in album.php in AlstraSoft Video Share Enterprise 4.51 allows remote attackers to execute arbitrary SQL commands via the UID parameter, a different vector than CVE-2007-4086.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31134; http://securityreason.com/securityalert/4075; http://www.securityfocus.com/bid/30272
CVE: CVE-2008-3387
Published: 2008-07-30
Description: SQL injection vulnerability in show.php in PHPFootball 1.6 allows remote attackers to execute arbitrary SQL commands via the dbtable parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4076; http://www.securityfocus.com/bid/30296; https://exchange.xforce.ibmcloud.com/vulnerabilities/43911
CVE: CVE-2008-3388
Published: 2008-07-30
Description: Multiple SQL injection vulnerabilities in Def-Blog 1.0.3 allow remote attackers to execute arbitrary SQL commands via the article parameter to (1) comaddok.php and (2) comlook.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31174; http://securityreason.com/securityalert/4079; http://www.securityfocus.com/archive/1/494534/100/0/threaded
CVE: CVE-2008-3390
Published: 2008-07-31
Description: Directory traversal vulnerability in libraries/general.init.php in Minishowcase Image Gallery 09b136, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4080; http://www.securityfocus.com/archive/1/494864/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/44046
CVE: CVE-2008-3391
Published: 2008-07-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web script or HTML via the mode parameter to (1) admin_group_details.asp and (2) admin_category_details.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://depo2.nm.ru/WebWiz_Forum_v9.5_XSS.txt; http://depo2.nm.ru/WebWiz_Forum_v9.5_XSS2.txt; http://secunia.com/advisories/31281
CVE: CVE-2008-3392
Published: 2008-07-31
Description: Cross-site request forgery (CSRF) vulnerability in Web Wiz Forum 9.5 allows remote attackers to log out a user via a link or IMG tag to log_off_user.asp.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://depo2.nm.ru/WebWiz_Forum_v9.5_CSRF.txt; http://secunia.com/advisories/31281; https://exchange.xforce.ibmcloud.com/vulnerabilities/44011
CVE: CVE-2008-3393
Published: 2008-07-31
Description: SQL injection vulnerability in events.cfm in BookMine allows remote attackers to execute arbitrary SQL commands via the events_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://holisticinfosec.org/content/view/79/45/; http://secunia.com/advisories/31258; http://www.osvdb.org/47202
CVE: CVE-2008-3394
Published: 2008-07-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in search.cfm in BookMine allow remote attackers to inject arbitrary web script or HTML via the (1) gallery and (2) search_string parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/79/45/; http://secunia.com/advisories/31258; http://www.osvdb.org/47203
CVE: CVE-2008-3395
Published: 2008-07-31
Description: Calacode @Mail 5.41 on Linux uses weak world-readable permissions for (1) webmail/libs/Atmail/Config.php and (2) webmail/webadmin/.htpasswd, which allows local users to obtain sensitive information by reading these files.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/31279; http://www.securityfocus.com/bid/30434; https://exchange.xforce.ibmcloud.com/vulnerabilities/44144
CVE: CVE-2008-3396
Published: 2008-07-31
Description: Unreal Tournament 2004 (UT2004) 3369 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a certain sequence of malformed packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/ut2004null-adv.txt; http://aluigi.org/poc/ut2004null.zip; http://secunia.com/advisories/31266
CVE: CVE-2008-3397
Published: 2008-07-31
Description: Cross-site scripting (XSS) vulnerability in Runesoft Cerberus CMS before 3_1.4_0.9 allows remote attackers to inject arbitrary web script or HTML via a cerberus_user cookie.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://gl2logic.com/cerberus/cerberus.php?app=Old_News&SHOWID=7; http://secunia.com/advisories/31218; http://www.securityfocus.com/bid/30416
CVE: CVE-2008-3398
Published: 2008-07-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web script or HTML via the msg parameter to unspecified components, possibly including login.php. NOTE: this may overlap CVE-2008-1129.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/31233; http://securityreason.com/securityalert/4081; http://www.securityfocus.com/archive/1/494754/100/0/threaded
CVE: CVE-2008-3399
Published: 2008-07-31
Description: PHP remote file inclusion vulnerability in activities/workflow-activities.php in XRMS CRM 1.99.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the include_directory parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://securityreason.com/securityalert/4081; http://www.securityfocus.com/archive/1/494754/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/43992
CVE: CVE-2008-3400
Published: 2008-07-31
Description: XRMS CRM 1.99.2 allows remote attackers to obtain configuration information via a direct request to tests/info.php, which calls the phpinfo function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/31233; http://securityreason.com/securityalert/4081; http://www.securityfocus.com/archive/1/494754/100/0/threaded
CVE: CVE-2008-3401
Published: 2008-07-31
Description: PHP remote file inclusion vulnerability in hioxRandomAd.php in HIOX Random Ad (HRA) 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/31300; http://securityreason.com/securityalert/4082; http://www.securityfocus.com/archive/1/494927/100/0/threaded
CVE: CVE-2008-3402
Published: 2008-07-31
Description: Multiple PHP remote file inclusion vulnerabilities in HIOX Browser Statistics (HBS) 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the hm parameter to (1) hioxupdate.php and (2) hioxstats.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/31299; http://securityreason.com/securityalert/4083; http://www.securityfocus.com/archive/1/494930/100/0/threaded
CVE: CVE-2008-3403
Published: 2008-07-31
Description: SQL injection vulnerability in mojoClassified.cgi in MojoPersonals allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31165; http://securityreason.com/securityalert/4084; http://www.securityfocus.com/bid/30325
CVE: CVE-2008-3404
Published: 2008-07-31
Description: Cross-site scripting (XSS) vulnerability in guestbook.js.php in MJGuest 6.8 GT allows remote attackers to inject arbitrary web script or HTML via the link parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8691&w=2; http://securityreason.com/securityalert/4085; http://www.mdsjack.bo.it/files/mjguest.log.txt
CVE: CVE-2008-3405
Published: 2008-07-31
Description: Directory traversal vulnerability in index.php in Ricardo Amaral nzFotolog 0.4.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action_file parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31297; http://securityreason.com/securityalert/4086; http://www.securityfocus.com/bid/30439
CVE: CVE-2008-3406
Published: 2008-07-31
Description: SQL injection vulnerability in showcat.php in phpLinkat 0.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4087; http://www.securityfocus.com/bid/30386; https://exchange.xforce.ibmcloud.com/vulnerabilities/44060
CVE: CVE-2008-3407
Published: 2008-07-31
Description: phpLinkat 0.1 allows remote attackers to bypass authentication and access unspecified pages under admin/ by sending a login=right cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://securityreason.com/securityalert/4087; http://www.securityfocus.com/bid/30386; https://exchange.xforce.ibmcloud.com/vulnerabilities/44062
CVE: CVE-2008-3408
Published: 2008-07-31
Description: Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a crafted m3u file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/31294; http://securityreason.com/securityalert/4088; http://www.exploit-db.com/exploits/15895
CVE: CVE-2008-3409
Published: 2008-07-31
Description: Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a UDP packet containing a large value in a certain size field, followed by a data string of that size, aka attack 1 in ut3mendo.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/ut3mendo-adv.txt; http://aluigi.org/poc/ut3mendo.zip; http://secunia.com/advisories/31265
CVE: CVE-2008-3410
Published: 2008-07-31
Description: Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a UDP packet in which the value of a certain size field is greater than the total packet length, aka attack 2 in ut3mendo.c.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-399
References: http://aluigi.altervista.org/adv/ut3mendo-adv.txt; http://aluigi.org/poc/ut3mendo.zip; http://secunia.com/advisories/31265
CVE: CVE-2008-3411
Published: 2008-07-31
Description: The Axesstel AXW-D800 modem with D2_ETH_109_01_VEBR Jun-14-2006 software does not require authentication for (1) etc/config/System.html, (2) etc/config/Network.html, (3) etc/config/Security.html, (4) cgi-bin/sysconf.cgi, and (5) cgi-bin/route.cgi, which allows remote attackers to change the modem's configuration via direct requests.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31285; http://securityreason.com/securityalert/4089; http://www.securityfocus.com/archive/1/494815/100/0/threaded
CVE: CVE-2008-3412
Published: 2008-07-31
Description: SQL injection vulnerability in Comsenz EPShop (aka ECShop) before 3.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a (1) pro_show or (2) disppro action to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4090; http://www.securityfocus.com/bid/30387; https://exchange.xforce.ibmcloud.com/vulnerabilities/44025
CVE: CVE-2008-3413
Published: 2008-07-31
Description: SQL injection vulnerability in category.php in Greatclone GC Auction Platinum allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31241; http://securityreason.com/securityalert/4091; http://www.securityfocus.com/bid/30389
CVE: CVE-2008-3414
Published: 2008-07-31
Description: SQL injection vulnerability in line2.php in SiteAdmin allows remote attackers to execute arbitrary SQL commands via the art parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31240; http://securityreason.com/securityalert/4092; http://www.securityfocus.com/bid/30391
CVE: CVE-2008-3415
Published: 2008-07-31
Description: Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31243; http://securityreason.com/securityalert/4093; http://www.cmscout.co.za/index.php?page=news&id=29
CVE: CVE-2008-3416
Published: 2008-07-31
Description: SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via the username parameter in a members action to index.php, related to an incorrect protection mechanism in the clean_string function in includes/functions.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forums.xaos-ia.com/?topic=760; http://secunia.com/advisories/31248; http://securityreason.com/securityalert/4094
CVE: CVE-2008-3417
Published: 2008-07-31
Description: SQL injection vulnerability in home/index.asp in fipsCMS light 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the r parameter, a different vector than CVE-2006-6115 and CVE-2007-2561.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31250; http://securityreason.com/securityalert/4095; http://www.securityfocus.com/bid/30380
CVE: CVE-2008-3418
Published: 2008-07-31
Description: SQL injection vulnerability in browse.php in TriO 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31244; http://securityreason.com/securityalert/4077; https://exchange.xforce.ibmcloud.com/vulnerabilities/44033
CVE: CVE-2008-3419
Published: 2008-07-31
Description: SQL injection vulnerability in ugroups.php in Youtuber Clone allows remote attackers to execute arbitrary SQL commands via the UID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31238; http://securityreason.com/securityalert/4096; http://www.vupen.com/english/advisories/2008/2212/references
CVE: CVE-2008-3420
Published: 2008-07-31
Description: Multiple SQL injection vulnerabilities in Mobius for Mimsy XG 1 1.4.4.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to browse.php or (2) the s parameter in an exhibitions action to detail.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31247; http://securityreason.com/securityalert/4097; http://www.securityfocus.com/bid/30382
CVE: CVE-2008-3421
Published: 2008-07-31
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Blackboard Academic Suite 8.0.260.7 allow remote attackers to hijack the authentication of student users for requests that change configuration and enrollments via unspecified input to (1) update_module.jsp, (2) enroll_course.pl, and (3) unenroll.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://ceaseless.ws/bb-csrf/; http://secunia.com/advisories/31177; http://www.securitytracker.com/id?1020559
CVE: CVE-2008-3422
Published: 2008-07-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html; http://lists.ximian.com/pipermail/mono-devel-list/2008-July/028633.html; http://secunia.com/advisories/31338
CVE: CVE-2008-3424
Published: 2008-07-31
Description: Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypass intended access restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://secunia.com/advisories/31284; http://secunia.com/advisories/31423; http://secunia.com/advisories/31459
CVE: CVE-2008-3425
Published: 2008-07-31
Description: Unspecified vulnerability in the Sun Java System Web Server 7.0 plugin in Sun N1 Service Provisioning System (SPS) 5.2 and 6.0 allows remote authenticated SPS users to gain administrative access to the web server via unknown attack vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/31301; http://sunsolve.sun.com/search/document.do?assetkey=1-26-239566-1; http://www.securityfocus.com/bid/30451
CVE: CVE-2008-3426
Published: 2008-07-31
Description: Unspecified vulnerability in the Solaris Platform Information and Control Library daemon (picld) in Sun Solaris 8 through 10, and OpenSolaris builds snv_01 through snv_95, allows local users to cause a denial of service via unknown vectors that prevent operation of utilities such as prtdiag, prtpicl, and prtfru.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/31303; http://secunia.com/advisories/31501; http://sunsolve.sun.com/search/document.do?assetkey=1-26-239728-1
CVE: CVE-2008-3427
Published: 2008-07-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-3420.  Reason: This candidate is a duplicate of CVE-2008-3420.  Notes: All CVE users should reference CVE-2008-3420 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-3428
Published: 2008-07-31
Description: Session fixation vulnerability in phpFreeChat 1.1 allows remote authenticated users to hijack web sessions by setting the session_id parameter to match the victim's nickid parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/31283; http://www.phpfreechat.net/changelog/1.2; http://www.securityfocus.com/bid/30462
CVE: CVE-2008-3429
Published: 2008-07-31
Description: Buffer overflow in URI processing in HTTrack and WinHTTrack before 3.42-3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/31323/; http://secunia.com/advisories/31380; http://secunia.com/advisories/31866
CVE: CVE-2008-3430
Published: 2008-07-31
Description: Buffer overflow in the CoVideoWindow.ocx ActiveX control 5.0.907.1 in Eyeball MessengerSDK, as used in products such as SiOL Komunikator 1.3, allows remote attackers to execute arbitrary code via a large argument supplied to the BGColor method.  NOTE: this might only be a vulnerability in certain insecure configurations of Internet Explorer.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.org/0807-exploits/siol-overflow.txt; http://www.securityfocus.com/bid/30424; https://exchange.xforce.ibmcloud.com/vulnerabilities/44111
CVE: CVE-2007-2952
Published: 2008-08-01
Description: Multiple stack-based buffer overflows in the filter service (aka k9filter.exe) in Blue Coat K9 Web Protection 3.2.44 with Filter 3.2.32 allow (1) remote attackers to execute arbitrary code via a long HTTP Referer header to the K9 Web Protection Administration interface and (2) man-in-the-middle attackers to execute arbitrary code via an HTTP response with a long HTTP version field.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/25813; http://secunia.com/secunia_research/2007-61/advisory/; http://secunia.com/secunia_research/2007-64/advisory/