deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4760
Published: 2008-10-28
Description: SQL injection vulnerability in lecture.php in Graphiks MyForum 1.3, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4519; http://www.securityfocus.com/bid/31926; http://www.vupen.com/english/advisories/2008/2921
CVE: CVE-2008-4761
Published: 2008-10-28
Description: Cross-site scripting (XSS) vulnerability in includes/htmlArea/plugins/HtmlTidy/html-tidy-logic.php in Kayako eSupport 3.20.2 allows remote attackers to inject arbitrary web script or HTML via the jsMakeSrc parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this issue is probably in the HTMLArea HTMLTidy (HTML Tidy) plugin, not eSupport.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/31908.html; http://www.openwall.com/lists/oss-security/2008/10/27/6; http://www.securityfocus.com/bid/31908
CVE: CVE-2008-4762
Published: 2008-10-28
Description: Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service crash) and potentially execute arbitrary code via a long argument to the (1) rename and (2) realpath parameters.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32366; http://securityreason.com/securityalert/4515; http://www.securityfocus.com/archive/1/497746/100/0/threaded
CVE: CVE-2008-4763
Published: 2008-10-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in sample.php in WiKID wClient-PHP 3.0-2 and earlier allow remote attackers to inject arbitrary web script or HTML via the PHP_SELF variable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4514; http://www.securityfocus.com/archive/1/490768/100/0/threaded; http://www.securityfocus.com/bid/28740
CVE: CVE-2008-4764
Published: 2008-10-28
Description: Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter in a show_error action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28764; https://exchange.xforce.ibmcloud.com/vulnerabilities/41873; https://www.exploit-db.com/exploits/5435
CVE: CVE-2008-4765
Published: 2008-10-28
Description: SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbitrary SQL commands via the pollID parameter in a results operation.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0804-exploits/pollbooth20-sql.txt; http://www.securityfocus.com/bid/28752; https://exchange.xforce.ibmcloud.com/vulnerabilities/41796
CVE: CVE-2008-4766
Published: 2008-10-28
Description: SQL injection vulnerability in member.php in Oxygen Bulletin Board 1.1.3 allows remote attackers to execute arbitrary SQL commands via the member parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28651; http://www.securityfocus.com/bid/28651/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/41703
CVE: CVE-2008-4767
Published: 2008-10-28
Description: Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitrary code by uploading a file with (1) .htm, (2) .html, or (3) .txt extensions, then accessing it via a direct request to the file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: it is unclear how allowing the upload of .html or .txt files supports arbitrary code execution; this might be legitimate functionality.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://www.juniper.net/security/auto/vulnerabilities/vuln28919.html; http://www.securityfocus.com/bid/28919; https://exchange.xforce.ibmcloud.com/vulnerabilities/42007
CVE: CVE-2008-4768
Published: 2008-10-28
Description: SQL injection vulnerability in TLM CMS 3.1 allows remote attackers to execute arbitrary SQL commands via the nom parameter to a-b-membres.php.  NOTE: the goodies.php vector is already covered by CVE-2007-4808.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28837; http://www.securityfocus.com/bid/28837/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/41923
CVE: CVE-2008-4769
Published: 2008-10-28
Description: Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/29949; http://trac.wordpress.org/changeset/7586; http://www.debian.org/security/2009/dsa-1871
CVE: CVE-2008-4771
Published: 2008-10-28
Description: Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 and 1.0.0.51), (2) D-Link MPEG4 SHM Audio Control (VAPGDecoder.dll 1.7.0.5), (3) Vivotek RTSP MPEG4 SP Control (RtspVapgDecoderNew.dll 2.0.0.39), and possibly other products, allows remote attackers to execute arbitrary code via a long Url property.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/42378; http://osvdb.org/43007; http://secunia.com/advisories/29131
CVE: CVE-2008-4772
Published: 2008-10-28
Description: SQL injection vulnerability in main/main.php in QuestCMS allows remote attackers to execute arbitrary SQL commands via the obj parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4523; http://www.securityfocus.com/bid/31945; https://exchange.xforce.ibmcloud.com/vulnerabilities/46150
CVE: CVE-2008-4773
Published: 2008-10-28
Description: Directory traversal vulnerability in main/main.php in QuestCMS allows remote attackers to read arbitrary local files via a .. (dot dot) in the theme parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4523; http://www.securityfocus.com/bid/31945; https://exchange.xforce.ibmcloud.com/vulnerabilities/46151
CVE: CVE-2008-4774
Published: 2008-10-28
Description: Cross-site scripting (XSS) vulnerability in main/main.php in QuestCMS allows remote attackers to inject arbitrary web script or HTML via the cx parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4523; http://www.securityfocus.com/bid/31945; https://exchange.xforce.ibmcloud.com/vulnerabilities/46149
CVE: CVE-2008-4775
Published: 2008-10-28
Description: Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/32449; http://secunia.com/advisories/32482; http://security.gentoo.org/glsa/glsa-200903-32.xml
CVE: CVE-2008-4776
Published: 2008-10-28
Description: libgadu before 1.8.2 allows remote servers to cause a denial of service (crash) via a contact description with a large length, which triggers a buffer over-read.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html; http://lists.ziew.org/pipermail/libgadu-devel/2008-October/000331.html; http://www.debian.org/security/2008/dsa-1664
CVE: CVE-2008-4777
Published: 2008-10-29
Description: SQL injection vulnerability in the Showroom Joomlearn LMS (com_lms) component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the cat parameter in a showTests task.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2008-04/0031.html; http://www.securityfocus.com/archive/1/490410/100/0/threaded; http://www.securityfocus.com/bid/28586
CVE: CVE-2008-4778
Published: 2008-10-29
Description: SQL injection vulnerability in the gallery module in Koobi CMS 4.3.0 allows remote attackers to execute arbitrary SQL commands via the galid parameter in a showimages action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4525; http://www.securityfocus.com/archive/1/490886/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/46254
CVE: CVE-2008-4779
Published: 2008-10-29
Description: Stack-based buffer overflow in TUGzip 3.5.0.0 allows remote attackers to denial of service (crash) or execute arbitrary code via a long filename in a .zip file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32411; http://securityreason.com/securityalert/4528; http://www.securityfocus.com/bid/31913
CVE: CVE-2008-4780
Published: 2008-10-29
Description: Directory traversal vulnerability in admin/centre.php in MyForum 1.3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the padmin parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4522; http://www.securityfocus.com/bid/31934; http://www.vupen.com/english/advisories/2008/2938
CVE: CVE-2008-4781
Published: 2008-10-29
Description: Directory traversal vulnerability in update.php in MyKtools 2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32432; http://securityreason.com/securityalert/4526; http://www.securityfocus.com/bid/31942
CVE: CVE-2008-4782
Published: 2008-10-29
Description: SQL injection vulnerability in public/code/cp_polls_results.php in All In One Control Panel (AIOCP) 1.4 allows remote attackers to execute arbitrary SQL commands via the poll_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32431; http://securityreason.com/securityalert/4518; https://www.exploit-db.com/exploits/6854
CVE: CVE-2008-4783
Published: 2008-10-29
Description: tlAds 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tlAds_login cookie to "admin."
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32427; http://securityreason.com/securityalert/4529; http://www.securityfocus.com/bid/31939
CVE: CVE-2008-4784
Published: 2008-10-29
Description: aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog_auth_a cookie to "A" or "O" in (1) edit_delete.php, (2) edit_cat.php, (3) edit_lock.php, and (4) edit_form.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/4524; http://www.securityfocus.com/bid/31894; https://exchange.xforce.ibmcloud.com/vulnerabilities/46083
CVE: CVE-2008-4785
Published: 2008-10-29
Description: SQL injection vulnerability in newuser.php in the alternate_profiles plugin, possibly 0.2, for e107 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4530; http://www.securityfocus.com/bid/31940; http://www.vupen.com/english/advisories/2008/2940
CVE: CVE-2008-4786
Published: 2008-10-29
Description: SQL injection vulnerability in easyshop.php in the EasyShop plugin for e107 allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4531; http://www.securityfocus.com/bid/31948; https://exchange.xforce.ibmcloud.com/vulnerabilities/46147
CVE: CVE-2008-4787
Published: 2008-10-29
Description: Visual truncation vulnerability in Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar via a URL with a hostname containing many &nbsp; (Non-Blocking Space character) sequences, which are rendered as whitespace, aka MSRC ticket MSRC7899, a related issue to CVE-2003-1025.
CVSS Score: 5.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/497825/100/0/threaded; http://www.securityfocus.com/archive/1/497827/100/0/threaded; http://www.securityfocus.com/bid/31960
CVE: CVE-2008-4788
Published: 2008-10-29
Description: Microsoft Internet Explorer 6 omits high-bit URL-encoded characters when displaying the address bar, which allows remote attackers to spoof the address bar via a URL with a domain name that differs from an important domain name only in these characters, as demonstrated by using exam%A9ple.com to spoof example.com, aka MSRC ticket MSRC7900.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/497825/100/0/threaded; http://www.securityfocus.com/archive/1/497827/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/46235
CVE: CVE-2008-4789
Published: 2008-10-29
Description: The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error."
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/318706; http://secunia.com/advisories/32198; http://www.openwall.com/lists/oss-security/2008/10/21/7
CVE: CVE-2008-4790
Published: 2008-10-29
Description: The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/318706; http://secunia.com/advisories/32198; http://secunia.com/advisories/32200
CVE: CVE-2008-4791
Published: 2008-10-29
Description: The user module in Drupal 5.x before 5.11 and 6.x before 6.5 might allow remote authenticated users to bypass intended login access rules and successfully login via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/318706; http://secunia.com/advisories/32201; http://www.openwall.com/lists/oss-security/2008/10/21/7
CVE: CVE-2008-4792
Published: 2008-10-29
Description: The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/318706; http://secunia.com/advisories/32201; http://www.openwall.com/lists/oss-security/2008/10/21/7
CVE: CVE-2008-4793
Published: 2008-10-29
Description: The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed modules.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/318706; http://secunia.com/advisories/32200; http://www.openwall.com/lists/oss-security/2008/10/21/7
CVE: CVE-2007-5394
Published: 2008-10-30
Description: Stack-based buffer overflow in AldFs32.dll in Adobe PageMaker 7.0.1 and 7.0.2 allows user-assisted remote attackers to execute arbitrary code via a .PMD file with a crafted font structure, a different vulnerability than CVE-2007-5169 and CVE-2007-6432.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27200; http://secunia.com/secunia_research/2007-80/; http://www.adobe.com/support/security/advisories/apsa08-10.html
CVE: CVE-2007-6021
Published: 2008-10-30
Description: Heap-based buffer overflow in Adobe PageMaker 7.0.1 and 7.0.2 allows user-assisted remote attackers to execute arbitrary code via a .PMD file with a crafted font structure.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27200; http://secunia.com/secunia_research/2007-80/; http://www.adobe.com/support/security/advisories/apsa08-10.html
CVE: CVE-2008-2237
Published: 2008-10-30
Description: Heap-based buffer overflow in OpenOffice.org (OOo) 2.x before 2.4.2 allows remote attackers to execute arbitrary code via a crafted WMF file associated with a StarOffice/StarSuite document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://neowiki.neooffice.org/index.php/NeoOffice_2.2.5_Patch_3_New_Features#Security_fixes; http://secunia.com/advisories/32419
CVE: CVE-2008-2238
Published: 2008-10-30
Description: Multiple integer overflows in OpenOffice.org (OOo) 2.x before 2.4.2 allow remote attackers to execute arbitrary code via crafted EMR records in an EMF file associated with a StarOffice/StarSuite document, which trigger a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=750; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://neowiki.neooffice.org/index.php/NeoOffice_2.2.5_Patch_3_New_Features#Security_fixes
CVE: CVE-2008-4794
Published: 2008-10-30
Description: Opera before 9.62 allows remote attackers to execute arbitrary commands via the History Search results page, a different vulnerability than CVE-2008-4696.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html; http://secunia.com/advisories/32538; http://security.gentoo.org/glsa/glsa-200811-01.xml
CVE: CVE-2008-4795
Published: 2008-10-30
Description: The links panel in Opera before 9.62 processes Javascript within the context of the "outermost page" of a frame, which allows remote attackers to inject arbitrary web script or HTML via cross-site scripting (XSS) attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html; http://secunia.com/advisories/32538; http://security.gentoo.org/glsa/glsa-200811-01.xml
CVE: CVE-2008-4796
Published: 2008-10-30
Description: The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN20502807/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000074.html; http://secunia.com/advisories/32361
CVE: CVE-2008-4797
Published: 2008-10-30
Description: Directory traversal vulnerability in Arihiro Kurata Kantan WEB Server 1.8 and earlier allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN79026329/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000059.html; http://secunia.com/advisories/31917
CVE: CVE-2008-4798
Published: 2008-10-30
Description: The loadModule function in lib/WebGUI/Asset.pm in WebGUI before 7.5.30 (stable) allows remote attackers to execute arbitrary code by uploading a Perl module and accessing it via a crafted URL.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32438; http://www.securityfocus.com/bid/31947; http://www.vupen.com/english/advisories/2008/2944
CVE: CVE-2008-4799
Published: 2008-10-31
Description: pamperspective in Netpbm before 10.35.48 does not properly calculate a window height, which allows context-dependent attackers to cause a denial of service (crash) via a crafted image file that triggers an out-of-bounds read.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/doc/HISTORY; http://www.openwall.com/lists/oss-security/2008/10/22/7; http://www.openwall.com/lists/oss-security/2008/10/23/2
CVE: CVE-2008-4800
Published: 2008-10-31
Description: The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denial of service (NULL pointer dereference and Internet Explorer 6.0 crash) via a large negative integer argument to the GetEntryPointForThread method.  NOTE: this issue might only be exploitable in limited environments or non-default browser settings.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://securityreason.com/securityalert/4532; http://www.securityfocus.com/archive/1/497943/100/0/threaded; http://www.securityfocus.com/bid/31996
CVE: CVE-2008-4801
Published: 2008-10-31
Description: Heap-based buffer overflow in the Data Protection for SQL CAD service (aka dsmcat.exe) in the Client Acceptor Daemon (CAD) and the scheduler in the Backup-Archive client 5.1.0.0 through 5.1.8.1, 5.2.0.0 through 5.2.5.2, 5.3.0.0 through 5.3.6.1, 5.4.0.0 through 5.4.2.2, and 5.5.0.0 through 5.5.0.91 in IBM Tivoli Storage Manager (TSM); and the Backup-Archive client in TSM Express; allows remote attackers to execute arbitrary code by sending a large amount of crafted data to a TCP port.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32465; http://www-01.ibm.com/support/docview.wss?uid=swg21322623; http://www-1.ibm.com/support/docview.wss?uid=swg1IC56773
CVE: CVE-2008-4802
Published: 2008-10-31
Description: Cross-site scripting (XSS) vulnerability in complete.php in Simple PHP Scripts blog 0.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28054; https://exchange.xforce.ibmcloud.com/vulnerabilities/40986; http://www.securityfocus.com/bid/28054
CVE: CVE-2008-4803
Published: 2008-10-31
Description: Cross-site scripting (XSS) vulnerability in index.php in Simple PHP Scripts gallery 0.1, 0.3, and 0.4 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28056; https://exchange.xforce.ibmcloud.com/vulnerabilities/40985; http://www.securityfocus.com/bid/28056
CVE: CVE-2008-4804
Published: 2008-10-31
Description: SQL injection vulnerability in the Gallery module 1.3 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the aid parameter in a showalbum action to index.php.  NOTE: some of these details are obtained from third party information.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0395.html; http://www.securityfocus.com/bid/27957; https://exchange.xforce.ibmcloud.com/vulnerabilities/41006
CVE: CVE-2007-6432
Published: 2008-10-31
Description: Stack-based buffer overflow in AldFs32.dll in Adobe PageMaker 7.0.1 and 7.0.2 allows user-assisted remote attackers to execute arbitrary code via a malformed .PMD file, related to "Key Strings," a different vulnerability than CVE-2007-5169 and CVE-2007-5394.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=749; http://www.adobe.com/support/security/advisories/apsa08-10.html; http://www.securityfocus.com/archive/1/497996/100/0/threaded