deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3960
Published: 2008-09-11
Description: Unspecified vulnerability in the JDBC Applet Server Service (aka db2jds) in IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to cause a denial of service (service crash) via "malicious packets."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT; http://osvdb.org/48148; http://secunia.com/advisories/31787
CVE: CVE-2008-3962
Published: 2008-09-11
Description: The from_format function in ssmtp.c in ssmtp 2.61 and 2.62, in certain configurations, uses uninitialized memory for the From: field of an e-mail message, which might allow remote attackers to obtain sensitive information (memory contents) in opportunistic circumstances by reading a message.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2008/09/09/5; http://www.openwall.com/lists/oss-security/2008/09/09/6; http://www.openwall.com/lists/oss-security/2008/09/11/2
CVE: CVE-2008-3963
Published: 2008-09-11
Description: MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-134
References: http://bugs.mysql.com/bug.php?id=35658; http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html
CVE: CVE-2008-3964
Published: 2008-09-11
Description: Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-193
References: http://secunia.com/advisories/31781; http://secunia.com/advisories/33137; http://secunia.com/advisories/35302
CVE: CVE-2008-3965
Published: 2008-09-11
Description: SQL injection vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://community.mybboard.net/attachment.php?aid=10579; http://community.mybboard.net/showthread.php?tid=36022; http://secunia.com/advisories/31760
CVE: CVE-2008-3966
Published: 2008-09-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via (1) a certain referrer field in usercp2.php, (2) a certain location field in inc/functions_online.php, and certain (3) tsubject and (4) psubject fields in moderation.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.mybboard.net/attachment.php?aid=10579; http://community.mybboard.net/showthread.php?tid=36022; http://secunia.com/advisories/31760
CVE: CVE-2008-3967
Published: 2008-09-11
Description: moderation.php in MyBB (aka MyBulletinBoard) before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://community.mybboard.net/attachment.php?aid=10579; http://community.mybboard.net/showthread.php?tid=36022; http://secunia.com/advisories/31760
CVE: CVE-2008-3968
Published: 2008-09-11
Description: Cross-site scripting (XSS) vulnerability in userlist.php in PunBB before 1.2.20 allows remote attackers to inject arbitrary web script or HTML via the p parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://punbb.informer.com/download/changelogs/1.2.19_to_1.2.20.txt; http://punbb.informer.com/forums/topic/19682/punbb-1220-and-13rc-hotfix-released/; http://www.openwall.com/lists/oss-security/2008/09/09/10
CVE: CVE-2008-3969
Published: 2008-09-11
Description: Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of an incomplete fix for CVE-2008-3920.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/31690; http://secunia.com/advisories/31991; http://security.gentoo.org/glsa/glsa-200809-14.xml
CVE: CVE-2008-3970
Published: 2008-09-11
Description: pam_mount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://dev.medozas.de/gitweb.cgi?p=pam_mount%3Ba=commitdiff%3Bh=33b91d7659ae3aa78b1e94fd3f8e545ae5ff25db; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html; http://sourceforge.net/mailarchive/forum.php?thread_name=alpine.LNX.1.10[PII_REDACTED]120.17569%40fbirervta.pbzchgretzou.qr&forum_name=pam-mount-user
CVE: CVE-2008-3971
Published: 2008-09-11
Description: Heap-based buffer overflow in the open_man_file function in callbacks.c in gmanedit 0.4.1 allows remote attackers to execute arbitrary code via a crafted man page, which is not properly handled during utf8 conversion.  NOTE: another overflow was reported using a configuration file, but that vector does not have a scenario that crosses privilege boundaries.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=497835; http://www.openwall.com/lists/oss-security/2008/09/06/2; http://www.openwall.com/lists/oss-security/2008/09/09/13
CVE: CVE-2008-3972
Published: 2008-09-11
Description: pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html; http://secunia.com/advisories/32099; http://secunia.com/advisories/34362
CVE: CVE-2008-4018
Published: 2008-09-11
Description: swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors.  NOTE: this can be leveraged to gain privileges. NOTE: this issue exists because of an incomplete fix for CVE-2007-5805.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/swcons_advisory.asc; http://secunia.com/advisories/31739; http://securitytracker.com/id?1020818
CVE: CVE-2008-3584
Published: 2008-09-11
Description: NetBSD 3.0, 3.1, and 4.0, when a pppoe instance exists, does not properly check the length of a PPPoE packet tag, which allows remote attackers to cause a denial of service (system crash) via a crafted PPPoE packet.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-010.txt.asc; http://secunia.com/advisories/31597; http://support.apple.com/kb/HT3467
CVE: CVE-2008-4039
Published: 2008-09-11
Description: SQL injection vulnerability in index.php in Spice Classifieds allows remote attackers to execute arbitrary SQL commands via the cat_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31664; http://securityreason.com/securityalert/4237; http://www.securityfocus.com/bid/30985
CVE: CVE-2008-4040
Published: 2008-09-11
Description: Directory traversal vulnerability in the Kyocera Command Center in Kyocera FS-118MFP allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://packetstorm.linuxsecurity.com/0808-exploits/kyocera-traversal.txt; http://secunia.com/advisories/31680; http://www.securityfocus.com/bid/30971
CVE: CVE-2008-4041
Published: 2008-09-11
Description: The IMAP server in Softalk Mail Server (formerly WorkgroupMail) 8.5.1.431 allows remote authenticated users to cause a denial of service (resource consumption and daemon crash) via a long IMAP APPEND command with certain repeated parameters.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/31715; http://securityreason.com/securityalert/4238; http://www.securityfocus.com/archive/1/495896/100/0/threaded
CVE: CVE-2008-4042
Published: 2008-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-3889.  Reason: This candidate is a duplicate of CVE-2008-3889.  Notes: All CVE users should reference CVE-2008-3889 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-4043
Published: 2008-09-11
Description: Multiple SQL injection vulnerabilities in AJ Square AJ HYIP Acme allow remote attackers to execute arbitrary SQL commands via the artid parameter to (1) acme/article/comment.php and (2) prime/article/comment.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4240; http://www.securityfocus.com/bid/30974; https://exchange.xforce.ibmcloud.com/vulnerabilities/44803
CVE: CVE-2008-4044
Published: 2008-09-11
Description: SQL injection vulnerability in article/readarticle.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to execute arbitrary SQL commands via the artid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4241; http://www.securityfocus.com/bid/30978; https://exchange.xforce.ibmcloud.com/vulnerabilities/44803
CVE: CVE-2008-4045
Published: 2008-09-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in @Mail 5.42 allow remote attackers to inject arbitrary web script or HTML via the (1) file and (2) HelpFile parameters to parse.php, the (3) Folder and (4) start parameters to showmail.php, and the (5) abookview parameter to abook.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0808-exploits/atmail542-xss.txt; http://secunia.com/advisories/31720; http://secunia.com/advisories/31727
CVE: CVE-2008-4046
Published: 2008-09-11
Description: SQL injection vulnerability in index.php in eliteCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0809-exploits/elitecms-sql.txt; http://secunia.com/advisories/31722; http://www.securityfocus.com/bid/30990
CVE: CVE-2008-4047
Published: 2008-09-11
Description: Unspecified vulnerability in Novell Forum (formerly SiteScape Forum) 7.0, 7.1, 7.2, 7.3, and 8.0 allows remote attackers to execute arbitrary TCL code via a modified URL.  NOTE: this might overlap CVE-2007-6515.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://download.novell.com/Download?buildid=6k-5X-UPnrM~; http://secunia.com/advisories/31578; http://www.securityfocus.com/bid/30909
CVE: CVE-2008-4048
Published: 2008-09-11
Description: Heap-based buffer overflow in a certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remote attackers to execute arbitrary code via a long third argument to the CreateURLShortcut method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/31644; http://securityreason.com/securityalert/4242; http://www.securityfocus.com/bid/30891
CVE: CVE-2008-4049
Published: 2008-09-11
Description: A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remote attackers to execute arbitrary programs via arguments to the RunApp method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/31644; http://securityreason.com/securityalert/4243; http://www.securityfocus.com/bid/30889
CVE: CVE-2008-4050
Published: 2008-09-11
Description: A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remote attackers to (1) create and read arbitrary registry values via the RegistryValue method, and (2) read arbitrary files via the GetTextFile method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31644; http://securityreason.com/securityalert/4244; http://www.securityfocus.com/bid/30939
CVE: CVE-2008-4051
Published: 2008-09-11
Description: Cross-site scripting (XSS) vulnerability in surveyresults.asp in Smart Survey 1.0 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31637; http://www.securityfocus.com/bid/30841; http://www.securityfocus.com/bid/30841/exploit
CVE: CVE-2008-4052
Published: 2008-09-11
Description: Stack-based buffer overflow in SMGSHR.EXE in OpenVMS for Integrity Servers 8.2-1, 8.3, and 8.3-1H1 and OpenVMS ALPHA 7.3-2, 8.2, and 8.3 allows local users to cause a denial of service (crash) or gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://mail.openvms.org:8100/Lists/alerts/Message/832.html; http://mail.openvms.org:8100/Lists/alerts/Message/833.html; http://mail.openvms.org:8100/Lists/alerts/Message/834.html
CVE: CVE-2008-4053
Published: 2008-09-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in the Bluemoon PopnupBLOG module 3.20 and 3.30 for XOOPS allow remote attackers to inject arbitrary web script or HTML via the (1) param, (2) cat_id, and (3) view parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2008/08/popnupblog-indexphp-multiple-variables.html; http://secunia.com/advisories/31625; http://www.securityfocus.com/bid/30827
CVE: CVE-2008-4054
Published: 2008-09-11
Description: SQL injection vulnerability in indir.php in Kolifa.net Download Script 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31621; http://securityreason.com/securityalert/4235; http://www.securityfocus.com/bid/30839
CVE: CVE-2008-4055
Published: 2008-09-11
Description: SQL injection vulnerability in tops_top.php in Million Pixel Ad Script (Million Pixel Script) allows remote attackers to execute arbitrary SQL commands via the id_cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0808-exploits/millionpixel-sql.txt; http://secunia.com/advisories/31626; http://packetstorm.linuxsecurity.com/0808-exploits/millionpixel-sql.txt
CVE: CVE-2008-4056
Published: 2008-09-11
Description: Cross-site scripting (XSS) vulnerability in admin/login.php in Matterdaddy Market 1.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31943; http://www.securityfocus.com/bid/30848; http://www.securityfocus.com/bid/30848/exploit
CVE: CVE-2008-4057
Published: 2008-09-11
Description: Unspecified vulnerability in Objective Development Sharity 3 before 3.5 has unknown impact and attack vectors, related to a "serious security problem."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/31638; http://www.obdev.at/products/sharity/releasenotes.html; http://www.securityfocus.com/bid/30860
CVE: CVE-2008-2932
Published: 2008-09-12
Description: Heap-based buffer overflow in Red Hat adminutil 1.1.6 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via % (percent) encoded HTTP input to unspecified CGI scripts in Fedora Directory Server.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-2929.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31777; http://www.securityfocus.com/bid/31106; https://bugzilla.redhat.com/show_bug.cgi?id=454662
CVE: CVE-2008-3274
Published: 2008-09-12
Description: The default configuration of Red Hat Enterprise IPA 1.0.0 and FreeIPA before 1.1.1 places ldap:///anyone on the read ACL for the krbMKey attribute, which allows remote attackers to obtain the Kerberos master key via an anonymous LDAP query.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.fedorahosted.org/git/freeipa.git/?p=freeipa.git%3Ba=commit%3Bh=9932887f2af38b9701efec27707648c026ec445c; http://rhn.redhat.com/errata/RHSA-2008-0860.html; http://secunia.com/advisories/31861
CVE: CVE-2008-3529
Published: 2008-09-12
Description: Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://lists.apple.com/archives/security-announce/2009/May/msg00000.html; http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
CVE: CVE-2008-3823
Published: 2008-09-12
Description: Cross-site scripting (XSS) vulnerability in MIME/MIME/Contents.php in the MIME library in Horde 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of a MIME attachment in an e-mail message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=horde-announce&m=[PII_REDACTED]9867&w=2; http://ocert.org/patches/2008-012/MIME.patch; http://secunia.com/advisories/31842
CVE: CVE-2008-3824
Published: 2008-09-12
Description: Cross-site scripting (XSS) vulnerability in (1) Text_Filter/Filter/xss.php in Horde 3.1.x before 3.1.9 and 3.2.x before 3.2.2 and (2) externalinput.php in Popoon r22196 and earlier allows remote attackers to inject arbitrary web script or HTML by using / (slash) characters as replacements for spaces in an HTML e-mail message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.liip.ch/missed-case-in-externalinput-php-resulting-in-viable-xss-attacks.html; http://marc.info/?l=horde-announce&m=[PII_REDACTED]1491&w=2; http://marc.info/?l=horde-announce&m=[PII_REDACTED]9867&w=2
CVE: CVE-2008-3889
Published: 2008-09-12
Description: Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html; http://secunia.com/advisories/31716; http://secunia.com/advisories/31800
CVE: CVE-2008-4071
Published: 2008-09-15
Description: A certain ActiveX control in Adobe Acrobat 9, when used with Microsoft Windows Vista and Internet Explorer 7, allows remote attackers to cause a denial of service (browser crash) via an src property value with an invalid acroie:// URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/4257; https://exchange.xforce.ibmcloud.com/vulnerabilities/45195; https://www.exploit-db.com/exploits/6424
CVE: CVE-2008-4072
Published: 2008-09-15
Description: Multiple SQL injection vulnerabilities in index.php in phsBlog 0.2 allow remote attackers to execute arbitrary SQL commands via (1) the sid parameter in a pickup action or (2) the sql_cid parameter, different vectors than CVE-2008-3588.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31815; http://securityreason.com/securityalert/4246; http://www.securityfocus.com/archive/1/496233/100/0/threaded
CVE: CVE-2008-4073
Published: 2008-09-15
Description: SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary SQL commands via the pageid parameter in a DBpAGE action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4248; http://www.securityfocus.com/bid/31120; http://www.vupen.com/english/advisories/2008/2551
CVE: CVE-2008-4074
Published: 2008-09-15
Description: SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4247; http://www.securityfocus.com/bid/31137; https://exchange.xforce.ibmcloud.com/vulnerabilities/45049
CVE: CVE-2008-4075
Published: 2008-09-15
Description: Directory traversal vulnerability in index.php in D-iscussion Board 3.01 allows remote attackers to read arbitrary files via a .. (dot dot) in the topic parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31808; http://securityreason.com/securityalert/4249; http://www.securityfocus.com/bid/31135
CVE: CVE-2008-4076
Published: 2008-09-15
Description: Cross-site scripting (XSS) vulnerability in (1) Tor World Tor Board 1.3 and earlier, (2) Topics BBS 1.11 and earlier, (3) Simple BBS 1.86 and earlier, and (4) Interactive BBS 1.57 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2008-0917.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://download.torworld.com/bug/20080905.html; http://jvn.jp/en/jp/JVN18616622/index.html; http://secunia.com/advisories/31835
CVE: CVE-2008-4077
Published: 2008-09-15
Description: The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attackers to cause a denial of service (resource exhaustion) via an HTTP POST request with a large Content-Length.
CVSS Score: 7.8 (HIGH)
CWE: CWE-400
References: http://secunia.com/advisories/31843; http://securityreason.com/securityalert/4250; http://www.ledgersmb.org/node/70
CVE: CVE-2008-4078
Published: 2008-09-15
Description: SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31843; http://securityreason.com/securityalert/4250; http://sourceforge.net/project/shownotes.php?group_id=175965&release_id=624978
CVE: CVE-2008-4079
Published: 2008-09-15
Description: Cross-site scripting (XSS) vulnerability in Movable Type (MT) 4.x through 4.20, and 3.36 and earlier; Movable Type Enterprise 4.x through 4.20, and 1.54 and earlier; and Movable Type Community Solution allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN30385652/index.html; http://www.securityfocus.com/bid/31073; http://www.sixapart.jp/movabletype/news/2008/08/07-1445.html
CVE: CVE-2008-4080
Published: 2008-09-15
Description: SQL injection vulnerability in Stash 1.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the (1) username parameter to admin/library/authenticate.php and the (2) download parameter to downloadmp3.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/47994; http://secunia.com/advisories/31818; http://securityreason.com/securityalert/4252
CVE: CVE-2008-4081
Published: 2008-09-15
Description: admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by setting a bsm cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/4258; http://www.securityfocus.com/bid/30286; https://exchange.xforce.ibmcloud.com/vulnerabilities/43903