deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-6630
Published: 2008-01-04
Description: The Url_init function in utils/url.c in Netembryo 0.0.4, when used by LScube Feng, allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a malformed URI containing a "/:" sequence, as demonstrated by a "DESCRIBE /: RTSP/1.0" request.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/fengulo-adv.txt; http://aluigi.org/poc/fengulo.zip; http://osvdb.org/40158
CVE: CVE-2007-6631
Published: 2008-01-04
Description: Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via (1) a reply that begins with a long version string, which triggers an overflow in handle_rtsp_pkt in rtsp_handlers.c; long headers that trigger overflows in (2) send_pause_request, (3) send_play_request, (4) send_setup_request, or (5) send_teardown_request in rtsp_send.c, as demonstrated by the Content-Base header; or a long Transport header, which triggers an overflow in (6) get_transport_str_sctp, (7) get_transport_str_tcp, or (8) get_transport_str_udp in rtsp_transport.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/libnemesibof-adv.txt; http://aluigi.org/poc/libnemesibof.zip; http://osvdb.org/42820
CVE: CVE-2007-6632
Published: 2008-01-04
Description: showCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/39880; http://www.inj3ct-it.org/exploit/xml2owl-0.1.1.rce.txt; http://www.securityfocus.com/bid/27050
CVE: CVE-2007-6633
Published: 2008-01-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script or HTML via (1) the cat_name parameter to faq.php; and unspecified parameters to the (2) add categories, (3) edit categories, (4) delete categories, (5) add faq, (6) edit faq, and (7) delete faq Admin scripts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059318.html; http://osvdb.org/39664; http://secunia.com/advisories/28248
CVE: CVE-2007-6634
Published: 2008-01-04
Description: Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the category_id parameter to faq.php, and unspecified other vectors involving additional scripts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059318.html; http://osvdb.org/39665; http://secunia.com/advisories/28248
CVE: CVE-2007-6635
Published: 2008-01-04
Description: FAQMasterFlexPlus, possibly 1.5 or 1.52, stores the admin password in cleartext in a database, which might allow context-dependent attackers to obtain the password via unspecified database access.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059318.html; http://www.securityfocus.com/archive/1/485589/100/0/threaded; http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059318.html
CVE: CVE-2007-6636
Published: 2008-01-04
Description: Unspecified vulnerability in the StorageFarabDb module in Bitflu before 0.42 allows user-assisted remote attackers to create or append data to arbitrary files via a crafted .torrent file.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://bitflu.workaround.ch/ChangeLog.txt; http://osvdb.org/39892; http://secunia.com/advisories/28238
CVE: CVE-2007-6637
Published: 2008-01-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect.  NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html; http://secunia.com/advisories/29763
CVE: CVE-2007-6638
Published: 2008-01-04
Description: March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/39726; http://secunia.com/advisories/28211; http://www.milw0rm.com/papers/190
CVE: CVE-2007-6639
Published: 2008-01-04
Description: SQL injection vulnerability in index.php in IPTBB 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewdir action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39881; http://www.securityfocus.com/bid/27082; https://exchange.xforce.ibmcloud.com/vulnerabilities/39340
CVE: CVE-2007-6640
Published: 2008-01-04
Description: Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://8-p.info/greasekit/vuln/20071226-en.html; http://osvdb.org/42819; http://secunia.com/advisories/28241
CVE: CVE-2007-6641
Published: 2008-01-04
Description: Cross-site scripting (XSS) vulnerability in dir.php in milliscripts Redirection allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a browse action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/39882; http://secunia.com/advisories/28306; http://securityreason.com/securityalert/3508
CVE: CVE-2007-6642
Published: 2008-01-04
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to (1) add a Super Admin, (2) upload an extension containing arbitrary PHP code, and (3) modify the configuration as administrators via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/41263; http://secunia.com/advisories/29257; http://securityreason.com/securityalert/3505
CVE: CVE-2007-6643
Published: 2008-01-04
Description: Cross-site scripting (XSS) vulnerability in the com_poll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/39979; http://secunia.com/advisories/29257; http://securitytracker.com/id?1019145
CVE: CVE-2007-6644
Published: 2008-01-04
Description: Joomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/43277; http://secunia.com/advisories/29257; http://securitytracker.com/id?1019145
CVE: CVE-2007-6645
Published: 2008-01-04
Description: Unspecified vulnerability in Joomla! before 1.5 RC4 allows remote authenticated users to gain privileges via unspecified vectors, aka "registered user privilege escalation vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/43276; http://secunia.com/advisories/29257; http://securitytracker.com/id?1019145
CVE: CVE-2007-6646
Published: 2008-01-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1, and possibly other versions before 1.1.0, allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the return parameter to the order script, or (4) the email parameter to user/remindComplete.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0003.html; http://livecart.com/news/Major-update-LiveCart-1-1-0.8; http://osvdb.org/39756
CVE: CVE-2008-0089
Published: 2008-01-04
Description: SQL injection vulnerability in uprofile.php in ClipShare allows remote attackers to execute arbitrary SQL commands via the UID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/40077; http://secunia.com/advisories/28313; http://www.securityfocus.com/bid/27108
CVE: CVE-2008-0090
Published: 2008-01-04
Description: A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long argument to the SetPassword method.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/27106; https://exchange.xforce.ibmcloud.com/vulnerabilities/39386; https://www.exploit-db.com/exploits/4829
CVE: CVE-2008-0091
Published: 2008-01-04
Description: Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28309; http://www.attrition.org/pipermail/vim/2008-January/001865.html; http://www.securityfocus.com/bid/27092
CVE: CVE-2008-0092
Published: 2008-01-04
Description: Cross-site scripting (XSS) vulnerability in index.php in the search module in Appalachian State University phpWebSite 1.4.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://phpwebsite.appstate.edu/blog/2143; http://secunia.com/advisories/28303; http://securityreason.com/securityalert/3511
CVE: CVE-2007-6598
Published: 2008-01-04
Description: Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://dovecot.org/list/dovecot-news/2007-December/000057.html; http://dovecot.org/list/dovecot-news/2007-December/000058.html; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html
CVE: CVE-2007-6599
Published: 2008-01-04
Description: Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://lists.openafs.org/pipermail/openafs-announce/2007/000220.html; http://secunia.com/advisories/28327; http://secunia.com/advisories/28401
CVE: CVE-2007-6647
Published: 2008-01-04
Description: SQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39883; http://www.securityfocus.com/bid/27070; https://exchange.xforce.ibmcloud.com/vulnerabilities/39308
CVE: CVE-2007-6648
Published: 2008-01-04
Description: Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/39784; http://secunia.com/advisories/28270; http://www.securityfocus.com/bid/27072
CVE: CVE-2007-6649
Published: 2008-01-04
Description: PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/39916; http://www.securityfocus.com/bid/27073; https://exchange.xforce.ibmcloud.com/vulnerabilities/39314
CVE: CVE-2007-6650
Published: 2008-01-04
Description: Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif content type, and possibly other image and PDF content types, as demonstrated by uploading a .htaccess file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/40155; http://www.bugreport.ir/?/24; http://www.securityfocus.com/archive/1/485642/100/0/threaded
CVE: CVE-2007-6651
Published: 2008-01-04
Description: Directory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive information (script source code) via a .. (dot dot) in the suck_url parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/39915; http://secunia.com/advisories/28300; http://www.bugreport.ir/?/24
CVE: CVE-2007-6652
Published: 2008-01-04
Description: cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo_0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb (aka the XCMS footer).
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/40277; http://secunia.com/advisories/28256; https://exchange.xforce.ibmcloud.com/vulnerabilities/39346
CVE: CVE-2007-6653
Published: 2008-01-04
Description: Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/39884; http://www.securityfocus.com/bid/27076; https://exchange.xforce.ibmcloud.com/vulnerabilities/39330
CVE: CVE-2007-6654
Published: 2008-01-04
Description: Buffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows remote attackers to execute arbitrary code via a long string in the ProductCode argument (second argument) to the DownloadAndExecute method, a different vulnerability than CVE-2007-0321, CVE-2007-2419, and CVE-2007-5660.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059288.html; http://osvdb.org/39980; https://exchange.xforce.ibmcloud.com/vulnerabilities/39204
CVE: CVE-2007-6655
Published: 2008-01-04
Description: PHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/39836; http://secunia.com/advisories/28296; http://www.securityfocus.com/bid/27075
CVE: CVE-2007-6656
Published: 2008-01-04
Description: SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123/; http://forum.cmsmadesimple.org/index.php/topic%2C18240.0.html; http://osvdb.org/39788
CVE: CVE-2007-6657
Published: 2008-01-04
Description: PHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mfh_root_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/39895; https://exchange.xforce.ibmcloud.com/vulnerabilities/39316; https://www.exploit-db.com/exploits/4808
CVE: CVE-2007-6658
Published: 2008-01-04
Description: SQL injection vulnerability in admin.php/vars.php in CustomCMS (CCMS) 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39894; http://securityreason.com/securityalert/3510; http://www.securityfocus.com/archive/1/485633/100/0/threaded
CVE: CVE-2007-6659
Published: 2008-01-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) contentshort or (2) contentfull parameter in an addnews action to the default URI; (3) the content parameter in a pm write action to 2z/admin.php; (4) the referer parameter to templates/default/usermenu.tpl, accessed through index.php; or the (5) newavatar or (6) newphoto parameter in a profile action to the default URI under 2z/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://2z-project.ru/forum/viewtopic.php?pid=8309; http://secunia.com/advisories/28244; http://securityreason.com/securityalert/3514
CVE: CVE-2007-6660
Published: 2008-01-04
Description: 2z project 0.9.6.1 allows remote attackers to obtain sensitive information via (1) a request to index.php with an invalid template or (2) a request to the default URI with certain year and month parameters, which reveals the path in various error messages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://2z-project.ru/forum/viewtopic.php?pid=8309; http://securityreason.com/securityalert/3514; http://www.securityfocus.com/archive/1/485590/100/0/threaded
CVE: CVE-2007-6661
Published: 2008-01-04
Description: 2z project 0.9.6.1 allows attackers to change the password without supplying the old password.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-255
References: http://2z-project.ru/forum/viewtopic.php?pid=8309; http://securityreason.com/securityalert/3514; http://www.securityfocus.com/archive/1/485590/100/0/threaded
CVE: CVE-2007-6662
Published: 2008-01-04
Description: Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/39885; http://securityreason.com/securityalert/3515; http://www.securityfocus.com/archive/1/485632/100/0/threaded
CVE: CVE-2007-6663
Published: 2008-01-04
Description: SQL injection vulnerability in (1) Puarcade.php and (2) PUarcade.html.php in Pragmatic Utopia PU Arcade (com_puarcade) 2.0.3, 2.1.2, and 2.1.3 Beta component for Joomla!  allows remote attackers to execute arbitrary SQL commands via the fid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39787; http://osvdb.org/39886; http://secunia.com/advisories/28295
CVE: CVE-2007-6664
Published: 2008-01-04
Description: SQL injection vulnerability in index.php in WebPortal CMS 0.6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39887; http://www.securityfocus.com/bid/27088; https://exchange.xforce.ibmcloud.com/vulnerabilities/39336
CVE: CVE-2007-6665
Published: 2008-01-04
Description: SQL injection vulnerability in admin/login.asp in Netchemia oneSCHOOL allows remote attackers to execute arbitrary SQL commands via the txtLoginID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39893; http://www.securityfocus.com/bid/27085; https://exchange.xforce.ibmcloud.com/vulnerabilities/39349
CVE: CVE-2007-6666
Published: 2008-01-04
Description: SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the albumnr parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/39786; http://secunia.com/advisories/28281; http://www.securityfocus.com/bid/27084
CVE: CVE-2007-6667
Published: 2008-01-04
Description: SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the member.php vector is already covered by CVE-2005-0413.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/39781; http://osvdb.org/39782; http://www.securityfocus.com/bid/27083
CVE: CVE-2007-5965
Published: 2008-01-08
Description: QSslSocket in Trolltech Qt 4.3.0 through 4.3.2 does not properly verify SSL certificates, which might make it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service, or trick a service into accepting an invalid client certificate for a user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28228; http://secunia.com/advisories/28321; http://secunia.com/advisories/28636
CVE: CVE-2008-0093
Published: 2008-01-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in newticket.php in eTicket 1.5.5.2, and 1.5.6 RC2 and RC3, allow remote attackers to inject arbitrary web script or HTML via the (1) Name and (2) Subject parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28331; http://www.digitrustgroup.com/advisories/web-application-security-eticket.html; http://www.securityfocus.com/bid/27130
CVE: CVE-2007-6668
Published: 2008-01-08
Description: admin/uploadgames.php in MySpace Content Zone (MCZ) 3.x does not require administrative privileges, which allows remote attackers to perform unrestricted file uploads, as demonstrated by uploading (1) a .php file and (2) a .php%00.jpeg file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/40211; http://secunia.com/advisories/28159; http://www.securityfocus.com/bid/27062
CVE: CVE-2007-6669
Published: 2008-01-08
Description: Cross-site scripting (XSS) vulnerability in search.php in PHCDownload 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the string parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2007/12/xss-flaw-posible-sql-injection-in.html; http://osvdb.org/40190; http://secunia.com/advisories/28258
CVE: CVE-2007-6670
Published: 2008-01-08
Description: SQL injection vulnerability in search.php in PHCDownload 1.1.0 allows remote attackers to execute arbitrary SQL commands via the string parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lostmon.blogspot.com/2007/12/xss-flaw-posible-sql-injection-in.html; http://osvdb.org/40191; http://secunia.com/advisories/28258
CVE: CVE-2008-0094
Published: 2008-01-08
Description: Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to (1) include and execute arbitrary local files via a .. (dot dot) in the as_language parameter to assets/snippets/AjaxSearch/AjaxSearch.php, reached through index-ajax.php; and (2) read arbitrary local files via a .. (dot dot) in the file parameter to assets/js/htcmime.php.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://modxcms.com/forums/index.php/topic%2C21290.0.html; http://secunia.com/advisories/28220; http://securityreason.com/securityalert/3522
CVE: CVE-2008-0095
Published: 2008-01-08
Description: The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.digium.com/view.php?id=11637; http://downloads.digium.com/pub/security/AST-2008-001.html; http://secunia.com/advisories/28299
CVE: CVE-2008-0096
Published: 2008-01-08
Description: Multiple buffer overflows in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allow remote attackers to execute arbitrary code via a (1) a long username, which triggers an overflow in the log function; or (2) a long password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/gswsshit-adv.txt; http://secunia.com/advisories/28307; http://securityreason.com/securityalert/3517