deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6481
Published: 2009-03-17
Description: SQL injection vulnerability in the Versioning component (com_versioning) 1.0.2 in Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit task to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30050; https://exchange.xforce.ibmcloud.com/vulnerabilities/43526; https://www.exploit-db.com/exploits/5989
CVE: CVE-2009-0923
Published: 2009-03-17
Description: Unspecified vulnerability in Kerberos Incremental Propagation in Solaris 10 and OpenSolaris snv_01 through snv_110 allows remote attackers to cause a denial of service (loss of incremental propagation requests to slave KDC servers) via unknown vectors related to the master Key Distribution Center (KDC) server.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/34298; http://secunia.com/advisories/34487; http://sunsolve.sun.com/search/document.do?assetkey=1-26-249926-1
CVE: CVE-2009-0924
Published: 2009-03-17
Description: Unspecified vulnerability in Sun OpenSolaris snv_39 through snv_45, when running in 64-bit mode on x86 architectures, allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR 6442712.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/34331; http://sunsolve.sun.com/search/document.do?assetkey=1-66-254628-1; http://support.avaya.com/elmodocs2/security/ASA-2009-103.htm
CVE: CVE-2009-0925
Published: 2009-03-17
Description: Unspecified vulnerability in Sun Solaris 10 on SPARC sun4v systems, and OpenSolaris snv_47 through snv_85, allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR 6425723.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/34331; http://sunsolve.sun.com/search/document.do?assetkey=1-66-254628-1; http://support.avaya.com/elmodocs2/security/ASA-2009-103.htm
CVE: CVE-2009-0926
Published: 2009-03-17
Description: Unspecified vulnerability in the UFS filesystem functionality in Sun OpenSolaris snv_86 through snv_91, when running in 32-bit mode on x86 systems, allows local users to cause a denial of service (panic) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR 6679732.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/34331; http://sunsolve.sun.com/search/document.do?assetkey=1-66-254628-1; http://support.avaya.com/elmodocs2/security/ASA-2009-103.htm
CVE: CVE-2009-0929
Published: 2009-03-17
Description: Directory traversal vulnerability in the media manager in Nucleus CMS before 3.40 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/34180; http://www.nucleuscms.org/index.php/item/index.php/item/3051; http://www.securityfocus.com/bid/34040
CVE: CVE-2009-0930
Published: 2009-03-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 4.2.2 and 4.3.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) smime.php, (2) pgp.php, and (3) message.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cvs.horde.org/co.php/imp/docs/CHANGES?r=1.699.2.301.2.3; http://cvs.horde.org/co.php/imp/docs/CHANGES?r=1.699.2.375; http://lists.horde.org/archives/announce/2009/000484.html
CVE: CVE-2009-0931
Published: 2009-03-17
Description: Cross-site scripting (XSS) vulnerability in the tag cloud search script (horde/services/portal/cloud_search.php) in Horde before 3.2.4 and 3.3.3, and Horde Groupware before 1.1.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cvs.horde.org/co.php/groupware/docs/groupware/CHANGES?r=1.28.2.5; http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.413.2.5; http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.503
CVE: CVE-2009-0932
Published: 2009-03-17
Description: Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://cvs.horde.org/co.php/groupware/docs/groupware/CHANGES?r=1.28.2.5; http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.413.2.5; http://cvs.horde.org/co.php/horde/docs/CHANGES?r=1.515.2.503
CVE: CVE-2009-0933
Published: 2009-03-17
Description: Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dotclear.org/blog/post/2009/02/05/Dotclear-2.1.5; http://secunia.com/advisories/34181; http://www.securityfocus.com/bid/34036
CVE: CVE-2009-0934
Published: 2009-03-18
Description: Cross-site scripting (XSS) vulnerability in ejabberd before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to links and MUC logs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/52714; http://secunia.com/advisories/34340; http://secunia.com/advisories/34354
CVE: CVE-2009-0935
Published: 2009-03-18
Description: The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance, which causes the device's event list mutex to be unlocked twice and prevents proper synchronization of a data structure for the inotify instance.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]1681&w=2; http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.3; http://www.openwall.com/lists/oss-security/2009/03/06/2
CVE: CVE-2009-0936
Published: 2009-03-18
Description: Unspecified vulnerability in Tor before 0.2.0.34 allows attackers to cause a denial of service (infinite loop) via "corrupt votes."
CVSS Score: 5.0 (MEDIUM)
References: http://archives.seul.org/or/announce/Feb-2009/msg00000.html; http://secunia.com/advisories/33880; http://secunia.com/advisories/34583
CVE: CVE-2009-0937
Published: 2009-03-18
Description: Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.seul.org/or/announce/Feb-2009/msg00000.html; http://secunia.com/advisories/33880; http://secunia.com/advisories/34583
CVE: CVE-2009-0938
Published: 2009-03-18
Description: Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service (exit node crash) via "malformed input."
CVSS Score: 5.0 (MEDIUM)
References: http://archives.seul.org/or/announce/Feb-2009/msg00000.html; http://secunia.com/advisories/33880; http://secunia.com/advisories/34583
CVE: CVE-2009-0939
Published: 2009-03-18
Description: Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact and attack vectors related to "Spec conformance," as demonstrated using 192.168.0.
CVSS Score: 10.0 (HIGH)
References: http://archives.seul.org/or/announce/Feb-2009/msg00000.html; http://secunia.com/advisories/33880; http://secunia.com/advisories/34583
CVE: CVE-2007-5542
Published: 2009-03-18
Description: Stack-based buffer overflow in Miranda IM 0.6.8 allows remote attackers to execute arbitrary code via a crafted Yahoo! Messenger packet.  NOTE: this might overlap CVE-2007-5590.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/057935.html; http://packetstormsecurity.org/0710-advisories/mirandaim-overflows.txt; http://www.secureworks.com/research/threats/miranda/
CVE: CVE-2007-5543
Published: 2009-03-18
Description: Stack-based buffer overflow in Miranda IM 0.6.8 and 0.7.0 allows remote attackers to execute arbitrary code via a crafted Yahoo! Messenger packet.  NOTE: this might overlap CVE-2007-5590.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/057935.html; http://packetstormsecurity.org/0710-advisories/mirandaim-overflows.txt; http://www.secureworks.com/research/threats/miranda/
CVE: CVE-2008-4564
Published: 2009-03-18
Description: Stack-based buffer overflow in wp6sr.dll in the Autonomy KeyView SDK 10.4 and earlier, as used in IBM Lotus Notes, Symantec Mail Security (SMS) products, Symantec BrightMail Appliance products, and Symantec Data Loss Prevention (DLP) products, allows remote attackers to execute arbitrary code via a crafted Word Perfect Document (WPD) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=774; http://osvdb.org/52713; http://secunia.com/advisories/34303
CVE: CVE-2008-6482
Published: 2009-03-18
Description: PHP remote file inclusion vulnerability in admin.treeg.php in the Flash Tree Gallery (com_treeg) component 1.0 for Joomla!, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfig_live_site parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/49499; http://secunia.com/advisories/32520; http://www.securityfocus.com/bid/32041
CVE: CVE-2008-6483
Published: 2009-03-18
Description: PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_googlebase or Froogle) component 1.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/49529; http://secunia.com/advisories/32533; http://www.securityfocus.com/bid/32098
CVE: CVE-2008-6484
Published: 2009-03-18
Description: SQL injection vulnerability in login.php in Mole Group Taxi Map Script (aka Taxi Calc Dist Script) allows remote attackers to execute arbitrary SQL commands via the user field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49695; http://secunia.com/advisories/32576; http://www.securityfocus.com/bid/32140
CVE: CVE-2008-6485
Published: 2009-03-18
Description: SQL injection vulnerability in index.php in SoftComplex PHP Image Gallery allows remote attackers to execute arbitrary SQL commands via the ctg parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32182; https://exchange.xforce.ibmcloud.com/vulnerabilities/46436; https://www.exploit-db.com/exploits/7026
CVE: CVE-2008-6486
Published: 2009-03-18
Description: PHP remote file inclusion vulnerability in slideshow_uploadvideo.content.php in SharedLog, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[root_dir] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/51911; http://www.securityfocus.com/archive/1/497978/100/0/threaded; http://www.securityfocus.com/bid/32035
CVE: CVE-2008-6487
Published: 2009-03-18
Description: Multiple SQL injection vulnerabilities in login.asp in Digiappz DigiAffiliate 1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) admin and (2) password fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32217; http://www.vupen.com/english/advisories/2008/3068; https://exchange.xforce.ibmcloud.com/vulnerabilities/46500
CVE: CVE-2008-6488
Published: 2009-03-18
Description: SQL injection vulnerability in index.php in SoftComplex PHP Image Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the Admin field in a login action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32159; https://exchange.xforce.ibmcloud.com/vulnerabilities/49337; https://www.exploit-db.com/exploits/7021
CVE: CVE-2009-0538
Published: 2009-03-18
Description: Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format string specifiers in the pathname of a remote control file (aka .CHF file).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-134
References: http://osvdb.org/52797; http://secunia.com/advisories/34305; http://securityresponse.symantec.com/avcenter/security/Content/2009.03.17.html
CVE: CVE-2009-0940
Published: 2009-03-18
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566; http://osvdb.org/52847; http://osvdb.org/52848
CVE: CVE-2009-0941
Published: 2009-03-18
Description: The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders has no management password by default, which makes it easier for remote attackers to obtain access.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566; http://www.louhinetworks.fi/advisory/HP_20090317.txt; http://www.securityfocus.com/archive/1/501884/100/0/threaded
CVE: CVE-2009-0962
Published: 2009-03-19
Description: Unspecified vulnerability in Futomi's CGI Cafe MP Form Mail CGI eCommerce 1.3.0 and earlier, and CGI Professional 3.2.2 and earlier, allows remote attackers to gain administrative privileges via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN84899898/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000014.html; http://osvdb.org/52527
CVE: CVE-2008-6489
Published: 2009-03-19
Description: SQL injection vulnerability in MyAlbum component (com_myalbum) 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the album parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28496; https://exchange.xforce.ibmcloud.com/vulnerabilities/41510; https://www.exploit-db.com/exploits/5318
CVE: CVE-2008-6490
Published: 2009-03-19
Description: function/update_xml.php in FLABER 1.1 and earlier allows remote attackers to overwrite arbitrary files by specifying the target filename in the target_file parameter.  NOTE: this can be leveraged for code execution by overwriting a PHP file, as demonstrated using function/upload_file.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.vupen.com/english/advisories/2008/1163/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41715; https://www.exploit-db.com/exploits/5407
CVE: CVE-2008-6491
Published: 2009-03-19
Description: PHP remote file inclusion vulnerability in connexion.php in PHPGKit 0.9 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28526; http://www.securityfocus.com/bid/28526/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/41574
CVE: CVE-2009-0661
Published: 2009-03-19
Description: Wee Enhanced Environment for Chat (WeeChat) 0.2.6 allows remote attackers to cause a denial of service (crash) via an IRC PRIVMSG command containing crafted color codes that trigger an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519940; http://osvdb.org/52763; http://savannah.nongnu.org/bugs/index.php?25862
CVE: CVE-2009-0927
Published: 2009-03-19
Description: Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-121
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html; http://secunia.com/advisories/34490
CVE: CVE-2009-0963
Published: 2009-03-19
Description: Multiple SQL injection vulnerabilities in PHPRunner 4.2, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the SearchField parameter to (1) UserView_list.php, (2) orders_list.php, (3) users_list.php, and (4) Administrator_list.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52798; http://osvdb.org/52799; http://osvdb.org/52800
CVE: CVE-2009-0964
Published: 2009-03-19
Description: UserView_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain privileges.  NOTE: this can be leveraged with a separate SQL injection vulnerability to obtain passwords remotely without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://osvdb.org/52804; http://www.bugreport.ir/index_63.htm; http://www.securityfocus.com/archive/1/501894/100/0/threaded
CVE: CVE-2009-0965
Published: 2009-03-19
Description: SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers to execute arbitrary SQL commands via the node parameter in a browse action to gdl.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52803; http://www.securityfocus.com/bid/34144; http://www.vupen.com/english/advisories/2009/0751
CVE: CVE-2009-0966
Published: 2009-03-19
Description: PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter.  NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/52789; http://secunia.com/advisories/34325; http://www.securityfocus.com/bid/34157
CVE: CVE-2009-0967
Published: 2009-03-19
Description: The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service hang) via a large number of SMNT commands without an argument.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/34127; https://exchange.xforce.ibmcloud.com/vulnerabilities/49260; https://www.exploit-db.com/exploits/8212
CVE: CVE-2009-0968
Published: 2009-03-19
Description: SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52836; http://secunia.com/advisories/34341; http://www.securityfocus.com/bid/34147
CVE: CVE-2009-0969
Published: 2009-03-19
Description: Cross-site request forgery (CSRF) vulnerability in account/settings/account/index.php in phpFoX 1.6.21 allows remote attackers to hijack the authentication of administrators for requests that change the email address via the act[update] action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/52770; http://packetstormsecurity.org/0903-exploits/phpfox1621-xsrf.txt; http://secunia.com/advisories/34333
CVE: CVE-2009-0970
Published: 2009-03-19
Description: PHP remote file inclusion vulnerability in includes/class_image.php in PHP Pro Bid 6.05, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the fileExtension parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/34278; http://www.osvdb.org/52750; http://www.securityfocus.com/bid/34145
CVE: CVE-2009-0971
Published: 2009-03-19
Description: Cross-site scripting (XSS) vulnerability in futomi's CGI Cafe Access Analyzer CGI Standard Version 3.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN23558374/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000015.html; http://osvdb.org/52802
CVE: CVE-2008-6492
Published: 2009-03-20
Description: Unrestricted file upload vulnerability in process.php in Tizag Countdown Creator 3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via index.php, then accessing the uploaded file via a direct request to the file in pics/. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/51305; http://secunia.com/advisories/33007; http://www.securityfocus.com/bid/32661
CVE: CVE-2008-6493
Published: 2009-03-20
Description: Easy Content Management Publishing stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database/News.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/49392; https://www.exploit-db.com/exploits/7340; https://exchange.xforce.ibmcloud.com/vulnerabilities/49392
CVE: CVE-2008-6494
Published: 2009-03-20
Description: ASP User Engine.NET stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for users.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/49400; https://www.exploit-db.com/exploits/7332; https://exchange.xforce.ibmcloud.com/vulnerabilities/49400
CVE: CVE-2008-6495
Published: 2009-03-20
Description: Cross-site scripting (XSS) vulnerability in index.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 allows remote attackers to inject arbitrary web script or HTML via the album parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN55833077/index.html; http://packetstormsecurity.org/0812-exploits/yappang-xss.txt; http://secunia.com/advisories/32325
CVE: CVE-2008-6496
Published: 2009-03-20
Description: Insecure method vulnerability in the VSPDFEditorX.VSPDFEdit ActiveX control in VSPDFEditorX.ocx 1.0.200.0 in VISAGESOFT eXPert PDF EditorX allows remote attackers to create or overwrite arbitrary files via the first argument to the extractPagesToFile method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32990; http://www.securityfocus.com/bid/32664; https://exchange.xforce.ibmcloud.com/vulnerabilities/47166
CVE: CVE-2008-6497
Published: 2009-03-20
Description: The Neostrada Livebox ADSL Router allows remote attackers to cause a denial of service (network outage) via multiple HTTP requests for the /- URI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/50673; http://secunia.com/advisories/33026; http://www.securityfocus.com/archive/1/499010/100/0/threaded
CVE: CVE-2008-6498
Published: 2009-03-20
Description: Cross-site request forgery (CSRF) vulnerability in security/xamppsecurity.php in XAMPP 1.6.8 allows remote attackers to hijack the authentication of users for requests that change a certain .htaccess password via the xampppasswd parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/32134; https://exchange.xforce.ibmcloud.com/vulnerabilities/47201; https://www.exploit-db.com/exploits/7384