deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-6699
Published: 2008-02-04
Description: Multiple buffer overflows in the AIM PicEditor 9.5.1.8 ActiveX control in YGPPicEdit.dll in AOL You've Got Pictures (YGP) Picture Editor allow remote attackers to cause a denial of service (browser crash) via a long string in the (1) DisplayName, (2) FinalSavePath, (3) ForceSaveTo, (4) HiddenControls, (5) InitialEditorScreen, (6) Locale, (7) Proxy, and (8) UserAgent property values.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/41198; http://seclists.org/fulldisclosure/2007/Dec/0561.html; http://seclists.org/fulldisclosure/2007/Dec/0574.html
CVE: CVE-2008-0386
Published: 2008-02-04
Description: Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=207331; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html; http://secunia.com/advisories/28638
CVE: CVE-2008-0557
Published: 2008-02-04
Description: SQL injection vulnerability in index.php in the CatalogShop (com_catalogshop) 1.0b1 componenent for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27558; https://exchange.xforce.ibmcloud.com/vulnerabilities/40142; https://www.exploit-db.com/exploits/5030
CVE: CVE-2008-0558
Published: 2008-02-04
Description: Cross-site scripting (XSS) vulnerability in Uniwin eCart Professional before 2.0.16 allows remote attackers to inject arbitrary web script or HTML via the rp parameter to cartView.asp and unspecified other components.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28735; http://www.securityfocus.com/bid/27560; http://secunia.com/advisories/28735
CVE: CVE-2008-0559
Published: 2008-02-04
Description: Multiple directory traversal vulnerabilities in Nilson's Blogger 0.11 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the permalink parameter in core.php, accessed through index.php; and (2) the thispost parameter in comments.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28737; http://securityreason.com/securityalert/3604; http://www.securityfocus.com/archive/1/487384/100/0/threaded
CVE: CVE-2008-0560
Published: 2008-02-04
Description: PHP remote file inclusion vulnerability in cforms-css.php in Oliver Seidel cforms (contactforms), a Wordpress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the tm parameter. NOTE: CVE disputes this issue for 7.3, since there is no tm parameter, and the code exits with a fatal error due to a call to an undefined function
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://securityreason.com/securityalert/3605; http://www.attrition.org/pipermail/vim/2008-January/001895.html; http://www.securityfocus.com/archive/1/487347/100/0/threaded
CVE: CVE-2008-0561
Published: 2008-02-04
Description: SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27557; https://exchange.xforce.ibmcloud.com/vulnerabilities/40141; https://www.exploit-db.com/exploits/5029
CVE: CVE-2008-0562
Published: 2008-02-04
Description: SQL injection vulnerability in index.php in the Restaurant (com_restaurant) 1.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27551; https://exchange.xforce.ibmcloud.com/vulnerabilities/40144; https://www.exploit-db.com/exploits/5031
CVE: CVE-2007-4130
Published: 2008-02-05
Description: The Linux kernel 2.6.9 before 2.6.9-67 in Red Hat Enterprise Linux (RHEL) 4 on Itanium (ia64) does not properly handle page faults during NUMA memory access, which allows local users to cause a denial of service (panic) via invalid arguments to set_mempolicy in an MPOL_BIND operation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2008-0055.html; http://secunia.com/advisories/28748; http://www.securityfocus.com/bid/27556
CVE: CVE-2008-0178
Published: 2008-02-05
Description: Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the User-Agent HTTP header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28742; http://support.liferay.com/browse/LEP-4736; http://www.kb.cert.org/vuls/id/326065
CVE: CVE-2008-0179
Published: 2008-02-05
Description: Cross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/28742; http://support.liferay.com/browse/LEP-4737; http://www.kb.cert.org/vuls/id/888209
CVE: CVE-2008-0180
Published: 2008-02-05
Description: Cross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Greeting field in a User Profile.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28742; http://support.liferay.com/browse/LEP-4738; http://www.kb.cert.org/vuls/id/732449
CVE: CVE-2008-0181
Published: 2008-02-05
Description: Cross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Shutdown message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28742; http://support.liferay.com/browse/LEP-4739; http://www.kb.cert.org/vuls/id/217825
CVE: CVE-2008-0182
Published: 2008-02-05
Description: Cross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified actions as unspecified other authenticated users via the Shutdown message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/28742; http://support.liferay.com/browse/LEP-4739; http://www.kb.cert.org/vuls/id/767825
CVE: CVE-2008-0563
Published: 2008-02-05
Description: Cross-site request forgery (CSRF) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to perform unspecified actions as unspecified authenticated users via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://support.liferay.com/browse/LEP-4737; http://support.liferay.com/browse/LEP-4737
CVE: CVE-2007-5602
Published: 2008-02-05
Description: Multiple stack-based buffer overflows in SwiftView Viewer before 8.3.5, as used by SwiftView and SwiftSend, allow remote attackers to execute arbitrary code via unspecified vectors to the (1) svocx.ocx ActiveX control or the (2) npsview.dll plugin for Mozilla and Firefox.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/42836; http://osvdb.org/42837; http://secunia.com/advisories/28724
CVE: CVE-2007-6700
Published: 2008-02-05
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28726; http://www.mail-archive.com/misc%40openbsd.org/msg49057.html; http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/bgplg/bgplg.c
CVE: CVE-2008-0564
Published: 2008-02-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.10b1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) editing templates and (2) the list's "info attribute" in the web administrator interface, a different vulnerability than CVE-2006-3636.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html; http://mail.python.org/pipermail/mailman-announce/2008-February/000096.html
CVE: CVE-2008-0565
Published: 2008-02-05
Description: SQL injection vulnerability in vote.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/40840; http://secunia.com/advisories/28727; http://www.securityfocus.com/bid/27530
CVE: CVE-2008-0566
Published: 2008-02-05
Description: PHP remote file inclusion vulnerability in includes/smarty.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the full_path_to_public_program parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/27529; https://www.exploit-db.com/exploits/5022; http://www.securityfocus.com/bid/27529
CVE: CVE-2008-0567
Published: 2008-02-05
Description: Multiple PHP remote file inclusion vulnerabilities in ChronoEngine ChronoForms (com_chronocontact) 2.3.5 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) PPS/File.php, (2) Writer.php, and (3) PPS.php in excelwriter/; and (4) BIFFwriter.php, (5) Workbook.php, (6) Worksheet.php, and (7) Format.php in excelwriter/Writer/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/27531; https://www.exploit-db.com/exploits/5020; http://www.securityfocus.com/bid/27531
CVE: CVE-2008-0568
Published: 2008-02-05
Description: Unspecified vulnerability in the IP-authentication feature in the Secure Site 5.x-1.0 and 4.7.x-1.0 module for Drupal allows remote attackers to gain the privileges of a user who has authenticated from behind the same proxy server as the attacker.
CVSS Score: 10.0 (HIGH)
References: http://drupal.org/node/216019; http://secunia.com/advisories/28732; http://www.securityfocus.com/bid/27543
CVE: CVE-2008-0569
Published: 2008-02-05
Description: The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/216024; http://drupal.org/node/216035; http://drupal.org/node/216036
CVE: CVE-2008-0570
Published: 2008-02-05
Description: The OpenID 5.x-1.0 and earlier module for Drupal does not properly verify the claimed_id returned by an OpenID provider, which allows remote OpenID providers to spoof OpenID authentication for domains associated with other providers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/216022; http://secunia.com/advisories/28717; http://www.securityfocus.com/bid/27542
CVE: CVE-2008-0571
Published: 2008-02-05
Description: The point moderation form in the Userpoints 4.7.x before 4.7.x-2.3, 5.x-2 before 5.x-2.16, and 5.x-3 before 5.x-3.3 module for Drupal does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and manipulate points.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/216023; http://secunia.com/advisories/28730; http://www.vupen.com/english/advisories/2008/0375/references
CVE: CVE-2008-0572
Published: 2008-02-05
Description: Multiple PHP remote file inclusion vulnerabilities in Mindmeld 1.2.0.10 allow remote attackers to execute arbitrary PHP code via a URL in the MM_GLOBALS[home] parameter to (1) acweb/admin_index.php; and (2) ask.inc.php, (3) learn.inc.php, (4) manage.inc.php, (5) mind.inc.php, and (6) sensory.inc.php in include/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/27538; https://www.exploit-db.com/exploits/5026; http://www.securityfocus.com/bid/27538
CVE: CVE-2008-0573
Published: 2008-02-05
Description: IPSecDrv.sys 10.4.0.12 in SafeNET HighAssurance Remote and SoftRemote allows local users to gain privileges via a crafted IPSECDRV_IOCTL IOCTL request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/28701; http://www.securityfocus.com/bid/27496; http://www.securitytracker.com/id?1019282
CVE: CVE-2008-0574
Published: 2008-02-05
Description: Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.01.02 allows remote attackers to inject arbitrary web script or HTML via the sort parameter in a whoisonline action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28684; http://securityreason.com/securityalert/3606; http://www.securityfocus.com/archive/1/487312/100/0/threaded
CVE: CVE-2008-0575
Published: 2008-02-05
Description: Cross-site request forgery (CSRF) vulnerability in admin/admincenter.php in webSPELL 4.01.02 allows remote attackers to assign the superadmin privilege level to arbitrary accounts as administrators via an "update member" action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/28684; http://securityreason.com/securityalert/3606; http://www.securityfocus.com/archive/1/487312/100/0/threaded
CVE: CVE-2008-0576
Published: 2008-02-05
Description: Cross-site scripting (XSS) vulnerability in the Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors that write to summary table pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/216062; http://secunia.com/advisories/28731; http://www.vupen.com/english/advisories/2008/0376/references
CVE: CVE-2008-0577
Published: 2008-02-05
Description: The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal (1) does not restrict the extensions of attached files when the Upload module is enabled for issue nodes, which allows remote attackers to upload and possibly execute arbitrary files; and (2) accepts the .html extension within the bundled file-upload functionality, which allows remote attackers to upload files containing arbitrary web script or HTML.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/216063; http://secunia.com/advisories/28731; http://www.vupen.com/english/advisories/2008/0376/references
CVE: CVE-2008-0578
Published: 2008-02-05
Description: Cross-site scripting (XSS) vulnerability in the web management login page in Tripwire Enterprise 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28687; http://securityreason.com/securityalert/3610; http://www.liquidmatrix.org/blog/2008/01/29/advisory-tripwire-enterprise-xss-vulnerability
CVE: CVE-2007-6340
Published: 2008-02-05
Description: Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a unique initialization vector (IV), which makes it easier for local users to obtain cleartext passwords.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://securityreason.com/securityalert/3611; http://www.moernaut.com/default.aspx?item=lsrunase; http://www.moernaut.com/default.aspx?item=supercrypt
CVE: CVE-2008-0579
Published: 2008-02-05
Description: SQL injection vulnerability in index.php in the buslicense (com_buslicense) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in a list action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27508; http://www.vupen.com/english/advisories/2008/0359/references; https://www.exploit-db.com/exploits/5011
CVE: CVE-2008-0580
Published: 2008-02-05
Description: Geert Moernaut LSrunasE and Supercrypt use an encryption key composed of an SHA1 hash of a fixed string embedded in the executable file, which makes it easier for local users to obtain this key without reverse engineering.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://securityreason.com/securityalert/3611; http://www.securityfocus.com/archive/1/487269/100/0/threaded; http://www.securityfocus.com/bid/27500
CVE: CVE-2008-0581
Published: 2008-02-05
Description: Geert Moernaut LSrunasE allows local users to gain privileges by obtaining the encrypted password from a batch file, and constructing a modified batch file that specifies this password in the /password switch and specifies an arbitrary program in the /command switch.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://securityreason.com/securityalert/3611; http://www.securityfocus.com/archive/1/487269/100/0/threaded; http://securityreason.com/securityalert/3611
CVE: CVE-2008-0582
Published: 2008-02-05
Description: Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.1 through 3.6.0.244 on Windows allows remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Full Name field of a reviewer of a business item entry, accessible through (1) the SkypeFind dialog and (2) a skype:?skypefind URI for the skype: URI handler.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://aviv.raffon.net/2008/01/31/AttackersCanSkypeFindYou.aspx; http://www.kb.cert.org/vuls/id/794236; http://www.securityfocus.com/archive/1/487370/100/0/threaded
CVE: CVE-2008-0583
Published: 2008-02-05
Description: Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Description and unspecified other metadata fields of a Metacafe movie submitted by Metacafe Pro to the Skype video gallery, accessible through a search within the (1) "Add video to chat" or (2) "Add video to mood" dialog, a different vector than CVE-2008-0454.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://aviv.raffon.net/2008/01/22/NoMoreVideosForYouComeBackWhenPatchAvailable.aspx; http://skype.com/security/skype-sb-2008-001-update1.htm; http://www.kb.cert.org/vuls/id/794236
CVE: CVE-2008-0584
Published: 2008-02-05
Description: Multiple buffer overflows in bos.rte.control in IBM AIX 5.2 and 5.3 allow local users to gain privileges via unspecified vectors related to the (1) swap, (2) swapoff, and (3) swapon programs.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/28609; http://www.ibm.com/support/docview.wss?uid=isg1IY96095; http://www.ibm.com/support/docview.wss?uid=isg1IY96101
CVE: CVE-2008-0585
Published: 2008-02-05
Description: sysmgt.websm.webaccess in IBM AIX 5.2 and 5.3 has world writable permissions for unspecified WebSM Remote Client files, which allows local users to "alter the behavior of" this client by overwriting these files.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28609; http://www.ibm.com/support/docview.wss?uid=isg1IY97257; http://www.securityfocus.com/bid/27433
CVE: CVE-2008-0586
Published: 2008-02-05
Description: Multiple buffer overflows in IBM AIX 5.2 and 5.3 allow local users to gain privileges via unspecified vectors related to the (1) lchangevg, (2) ldeletepv, (3) putlvodm, (4) lvaryoffvg, and (5) lvgenminor programs in bos.rte.lvm; and the (6) tellclvmd program in bos.clvm.enh.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://aix.software.ibm.com/aix/efixes/security/lvm_advisory.asc; http://osvdb.org/40427; http://osvdb.org/40428
CVE: CVE-2008-0587
Published: 2008-02-05
Description: Buffer overflow in the uspchrp program in devices.chrp.base.diag in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28609; http://www.ibm.com/support/docview.wss?uid=isg1IZ06261; http://www.ibm.com/support/docview.wss?uid=isg1IZ06489
CVE: CVE-2008-0588
Published: 2008-02-05
Description: Buffer overflow in the utape program in devices.scsi.tape.diag in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/28609; http://www.ibm.com/support/docview.wss?uid=isg1IZ06260; http://www.ibm.com/support/docview.wss?uid=isg1IZ06488
CVE: CVE-2008-0589
Published: 2008-02-05
Description: The ps program in bos.rte.control in IBM AIX 5.2, 5.3, and 6.1 allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/28609; http://securitytracker.com/id?1019265; http://www.ibm.com/support/docview.wss?uid=isg1IZ11242
CVE: CVE-2008-0485
Published: 2008-02-05
Description: Array index error in libmpdemux/demux_mov.c in MPlayer 1.0 rc2 and earlier might allow remote attackers to execute arbitrary code via a QuickTime MOV file with a crafted stsc atom tag.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060032.html; http://secunia.com/advisories/28779; http://secunia.com/advisories/28955
CVE: CVE-2008-0486
Published: 2008-02-05
Description: Array index vulnerability in libmpdemux/demux_audio.c in MPlayer 1.0rc2 and SVN before r25917, and possibly earlier versions, as used in Xine-lib 1.1.10, might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=209106; http://bugs.xine-project.org/show_bug.cgi?id=38; http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060033.html
CVE: CVE-2008-0590
Published: 2008-02-05
Description: Buffer overflow in Ipswitch WS_FTP Server with SSH 6.1.0.0 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long opendir command.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28753; http://securityreason.com/securityalert/3609; http://www.securityfocus.com/archive/1/487441/100/0/threaded
CVE: CVE-2008-0601
Published: 2008-02-06
Description: SQL injection vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to execute arbitrary SQL commands via the name parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27624; https://www.exploit-db.com/exploits/5064; http://www.securityfocus.com/bid/27624
CVE: CVE-2008-0602
Published: 2008-02-06
Description: Directory traversal vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the class_name parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/5061; https://www.exploit-db.com/exploits/5061