deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4574
Published: 2008-10-15
Description: SQL injection vulnerability in default.asp in Ayco Okul Portali allows remote attackers to execute arbitrary SQL commands via the linkid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32244; http://securityreason.com/securityalert/4426; http://www.securityfocus.com/bid/31704
CVE: CVE-2008-4553
Published: 2008-10-15
Description: qemu-make-debian-root in qemu 0.9.1-5 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on temporary files and directories.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496394; http://dev.gentoo.org/~rbu/security/debiantemp/qemu; http://secunia.com/advisories/32335
CVE: CVE-2008-4554
Published: 2008-10-15
Description: The do_splice_from function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the O_APPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git%3Ba=commit%3Bh=efc968d450e013049a662d22727cf132618dcb2f; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html; http://secunia.com/advisories/32386
CVE: CVE-2008-4575
Published: 2008-10-15
Description: Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service (crash) via (1) a long -cmd argument and (2) unspecified vectors related to "a bunch of potential string overflows."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/32363; http://www.openwall.com/lists/oss-security/2008/10/15/6; http://www.securityfocus.com/bid/31770
CVE: CVE-2008-4576
Published: 2008-10-15
Description: sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service (OOPS) via an INIT-ACK that states the peer does not support AUTH, which causes the sctp_process_init function to clean up active transports and triggers the OOPS when the T1-Init timer expires.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.18; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html
CVE: CVE-2008-4577
Published: 2008-10-15
Description: The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://bugs.gentoo.org/show_bug.cgi?id=240409; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://secunia.com/advisories/32164
CVE: CVE-2008-4578
Published: 2008-10-15
Description: The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://bugs.gentoo.org/show_bug.cgi?id=240409; http://secunia.com/advisories/32164; http://secunia.com/advisories/33149
CVE: CVE-2008-4579
Published: 2008-10-15
Description: The (1) fence_apc and (2) fence_apc_snmp programs, as used in (a) fence 2.02.00-r1 and possibly (b) cman, when running in verbose mode, allows local users to append to arbitrary files via a symlink attack on the apclog temporary file.
CVSS Score: 1.9 (LOW)
CWE: CWE-59
References: http://bugs.gentoo.org/show_bug.cgi?id=240576; http://secunia.com/advisories/32387; http://secunia.com/advisories/32390
CVE: CVE-2008-4580
Published: 2008-10-15
Description: fence_manual, as used in fence 2.02.00-r1 and possibly cman, allows local users to modify arbitrary files via a symlink attack on the fence_manual.fifo temporary file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.gentoo.org/show_bug.cgi?id=240576; http://www.openwall.com/lists/oss-security/2008/10/13/3; http://www.openwall.com/lists/oss-security/2008/10/16/1
CVE: CVE-2008-4581
Published: 2008-10-15
Description: The Editor in IBM ENOVIA SmarTeam 5 before release 18 SP5, and release 19 before SP01, allows remote authenticated users to bypass intended access restrictions and read Document objects via the Workflow Process (aka Flow Process) view.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/32105; http://www-01.ibm.com/support/docview.wss?uid=swg27012567&aid=1; http://www-1.ibm.com/support/docview.wss?uid=swg1HD71425
CVE: CVE-2008-4582
Published: 2008-10-15
Description: Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://liudieyu0.blog124.fc2.com/blog-entry-6.html; http://secunia.com/advisories/32192; http://secunia.com/advisories/32684
CVE: CVE-2008-4583
Published: 2008-10-15
Description: Insecure method vulnerability in the Chilkat FTP 2.0 ActiveX component (ChilkatCert.dll) allows remote attackers to overwrite arbitrary files via a full pathname in the SavePkcs8File method.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/4427; http://www.securityfocus.com/bid/27540; https://www.exploit-db.com/exploits/5028
CVE: CVE-2008-4584
Published: 2008-10-15
Description: Insecure method vulnerability in Chilkat Mail 7.8 ActiveX control (ChilkatCert.dll) allows remote attackers to overwrite arbitrary files via a full pathname to the SaveLastError method.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/4424; http://www.securityfocus.com/bid/27493; https://exchange.xforce.ibmcloud.com/vulnerabilities/40041
CVE: CVE-2008-4585
Published: 2008-10-15
Description: Belong Software Site Builder 0.1 beta allows remote attackers to bypass intended access restrictions and perform administrative actions via a direct request to admin/home.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://securityreason.com/securityalert/4414; http://www.securityfocus.com/archive/1/486803/100/200/threaded; http://www.securityfocus.com/bid/27402
CVE: CVE-2008-4586
Published: 2008-10-15
Description: Insecure method vulnerability in the MVSNCLientWebAgent61.WebAgent.1 ActiveX control (isusweb.dll 6.1.100.61372) in Macrovision FLEXnet Connect 6.1 allows remote attackers to force the download and execution of arbitrary files via the DownloadAndExecute method.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/28496; http://securityreason.com/securityalert/4425; http://www.securityfocus.com/bid/27279
CVE: CVE-2008-4587
Published: 2008-10-15
Description: Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.61372) in Macrovision FLEXnet Connect 6.1 allows remote attackers to force the download and execution of arbitrary files via the AddFile and RunScheduledJobs methods.  NOTE: this could be leveraged for code execution by uploading executable files to Startup folders.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/28496; http://securityreason.com/securityalert/4428; http://www.securityfocus.com/bid/27279
CVE: CVE-2008-4588
Published: 2008-10-15
Description: Stack-based buffer overflow in the FTP server in Etype Eserv 3.x, possibly 3.26, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long argument to the ABOR command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4415; http://www.securityfocus.com/bid/31753; http://www.zeroscience.org/codes/eserv_bof.txt
CVE: CVE-2008-4589
Published: 2008-10-15
Description: Heap-based buffer overflow in the tvtumin.sys kernel driver in Lenovo Rescue and Recovery 4.20, including 4.20.0511 and 4.20.0512, allows local users to execute arbitrary code via a long file name.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32252; http://securityreason.com/securityalert/4421; http://www-307.ibm.com/pc/support/site.wss/MIGR-4Q2QAK.html
CVE: CVE-2008-4590
Published: 2008-10-16
Description: Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to admin/login.php and (2) the post parameter to admin/news.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4413; http://www.securityfocus.com/bid/31687; https://exchange.xforce.ibmcloud.com/vulnerabilities/45799
CVE: CVE-2008-4591
Published: 2008-10-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/include/isadmin.inc.php in PhpWebGallery 1.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) lang[access_forbiden] and (2) lang[ident_title] parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4419; https://exchange.xforce.ibmcloud.com/vulnerabilities/45061; https://www.exploit-db.com/exploits/6425
CVE: CVE-2008-4592
Published: 2008-10-16
Description: Directory traversal vulnerability in index.php in Sports Clubs Web Panel 0.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4423; http://www.vupen.com/english/advisories/2008/2550; https://exchange.xforce.ibmcloud.com/vulnerabilities/45062
CVE: CVE-2008-4401
Published: 2008-10-17
Description: ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html; http://secunia.com/advisories/32270; http://secunia.com/advisories/32448
CVE: CVE-2008-4473
Published: 2008-10-17
Description: Multiple heap-based buffer overflows in Adobe Flash CS3 Professional on Windows and Flash MX 2004 allow remote attackers to execute arbitrary code via an SWF file containing long control parameters.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32246; http://security-assessment.com/files/advisories/2008-10-16_Multiple_Flash_Authoring_Heap_Overflows.pdf; http://securityreason.com/securityalert/4429
CVE: CVE-2008-4412
Published: 2008-10-17
Description: Unspecified vulnerability in HP Systems Insight Manager (SIM) before 5.2 Update 2 (C.05.02.02.00) allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01571962; http://secunia.com/advisories/32287; http://www.securityfocus.com/bid/31777
CVE: CVE-2008-4593
Published: 2008-10-17
Description: Apple iPhone 2.1 with firmware 5F136, when Require Passcode is enabled and Show SMS Preview is disabled, allows physically proximate attackers to obtain sensitive information by performing an Emergency Call tap and then reading SMS messages on the device screen, aka Apple bug number 6267416.
CVSS Score: 1.2 (LOW)
CWE: CWE-200
References: http://securitytracker.com/id?1021021; http://www.karlkraft.com/index.php/2008/10/03/yet-another-iphone-emergency-call-security-bug/; https://exchange.xforce.ibmcloud.com/vulnerabilities/46062
CVE: CVE-2008-4594
Published: 2008-10-17
Description: Unspecified vulnerability in the SNMPv3 component in Linksys WAP4400N firmware 1.2.14 on the Marvell Semiconductor 88W8361P-BEM1 chipset has unknown impact and attack vectors, probably remote.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/32259; http://www.linksys.com/servlet/Satellite?blobcol=urldata&blobheadername1=Content-Type&blobheadername2=Content-Disposition&blobheadervalue1=application%2Fmsword&blobheadervalue2=inline%3B+filename; http://www.vupen.com/english/advisories/2008/2805
CVE: CVE-2008-4595
Published: 2008-10-17
Description: Multiple unspecified vulnerabilities in Slaytanic Scripts Content Plus 2.1.1 have unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/32245; http://sourceforge.net/project/shownotes.php?release_id=632842; http://www.securityfocus.com/bid/31798
CVE: CVE-2008-4596
Published: 2008-10-17
Description: Cross-site scripting (XSS) vulnerability in Shindig-Integrator 5.x, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in generated pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/321758; http://secunia.com/advisories/32285; https://exchange.xforce.ibmcloud.com/vulnerabilities/45925
CVE: CVE-2008-4597
Published: 2008-10-17
Description: Shindig-Integrator 5.x, a module for Drupal, does not properly restrict generated page access, which allows remote attackers to gain privileges via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/321758; http://secunia.com/advisories/32285; https://exchange.xforce.ibmcloud.com/vulnerabilities/46069
CVE: CVE-2008-4598
Published: 2008-10-17
Description: Unspecified vulnerability in Shindig-Integrator 5.x, a module for Drupal, has unspecified impact and remote attack vectors related to "numerous flaws" that are not related to XSS or access control, a different vulnerability than CVE-2008-4596 and CVE-2008-4597.
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/321758; http://secunia.com/advisories/32285; https://exchange.xforce.ibmcloud.com/vulnerabilities/46070
CVE: CVE-2008-4599
Published: 2008-10-18
Description: SQL injection vulnerability in category.php in Mosaic Commerce allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32309; http://securityreason.com/securityalert/4430; http://www.securityfocus.com/bid/31782
CVE: CVE-2008-4600
Published: 2008-10-18
Description: configure.php in PokerMax Poker League Tournament Script 0.13 allows remote attackers to bypass authentication and gain administrative access by setting the ValidUserAdmin cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32312; http://securityreason.com/securityalert/4431; http://www.securityfocus.com/bid/31784
CVE: CVE-2008-4601
Published: 2008-10-18
Description: Cross-site scripting (XSS) vulnerability in the login feature in Habari CMS 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the habari_username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0810-exploits/habaricms-xss.txt; http://secunia.com/advisories/32311; http://www.securityfocus.com/bid/31794
CVE: CVE-2008-4602
Published: 2008-10-18
Description: Directory traversal vulnerability in index.php in Post Affiliate Pro 2.0 allows remote authenticated users to read and possibly execute arbitrary local files via a .. (dot dot) in the md parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4432; http://www.securityfocus.com/bid/31796; https://exchange.xforce.ibmcloud.com/vulnerabilities/46060
CVE: CVE-2008-4603
Published: 2008-10-18
Description: SQL injection vulnerability in search.php in iGaming CMS 2.0 Alpha 1 allows remote attackers to execute arbitrary SQL commands via the keywords parameter in a search_games action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4433; http://www.securityfocus.com/bid/31793; https://www.exploit-db.com/exploits/6769
CVE: CVE-2008-4604
Published: 2008-10-18
Description: SQL injection vulnerability in index.php in Easy CafeEngine 1.1 allows remote attackers to execute arbitrary SQL commands via the itemid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32307; http://securityreason.com/securityalert/4434; http://www.securityfocus.com/bid/31788
CVE: CVE-2008-4605
Published: 2008-10-18
Description: SQL injection vulnerability in CafeEngine allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) dish.php and (2) menu.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32308; http://securityreason.com/securityalert/4434; http://www.securityfocus.com/bid/31786
CVE: CVE-2008-4606
Published: 2008-10-18
Description: Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) location_id parameter to locationdel.php and (2) vlan_id parameter to vlanedit.php.  NOTE: the vlanview.php and vlandel.php vectors are already covered by CVE-2007-6579.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/49231; http://osvdb.org/show/osvdb/49232; http://securityreason.com/securityalert/4435
CVE: CVE-2007-6718
Published: 2008-10-20
Description: MPlayer, possibly 1.0rc1, allows remote attackers to cause a denial of service (SIGSEGV and application crash) via (1) a malformed MP3 file, as demonstrated by lol-mplayer.mp3; (2) a malformed Ogg Vorbis file, as demonstrated by lol-mplayer.ogg; (3) a malformed MPEG-1 file, as demonstrated by lol-mplayer.mpg; (4) a malformed MPEG-2 file, as demonstrated by lol-mplayer.m2v; (5) a malformed MPEG-4 AVI file, as demonstrated by lol-mplayer.avi; (6) a malformed FLAC file, as demonstrated by lol-mplayer.flac; (7) a malformed Ogg Theora file, as demonstrated by lol-mplayer.ogm; (8) a malformed WMV file, as demonstrated by lol-mplayer.wmv; or (9) a malformed AAC file, as demonstrated by lol-mplayer.aac.  NOTE: vector 5 might overlap CVE-2007-4938, and vector 6 might overlap CVE-2008-0486.
CVSS Score: 4.3 (MEDIUM)
References: http://sam.zoy.org/blog/2007-01-16-exposing-file-parsing-vulnerabilities; http://www.openwall.com/lists/oss-security/2008/10/07/1; http://sam.zoy.org/blog/2007-01-16-exposing-file-parsing-vulnerabilities
CVE: CVE-2008-3831
Published: 2008-10-20
Description: The i915 driver in (1) drivers/char/drm/i915_dma.c in the Linux kernel 2.6.24 on Debian GNU/Linux and (2) sys/dev/pci/drm/i915_drv.c in OpenBSD does not restrict the DRM_I915_HWS_ADDR ioctl to the Direct Rendering Manager (DRM) master, which allows local users to cause a denial of service (memory corruption) via a crafted ioctl call, related to absence of the DRM_MASTER and DRM_ROOT_ONLY flags in the ioctl's configuration.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/openbsd/cvs/2008-10/0365.html; http://secunia.com/advisories/32315; http://secunia.com/advisories/32386
CVE: CVE-2008-4609
Published: 2008-10-20
Description: The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
CVSS Score: 7.1 (HIGH)
CWE: CWE-16
References: http://blog.robertlee.name/2008/10/conjecture-speculation.html; http://insecure.org/stf/tcp-dos-attack-explained.html; http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html
CVE: CVE-2008-4610
Published: 2008-10-20
Description: MPlayer allows remote attackers to cause a denial of service (application crash) via (1) a malformed AAC file, as demonstrated by lol-vlc.aac; or (2) a malformed Ogg Media (OGM) file, as demonstrated by lol-ffplay.ogm, different vectors than CVE-2007-6718.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/34296; http://www.openwall.com/lists/oss-security/2008/10/07/1; http://www.ubuntu.com/usn/USN-734-1
CVE: CVE-2008-4611
Published: 2008-10-20
Description: SQL injection vulnerability in index.php in PHP Arsivimiz Php Ziyaretci Defteri allows remote attackers to execute arbitrary SQL commands via the sayfa parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4436; http://www.securityfocus.com/archive/1/487317/100/200/threaded; http://www.securityfocus.com/bid/27518
CVE: CVE-2008-4612
Published: 2008-10-20
Description: Cross-site scripting (XSS) vulnerability in PortalApp 4.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter to (1) forums.asp and (2) content.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28337; http://securityreason.com/securityalert/4439; http://www.aspapp.com/content.asp?CatId=197&ContentType=Downloads
CVE: CVE-2008-4613
Published: 2008-10-20
Description: SQL injection vulnerability in forums.asp in PortalApp 4.0 allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28337; http://securityreason.com/securityalert/4439; http://www.aspapp.com/content.asp?CatId=197&ContentType=Downloads
CVE: CVE-2008-4614
Published: 2008-10-20
Description: PortalApp 4.0 does not require authentication for (1) forums.asp and (2) content.asp, which allows remote attackers to create and delete forums, topics, and replies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/28337; http://securityreason.com/securityalert/4439; http://www.aspapp.com/content.asp?CatId=197&ContentType=Downloads
CVE: CVE-2008-4615
Published: 2008-10-20
Description: Unspecified vulnerability in i_utils.asp in PortalApp before 4.01a has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.aspapp.com/content.asp?CatId=197&ContentType=Downloads; https://exchange.xforce.ibmcloud.com/vulnerabilities/46056; http://www.aspapp.com/content.asp?CatId=197&ContentType=Downloads
CVE: CVE-2008-4616
Published: 2008-10-20
Description: The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/4438; http://www.securityfocus.com/archive/1/486333/100/200/threaded; http://www.securityfocus.com/bid/27291
CVE: CVE-2008-4617
Published: 2008-10-20
Description: SQL injection vulnerability in the actualite module 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4437; http://www.securityfocus.com/bid/28565; https://exchange.xforce.ibmcloud.com/vulnerabilities/41579
CVE: CVE-2008-4618
Published: 2008-10-21
Description: The Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.27 does not properly handle a protocol violation in which a parameter has an invalid length, which allows attackers to cause a denial of service (panic) via unspecified vectors, related to sctp_sf_violation_paramlen, sctp_sf_abort_violation, sctp_make_abort_violation, and incorrect data types in function calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=ba0166708ef4da7eeb61dd92bbba4d5a749d6561; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html; http://secunia.com/advisories/32918