deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4341
Published: 2008-09-30
Description: add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by setting a cookie with admin=yes and login=admin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/31311; http://www.vupen.com/english/advisories/2008/2654; https://exchange.xforce.ibmcloud.com/vulnerabilities/45576
CVE: CVE-2008-4342
Published: 2008-09-30
Description: NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers to overwrite and create arbitrary files via calls to the EnableLog and LogMessage methods. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://retrogod.altervista.org/9sg_numedia_xpl.html; http://secunia.com/advisories/31936; http://secunia.com/advisories/31949
CVE: CVE-2008-4343
Published: 2008-09-30
Description: The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create, overwrite, and modify arbitrary files for execution via a call to the (1) SaveToFile, (2) SaveToTempFile, or (3) AppendBinary method.  NOTE: this issue might only be exploitable in limited environments or non-default browser settings.  NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31951; http://www.securityfocus.com/bid/31332; http://www.shinnai.net/xplits/TXT_rNowA1916DKFNUF48NyS
CVE: CVE-2008-4344
Published: 2008-09-30
Description: SQL injection vulnerability in cat.php in 6rbScript allows remote attackers to execute arbitrary SQL commands via the CatID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0809-exploits/6rbscriptcat-sql.txt; http://secunia.com/advisories/31945; http://www.securityfocus.com/bid/31329
CVE: CVE-2008-4345
Published: 2008-09-30
Description: SQL injection vulnerability in download.php in WebPortal CMS 0.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the aid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31784; http://www.securityfocus.com/bid/31156; http://www.vupen.com/english/advisories/2008/2560
CVE: CVE-2008-4346
Published: 2008-09-30
Description: Directory traversal vulnerability in TalkBack 2.3.6 and 2.3.6.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to comments.php, a different vector than CVE-2008-3371.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31879; http://securityreason.com/securityalert/4267; http://www.securityfocus.com/bid/31164
CVE: CVE-2008-4347
Published: 2008-09-30
Description: SQL injection vulnerability in newskom.php in Powie pNews 2.03 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31160; https://exchange.xforce.ibmcloud.com/vulnerabilities/45114; https://www.exploit-db.com/exploits/6447
CVE: CVE-2008-4348
Published: 2008-09-30
Description: SQL injection vulnerability in photo.php in PHPortfolio, possibly 1.3, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0809-exploits/phpportfolio-sql.txt; http://secunia.com/advisories/31828; http://www.securityfocus.com/bid/31143
CVE: CVE-2008-4349
Published: 2008-09-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in news.php in s0nic Paranews 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) page parameter in a details action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0809-exploits/paranews-xss.txt; http://secunia.com/advisories/31786; http://www.securityfocus.com/bid/31152
CVE: CVE-2008-4350
Published: 2008-09-30
Description: SQL injection vulnerability in main.php in vbLOGIX Tutorial Script 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48107; http://secunia.com/advisories/31829; http://www.securityfocus.com/bid/31157
CVE: CVE-2008-4351
Published: 2008-09-30
Description: Directory traversal vulnerability in index.php in phpSmartCom 0.2 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the p parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/31167; https://exchange.xforce.ibmcloud.com/vulnerabilities/45125; https://www.exploit-db.com/exploits/6452
CVE: CVE-2008-4352
Published: 2008-09-30
Description: SQL injection vulnerability in inc/pages/viewprofile.php in phpSmartCom 0.2 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a viewprofile action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31167; https://exchange.xforce.ibmcloud.com/vulnerabilities/45126; https://www.exploit-db.com/exploits/6452
CVE: CVE-2008-4353
Published: 2008-09-30
Description: SQL injection vulnerability in link.php in Linkarity allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. NOTE: although one component of Linkarity is distributable PHP code, this issue might be site-specific. If so, it should not be included in CVE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/45100; https://www.exploit-db.com/exploits/6455; https://exchange.xforce.ibmcloud.com/vulnerabilities/45100
CVE: CVE-2008-4354
Published: 2008-09-30
Description: SQL injection vulnerability in the products module in NetArt Media iBoutique 4.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31871; http://www.securityfocus.com/bid/31159; http://www.vupen.com/english/advisories/2008/2561
CVE: CVE-2008-4355
Published: 2008-09-30
Description: SQL injection vulnerability in showprofil.php in Powie PSCRIPT Forum (aka PHP Forum or pForum) 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31872; http://www.securityfocus.com/bid/31150; http://www.vupen.com/english/advisories/2008/2559
CVE: CVE-2008-4356
Published: 2008-09-30
Description: Multiple SQL injection vulnerabilities in Kasseler CMS 1.1.0 and 1.2.0 allow remote attackers to execute arbitrary SQL commands via (1) the nid parameter to index.php in a View action to the News module; (2) the vid parameter to index.php in a Result action to the Voting module; (3) the fid parameter to index.php in a ShowForum action to the Forum module; (4) the tid parameter to index.php in a ShowTopic action to the Forum module; (5) the uname parameter to index.php in a UserInfo action to the Account module; or (6) the module parameter to index.php, probably related to the TopSites module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31862; http://www.securityfocus.com/bid/31170; https://exchange.xforce.ibmcloud.com/vulnerabilities/45120
CVE: CVE-2008-4357
Published: 2008-09-30
Description: SQL injection vulnerability in linkto.php in Powie pLink 2.07 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31163; https://exchange.xforce.ibmcloud.com/vulnerabilities/45115; https://www.exploit-db.com/exploits/6449
CVE: CVE-2008-4358
Published: 2008-09-30
Description: Unspecified vulnerability in class/theme.class.php in SPAW Editor PHP Edition before 2.0.8.1 has unknown impact and attack vectors, probably related to directory traversal sequences in the theme name.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://blog.solmetra.com/2008/09/10/spaw-editor-php-edition-hotfix-release/; http://secunia.com/advisories/31796; http://sourceforge.net/project/shownotes.php?release_id=625333&group_id=77954
CVE: CVE-2008-4361
Published: 2008-09-30
Description: Directory traversal vulnerability in PowerPortal 2.0.13 allows remote attackers to list and possibly read arbitrary files via a .. (dot dot) in the path parameter to the default URI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32031; http://securityreason.com/securityalert/4340; http://www.securityfocus.com/bid/31454
CVE: CVE-2008-4362
Published: 2008-09-30
Description: The Virtual Token driver (vdlptokn.sys) 1.0.2.43 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) via a crafted IOCTL request to \Device\DLPTokenWalter0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/31921; http://securityreason.com/securityalert/4341; http://www.vupen.com/english/advisories/2008/2638
CVE: CVE-2008-4363
Published: 2008-09-30
Description: DLMFENC.sys 1.0.0.28 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) or potentially execute arbitrary code via a certain DLMFENC_IOCTL request to \\.\DLKPFSD_Device that overwrites a pointer, probably related to use of the ProbeForRead function when ProbeForWrite was intended.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://digit-labs.org/files/exploits/deslock-probe-read.c; http://secunia.com/advisories/31921; http://securityreason.com/securityalert/4342
CVE: CVE-2008-4364
Published: 2008-09-30
Description: SQL injection vulnerability in default.aspx in ParsaGostar ParsaWeb CMS allows remote attackers to execute arbitrary SQL commands via the (1) id parameter in the "page" page and (2) txtSearch parameter in the "Search" page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4343; http://www.bugreport.ir/index_53.htm; http://www.securityfocus.com/archive/1/496799/100/0/threaded
CVE: CVE-2008-4365
Published: 2008-09-30
Description: Cross-site scripting (XSS) vulnerability in search.php in Siteman 1.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/31439; https://exchange.xforce.ibmcloud.com/vulnerabilities/45484; http://www.securityfocus.com/bid/31439
CVE: CVE-2008-4366
Published: 2008-09-30
Description: Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a user directory under images/photos/upload.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/4344; http://www.securityfocus.com/bid/31456; https://exchange.xforce.ibmcloud.com/vulnerabilities/45492
CVE: CVE-2008-4368
Published: 2008-10-01
Description: The default configuration of Java 1.5 on Apple Mac OS X 10.5.4 and 10.5.5 contains a jurisdiction policy that limits Java Cryptography Extension (JCE) key sizes to 128 bits, which makes it easier for attackers to decrypt ciphertext produced by JCE.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html; http://support.apple.com/kb/HT3179; https://exchange.xforce.ibmcloud.com/vulnerabilities/45650
CVE: CVE-2008-4369
Published: 2008-10-01
Description: SQL injection vulnerability in pics.php in Availscript Photo Album allows remote attackers to execute arbitrary SQL commands via the sid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4330; http://www.securityfocus.com/bid/31085; https://exchange.xforce.ibmcloud.com/vulnerabilities/45017
CVE: CVE-2008-4370
Published: 2008-10-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in Availscript Photo Album allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to pics.php and the (2) a parameter to view.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4330; http://www.securityfocus.com/bid/31085; https://exchange.xforce.ibmcloud.com/vulnerabilities/45018
CVE: CVE-2008-4371
Published: 2008-10-01
Description: SQL injection vulnerability in articles.php in AvailScript Article Script allows remote attackers to execute arbitrary SQL commands via the aIDS parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31816; http://securityreason.com/securityalert/4331; http://www.securityfocus.com/bid/31095
CVE: CVE-2008-4372
Published: 2008-10-01
Description: Cross-site scripting (XSS) vulnerability in articles.php in AvailScript Article Script allows remote attackers to inject arbitrary web script or HTML via the aIDS parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31816; http://securityreason.com/securityalert/4331; http://www.securityfocus.com/bid/31095
CVE: CVE-2008-4373
Published: 2008-10-01
Description: SQL injection vulnerability in job_seeker/applynow.php in AvailScript Job Portal Script allows remote attackers to execute arbitrary SQL commands via the jid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4332; http://www.securityfocus.com/bid/31101; https://exchange.xforce.ibmcloud.com/vulnerabilities/45041
CVE: CVE-2008-4374
Published: 2008-10-01
Description: SQL injection vulnerability in index.php in CMS Buzz allows remote attackers to execute arbitrary SQL commands via the id parameter in a playgame action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31817; http://securityreason.com/securityalert/4333; http://www.securityfocus.com/bid/31097
CVE: CVE-2008-4375
Published: 2008-10-01
Description: SQL injection vulnerability in viewprofile.php in Availscript Classmate Script allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4334; http://www.securityfocus.com/bid/31100; https://exchange.xforce.ibmcloud.com/vulnerabilities/45025
CVE: CVE-2008-4376
Published: 2008-10-01
Description: SQL injection vulnerability in index.php in Live TV Script allows remote attackers to execute arbitrary SQL commands via the mid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4328; http://www.securityfocus.com/bid/31083; https://exchange.xforce.ibmcloud.com/vulnerabilities/44983
CVE: CVE-2008-4377
Published: 2008-10-01
Description: SQL injection vulnerability in index.asp in Creative Mind Creator CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the sideid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/47979; http://secunia.com/advisories/31819; http://securityreason.com/securityalert/4335
CVE: CVE-2008-4378
Published: 2008-10-01
Description: SQL injection vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4336; http://www.securityfocus.com/bid/31078; https://exchange.xforce.ibmcloud.com/vulnerabilities/44991
CVE: CVE-2008-4379
Published: 2008-10-01
Description: Cross-site scripting (XSS) vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4336; https://exchange.xforce.ibmcloud.com/vulnerabilities/44992; https://www.exploit-db.com/exploits/6403
CVE: CVE-2008-4380
Published: 2008-10-01
Description: The web interface in Samsung DVR SHR2040 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request, related to the filter for configuration properties and "/x" characters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31752; http://securityreason.com/securityalert/4329; http://www.securityfocus.com/bid/31047
CVE: CVE-2008-2831
Published: 2008-10-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the delegated spam management feature in the Spam Quarantine Management (SQM) component in MailMarshal SMTP 6.0.3.8 through 6.3.0.0 allow user-assisted remote authenticated users to inject arbitrary web script or HTML via (1) the list of blocked senders or (2) the list of safe senders.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/32062; http://www.dcsl.ul.ie/marshal.htm; http://www.marshal.com/kb/article.aspx?id=12175
CVE: CVE-2008-3520
Published: 2008-10-02
Description: Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=222819; http://rhn.redhat.com/errata/RHSA-2015-0698.html; http://secunia.com/advisories/33173
CVE: CVE-2008-3521
Published: 2008-10-02
Description: Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit.  NOTE: this was originally reported as a symlink issue, but this was incorrect.  NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.gentoo.org/attachment.cgi?id=163282&action=view; http://bugs.gentoo.org/show_bug.cgi?id=222819; http://secunia.com/advisories/34391
CVE: CVE-2008-3522
Published: 2008-10-02
Description: Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/attachment.cgi?id=163282&action=view; http://bugs.gentoo.org/show_bug.cgi?id=222819; http://rhn.redhat.com/errata/RHSA-2015-0698.html
CVE: CVE-2008-3542
Published: 2008-10-02
Description: Unspecified vulnerability in HP Insight Diagnostics before 7.9.1.2402 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0640&w=2; http://secunia.com/advisories/32061; http://securityreason.com/securityalert/4346
CVE: CVE-2008-4381
Published: 2008-10-02
Description: Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (application crash) via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://securityreason.com/securityalert/4345; http://www.openwall.com/lists/oss-security/2008/10/03/7; http://www.openwall.com/lists/oss-security/2008/10/03/8
CVE: CVE-2008-4382
Published: 2008-10-02
Description: Konqueror in KDE 3.5.9 allows remote attackers to cause a denial of service (application crash) via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/archive/1/496849/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/45645; http://www.securityfocus.com/archive/1/496849/100/0/threaded
CVE: CVE-2008-4396
Published: 2008-10-02
Description: Stack-based buffer overflow in Safer Networking FileAlyzer 1.6.0.0 and 1.6.0.4 beta, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via an executable with malformed version data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://forums.spybot.info/showthread.php?t=34737; http://lostmon.blogspot.com/2008/09/filealyzer-1604-stak-overflow.html; http://packetstormsecurity.org/0809-advisories/filealyzer-overflow.txt
CVE: CVE-2008-2236
Published: 2008-10-03
Description: Cross-site scripting (XSS) vulnerability in blosxom.cgi in Blosxom before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the flav parameter (flavour variable).  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN03300113/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000073.html; http://secunia.com/advisories/32074
CVE: CVE-2008-2439
Published: 2008-10-03
Description: Directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in the client in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1372, OfficeScan 8.0 SP1 before build 1222, OfficeScan 8.0 SP1 Patch 1 before build 3087, and Worry-Free Business Security 5.0 before build 1220 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP request.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31343; http://secunia.com/advisories/32097; http://secunia.com/secunia_research/2008-39/
CVE: CVE-2008-2476
Published: 2008-10-03
Description: The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-013.txt.asc; http://secunia.com/advisories/32112; http://secunia.com/advisories/32116
CVE: CVE-2008-3825
Published: 2008-10-03
Description: pam_krb5 2.2.14 in Red Hat Enterprise Linux (RHEL) 5 and earlier, when the existing_ticket option is enabled, uses incorrect privileges when reading a Kerberos credential cache, which allows local users to gain privileges by setting the KRB5CCNAME environment variable to an arbitrary cache filename and running the (1) su or (2) sudo program. NOTE: there may be a related vector involving sshd that has limited relevance.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html; http://secunia.com/advisories/32119; http://secunia.com/advisories/32135
CVE: CVE-2008-4402
Published: 2008-10-03
Description: Multiple buffer overflows in CGI modules in the server in Trend Micro OfficeScan 8.0 SP1 before build 2439 and 8.0 SP1 Patch 1 before build 3087 allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32097; http://www.securityfocus.com/bid/31531; http://www.securitytracker.com/id?1020974