deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1877
Published: 2008-04-17
Description: tss 0.8.1 allows local users to read arbitrary files via the -a parameter, which is processed while tss is running with privileges.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=475747; https://exchange.xforce.ibmcloud.com/vulnerabilities/41929; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=475747
CVE: CVE-2007-6714
Published: 2008-04-17
Description: DBMail before 2.2.9, when using authldap with an LDAP server that supports anonymous login such as Active Directory, allows remote attackers to bypass authentication via an empty password, which causes the LDAP bind to indicate success based on anonymous authentication.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://dbmail.org/index.php?page=news&id=44; http://osvdb.org/44561; http://secunia.com/advisories/29903
CVE: CVE-2007-6715
Published: 2008-04-17
Description: Mozilla Firefox allows remote attackers to cause a denial of service (crash) via crafted image, as demonstrated by the zzuf lol-firefox.gif test case.
CVSS Score: 4.3 (MEDIUM)
References: http://hboeck.de/archives/578-How-long-does-it-take-to-fix-a-crash-bug.html; http://osvdb.org/44727; http://sam.zoy.org/blog/2007-01-16-exposing-file-parsing-vulnerabilities
CVE: CVE-2008-1878
Published: 2008-04-17
Description: Stack-based buffer overflow in the demux_nsf_send_chunk function in src/demuxers/demux_nsf.c in xine-lib 1.1.12 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long NSF title.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html; http://secunia.com/advisories/29850; http://secunia.com/advisories/30021
CVE: CVE-2008-1881
Published: 2008-04-17
Description: Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary code via a long subtitle in an SSA file.  NOTE: this issue is due to an incomplete fix for CVE-2007-6681.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/vlcboffs-adv.txt; http://aluigi.org/adv/vlcboffs-adv.txt; http://secunia.com/advisories/28233
CVE: CVE-2008-1693
Published: 2008-04-18
Description: The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://secunia.com/advisories/29816; http://secunia.com/advisories/29834
CVE: CVE-2008-1734
Published: 2008-04-18
Description: Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than interpretation as the literal [a-z] regular-expression string, and consequently blocks the launch of the PHP interpreter within the Apache HTTP Server.
CVSS Score: 3.6 (LOW)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=209535; http://security.gentoo.org/glsa/glsa-200804-19.xml; http://www.securityfocus.com/bid/28844
CVE: CVE-2008-1883
Published: 2008-04-18
Description: The server in Blackboard Academic Suite 7.x stores MD5 password hashes that are provided directly by clients, which makes it easier for remote attackers to access accounts via a modified client that skips the javascript/md5.js hash calculation, and instead sends an arbitrary MD5 string.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secskill.wordpress.com/2008/03/27/hacking-blackboard-academic-suite-2/; http://securityreason.com/securityalert/3810; http://www.scribd.com/doc/2363025/Hacking-Blackboard-Academic-Suite
CVE: CVE-2008-1884
Published: 2008-04-18
Description: Directory traversal vulnerability in index.php in Wikepage Opus 13 2007.2 allows remote attackers to read arbitrary files via directory traversal sequences in the wiki parameter, a different vector than CVE-2006-4418.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2008-04/0082.html; http://secunia.com/advisories/29699; http://www.securityfocus.com/bid/28664
CVE: CVE-2008-1885
Published: 2008-04-18
Description: Directory traversal vulnerability in the NeffyLauncher 1.0.5 ActiveX control (NeffyLauncher.dll) in CDNetworks Nefficient Download allows remote attackers to download arbitrary code onto a client system via a .. (dot dot) in the SkinPath parameter and a .zip URL in the HttpSkin parameter.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/bugtraq/2008/Apr/0065.html; http://secunia.com/advisories/29692; http://www.securityfocus.com/bid/28666
CVE: CVE-2008-1886
Published: 2008-04-18
Description: The NeffyLauncher 1.0.5 ActiveX control (NeffyLauncher.dll) in CDNetworks Nefficient Download uses weak cryptography for a KeyCode that blocks unauthorized use of the control, which allows remote attackers to bypass this protection mechanism by calculating the required KeyCode.  NOTE: this can be used by arbitrary web sites to host exploit code that targets this control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://seclists.org/bugtraq/2008/Apr/0065.html; http://www.securityfocus.com/bid/28666; https://exchange.xforce.ibmcloud.com/vulnerabilities/41933
CVE: CVE-2008-1887
Published: 2008-04-18
Description: Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString_FromStringAndSize function, which allocates less memory than expected when assert() is disabled and triggers a buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-120
References: http://bugs.python.org/issue2587; http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
CVE: CVE-2008-1888
Published: 2008-04-18
Description: Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML via the Picture Source (aka picture object source) field in the Rich Text Editor.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.caughq.org/advisories/CAU-2008-0002.txt; http://www.securityfocus.com/archive/1/490624/100/0/threaded; http://www.securityfocus.com/bid/28706
CVE: CVE-2008-1889
Published: 2008-04-18
Description: SQL injection vulnerability in viewcat.php in XplodPHP AutoTutorials 2.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29840; http://www.securityfocus.com/bid/28808; http://www.vupen.com/english/advisories/2008/1244/references
CVE: CVE-2008-1890
Published: 2008-04-18
Description: SQL injection vulnerability in the Jom Comment 2.0 build 345 component for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29820; http://www.securityfocus.com/bid/28812; https://exchange.xforce.ibmcloud.com/vulnerabilities/41866
CVE: CVE-2008-1891
Published: 2008-04-18
Description: Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/webrickcgi-adv.txt; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html; http://secunia.com/advisories/29794
CVE: CVE-2008-1892
Published: 2008-04-18
Description: Cross-site scripting (XSS) vulnerability in bs_auth.php in Blogator-script 0.95 and 1.01 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29684; http://www.securityfocus.com/bid/28810; https://exchange.xforce.ibmcloud.com/vulnerabilities/41930
CVE: CVE-2008-1893
Published: 2008-04-18
Description: PHP remote file inclusion vulnerability in index.php in W2B Online Banking allows remote attackers to execute arbitrary PHP code via a URL in the ilang parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3472&w=2; http://www.securityfocus.com/bid/28796; https://exchange.xforce.ibmcloud.com/vulnerabilities/41931
CVE: CVE-2008-1894
Published: 2008-04-18
Description: Cross-site scripting (XSS) vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061428.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8302&w=2; http://osvdb.org/51450
CVE: CVE-2008-1895
Published: 2008-04-18
Description: Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugreport.ir/index.php?/35; http://bugreport.ir/index.php?/35/exploit; http://secunia.com/advisories/29827
CVE: CVE-2008-1896
Published: 2008-04-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Redirect parameter to login.asp and the (2) OrderBy parameter to member_send.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugreport.ir/index.php?/35; http://secunia.com/advisories/29827; http://www.securityfocus.com/archive/1/490923/100/0/threaded
CVE: CVE-2008-0165
Published: 2008-04-21
Description: Cross-site request forgery (CSRF) vulnerability in Ikiwiki before 2.42 allows remote attackers to modify user preferences, including passwords, via the (1) preferences and (2) edit forms.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=475445; http://ikiwiki.info/security/#index31h2; http://secunia.com/advisories/29907
CVE: CVE-2008-1436
Published: 2008-04-21
Description: Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://blogs.technet.com/msrc/archive/2008/04/17/msrc-blog-microsoft-security-advisory-951306.aspx; http://isc.sans.org/diary.html?storyid=4306; http://milw0rm.com/sploits/2008-Churrasco.zip
CVE: CVE-2008-1898
Published: 2008-04-21
Description: A certain ActiveX control in WkImgSrv.dll 7.03.0616.0, as distributed in Microsoft Works 7 and Microsoft Office 2003 and 2007, allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via an invalid WksPictureInterface property value, which triggers an improper function call.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0029.html; http://blogs.technet.com/swi/archive/2008/06/05/why-there-wont-be-a-security-update-for-wkimgsrv-dll.aspx; http://www.securityfocus.com/archive/1/491027/100/0/threaded
CVE: CVE-2008-1102
Published: 2008-04-22
Description: Stack-based buffer overflow in the imb_loadhdr function in Blender 2.45 allows user-assisted remote attackers to execute arbitrary code via a .blend file that contains a crafted Radiance RGBE image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html; http://secunia.com/advisories/29818; http://secunia.com/advisories/29957
CVE: CVE-2008-1613
Published: 2008-04-22
Description: SQL injection vulnerability in ioRD.asp in RedDot CMS 7.5 Build 7.5.0.48, and possibly other versions including 6.5 and 7.0, allows remote attackers to execute arbitrary SQL commands via the LngId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29843; http://www.irmplc.com/index.php/167-Advisory-026; http://www.securityfocus.com/archive/1/491139/100/0/threaded
CVE: CVE-2008-1679
Published: 2008-04-22
Description: Multiple integer overflows in imageop.c in Python before 2.5.3 allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows.  NOTE: this issue is due to an incomplete fix for CVE-2007-4965.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-190
References: http://bugs.python.org/issue1179; http://bugs.python.org/msg64682; http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
CVE: CVE-2008-1694
Published: 2008-04-22
Description: vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-59
References: http://bugs.gentoo.org/show_bug.cgi?id=216880; http://secunia.com/advisories/29905; http://secunia.com/advisories/29926
CVE: CVE-2008-1900
Published: 2008-04-22
Description: option_Update.asp in Carbon Communities 2.4 and earlier allows remote attackers to edit arbitrary member information via a modified ID field.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/490923/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/41961; http://www.securityfocus.com/archive/1/490923/100/0/threaded
CVE: CVE-2008-1901
Published: 2008-04-22
Description: aptlinex before 0.91 allows local users to overwrite arbitrary files via a symlink attack on the gambas-apt.lock temporary file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476588; https://exchange.xforce.ibmcloud.com/vulnerabilities/41956; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476588
CVE: CVE-2008-1902
Published: 2008-04-22
Description: The GUI for aptlinex before 0.91 does not sufficiently warn the user of potentially dangerous actions, which allows remote attackers to remove or modify packages via an apt:// URL.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476572; https://exchange.xforce.ibmcloud.com/vulnerabilities/41954; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476572
CVE: CVE-2008-1903
Published: 2008-04-22
Description: PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the newsoffice_directory parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/29797; http://www.securityfocus.com/bid/28748; https://exchange.xforce.ibmcloud.com/vulnerabilities/41770
CVE: CVE-2008-1904
Published: 2008-04-22
Description: Cicoandcico CcMail 1.0.1 and earlier does not verify that the this_cookie cookie corresponds to an authenticated session, which allows remote attackers to obtain access to the "admin area" via a modified this_cookie cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/29812; http://www.securityfocus.com/bid/28751; https://exchange.xforce.ibmcloud.com/vulnerabilities/41797
CVE: CVE-2008-1905
Published: 2008-04-22
Description: NMMediaServer.exe in Nero MediaHome 3.3.3.0 and earlier, as used in Nero 8.3.2.1 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a long HTTP request to TCP port 54444, a different vector than CVE-2007-2322.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/neromedia-adv.txt; http://secunia.com/advisories/29808; http://www.securityfocus.com/bid/28775
CVE: CVE-2008-1906
Published: 2008-04-22
Description: Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugreport.ir/index.php?/34; http://secunia.com/advisories/29807; http://www.securityfocus.com/bid/28755
CVE: CVE-2008-1907
Published: 2008-04-22
Description: Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, and (3) id_category parameters to unspecified components.  NOTE: this probably overlaps CVE-2007-2959 and CVE-2007-2890.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugreport.ir/index.php?/34; http://secunia.com/advisories/29807; http://www.securityfocus.com/bid/28755
CVE: CVE-2008-1908
Published: 2008-04-22
Description: Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or (2) the action parameter to category.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://bugreport.ir/index.php?/34; http://secunia.com/advisories/29807; http://www.securityfocus.com/bid/28755
CVE: CVE-2008-1909
Published: 2008-04-22
Description: SQL injection vulnerability in comment.php in PHP Knowledge Base (PHPKB) 1.5 and 2.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29791; http://www.securityfocus.com/bid/28739; https://exchange.xforce.ibmcloud.com/vulnerabilities/41769
CVE: CVE-2008-1910
Published: 2008-04-22
Description: Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 SP2 allows remote attackers to execute arbitrary code via a malformed opcode 0x52 request to TCP port 3050. NOTE: this might overlap CVE-2007-5243 or CVE-2007-5244.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/490752/100/0/threaded; http://www.securityfocus.com/bid/28730; http://www.securitytracker.com/id?1019834
CVE: CVE-2008-1911
Published: 2008-04-22
Description: SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a cookpass cookie.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29810; http://www.securityfocus.com/bid/28754; https://exchange.xforce.ibmcloud.com/vulnerabilities/41785
CVE: CVE-2008-1912
Published: 2008-04-22
Description: Stack-based buffer overflow in DivX Player 6.7 build 6.7.0.22 and earlier allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long subtitle in a .SRT file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29780; http://www.securityfocus.com/archive/1/490898/100/0/threaded; http://www.securityfocus.com/bid/28799
CVE: CVE-2008-1913
Published: 2008-04-22
Description: SQL injection vulnerability in index.php in Lasernet CMS 1.5 and 1.11, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the new parameter in a new action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29734; http://www.securityfocus.com/bid/28804; http://www.vupen.com/english/advisories/2008/1239/references
CVE: CVE-2008-1914
Published: 2008-04-22
Description: Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows remote attackers to execute arbitrary code via a long URI in a request to TCP port 6080. NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29831; http://www.securityfocus.com/archive/1/490916/100/0/threaded; http://www.securityfocus.com/archive/1/491035/100/0/threaded
CVE: CVE-2007-6255
Published: 2008-04-23
Description: Buffer overflow in the Microsoft HeartbeatCtl ActiveX control in HRTBEAT.OCX allows remote attackers to execute arbitrary code via the Host argument to an unspecified method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/44652; http://www.kb.cert.org/vuls/id/570089; http://www.securityfocus.com/bid/28882
CVE: CVE-2008-1385
Published: 2008-04-23
Description: Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html; http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html; http://int21.de/cve/CVE-2008-1385-s9y.html
CVE: CVE-2008-1386
Published: 2008-04-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via (1) unspecified path fields or (2) the database host field.  NOTE: the timing window for exploitation of this issue might be limited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html; http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html; http://int21.de/cve/CVE-2008-1386-s9y.html
CVE: CVE-2008-1765
Published: 2008-04-23
Description: Buffer overflow in Adobe Photoshop Album Starter Edition 3.2, and possibly After Effects CS3, allows user-assisted remote attackers and physically proximate attackers to execute arbitrary code via a BMP file with an invalid image header.  NOTE: the related issue in Photoshop CS3 is already covered by CVE-2007-2244.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0551.html; http://secunia.com/advisories/29838; http://securitytracker.com/id?1019910
CVE: CVE-2008-1915
Published: 2008-04-23
Description: SQL injection vulnerability in view.asp in DevWorx BlogWorx 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29879; http://www.securityfocus.com/bid/28776; http://www.vupen.com/english/advisories/2008/1305/references