deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3837
Published: 2008-09-24
Description: Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or unspecified other drag-and-drop action, via a crafted onmousedown action that calls window.moveBy, a variant of CVE-2003-0823.
CVSS Score: 9.3 (HIGH)
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-4058
Published: 2008-09-24
Description: The XPConnect component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to (1) chrome XBL and (2) chrome JS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-4059
Published: 2008-09-24
Description: The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to a SCRIPT element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-4060
Published: 2008-09-24
Description: Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to create documents that lack script-handling objects, and execute arbitrary code with chrome privileges, via vectors related to (1) the document.loadBindingDocument function and (2) XSLT.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-4061
Published: 2008-09-24
Description: Integer overflow in the MathML component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via an mtd element with a large integer value in the rowspan attribute, related to the layout engine.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-4062
Published: 2008-09-24
Description: Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the JavaScript engine and (1) misinterpretation of the characteristics of Namespace and QName in jsxml.c, (2) misuse of signed integers in the nsEscapeCount function in nsEscape.cpp, and (3) interaction of JavaScript garbage collection with certain use of an NPObject in the nsNPObjWrapper::GetNewOrUsed function in nsJSNPRuntime.cpp.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-4063
Published: 2008-09-24
Description: Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the layout engine and (1) a zero value of the "this" variable in the nsContentList::Item function; (2) interaction of the indic IME extension, a Hindi language selection, and the "g" character; and (3) interaction of the nsFrameList::SortByContentOrder function with a certain insufficient protection of inline frames.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31987; http://secunia.com/advisories/32011
CVE: CVE-2008-4064
Published: 2008-09-24
Description: Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to graphics rendering and (1) handling of a long alert messagebox in the cairo_surface_set_device_offset function, (2) integer overflows when handling animated PNG data in the info_callback function in nsPNGDecoder.cpp, and (3) an integer overflow when handling SVG data in the nsSVGFEGaussianBlurElement::SetupPredivide function in nsSVGFilters.cpp.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31987; http://secunia.com/advisories/32011
CVE: CVE-2008-4065
Published: 2008-09-24
Description: Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from JavaScript code before execution, aka "Stripped BOM characters bug."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-4066
Published: 2008-09-24
Description: Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "jav&#56325ascript" sequence, aka "HTML escaped low surrogates bug."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogs.technet.com/bluehat/archive/2008/08/14/targeted-fuzzing.aspx; http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://jvn.jp/en/jp/JVN96950482/index.html
CVE: CVE-2008-4067
Published: 2008-09-24
Description: Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. (dot dot) and URL-encoded / (slash) characters in a resource: URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-4068
Published: 2008-09-24
Description: Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass "restrictions imposed on local HTML files," and obtain sensitive information and prompt users to write this information into a file, via directory traversal sequences in a resource: URI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-4069
Published: 2008-09-24
Description: The XBM decoder in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to read uninitialized memory, and possibly obtain sensitive information in opportunistic circumstances, via a crafted XBM image file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://download.novell.com/Download?buildid=WZXONb-tqBw~; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/31984
CVE: CVE-2008-4241
Published: 2008-09-25
Description: SQL injection vulnerability in CJ Ultra Plus 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via an SID cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4316; http://www.securityfocus.com/bid/31333; http://www.vupen.com/english/advisories/2008/2651
CVE: CVE-2008-4242
Published: 2008-09-25
Description: ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://bugs.proftpd.org/show_bug.cgi?id=3115; http://secunia.com/advisories/31930; http://secunia.com/advisories/33261
CVE: CVE-2008-4243
Published: 2008-09-25
Description: Directory traversal vulnerability in ImageServer (aka UTImageServer) in WebAdmin before 1.7 for Epic Games Unreal Tournament 3 (UT3) 1.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://aluigi.org/adv/ut3webown-adv.txt; http://secunia.com/advisories/31926; http://securityreason.com/securityalert/4317
CVE: CVE-2008-4244
Published: 2008-09-25
Description: Rianxosencabos CMS 0.9 allows remote attackers to bypass authentication and gain administrative access by setting the usuario and pass cookies to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/4312; http://www.securityfocus.com/bid/31292; https://exchange.xforce.ibmcloud.com/vulnerabilities/45291
CVE: CVE-2008-4245
Published: 2008-09-25
Description: The Admin Control Panel in Rianxosencabos CMS 0.9 does not require administrator privileges, which allows remote authenticated users to (1) change a user's privileges, (2) delete a user account, or perform unspecified other administrative actions via vectors involving an admin lista action to the default URI, possibly related to useradmin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://securityreason.com/securityalert/4311; http://www.securityfocus.com/bid/31296; https://exchange.xforce.ibmcloud.com/vulnerabilities/45290
CVE: CVE-2008-4246
Published: 2008-09-25
Description: Unspecified vulnerability in Denora IRC Stats Server before 1.4.1 allows remote IRC servers to cause a denial of service (application crash) via a crafted CTCP response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://denorastats.org/?p=home; http://dev.denorastats.org/news/show/4; http://www.securityfocus.com/bid/31233
CVE: CVE-2008-4247
Published: 2008-09-25
Description: ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc; http://bugs.proftpd.org/show_bug.cgi?id=3115; http://secunia.com/advisories/32068
CVE: CVE-2008-2739
Published: 2008-09-26
Description: The SERVICE.DNS signature engine in the Intrusion Prevention System (IPS) in Cisco IOS 12.3 and 12.4 allows remote attackers to cause a denial of service (device crash or hang) via network traffic that triggers unspecified IPS signatures, a different vulnerability than CVE-2008-1447.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a01556.shtml; http://www.vupen.com/english/advisories/2008/2670
CVE: CVE-2008-3637
Published: 2008-09-26
Description: The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11, 10.5.4, and 10.5.5 uses an uninitialized variable, which allows remote attackers to execute arbitrary code via a crafted applet, related to an "error checking issue."
CVSS Score: 8.8 (HIGH)
CWE: CWE-665
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html; http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://secunia.com/advisories/32018
CVE: CVE-2008-3638
Published: 2008-09-26
Description: Java on Apple Mac OS X 10.5.4 and 10.5.5 does not prevent applets from accessing file:// URLs, which allows remote attackers to execute arbitrary programs.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html; http://secunia.com/advisories/32018; http://support.apple.com/kb/HT3179
CVE: CVE-2008-3798
Published: 2008-09-26
Description: Cisco IOS 12.4 allows remote attackers to cause a denial of service (device crash) via a normal, properly formed SSL packet that occurs during termination of an SSL session.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a0146c.shtml; http://www.securitytracker.com/id?1020930
CVE: CVE-2008-3799
Published: 2008-09-26
Description: Memory leak in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service (memory consumption and voice-service outage) via unspecified valid SIP messages.
CVSS Score: 7.8 (HIGH)
CWE: CWE-772
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a01562.shtml; http://www.securitytracker.com/id?1020939
CVE: CVE-2008-3800
Published: 2008-09-26
Description: Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service (device or process reload) via unspecified valid SIP messages, aka Cisco Bug ID CSCsu38644, a different vulnerability than CVE-2008-3801 and CVE-2008-3802.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/31990; http://secunia.com/advisories/32013; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a01562.shtml
CVE: CVE-2008-3801
Published: 2008-09-26
Description: Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service (device or process reload) via unspecified valid SIP messages, aka Cisco Bug ID CSCsm46064, a different vulnerability than CVE-2008-3800 and CVE-2008-3802.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/31990; http://secunia.com/advisories/32013; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a01562.shtml
CVE: CVE-2008-3802
Published: 2008-09-26
Description: Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service (device reload) via unspecified valid SIP messages, aka Cisco bug ID CSCsk42759, a different vulnerability than CVE-2008-3800 and CVE-2008-3801.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a01562.shtml; http://www.securitytracker.com/id?1020939
CVE: CVE-2008-3803
Published: 2008-09-26
Description: A "logic error" in Cisco IOS 12.0 through 12.4, when a Multiprotocol Label Switching (MPLS) VPN with extended communities is configured, sometimes causes a corrupted route target (RT) to be used, which allows remote attackers to read traffic from other VPNs in opportunistic circumstances.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a014a9.shtml; http://www.securityfocus.com/bid/31366
CVE: CVE-2008-3804
Published: 2008-09-26
Description: Unspecified vulnerability in the Multi Protocol Label Switching (MPLS) Forwarding Infrastructure (MFI) in Cisco IOS 12.2 and 12.4 allows remote attackers to cause a denial of service (memory corruption) via crafted packets for which the software path is used.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a014ac.shtml; http://www.securitytracker.com/id?1020934
CVE: CVE-2008-3805
Published: 2008-09-26
Description: Cisco IOS 12.0 through 12.4 on Cisco 10000, uBR10012 and uBR7200 series devices handles external UDP packets that are sent to 127.0.0.0/8 addresses intended for IPC communication within the device, which allows remote attackers to cause a denial of service (device or linecard reload) via crafted UDP packets, a different vulnerability than CVE-2008-3806.
CVSS Score: 8.5 (HIGH)
References: http://secunia.com/advisories/31990; http://tools.cisco.com/security/center/viewAlert.x?alertId=16646; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a014ae.shtml
CVE: CVE-2008-3806
Published: 2008-09-26
Description: Cisco IOS 12.0 through 12.4 on Cisco 10000, uBR10012 and uBR7200 series devices handles external UDP packets that are sent to 127.0.0.0/8 addresses intended for IPC communication within the device, which allows remote attackers to cause a denial of service (device or linecard reload) via crafted UDP packets, a different vulnerability than CVE-2008-3805.
CVSS Score: 8.5 (HIGH)
References: http://secunia.com/advisories/31990; http://tools.cisco.com/security/center/viewAlert.x?alertId=16646; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a014ae.shtml
CVE: CVE-2008-3807
Published: 2008-09-26
Description: Cisco IOS 12.2 and 12.3 on Cisco uBR10012 series devices, when linecard redundancy is configured, enables a read/write SNMP service with "private" as the community, which allows remote attackers to obtain administrative access by guessing this community and sending SNMP requests.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a014b1.shtml; http://www.securitytracker.com/id?1020941
CVE: CVE-2008-3808
Published: 2008-09-26
Description: Unspecified vulnerability in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (device reload) via a crafted Protocol Independent Multicast (PIM) packet.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a01491.shtml; http://www.securityfocus.com/bid/31356
CVE: CVE-2008-3809
Published: 2008-09-26
Description: Cisco IOS 12.0 through 12.4 on Gigabit Switch Router (GSR) devices (aka 12000 Series routers) allows remote attackers to cause a denial of service (device crash) via a malformed Protocol Independent Multicast (PIM) packet.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/31990; http://tools.cisco.com/security/center/viewAlert.x?alertId=16638; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a01491.shtml
CVE: CVE-2008-3810
Published: 2008-09-26
Description: Cisco IOS 12.2 and 12.4, when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled, allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages, aka CSCsg22426, a different vulnerability than CVE-2008-3811.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a0148e.shtml; http://www.securityfocus.com/bid/31359
CVE: CVE-2008-3811
Published: 2008-09-26
Description: Cisco IOS 12.2 and 12.4, when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled, allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages, aka Cisco Bug ID CSCsi17020, a different vulnerability than CVE-2008-3810.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a0148e.shtml; http://www.securityfocus.com/bid/31359
CVE: CVE-2008-3812
Published: 2008-09-26
Description: Cisco IOS 12.4, when IOS firewall Application Inspection Control (AIC) with HTTP Deep Packet Inspection is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed HTTP transit packet.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/31990; http://tools.cisco.com/security/center/viewAlert.x?alertId=16661; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a01545.shtml
CVE: CVE-2008-3813
Published: 2008-09-26
Description: Unspecified vulnerability in Cisco IOS 12.2 and 12.4, when the L2TP mgmt daemon process is enabled, allows remote attackers to cause a denial of service (device reload) via a crafted L2TP packet.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/31990; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a0157a.shtml; http://www.securitytracker.com/id?1020938
CVE: CVE-2008-3528
Published: 2008-09-27
Description: The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a denial of service (temporary system hang) by mounting a filesystem that has corrupted dir->i_size and dir->i_blocks values and performing (a) read or (b) write operations.  NOTE: there are limited scenarios in which this crosses privilege boundaries.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html
CVE: CVE-2008-4070
Published: 2008-09-27
Description: Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html; http://secunia.com/advisories/32010; http://secunia.com/advisories/32025
CVE: CVE-2008-4119
Published: 2008-09-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in CA Service Desk 11.2 and CMDB 11.0 through 11.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "multiple web forms."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2008/09/25.aspx; http://secunia.com/advisories/32038; http://securityreason.com/securityalert/4318
CVE: CVE-2008-4195
Published: 2008-09-27
Description: Opera before 9.52 does not properly restrict the ability of a framed web page to change the address associated with a different frame, which allows remote attackers to trigger the display of an arbitrary address in a frame via unspecified use of web script.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/31549; http://secunia.com/advisories/32538; http://security.gentoo.org/glsa/glsa-200811-01.xml