deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0158
Published: 2008-01-09
Description: Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to read arbitrary files via a .. (dot dot) in the aux_page parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/0801-exploits/shopscript-disclose.txt; http://www.securityfocus.com/bid/27165; https://exchange.xforce.ibmcloud.com/vulnerabilities/39449
CVE: CVE-2008-0159
Published: 2008-01-09
Description: SQL injection vulnerability in index.php in eggBlog 3.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the eggblogpassword parameter in a cookie.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28371; http://www.securityfocus.com/bid/27168; https://exchange.xforce.ibmcloud.com/vulnerabilities/39473
CVE: CVE-2007-4769
Published: 2008-01-09
Description: The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html; http://secunia.com/advisories/28359
CVE: CVE-2007-4772
Published: 2008-01-09
Description: The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted regular expression.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html
CVE: CVE-2007-5401
Published: 2008-01-09
Description: Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute arbitrary ASP files, related to not properly checking file extensions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/27699; http://secunia.com/secunia_research/2007-94/advisory/; http://www.securityfocus.com/bid/27187
CVE: CVE-2007-5402
Published: 2008-01-09
Description: Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow (1) remote attackers to execute arbitrary SQL commands via the sys_request_id parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via (2) the oldpassword parameter to writepwdenduser.asp, and the sys_request_id parameter to (3) changerequeststatus.asp, (4) editrequestuser.asp, (5) requestcommentsuser.asp, and (6) useractions.asp, different vectors than CVE-2004-2551.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/27699; http://secunia.com/secunia_research/2007-94/advisory/; http://www.securityfocus.com/bid/27187
CVE: CVE-2007-5403
Published: 2008-01-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Forename, (2) Surname, (3) Telephone, and (4) Fax fields to writeenduserenduser.asp; the (5) Filter field to statsrequestypereport.asp; and the (6) sys_request_id parameter to requestattach.asp; and allow remote authenticated users to inject arbitrary web script or HTML via the (7) Asset, (8) Location, and (9) Problem fields to editrequestenduser.asp; the (10) Asset, (11) Asset Location, (12) Problem Desc, and (13) Solution Desc fields to editrequestuser.asp; and the (14) End User and (15) Description fields to usersearchrequests.asp.  NOTE: vectors 5 and 6 do not require authentication to exploit.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/27699; http://secunia.com/secunia_research/2007-94/advisory/; http://www.securityfocus.com/bid/27187
CVE: CVE-2007-5404
Published: 2008-01-09
Description: Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/27699; http://secunia.com/secunia_research/2007-94/advisory/; http://www.securityfocus.com/bid/27187
CVE: CVE-2007-5616
Published: 2008-01-09
Description: ssh-signer in SSH Tectia Client and Server 5.x before 5.2.4, and 5.3.x before 5.3.6, on Unix and Linux allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/28247; http://securitytracker.com/id?1019167; http://www.kb.cert.org/vuls/id/921339
CVE: CVE-2007-6067
Published: 2008-01-09
Description: Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html
CVE: CVE-2007-6600
Published: 2008-01-09
Description: PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html; http://secunia.com/advisories/28359
CVE: CVE-2007-6601
Published: 2008-01-09
Description: The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors.  NOTE: this issue exists because of an incomplete fix for CVE-2007-3278.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html; http://secunia.com/advisories/28359
CVE: CVE-2007-5762
Published: 2008-01-09
Description: NICM.SYS driver 3.0.0.4, as used in Novell NetWare Client 4.91 SP4, allows local users to execute arbitrary code by opening the \\.\nicm device and providing crafted kernel addresses via IOCTLs with the METHOD_NEITHER buffering mode.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://download.novell.com/Download?buildid=4FmI89wOmg4~; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=637; http://secunia.com/advisories/28396
CVE: CVE-2008-0184
Published: 2008-01-09
Description: Absolute path traversal vulnerability in index.php in Sys-Hotel on Line System allows remote attackers to read arbitrary files via an encoded "/" ("%2F") in the file parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/3528; http://www.securityfocus.com/archive/1/485940/100/0/threaded; http://www.securityfocus.com/bid/27184
CVE: CVE-2008-0185
Published: 2008-01-09
Description: SQL injection vulnerability in index.php in NetRisk 1.9.7 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via the pid parameter in a profile page (possibly profile.php).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28328; http://sourceforge.net/project/shownotes.php?release_id=551208&group_id=129681; http://www.securityfocus.com/archive/1/485834/100/0/threaded
CVE: CVE-2008-0186
Published: 2008-01-09
Description: Cross-site scripting (XSS) vulnerability in index.php in NetRisk 1.9.7 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter, possibly related to CVE-2008-0144.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28369; http://www.securityfocus.com/archive/1/485834/100/0/threaded; http://www.securityfocus.com/bid/27161
CVE: CVE-2008-0187
Published: 2008-01-09
Description: SQL injection vulnerability in songinfo.php in SAM Broadcaster samPHPweb, possibly 4.2.2 and earlier, allows remote attackers to execute arbitrary SQL commands via the songid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27147; https://exchange.xforce.ibmcloud.com/vulnerabilities/39463; https://www.exploit-db.com/exploits/4836
CVE: CVE-2007-0012
Published: 2008-01-09
Description: Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service (Internet Explorer crash) via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/3527; http://www.securityfocus.com/archive/1/485942/100/0/threaded; http://www.securityfocus.com/bid/27185
CVE: CVE-2007-6250
Published: 2008-01-09
Description: Stack-based buffer overflow in AOL AOLMediaPlaybackControl (AOLMediaPlaybackControl.exe), as used by AmpX ActiveX control (AmpX.dll), might allow remote attackers to execute arbitrary code via the AppendFileToPlayList method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28399; http://www.kb.cert.org/vuls/id/568681; http://www.securityfocus.com/bid/27207
CVE: CVE-2007-6531
Published: 2008-01-09
Description: Stack-based buffer overflow in the Panel (xfce4-panel) component in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via Launcher tooltips.  NOTE: a second buffer overflow (over-read) in the xfce_mkdirhier function was also reported, but it might not be exploitable for a crash or code execution, so it is not a vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=201289; http://bugs.gentoo.org/show_bug.cgi?id=201293; http://osvdb.org/43422
CVE: CVE-2007-6532
Published: 2008-01-09
Description: Double free vulnerability in the Widget Library (libxfcegui4) in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via unknown vectors related to the "cliend id, program name and working directory in session management."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=201292; http://security.gentoo.org/glsa/glsa-200801-06.xml; http://www.vupen.com/english/advisories/2008/0080
CVE: CVE-2007-6677
Published: 2008-01-10
Description: Cross-site scripting (XSS) vulnerability in Peter's Random Anti-Spam Image 0.2.4 and earlier plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the comment field in the comment form.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/43444; http://websecurity.com.ua/1535/; http://osvdb.org/43444
CVE: CVE-2008-0127
Published: 2008-01-10
Description: The administration interface in McAfee E-Business Server 8.5.2 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long initial authentication packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28408; http://securityreason.com/securityalert/3530; http://securitytracker.com/id?1019170
CVE: CVE-2008-0190
Published: 2008-01-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in templates/example_template.php in AwesomeTemplateEngine allow remote attackers to inject arbitrary web script or HTML via the (1) data[title], (2) data[message], (3) data[table][1][item], (4) data[table][1][url], or (5) data[poweredby] parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument784.html
CVE: CVE-2008-0191
Published: 2008-01-10
Description: WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and the SQL database structure.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument663.html
CVE: CVE-2008-0192
Published: 2008-01-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the popuptitle parameter to (1) wp-admin/post.php or (2) wp-admin/page-new.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument714.html
CVE: CVE-2008-0193
Published: 2008-01-10
Description: Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://secunia.com/advisories/29014; http://securityreason.com/securityalert/3539
CVE: CVE-2008-0194
Published: 2008-01-10
Description: Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete arbitrary files, and cause a denial of service via a .. (dot dot) in the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.  NOTE: this might be the same as CVE-2006-5705.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://secunia.com/advisories/29014; http://securityreason.com/securityalert/3539
CVE: CVE-2008-0195
Published: 2008-01-10
Description: WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument762.html
CVE: CVE-2008-0196
Published: 2008-01-10
Description: Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the \..\..\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument762.html
CVE: CVE-2008-0197
Published: 2008-01-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wpcf_email, (2) wpcf_subject, (3) wpcf_question, (4) wpcf_answer, (5) wpcf_success_msg, (6) wpcf_error_msg, or (7) wpcf_msg parameter to wp-admin/admin.php, or (8) the SRC attribute of an IFRAME element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument546.html
CVE: CVE-2008-0198
Published: 2008-01-10
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument546.html
CVE: CVE-2008-0199
Published: 2008-01-10
Description: PRO-Search 0.17 and earlier allows remote attackers to cause a denial of service via certain values of the show_page and time parameters to the default URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument731.html
CVE: CVE-2008-0200
Published: 2008-01-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in account/index.html in RotaBanner Local 3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) drop parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument625.html
CVE: CVE-2008-0201
Published: 2008-01-10
Description: Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument472.html
CVE: CVE-2008-0202
Published: 2008-01-10
Description: CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://securityvulns.ru/Sdocument472.html
CVE: CVE-2008-0203
Published: 2008-01-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in cryptographp/admin.php in the Cryptographp 1.2 and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cryptwidth, (2) cryptheight, (3) bgimg, (4) charR, (5) charG, (6) charB, (7) charclear, (8) tfont, (9) charel, (10) charelc, (11) charelv, (12) charnbmin, (13) charnbmax, (14) charspace, (15) charsizemin, (16) charsizemax, (17) charanglemax, (18) noisepxmin, (19) noisepxmax, (20) noiselinemin, (21) noiselinemax, (22) nbcirclemin, (23) nbcirclemax, or (24) brushsize parameter to wp-admin/options-general.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://websecurity.com.ua/1596/
CVE: CVE-2008-0204
Published: 2008-01-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) mcsp_opt_msg_no_answer or (2) mcsp_opt_msg_wrong_answer parameter to wp-admin/options-general.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://websecurity.com.ua/1576/
CVE: CVE-2008-0205
Published: 2008-01-10
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) mcsp_opt_msg_no_answer or (2) mcsp_opt_msg_wrong_answer parameter to wp-admin/options-general.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://websecurity.com.ua/1576/
CVE: CVE-2008-0206
Published: 2008-01-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in captcha\captcha.php in the Captcha! 2.5d and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) captcha_ttffolder, (2) captcha_numchars, (3) captcha_ttfrange, or (4) captcha_secret parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://securityreason.com/securityalert/3539; http://websecurity.com.ua/1588/
CVE: CVE-2008-0207
Published: 2008-01-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in PRO-Search 0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) prot, (2) host, (3) path, (4) name, (5) ext, (6) size, (7) search_days, or (8) show_page parameter to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html; http://secunia.com/advisories/28335; http://securityreason.com/securityalert/3539
CVE: CVE-2008-0208
Published: 2008-01-10
Description: Cross-site scripting (XSS) vulnerability in login.asp in Snitz Forums 2000 3.4.05 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hackerscenter.com/archive/view.asp?id=28145; http://secunia.com/advisories/28284; http://www.packetstormsecurity.org/0801-exploits/snitz-multi.txt
CVE: CVE-2008-0209
Published: 2008-01-10
Description: Open redirect vulnerability in Forums/login.asp in Snitz Forums 2000 3.4.06 and earlier allows remote attackers to redirect users to arbitrary web sites via a URL in the target parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://hackerscenter.com/archive/view.asp?id=28145; http://www.packetstormsecurity.org/0801-exploits/snitz-multi.txt; http://www.securityfocus.com/archive/1/485836/100/200/threaded
CVE: CVE-2008-0210
Published: 2008-01-10
Description: Uebimiau Webmail 2.7.10 and 2.7.2 does not protect authentication state variables from being set through HTTP requests, which allows remote attackers to bypass authentication via a sess[auth]=1 parameter settting.  NOTE: this can be leveraged to conduct directory traversal attacks without authentication by using CVE-2008-0140.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/27154; https://www.exploit-db.com/exploits/4846; http://www.securityfocus.com/bid/27154
CVE: CVE-2007-6678
Published: 2008-01-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-6167.  Reason: This candidate is a duplicate of CVE-2007-6167.  Notes: All CVE users should reference CVE-2007-6167 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CWE: CWE-94