deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0353
Published: 2008-01-18
Description: SQL injection vulnerability in visualizza_tabelle.php in php-residence 0.7.2 and 1.0 allows remote attackers to execute arbitrary SQL commands via the cognome_cerca parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28516; http://www.securityfocus.com/bid/27320; https://exchange.xforce.ibmcloud.com/vulnerabilities/39739
CVE: CVE-2008-0354
Published: 2008-01-18
Description: Cross-site scripting (XSS) vulnerability in the chat client in IBM Lotus Sametime 7.5 and 7.5.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted message, which triggers code execution after a mouseover event initiated by the victim.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27942; http://www-1.ibm.com/support/docview.wss?uid=swg21292938; http://www.securityfocus.com/bid/27316
CVE: CVE-2008-0355
Published: 2008-01-18
Description: SQL injection vulnerability in index.php in the forum module in PHPEcho CMS, probably 2.0-rc3 and earlier, allows remote attackers to execute arbitrary SQL commands via the id parameter in a section action, a different vector than CVE-2007-2866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27326; https://exchange.xforce.ibmcloud.com/vulnerabilities/39741; https://www.exploit-db.com/exploits/4929
CVE: CVE-2008-0356
Published: 2008-01-18
Description: Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28508; http://support.citrix.com/article/CTX114487; http://www.kb.cert.org/vuls/id/412228
CVE: CVE-2008-0357
Published: 2008-01-18
Description: Directory traversal vulnerability in pages/upload.php in Galaxyscripts Mini File Host 1.2.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28504; http://www.securityfocus.com/bid/27327; https://exchange.xforce.ibmcloud.com/vulnerabilities/39799
CVE: CVE-2008-0358
Published: 2008-01-18
Description: SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via the parent_id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28499; http://www.pixelpost.org/forum/showthread.php?t=7716; http://www.securityfocus.com/bid/27242
CVE: CVE-2008-0359
Published: 2008-01-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin.php or (2) index.php in photo/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogcms.com/wiki/changelog; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4383&w=2; http://secunia.com/advisories/28523
CVE: CVE-2008-0360
Published: 2008-01-18
Description: Multiple SQL injection vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to execute arbitrary SQL commands via (1) the blogid parameter to index.php, (2) the user parameter to action.php, or (3) the field parameter to admin/plugins/table/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blogcms.com/wiki/changelog; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4383&w=2; http://secunia.com/advisories/28523
CVE: CVE-2008-0361
Published: 2008-01-18
Description: Directory traversal vulnerability in agregar_info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tabla parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28520; http://securityreason.com/securityalert/3552; http://www.securityfocus.com/archive/1/486444/100/0/threaded
CVE: CVE-2008-0362
Published: 2008-01-18
Description: Cross-site scripting (XSS) vulnerability in gallery.php in Clever Copy 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the album parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28560; http://securityreason.com/securityalert/3553; http://www.securityfocus.com/archive/1/486492/100/0/threaded
CVE: CVE-2008-0363
Published: 2008-01-18
Description: Multiple SQL injection vulnerabilities in Clever Copy 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to postcomment.php and the (2) album parameter to gallery.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28560; http://securityreason.com/securityalert/3553; http://www.securityfocus.com/archive/1/486492/100/0/threaded
CVE: CVE-2007-5760
Published: 2008-01-18
Description: Array index error in the XFree86-Misc extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via a PassMessage request containing a large array index.
CVSS Score: 9.3 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=204362; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=646; http://lists.freedesktop.org/archives/xorg/2008-January/031918.html
CVE: CVE-2007-5958
Published: 2008-01-18
Description: X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in the -sp option to the X program, which produces different error messages depending on whether the filename exists.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://bugs.gentoo.org/show_bug.cgi?id=204362; http://docs.info.apple.com/article.html?artnum=307562; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01543321
CVE: CVE-2007-6427
Published: 2008-01-18
Description: The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to byte swapping and heap corruption within multiple functions, a different vulnerability than CVE-2007-4990.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://bugs.gentoo.org/show_bug.cgi?id=204362; http://docs.info.apple.com/article.html?artnum=307562; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01543321
CVE: CVE-2007-6428
Published: 2008-01-18
Description: The ProcGetReservedColormapEntries function in the TOG-CUP extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to read the contents of arbitrary memory locations via a request containing a 32-bit value that is improperly used as an array index.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=204362; http://docs.info.apple.com/article.html?artnum=307562; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=644
CVE: CVE-2007-6429
Published: 2008-01-18
Description: Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension, or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189, CWE-362
References: http://bugs.gentoo.org/show_bug.cgi?id=204362; http://docs.info.apple.com/article.html?artnum=307562; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01543321
CVE: CVE-2008-0006
Published: 2008-01-18
Description: Buffer overflow in (1) X.Org Xserver before 1.4.1, and (2) the libfont and libXfont libraries on some platforms including Sun Solaris, allows context-dependent attackers to execute arbitrary code via a PCF font with a large difference between the last col and first col values in the PCF_BDF_ENCODINGS table.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=204362; http://docs.info.apple.com/article.html?artnum=307562; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01543321
CVE: CVE-2008-0364
Published: 2008-01-18
Description: Buffer overflow in (1) BitTorrent 6.0 and earlier; and (2) uTorrent 1.7.5 and earlier, and 1.8-alpha-7834 and earlier in the 1.8.x series; on Windows allows remote attackers to cause a denial of service (application crash) via a long Unicode string representing a client version identifier.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/ruttorrent-adv.txt; http://aluigi.org/poc/ruttorrent.zip; http://download.utorrent.com/1.7.6/utorrent-1.7.6.txt
CVE: CVE-2008-0365
Published: 2008-01-18
Description: Multiple buffer overflows in CORE FORCE before 0.95.172 allow local users to cause a denial of service (system crash) and possibly execute arbitrary code in the kernel context via crafted arguments to (1) IOCTL functions in the Firewall module or (2) SSDT hook handler functions in the Registry module.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://force.coresecurity.com/index.php?module=articles&func=display&aid=32; http://securityreason.com/securityalert/3555; http://www.coresecurity.com/?action=item&id=2025
CVE: CVE-2008-0366
Published: 2008-01-18
Description: CORE FORCE before 0.95.172 does not properly validate arguments to SSDT hook handler functions in the Registry module, which allows local users to cause a denial of service (system crash) and possibly execute arbitrary code in the kernel context via crafted arguments.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://force.coresecurity.com/index.php?module=articles&func=display&aid=32; http://securityreason.com/securityalert/3555; http://www.coresecurity.com/?action=item&id=2025
CVE: CVE-2008-0367
Published: 2008-01-19
Description: Mozilla Firefox 2.0.0.11, 3.0b2, and possibly earlier versions, when prompting for HTTP Basic Authentication, displays the site requesting the authentication after the Realm text, which might make it easier for remote HTTP servers to conduct phishing and spoofing attacks.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthentication.aspx; http://aviv.raffon.net/2008/01/05/FirefoxDialogSpoofingFAQ.aspx; http://blog.mozilla.com/security/2008/01/04/basicauth-dialog-realm-value-spoofing/
CVE: CVE-2008-0368
Published: 2008-01-19
Description: onedcu in IBM Informix Dynamic Server (IDS) 10.x before 10.00.xC8 allows local users to create arbitrary files via the Trace file argument.
CVSS Score: 7.2 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=651; http://secunia.com/advisories/28534; http://www-1.ibm.com/support/docview.wss?uid=swg1IC54307
CVE: CVE-2008-0369
Published: 2008-01-19
Description: Multiple unspecified programs in IBM Informix Dynamic Server (IDS) 10.x before 10.00.xC8 allow local users to create arbitrary files by specifying the target file in the SQLIDEBUG environment variable, whose ownership is changed to the user invoking the programs.
CVSS Score: 6.9 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=650; http://secunia.com/advisories/28534; http://www-1.ibm.com/support/docview.wss?uid=swg1IC54309
CVE: CVE-2008-0065
Published: 2008-01-22
Description: Multiple stack-based buffer overflows in in_mp3.dll in Winamp 5.21, 5.5, and 5.51 allow remote attackers to execute arbitrary code via a long (1) artist or (2) name tag in Ultravox streaming metadata, related to construction of stream titles.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27865; http://secunia.com/secunia_research/2008-2/advisory/; http://www.securityfocus.com/bid/27344
CVE: CVE-2008-0370
Published: 2008-01-22
Description: Cross-site scripting (XSS) vulnerability in dohtaccess.html in cPanel before 11.17 build 19417 allows remote attackers to inject arbitrary web script or HTML via the rurl parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://aria-security.net/forum/showthread.php?p=1238; http://secunia.com/advisories/28561; http://securityreason.com/securityalert/3561
CVE: CVE-2008-0371
Published: 2008-01-22
Description: Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via (1) the mohit parameter to (a) inc/receivertwo.php; and allow remote attackers to execute arbitrary SQL commands via (2) the id parameter to (b) inc/usercp.php, related to functionz/usercp.php; or (3) the username parameter to (c) admin/index.php, related to functionz/first_process.php, or (d) index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28515; http://www.securityfocus.com/bid/27315; https://exchange.xforce.ibmcloud.com/vulnerabilities/39733
CVE: CVE-2008-0372
Published: 2008-01-22
Description: 8e6 R3000 Internet Filter 2.0.05.33, and other versions before 2.0.11, allows remote attackers to bypass intended restrictions via a fragmented HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28524; http://securityreason.com/securityalert/3557; http://www.securityfocus.com/archive/1/486398/100/0/threaded
CVE: CVE-2008-0373
Published: 2008-01-22
Description: Unrestricted file upload vulnerability in PHP F1 Max's File Uploader allows remote attackers to upload and execute arbitrary PHP files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/3572; http://www.securityfocus.com/archive/1/486335/100/0/threaded; http://www.securityfocus.com/bid/27285
CVE: CVE-2008-0374
Published: 2008-01-22
Description: OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 sends the configuration of the printer in cleartext, which allows remote attackers to obtain the administrative password by connecting to TCP port 5548 or 7777.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://secunia.com/advisories/28553; http://securityreason.com/securityalert/3569; http://www.csnc.ch/en/modules/news/news_0004.html_[PII_REDACTED].html
CVE: CVE-2008-0375
Published: 2008-01-22
Description: Unspecified vulnerability in OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 allows remote attackers to set the password and obtain administrative access via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/28553; http://securityreason.com/securityalert/3569; http://www.csnc.ch/en/modules/news/news_0004.html_[PII_REDACTED].html
CVE: CVE-2008-0376
Published: 2008-01-22
Description: PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the cfile parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/28568; http://www.securityfocus.com/bid/27345; https://exchange.xforce.ibmcloud.com/vulnerabilities/39765
CVE: CVE-2008-0377
Published: 2008-01-22
Description: MicroNews allows remote attackers to bypass authentication and gain administrative privileges via a direct request to admin.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/3556; http://www.securityfocus.com/archive/1/486349/100/0/threaded; http://www.securityfocus.com/bid/27288
CVE: CVE-2008-0378
Published: 2008-01-22
Description: Stack-based buffer overflow in SocksCap 2.40-051231 and earlier, when "Resolve all names remotely" is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hostname.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://securityreason.com/securityalert/3560; http://www.securityfocus.com/archive/1/486632/100/0/threaded; http://www.securityfocus.com/bid/27357
CVE: CVE-2008-0379
Published: 2008-01-22
Description: Race condition in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) in Crystal Reports XI Release 2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SelectedSession method, which triggers a buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-120, CWE-362
References: http://www.securityfocus.com/bid/27333; http://www.securitytracker.com/id?1019239; https://exchange.xforce.ibmcloud.com/vulnerabilities/39743
CVE: CVE-2008-0380
Published: 2008-01-22
Description: Buffer overflow in the Digital Data Communications RtspVaPgCtrl ActiveX control (RtspVapgDecoder.dll 1.1.0.29) allows remote attackers to execute arbitrary code via a long MP4Prefix property.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28492; http://www.securityfocus.com/bid/27337; http://www.vupen.com/english/advisories/2008/0182
CVE: CVE-2008-0381
Published: 2008-01-22
Description: Unspecified vulnerability in Mahara before 0.9.1 has unknown impact and remote attack vectors, probably related to cross-site scripting (XSS) in uploaded files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28484; http://www.securityfocus.com/bid/27348; https://eduforge.org/frs/shownotes.php?release_id=342
CVE: CVE-2008-0382
Published: 2008-01-22
Description: Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to (1) forumdisplay.php or (2) a results action in search.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28509; http://securityreason.com/securityalert/3559; http://www.securityfocus.com/archive/1/486434/100/0/threaded
CVE: CVE-2008-0383
Published: 2008-01-22
Description: Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via (1) the mergepost parameter in a do_mergeposts action, (2) rid parameter in an allreports action, or (3) threads parameter in a do_multimovethreads action to (a) moderation.php; or (4) gid parameter to (b) admin/usergroups.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://community.mybboard.net/showthread.php?tid=27227; http://secunia.com/advisories/28509; http://securityreason.com/securityalert/3558
CVE: CVE-2008-0384
Published: 2008-01-22
Description: OpenBSD 4.2 allows local users to cause a denial of service (kernel panic) by calling the SIOCGIFRTLABEL IOCTL on an interface that does not have a route label, which triggers a NULL pointer dereference when the return value from the rtlabel_id2name function is not checked.
CVSS Score: 4.9 (MEDIUM)
References: http://marc.info/?l=openbsd-security-announce&m=[PII_REDACTED]4064; http://secunia.com/advisories/28473; http://www.openbsd.org/errata42.html#005_ifrtlabel
CVE: CVE-2008-0128
Published: 2008-01-23
Description: The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx; http://issues.apache.org/bugzilla/show_bug.cgi?id=41217; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
CVE: CVE-2008-0388
Published: 2008-01-23
Description: SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the user parameter in a showprofile action to the default URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0272.html; http://osvdb.org/52211; http://secunia.com/advisories/28567
CVE: CVE-2008-0389
Published: 2008-01-23
Description: Unspecified vulnerability in the serveServletsByClassnameEnabled feature in IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.25, 6.1 through 6.1.0.14, and 5.1.1.x before 5.1.1.18 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/28576; http://secunia.com/advisories/29687; http://www-1.ibm.com/support/docview.wss?uid=swg24018067
CVE: CVE-2008-0390
Published: 2008-01-23
Description: stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to index.php, and execute online.db.txt via a certain request to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/27342; https://exchange.xforce.ibmcloud.com/vulnerabilities/39777; https://www.exploit-db.com/exploits/4933
CVE: CVE-2008-0391
Published: 2008-01-23
Description: inc/elementz.php in aliTalk 1.9.1.1 does not properly verify authentication, which allows remote attackers to add an arbitrary user account via a modified lilil parameter, in conjunction with the ubild and pa parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/27315; https://www.exploit-db.com/exploits/4922; http://www.securityfocus.com/bid/27315
CVE: CVE-2008-0392
Published: 2008-01-23
Description: Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to execute arbitrary code via a .dsr file with a long (1) ConnectionName or (2) CommandName line.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28563; http://www.securityfocus.com/bid/27349; http://www.securitytracker.com/id?1019258
CVE: CVE-2008-0393
Published: 2008-01-23
Description: Directory traversal vulnerability in info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tabla parameter, a different vector than CVE-2008-0361.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28520; http://www.securityfocus.com/bid/27343; https://exchange.xforce.ibmcloud.com/vulnerabilities/39768
CVE: CVE-2008-0394
Published: 2008-01-23
Description: Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to execute arbitrary code via a long RCPT TO command, which is not properly handled by the makeuserkey function.  NOTE: some of these details were obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28590; http://www.milw0rm.com/sploits/2008-vs-GNU-citadel.tar.gz; http://www.securityfocus.com/bid/27376
CVE: CVE-2008-0395
Published: 2008-01-23
Description: Kayako SupportSuite 3.11.01 allows remote attackers to obtain server configuration information via a direct request to syncml/index.php, which prints the contents of the $_SERVER superglobal.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/28613; http://securityreason.com/securityalert/3573; http://www.securityfocus.com/archive/1/486762/100/0/threaded
CVE: CVE-2008-0396
Published: 2008-01-23
Description: Directory traversal vulnerability in BitDefender Update Server (http.exe), as used in BitDefender products including Security for Fileservers and Enterprise Manager (BDEM), allows remote attackers to read arbitrary files via .. (dot dot) sequences in an HTTP request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://oliver.greyhat.de/2008/01/19/bitdefender-unauthorized-remote-file-access-vulnerability/; http://secunia.com/advisories/28578; http://securityreason.com/securityalert/3568