deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4500
Published: 2008-10-09
Description: Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted stou command, probably related to MS-DOS device names, as demonstrated using "con:1".
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/32150; http://securityreason.com/securityalert/4377; http://www.securityfocus.com/bid/31556
CVE: CVE-2008-4501
Published: 2008-10-09
Description: Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to overwrite or create arbitrary files via a ..\ (dot dot backslash) in the RNTO command.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32150; http://securityreason.com/securityalert/4378; http://www.vupen.com/english/advisories/2008/2746
CVE: CVE-2008-4502
Published: 2008-10-09
Description: Multiple PHP remote file inclusion vulnerabilities in DataFeedFile (DFF) PHP Framework API allow remote attackers to execute arbitrary PHP code via a URL in the DFF_config[dir_include] parameter to (1) DFF_affiliate_client_API.php, (2) DFF_featured_prdt.func.php, (3) DFF_mer.func.php, (4) DFF_mer_prdt.func.php, (5) DFF_paging.func.php, (6) DFF_rss.func.php, and (7) DFF_sku.func.php in include/.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32166; http://securityreason.com/securityalert/4370; http://www.securityfocus.com/bid/31644
CVE: CVE-2008-4503
Published: 2008-10-09
Description: The Settings Manager in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to cause victims to unknowingly click on a link or dialog via access control dialogs disguised as normal graphical elements, as demonstrated by hijacking the camera or microphone, and related to "clickjacking."
CVSS Score: 6.8 (MEDIUM)
References: http://blog.guya.net/2008/10/07/malicious-camera-spying-using-clickjacking/; http://ha.ckers.org/blog/20081007/clickjacking-details/; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
CVE: CVE-2008-4504
Published: 2008-10-09
Description: Heap-based buffer overflow in Mplayer.exe in Herosoft Inc. Hero DVD Player 3.0.8 allows user-assisted remote attackers to execute arbitrary code via an M3u file with a "long entry." NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/31933; http://www.securityfocus.com/bid/31627; https://exchange.xforce.ibmcloud.com/vulnerabilities/45724
CVE: CVE-2008-4505
Published: 2008-10-09
Description: Unspecified vulnerability in IBM Lotus Quickr 8.1 before Fix pack 1 (8.1.0.1) might allow attackers to cause a denial of service (system crash) via a "nonstandard URL argument" to the OpenDocument command. NOTE: due to lack of details from the vendor, it is not clear whether this is a vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/32098; http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www.securityfocus.com/bid/31608
CVE: CVE-2008-4506
Published: 2008-10-09
Description: Unspecified vulnerability in IBM Lotus Quickr 8.1 before Fix pack 1 (8.1.0.1) allows a place manager to "demote or delete a place superuser group" via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32098; http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www.securityfocus.com/bid/31608
CVE: CVE-2008-4507
Published: 2008-10-09
Description: Unspecified vulnerability in IBM Lotus Quickr 8.1 before Fix pack 1 (8.1.0.1) allows editors to delete pages that were created by a different author via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32098; http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www.securityfocus.com/bid/31608
CVE: CVE-2008-4508
Published: 2008-10-09
Description: Stack-based buffer overflow in the file parsing function in Tonec Internet Download Manager, possibly 5.14 and earlier, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted AppleDouble file containing a long string.  NOTE: this is probably a different vulnerability than CVE-2005-2210.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://downloads.securityfocus.com/vulnerabilities/exploits/31603.pl; http://www.securityfocus.com/bid/31603; https://exchange.xforce.ibmcloud.com/vulnerabilities/45711
CVE: CVE-2008-4509
Published: 2008-10-09
Description: Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the root directory.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4379; http://www.securityfocus.com/bid/31574; https://exchange.xforce.ibmcloud.com/vulnerabilities/45683
CVE: CVE-2008-4510
Published: 2008-10-09
Description: Microsoft Windows Vista Home and Ultimate Edition SP1 and earlier allows local users to cause a denial of service (page fault and system crash) via multiple attempts to access a virtual address in a PAGE_NOACCESS memory page.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32115; http://securityreason.com/securityalert/4388; http://www.securityfocus.com/bid/31570
CVE: CVE-2008-4511
Published: 2008-10-09
Description: Todd Woolums ASP News Management, possibly 2.21, stores db/news.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://securityreason.com/securityalert/4380; http://www.securityfocus.com/archive/1/496787/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/45838
CVE: CVE-2008-4512
Published: 2008-10-09
Description: ASP/MS Access Shoutbox, probably 1.1 beta, stores db/shoutdb.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://securityreason.com/securityalert/4395; http://www.securityfocus.com/archive/1/496789/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/45837
CVE: CVE-2008-4513
Published: 2008-10-09
Description: Cross-site scripting (XSS) vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://nulledcore.com/?p=126; http://secunia.com/advisories/32225; http://trac.phorum.org/changeset/3528
CVE: CVE-2008-4514
Published: 2008-10-09
Description: The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via a font tag with a long color value, which triggers an assertion error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/4394; http://www.securityfocus.com/bid/31605; https://www.exploit-db.com/exploits/6689
CVE: CVE-2008-4515
Published: 2008-10-09
Description: Blue Coat K9 Web Protection 4.0.230 Beta relies on client-side JavaScript as a protection mechanism, which allows remote attackers to bypass authentication and access the (1) summary, (2) detail, (3) overrides, and (4) pwemail pages by disabling JavaScript.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://dicas3000.blogspot.com/2008/10/blue-coat-k9-web-protection-v40230-beta.html; http://seclists.org/fulldisclosure/2008/Oct/0070.html; http://www.securityfocus.com/bid/31584
CVE: CVE-2008-4516
Published: 2008-10-09
Description: SQL injection vulnerability in galerie.php in Galerie 3.2 allows remote attackers to execute arbitrary SQL commands via the pic parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4381; http://www.securityfocus.com/bid/31593; https://exchange.xforce.ibmcloud.com/vulnerabilities/45698
CVE: CVE-2008-4517
Published: 2008-10-09
Description: SQL injection vulnerability in leggi.php in geccBBlite 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4382; http://www.securityfocus.com/bid/31585; https://exchange.xforce.ibmcloud.com/vulnerabilities/45682
CVE: CVE-2008-4518
Published: 2008-10-09
Description: Multiple SQL injection vulnerabilities in Fastpublish CMS 1.9.9.9.9 d (1.9999 d) allow remote attackers to execute arbitrary SQL commands via the (1) sprache parameter to index2.php and the (2) artikel parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32126; http://securityreason.com/securityalert/4383; http://www.securityfocus.com/bid/31582
CVE: CVE-2008-4519
Published: 2008-10-09
Description: Multiple directory traversal vulnerabilities in Fastpublish CMS 1.9999 d allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the target parameter to (1) index2.php and (2) index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32126; http://securityreason.com/securityalert/4383; http://www.securityfocus.com/bid/31582
CVE: CVE-2008-4520
Published: 2008-10-09
Description: Cross-site scripting (XSS) vulnerability in bulk_update.pl in AutoNessus before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the remark parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://autonessus.cvs.sourceforge.net/viewvc/autonessus/AutoNessus/www/bulk_update.pl?r1=1.2&r2=1.3; http://secunia.com/advisories/32046; http://sourceforge.net/project/shownotes.php?group_id=216367&release_id=630124
CVE: CVE-2008-4521
Published: 2008-10-09
Description: SQL injection vulnerability in thisraidprogress.php in the World of Warcraft tracker infusion (raidtracker_panel) module 2.0 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the INFO_RAID_ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4384; http://www.securityfocus.com/bid/31579; https://exchange.xforce.ibmcloud.com/vulnerabilities/45675
CVE: CVE-2008-4522
Published: 2008-10-09
Description: Multiple directory traversal vulnerabilities in JMweb MP3 Music Audio Search and Download Script allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the src parameter to (1) listen.php and (2) download.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32141; http://securityreason.com/securityalert/4386; http://www.securityfocus.com/bid/31573
CVE: CVE-2008-4523
Published: 2008-10-09
Description: SQL injection vulnerability in login.php in IP Reg 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the user_name parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4389; http://www.securityfocus.com/bid/31561; https://exchange.xforce.ibmcloud.com/vulnerabilities/45641
CVE: CVE-2008-4524
Published: 2008-10-09
Description: SQL injection vulnerability in the "Check User" feature (includes/check_user.php) in AdaptCMS Lite and AdaptCMS Pro 1.3 allows remote attackers to execute arbitrary SQL commands via the user_name parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32171; http://securityreason.com/securityalert/4392; http://www.adaptcms.com/article/51/News/URGENT-AdaptCMS-13-Security-Fix-Released/
CVE: CVE-2008-4525
Published: 2008-10-09
Description: SQL injection vulnerability in index.php in AmpJuke 0.7.5 allows remote attackers to execute arbitrary SQL commands via the special parameter in a performerid action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0810-exploits/ampjuke-sql.txt; http://secunia.com/advisories/32168; http://www.securityfocus.com/bid/31592
CVE: CVE-2008-4526
Published: 2008-10-09
Description: Multiple directory traversal vulnerabilities in CCMS 3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter to (1) index.php, (2) forums.php, (3) admin.php, (4) header.php, (5) pages/story.php and (6) pages/poll.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4387; http://www.securityfocus.com/bid/31566; https://www.exploit-db.com/exploits/6663
CVE: CVE-2008-4527
Published: 2008-10-09
Description: SQL injection vulnerability in recept.php in the Recepies (Recept) module 1.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the kat_id parameter in a kategorier action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32004; http://securityreason.com/securityalert/4385; http://www.securityfocus.com/bid/31578
CVE: CVE-2008-4528
Published: 2008-10-09
Description: Directory traversal vulnerability in notes.php in Phlatline's Personal Information Manager (pPIM) 1.01 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter in an edit action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4390; http://www.securityfocus.com/bid/31571; https://exchange.xforce.ibmcloud.com/vulnerabilities/45681
CVE: CVE-2008-4529
Published: 2008-10-09
Description: Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP code via a URL in the _ENV[asicms][path] parameter to (1) Association.php, (2) BigMath.php, (3) DiffieHellman.php, (4) DumbStore.php, (5) Extension.php, (6) FileStore.php, (7) HMAC.php, (8) MemcachedStore.php, (9) Message.php, (10) Nonce.php, (11) SQLStore.php, (12) SReg.php, (13) TrustRoot.php, and (14) URINorm.php in classes/Auth/OpenID/; and (15) XRDS.php, (16) XRI.php and (17) XRIRes.php in classes/Auth/Yadis/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4391; http://www.securityfocus.com/bid/31601; http://www.vupen.com/english/advisories/2008/2755
CVE: CVE-2008-4530
Published: 2008-10-09
Description: Cross-site scripting (XSS) vulnerability in Brilliant Gallery 5.x before 5.x-4.2, a module for Drupal, allows remote authenticated users with permissions to inject arbitrary web script or HTML via unspecified vectors related to posting of answers.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/315919; http://secunia.com/advisories/32106; http://www.securityfocus.com/bid/31554
CVE: CVE-2008-4531
Published: 2008-10-09
Description: SQL injection vulnerability in Brilliant Gallery 5.x before 5.x-4.2, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to queries.  NOTE: this might be the same issue as CVE-2008-4338.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/315919; http://secunia.com/advisories/32106; http://www.securityfocus.com/bid/31554
CVE: CVE-2008-4532
Published: 2008-10-09
Description: Cross-site scripting (XSS) vulnerability in index.php in MaxiScript Website Directory allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32176; http://securityreason.com/securityalert/4393; http://www.securityfocus.com/archive/1/496967/100/0/threaded
CVE: CVE-2008-3432
Published: 2008-10-10
Description: Heap-based buffer overflow in the mch_expand_wildcards function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames, as demonstrated by the netrw.v3 test case.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: ftp://ftp.vim.org/pub/vim/patches/6.2.429; ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.059; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
CVE: CVE-2008-3641
Published: 2008-10-10
Description: The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
CVE: CVE-2008-3642
Published: 2008-10-10
Description: Buffer overflow in ColorSync in Mac OS X 10.4.11 and 10.5.5 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via an image with a crafted ICC profile.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://secunia.com/advisories/32222
CVE: CVE-2008-3643
Published: 2008-10-10
Description: Unspecified vulnerability in Finder in Mac OS X 10.5.5 allows user-assisted attackers to cause a denial of service (continuous termination and restart) via a crafted Desktop file that generates an error when producing its icon, related to an "error recovery issue."
CVSS Score: 7.8 (HIGH)
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://secunia.com/advisories/32222; http://support.apple.com/kb/HT3216
CVE: CVE-2008-3645
Published: 2008-10-10
Description: Heap-based buffer overflow in the local IPC component in the EAPOLController plugin for configd (Networking component) in Mac OS X 10.4.11 and 10.5.5 allows local users to execute arbitrary code via unknown vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://secunia.com/advisories/32222; http://support.apple.com/kb/HT3216
CVE: CVE-2008-3646
Published: 2008-10-10
Description: The Postfix configuration file in Mac OS X 10.5.5 causes Postfix to be network-accessible when mail is sent from a local command-line tool, which allows remote attackers to send mail to local Mac OS X users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://secunia.com/advisories/32222; http://support.apple.com/kb/HT3216
CVE: CVE-2008-3647
Published: 2008-10-10
Description: Buffer overflow in PSNormalizer in Mac OS X 10.4.11 and 10.5.5 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a PostScript file with a crafted bounding box comment.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://secunia.com/advisories/32222; http://support.apple.com/kb/HT3216
CVE: CVE-2008-4211
Published: 2008-10-10
Description: Integer signedness error in (1) QuickLook in Apple Mac OS X 10.5.5 and (2) Office Viewer in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted Microsoft Excel file that triggers an out-of-bounds memory access, related to "handling of columns."
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2008/Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://secunia.com/advisories/32222
CVE: CVE-2008-4212
Published: 2008-10-10
Description: Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in documentation, which might allow remote attackers to bypass intended access restrictions.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://secunia.com/advisories/32222; http://support.apple.com/kb/HT3216
CVE: CVE-2008-4214
Published: 2008-10-10
Description: Unspecified vulnerability in Script Editor in Mac OS X 10.4.11 and 10.5.5 allows local users to cause the scripting dictionary to be written to arbitrary locations, related to an "insecure file operation" on temporary files.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://secunia.com/advisories/32222; http://support.apple.com/kb/HT3216
CVE: CVE-2008-4215
Published: 2008-10-10
Description: Weblog in Mac OS X Server 10.4.11 does not properly check an error condition when a weblog posting access control list is specified for a user that has multiple short names, which might allow attackers to bypass intended access restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://secunia.com/advisories/32222; http://support.apple.com/kb/HT3216
CVE: CVE-2008-4394
Published: 2008-10-10
Description: Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the current working directory in the Python search path, which allows local users to execute arbitrary code via a modified Python module that is loaded by the (1) ys-apps/portage, (2) net-mail/fetchmail, (3) app-editors/leo ebuilds, and other ebuilds.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/32228; http://security.gentoo.org/glsa/glsa-200810-02.xml; http://www.securityfocus.com/bid/31670
CVE: CVE-2008-4533
Published: 2008-10-10
Description: Cross-site scripting (XSS) vulnerability in Kantan WEB Server 1.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN94163107/index.html; http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000060.html; http://secunia.com/advisories/31917
CVE: CVE-2008-4534
Published: 2008-10-10
Description: SQL injection vulnerability in EC-CUBE Ver2 2.1.2a and earlier, and Ver2 RC 2.3.0-rc1 and earlier, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN81111541/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000065.html; http://secunia.com/advisories/32065
CVE: CVE-2008-4535
Published: 2008-10-10
Description: Cross-site scripting (XSS) vulnerability in EC-CUBE Ver2 2.1.2a and earlier, EC-CUBE Ver2 Beta(RC) 2.2.0-beta and earlier, and EC-CUBE Community Edition Nighly-Build r17623 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2008-4536 and CVE-2008-4537.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN99916563/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000064.html; http://secunia.com/advisories/32065
CVE: CVE-2008-4536
Published: 2008-10-10
Description: Cross-site scripting (XSS) vulnerability in EC-CUBE Ver1 1.4.6 and earlier, Ver1 Beta 1.5.0-beta and earlier, Ver2 2.1.2a and earlier, Ver2 Beta(RC) 2.2.0-beta and earlier, Community Edition 1.3.4 and earlier, and Community Edition Nightly-Build r17319 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2008-4535 and CVE-2008-4537.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN36085487/index.html; http://secunia.com/advisories/32065; http://www.ec-cube.net/release/detail.php?release_id=193