deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0498
Published: 2008-01-30
Description: SQL injection vulnerability in main_bigware_53.tpl.php in Bigware Shop 2.0 allows remote attackers to execute arbitrary SQL commands via the pollid parameter in a results action to main_bigware_53.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28691; http://www.securityfocus.com/bid/27489; http://www.vupen.com/english/advisories/2008/0351
CVE: CVE-2008-0499
Published: 2008-01-30
Description: SQL injection vulnerability in Mambo LaiThai 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28652; http://sourceforge.net/project/shownotes.php?group_id=192544&release_id=571300; http://www.securityfocus.com/bid/27483
CVE: CVE-2008-0500
Published: 2008-01-30
Description: Multiple unspecified vulnerabilities in Mambo LaiThai 4.5.5 have unknown impact and attack vectors related to (1) mod_login and (2) mod_template_chooser.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/28652; http://sourceforge.net/project/shownotes.php?group_id=192544&release_id=571300; http://www.securityfocus.com/bid/27483
CVE: CVE-2008-0501
Published: 2008-01-30
Description: Directory traversal vulnerability in phpMyClub 0.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page_courante parameter to the top-level URI.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/27480; http://www.vupen.com/english/advisories/2008/0350; https://exchange.xforce.ibmcloud.com/vulnerabilities/40007
CVE: CVE-2008-0064
Published: 2008-01-31
Description: Stack-based buffer overflow in Pierre-emmanuel Gougelet (1) XnView 1.91 and 1.92, (2) NConvert 4.85, and (3) libgfl280.dll in GFL SDK 2.870 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted Radiance RGBE (.hdr) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28326; http://secunia.com/advisories/28710; http://secunia.com/secunia_research/2008-1/advisory
CVE: CVE-2008-0502
Published: 2008-01-31
Description: PHP remote file inclusion vulnerability in templates/Official/part_userprofile.php in Connectix Boards 0.8.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the template_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28704; http://www.securityfocus.com/bid/27506; http://www.vupen.com/english/advisories/2008/0363
CVE: CVE-2008-0503
Published: 2008-01-31
Description: Eval injection vulnerability in admin/op/disp.php in Netwerk Smart Publisher 1.0.1 allows remote attackers to execute arbitrary PHP code via the filedata parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/28685; http://www.securityfocus.com/bid/27488; http://www.vupen.com/english/advisories/2008/0352
CVE: CVE-2008-0504
Published: 2008-01-31
Description: Multiple SQL injection vulnerabilities in Coppermine Photo Gallery (CPG) before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) albumid, (2) startpic, and (3) numpics parameters to util.php; and (4) cid_array parameter to reviewcom.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://coppermine-gallery.net/forum/index.php?topic=50103.0; http://secunia.com/advisories/28682; http://www.securityfocus.com/archive/1/487351/100/200/threaded
CVE: CVE-2008-0505
Published: 2008-01-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in docs/showdoc.php in Coppermine Photo Gallery (CPG) before 1.4.15 allow remote attackers to inject arbitrary web script or HTML via the (1) h and (2) t parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://coppermine-gallery.net/forum/index.php?topic=50103.0; http://secunia.com/advisories/28682; http://www.securityfocus.com/archive/1/487351/100/200/threaded
CVE: CVE-2008-0506
Published: 2008-01-31
Description: include/imageObjectIM.class.php in Coppermine Photo Gallery (CPG) before 1.4.15, when the ImageMagick picture processing method is configured, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) quality, (2) angle, or (3) clipval parameter to picEditor.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://coppermine-gallery.net/forum/index.php?topic=50103.0; http://secunia.com/advisories/28682; http://www.securityfocus.com/archive/1/487310/100/200/threaded
CVE: CVE-2008-0507
Published: 2008-01-31
Description: SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28708; http://www.securityfocus.com/bid/27504; http://www.vupen.com/english/advisories/2008/0364
CVE: CVE-2008-0508
Published: 2008-01-31
Description: Cross-site request forgery (CSRF) vulnerability in deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for WordPress allows remote attackers to modify the oldstructure (aka dean_pm_config[oldstructure]) configuration setting as administrators via the old_struct parameter in a deans_permalinks_migration.php action to wp-admin/options-general.php, as demonstrated by placing an XSS sequence in this setting.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://g30rg3x.com/wp-files/dpm_11gx.zip; http://g30rg3x.com/xsrf-bajo-deans-permalinks-migration-10; http://packetstorm.linuxsecurity.com/0801-advisories/deans-xsrf.txt
CVE: CVE-2008-0509
Published: 2008-01-31
Description: Multiple buffer overflows in IBM AIX 4.3 allow remote attackers to cause a denial of service (crash) or possibly gain privileges via a long argument to (1) piox25, related to piox25.c; or (2) piox25remote, related to piox25remote.sh.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/28600; http://www-1.ibm.com/support/docview.wss?uid=isg1IZ13739; http://www.securityfocus.com/bid/27510
CVE: CVE-2008-0510
Published: 2008-01-31
Description: SQL injection vulnerability in index.php in the Newsletter (com_newsletter) component for Mambo 4.5 and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27502; http://www.vupen.com/english/advisories/2008/0354; https://exchange.xforce.ibmcloud.com/vulnerabilities/40036
CVE: CVE-2008-0511
Published: 2008-01-31
Description: SQL injection vulnerability in index.php in the MaMML (com_mamml) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27503; http://www.vupen.com/english/advisories/2008/0356; https://exchange.xforce.ibmcloud.com/vulnerabilities/40037
CVE: CVE-2008-0512
Published: 2008-01-31
Description: SQL injection vulnerability in index.php in the fq (com_fq) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27501; http://www.vupen.com/english/advisories/2008/0355; https://exchange.xforce.ibmcloud.com/vulnerabilities/40035
CVE: CVE-2008-0513
Published: 2008-01-31
Description: Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to parser/parser.php, as demonstrated by a filename ending with %00.gif, a different vector than CVE-2005-1840.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/28709; http://www.securityfocus.com/archive/1/487251/100/0/threaded; http://www.securityfocus.com/archive/1/487254/100/0/threaded
CVE: CVE-2008-0514
Published: 2008-01-31
Description: SQL injection vulnerability in index.php in the Glossary (com_glossary) 2.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a display action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27505; http://www.vupen.com/english/advisories/2008/0357; https://exchange.xforce.ibmcloud.com/vulnerabilities/40038
CVE: CVE-2008-0515
Published: 2008-01-31
Description: SQL injection vulnerability in index.php in the musepoes (com_musepoes) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an answer action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27507; http://www.vupen.com/english/advisories/2008/0358; https://www.exploit-db.com/exploits/5011
CVE: CVE-2008-0516
Published: 2008-01-31
Description: PHP remote file inclusion vulnerability in spaw/dialogs/confirm.php in SQLiteManager 1.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28642; http://www.securityfocus.com/bid/27515; https://exchange.xforce.ibmcloud.com/vulnerabilities/40065
CVE: CVE-2008-0517
Published: 2008-01-31
Description: SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for Mambo 4.5.x and Joomla! allows remote attackers to execute arbitrary SQL commands via the objid parameter in a contact showObject action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27520; http://www.vupen.com/english/advisories/2008/0362; https://exchange.xforce.ibmcloud.com/vulnerabilities/40060
CVE: CVE-2008-0518
Published: 2008-01-31
Description: SQL injection vulnerability in index.php in the Recipes (com_recipes) 1.00 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27519; http://www.vupen.com/english/advisories/2008/0360; https://exchange.xforce.ibmcloud.com/vulnerabilities/40064
CVE: CVE-2008-0519
Published: 2008-01-31
Description: SQL injection vulnerability in index.php in the Atapin Jokes (com_jokes) 1.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a CatView action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27522; http://www.vupen.com/english/advisories/2008/0361; https://exchange.xforce.ibmcloud.com/vulnerabilities/40067
CVE: CVE-2008-0520
Published: 2008-01-31
Description: Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28702; http://www.securityfocus.com/bid/27525; http://www.vupen.com/english/advisories/2008/0365
CVE: CVE-2008-0521
Published: 2008-01-31
Description: Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to read arbitrary files via a .. (dot dot) in the uri parameter to dispatcher.php in (1) examples/dispatcher/framework/, (2) examples/dispatcher/, (3) examples/wizard/, and (4) PHP/, different vectors than CVE-2008-0545.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/27482; https://exchange.xforce.ibmcloud.com/vulnerabilities/40008; https://www.exploit-db.com/exploits/5001
CVE: CVE-2008-0522
Published: 2008-01-31
Description: Cross-site scripting (XSS) vulnerability in multiple Hal Networks shopping-cart products allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/28692; http://www.hal9800.com/home/bug/20080123.html
CVE: CVE-2008-0523
Published: 2008-01-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in SoftCart.exe in SoftCart 5.1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) License_Plate, (2) License_State, (3) Ticket_Date, and (4) Ticket_Number parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28675; http://www.securityfocus.com/bid/27524; https://exchange.xforce.ibmcloud.com/vulnerabilities/40061
CVE: CVE-2008-0524
Published: 2008-01-31
Description: Cross-site request forgery (CSRF) vulnerability in the management interface in multiple Yamaha RT series routers allows remote attackers to change password settings and probably other configuration settings as administrators via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/28690; http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN88575577.html
CVE: CVE-2008-0525
Published: 2008-01-31
Description: PatchLink Update client for Unix, as used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac (LUM) 6.2094 through 6.4102 and other products, allows local users to (1) truncate arbitrary files via a symlink attack on the /tmp/patchlink.tmp file used by the logtrimmer script, and (2) execute arbitrary code via a symlink attack on the /tmp/plshutdown file used by the rebootTask script.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-59
References: http://secunia.com/advisories/28657; http://secunia.com/advisories/28665; http://securityreason.com/securityalert/3599
CVE: CVE-2007-4998
Published: 2008-01-31
Description: cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlink attack using crafted directories containing multiple source files that are copied to the same destination.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://osvdb.org/43228; https://bugzilla.redhat.com/show_bug.cgi?id=356471; https://issues.rpath.com/browse/RPL-2023
CVE: CVE-2007-6695
Published: 2008-02-01
Description: Cross-site scripting (XSS) vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/41199; http://www.digitrustgroup.com/advisories/web-application-security-drake_cms.html; http://www.securityfocus.com/bid/27459
CVE: CVE-2007-6696
Published: 2008-02-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) an event description, (2) the query string to pref.php, and (3) the adv parameter to search.php.  NOTE: vector 1 requires user authentication.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://osvdb.org/41274; http://osvdb.org/41275; http://osvdb.org/41276
CVE: CVE-2007-6697
Published: 2008-02-01
Description: Buffer overflow in the LWZReadByte function in IMG_gif.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, a similar issue to CVE-2006-4484.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=207933; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1630&w=2; http://secunia.com/advisories/28640
CVE: CVE-2008-0538
Published: 2008-02-01
Description: Multiple SQL injection vulnerabilities in phpIP Management 4.3.2 allow remote attackers to execute arbitrary SQL commands via the (1) password parameter to login.php, the (2) id parameter to display.php, and unspecified other vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0513&w=2; http://secunia.com/advisories/28656; http://www.securityfocus.com/archive/1/487122/100/0/threaded
CVE: CVE-2008-0539
Published: 2008-02-01
Description: Cross-site scripting (XSS) vulnerability in dms/policy/rep_request.php in F5 BIG-IP Application Security Manager (ASM) 9.4.3 allows remote attackers to inject arbitrary web script or HTML via the report_type parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28655; http://securityreason.com/securityalert/3602; http://www.securityfocus.com/archive/1/487118/100/0/threaded
CVE: CVE-2008-0540
Published: 2008-02-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in trixbox 2.4.2.0 allow remote attackers to inject arbitrary web script or HTML via the query string to index.php in (1) user/ or (2) maint/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.digitrustgroup.com/advisories/web-application-security-trixbox.html; http://www.securityfocus.com/bid/27460; http://www.digitrustgroup.com/advisories/web-application-security-trixbox.html
CVE: CVE-2008-0541
Published: 2008-02-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in forum.php in Gerd Tentler Simple Forum 3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) open and (2) date_show parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28681; http://www.securityfocus.com/bid/27463; https://exchange.xforce.ibmcloud.com/vulnerabilities/39978
CVE: CVE-2008-0542
Published: 2008-02-01
Description: Directory traversal vulnerability in thumbnail.php in Gerd Tentler Simple Forum 3.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28681; http://www.securityfocus.com/bid/27463; https://exchange.xforce.ibmcloud.com/vulnerabilities/39980
CVE: CVE-2008-0543
Published: 2008-02-01
Description: Multiple SQL injection vulnerabilities in Pre Dynamic Institution allow remote attackers to execute arbitrary SQL commands via the (1) sloginid and (2) spass parameters to (a) login.asp and (b) siteadmin/login.asp.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28651; http://securityreason.com/securityalert/3603; http://www.securityfocus.com/archive/1/487054/100/0/threaded
CVE: CVE-2008-0544
Published: 2008-02-01
Description: Heap-based buffer overflow in the IMG_LoadLBM_RW function in IMG_lbm.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted IFF ILBM file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=207933; http://secunia.com/advisories/28640; http://secunia.com/advisories/28752
CVE: CVE-2008-0545
Published: 2008-02-01
Description: Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) uri parameter to (a) yui-menu.tpl.php, (b) simple.tpl.php, and (c) advanced.tpl.php in dispatcher/framework/; and the (2) page parameter to (d) yui-menu.php, (e) simple.php, and (f) advanced.php in dispatcher/framework/, different vectors than CVE-2008-0521.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/27466; http://www.vupen.com/english/advisories/2008/0347; https://exchange.xforce.ibmcloud.com/vulnerabilities/39969
CVE: CVE-2008-0546
Published: 2008-02-01
Description: Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the (1) idProduct and (2) options parameters to (a) ajax/ajax_optInventory.asp, or the (2) recid parameter to (b) ajax/ajax_getBrands.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28662; http://securityreason.com/securityalert/3600; http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1
CVE: CVE-2008-0547
Published: 2008-02-01
Description: Cross-site scripting (XSS) vulnerability in admin/utilities_ConfigHelp.asp in CandyPress (CP) 4.1.1.26, and probably earlier 4.x and 3.x versions, allows remote attackers to inject arbitrary web script or HTML via the helpfield parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28662; http://securityreason.com/securityalert/3600; http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1
CVE: CVE-2008-0548
Published: 2008-02-01
Description: Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large integer in the Content-Length HTTP header, which triggers a NULL dereference when malloc fails.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/steamcazz-adv.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/39927; http://aluigi.altervista.org/adv/steamcazz-adv.txt
CVE: CVE-2008-0549
Published: 2008-02-01
Description: Integer overflow in the OggHeaderParse function in Steamcast 0.9.75 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via a long Ogg tag.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/steamcazz-adv.txt; http://aluigi.org/poc/steamcazz.zip; https://exchange.xforce.ibmcloud.com/vulnerabilities/39929
CVE: CVE-2008-0550
Published: 2008-02-01
Description: Off-by-one error in Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a certain HTTP request that leads to a buffer overflow, as demonstrated by a long User-Agent header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/steamcazz-adv.txt; http://aluigi.org/poc/steamcazz.zip; https://exchange.xforce.ibmcloud.com/vulnerabilities/39928
CVE: CVE-2008-0551
Published: 2008-02-01
Description: The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 allows remote attackers to execute arbitrary code via a URL in the argument to the Install method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28649; http://www.securityfocus.com/bid/27453; http://www.securityfocus.com/bid/27580
CVE: CVE-2008-0552
Published: 2008-02-01
Description: Cross-site scripting (XSS) vulnerability in index.php in eTicket 1.5.6-RC4 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3601; http://www.lonerunners.net/users/jekil/pub/hack-eticket/hack-eticket.txt; http://www.securityfocus.com/archive/1/487133/100/0/threaded
CVE: CVE-2007-6698
Published: 2008-02-01
Description: The BDB backend for slapd in OpenLDAP before 2.3.36 allows remote authenticated users to cause a denial of service (crash) via a potentially-successful modify operation with the NOOP control set to critical, possibly due to a double free vulnerability.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html; http://secunia.com/advisories/28817