deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3995
Published: 2008-10-14
Description: Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_CDC_PUBLISH.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/32291; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021050
CVE: CVE-2008-3996
Published: 2008-10-14
Description: Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.DBMS_CDC_IPUBLISH.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/32291; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.vupen.com/english/advisories/2008/2825
CVE: CVE-2008-3998
Published: 2008-10-14
Description: Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 12.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/32291; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021057
CVE: CVE-2008-4000
Published: 2008-10-14
Description: Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.18 and 8.49.14 allows remote attackers to affect confidentiality and integrity via unknown vectors.  NOTE: the previous information was obtained from the Oracle October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue allows bypass of the lockout mechanism using brute force guessing of credentials and a response discrepancy information leak when the password is correct.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/32291; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securityfocus.com/archive/1/497543/100/0/threaded
CVE: CVE-2008-4001
Published: 2008-10-14
Description: Unspecified vulnerability in the PeopleSoft Enterprise Portal component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne EP 8.9 and EP 9.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/32291; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021055
CVE: CVE-2008-4002
Published: 2008-10-14
Description: Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.18 and 8.49.14 allows remote authenticated users to affect confidentiality via unknown vectors.
CVSS Score: 3.5 (LOW)
References: http://secunia.com/advisories/32291; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021055
CVE: CVE-2008-4003
Published: 2008-10-14
Description: Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.18 and 8.49.14 allows remote attackers to affect confidentiality via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/32291; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021055
CVE: CVE-2008-4004
Published: 2008-10-14
Description: Unspecified vulnerability in the JDE EnterpriseOne Business Service Server component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.97.2.2 and 8.98.0.1 allows local users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 3.2 (LOW)
References: http://secunia.com/advisories/32291; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021055
CVE: CVE-2008-4005
Published: 2008-10-14
Description: Unspecified vulnerability in the Oracle Application Express component in Oracle Database 11.1.0.6 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/32291; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021050
CVE: CVE-2008-4008
Published: 2008-10-14
Description: Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.
CVSS Score: 10.0 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=751; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021056
CVE: CVE-2008-4009
Published: 2008-10-14
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.1, when configuring multiple authorizers, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/32304; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021056
CVE: CVE-2008-4010
Published: 2008-10-14
Description: Unspecified vulnerability in the WebLogic Workshop component in BEA Product Suite 10.3, 10.2, 10.0 MP1, 9.2 MP3, and 8.1 SP6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to "some NetUI tags."
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/32302; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021056
CVE: CVE-2008-4011
Published: 2008-10-14
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.0 MP1, 9.2 MP3, 9.1, and 9.0 allows remote authenticated users to affect integrity via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021056; http://www.vupen.com/english/advisories/2008/2825
CVE: CVE-2008-4012
Published: 2008-10-14
Description: Unspecified vulnerability in the WebLogic Workshop component in BEA Product Suite WLW 8.1SP5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to "some NetUI pageflows."
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/32303; http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021056
CVE: CVE-2008-4013
Published: 2008-10-14
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2008-100299.html; http://www.securitytracker.com/id?1021056; http://www.vupen.com/english/advisories/2008/2825
CVE: CVE-2008-4478
Published: 2008-10-14
Description: Multiple integer overflows in dhost.exe in Novell eDirectory 8.8 before 8.8.3, and 8.73 before 8.7.3.10 ftf1, allow remote attackers to execute arbitrary code via a crafted (1) Content-Length header in a SOAP request or (2) Netware Core Protocol opcode 0x0F message, which triggers a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/32111; http://securityreason.com/securityalert/4406; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037180.html
CVE: CVE-2008-4479
Published: 2008-10-14
Description: Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.8 before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to execute arbitrary code via a SOAP request with a long Accept-Language header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32111; http://securityreason.com/securityalert/4405; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037180.html
CVE: CVE-2008-4480
Published: 2008-10-14
Description: Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.x before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to execute arbitrary code via a crafted Netware Core Protocol opcode 0x24 message that triggers a calculation error that under-allocates a heap buffer.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32111; http://securityreason.com/securityalert/4404; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037180.html
CVE: CVE-2008-4556
Published: 2008-10-14
Description: Stack-based buffer overflow in the adm_build_path function in sadmind in Sun Solstice AdminSuite on Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/50019; http://risesecurity.org/advisories/RISE-2008001.txt; http://secunia.com/advisories/32283
CVE: CVE-2008-4557
Published: 2008-10-14
Description: plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 (aka Strawberry) allows remote attackers to execute arbitrary PHP code via the text parameter, which is inserted into an executable regular expression.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28330; http://securityreason.com/securityalert/4403; http://www.osvdb.org/40236
CVE: CVE-2008-4558
Published: 2008-10-15
Description: Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag, which passes a signed comparison.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32267; http://www.coresecurity.com/content/vlc-xspf-memory-corruption; http://www.exploit-db.com/exploits/6756
CVE: CVE-2008-1446
Published: 2008-10-15
Description: Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker, aka "Integer Overflow in IPP Service Vulnerability."
CVSS Score: 9.0 (HIGH)
CWE: CWE-190
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32248; http://www.kb.cert.org/vuls/id/793233
CVE: CVE-2008-2250
Published: 2008-10-15
Description: The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate window properties sent from a parent window to a child window during creation of a new window, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Window Creation Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32247; http://www.securityfocus.com/bid/31651
CVE: CVE-2008-2251
Published: 2008-10-15
Description: Double free vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows local users to gain privileges via a crafted application that makes system calls within multiple threads, aka "Windows Kernel Unhandled Exception Vulnerability." NOTE: according to Microsoft, this is not a duplicate of CVE-2008-4510.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32247; http://www.securityfocus.com/bid/31653
CVE: CVE-2008-2252
Published: 2008-10-15
Description: The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate parameters sent from user mode to the kernel, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Corruption Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32247; http://www.securityfocus.com/bid/31652
CVE: CVE-2008-3464
Published: 2008-10-15
Description: afd.sys in the Ancillary Function Driver (AFD) component in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP1 and SP2 does not properly validate input sent from user mode to the kernel, which allows local users to gain privileges via a crafted application, as demonstrated using crafted pointers and lengths that bypass intended ProbeForRead and ProbeForWrite restrictions, aka "AFD Kernel Overwrite Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://blogs.technet.com/swi/archive/2008/10/14/ms08-066-how-to-correctly-validate-and-capture-user-mode-data.aspx; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32261
CVE: CVE-2008-3466
Published: 2008-10-15
Description: Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32233
CVE: CVE-2008-3471
Published: 2008-10-15
Description: Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a BIFF file with a malformed record that triggers a user-influenced size calculation, aka "File Format Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32211; http://www.securityfocus.com/bid/31705
CVE: CVE-2008-3472
Published: 2008-10-15
Description: Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy, and execute arbitrary code or obtain sensitive information, via a crafted HTML document, aka "HTML Element Cross-Domain Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://www.securityfocus.com/bid/31615; http://www.securityfocus.com/bid/31654
CVE: CVE-2008-3473
Published: 2008-10-15
Description: Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy, and execute arbitrary code or obtain sensitive information, via a crafted HTML document, aka "Event Handling Cross-Domain Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://www.securityfocus.com/bid/31616; http://www.securitytracker.com/id?1021047
CVE: CVE-2008-3474
Published: 2008-10-15
Description: Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy and obtain sensitive information via a crafted HTML document, aka "Cross-Domain Information Disclosure Vulnerability."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://www.securitytracker.com/id?1021047; http://www.us-cert.gov/cas/techalerts/TA08-288A.html
CVE: CVE-2008-3475
Published: 2008-10-15
Description: Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-908
References: http://ifsec.blogspot.com/2008/10/internet-explorer-6-componentfrompoint.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://www.securityfocus.com/archive/1/497380/100/0/threaded
CVE: CVE-2008-3476
Published: 2008-10-15
Description: Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "HTML Objects Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://www.securityfocus.com/bid/31618; http://www.securitytracker.com/id?1021047
CVE: CVE-2008-3477
Published: 2008-10-15
Description: Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Office document with an embedded object, which allows remote attackers to execute arbitrary code via an Excel file containing a crafted value, leading to heap-based buffer overflows, integer overflows, array index errors, and memory corruption, aka "Calendar Object Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=746; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32211
CVE: CVE-2008-3479
Published: 2008-10-15
Description: Heap-based buffer overflow in the Microsoft Message Queuing (MSMQ) service (mqsvc.exe) in Microsoft Windows 2000 SP4 allows remote attackers to read memory contents and execute arbitrary code via a crafted RPC call, related to improper processing of parameters to string APIs, aka "Message Queuing Service Remote Code Execution Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://dvlabs.tippingpoint.com/advisory/TPTI-08-07; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32260
CVE: CVE-2008-4019
Published: 2008-10-15
Description: Integer overflow in the REPT function in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office SharePoint Server 2007 Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file containing a formula within a cell, aka "Formula Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-190
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32211; http://www.securityfocus.com/bid/31706
CVE: CVE-2008-4020
Published: 2008-10-15
Description: Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a "Content-Disposition: attachment" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download dialog box, aka "Vulnerability in Content-Disposition Header Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN55410403/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000070.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2
CVE: CVE-2008-4023
Published: 2008-10-15
Description: Active Directory in Microsoft Windows 2000 SP4 does not properly allocate memory for (1) LDAP and (2) LDAPS requests, which allows remote attackers to execute arbitrary code via a crafted request, aka "Active Directory Overflow Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32242; http://www.securityfocus.com/bid/31609
CVE: CVE-2008-4036
Published: 2008-10-15
Description: Integer overflow in Memory Manager in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows local users to gain privileges via a crafted application that triggers an erroneous decrement of a variable, related to validation of parameters for Virtual Address Descriptors (VADs) and a "memory allocation mapping error," aka "Virtual Address Descriptor Elevation of Privilege Vulnerability."
CVSS Score: 8.4 (HIGH)
CWE: CWE-189, CWE-190
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32251; http://www.securityfocus.com/bid/31675
CVE: CVE-2008-4038
Published: 2008-10-15
Description: Buffer underflow in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary code via a Server Message Block (SMB) request that contains a filename with a crafted length, aka "SMB Buffer Underflow Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/32249; http://www.securityfocus.com/bid/31647
CVE: CVE-2008-4569
Published: 2008-10-15
Description: SQL injection vulnerability in xlacomments.asp in XIGLA Software Absolute Poll Manager XE 4.1 allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4417; http://www.securityfocus.com/bid/31724; https://exchange.xforce.ibmcloud.com/vulnerabilities/45823
CVE: CVE-2008-4570
Published: 2008-10-15
Description: SQL injection vulnerability in index.php in Real Estate Classifieds allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32223; http://securityreason.com/securityalert/4418; http://www.securityfocus.com/bid/31723
CVE: CVE-2008-4571
Published: 2008-10-15
Description: Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev.plone.org/plone/ticket/7439; http://osvdb.org/40660; http://plone.org/products/plone/releases/3.0.4
CVE: CVE-2008-4572
Published: 2008-10-15
Description: GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments to the CWD and LIST commands, which triggers heap corruption related to an improper free call, and possibly triggering a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32218; http://securityreason.com/securityalert/4422; http://www.securityfocus.com/bid/31729
CVE: CVE-2008-4573
Published: 2008-10-15
Description: SQL injection vulnerability in kategori.asp in MunzurSoft Wep Portal W3 allows remote attackers to execute arbitrary SQL commands via the kat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32238; http://securityreason.com/securityalert/4420; http://www.securityfocus.com/bid/31713