deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2059
Published: 2008-06-04
Description: Cisco Adaptive Security Appliance (ASA) and Cisco PIX security appliance 8.0.x before 8.0(3)9 allows remote attackers to bypass control-plane ACLs for the device via unknown vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30552; http://www.cisco.com/en/US/products/products_security_advisory09186a00809a8354.shtml; http://www.securitytracker.com/id?1020184
CVE: CVE-2008-2551
Published: 2008-06-04
Description: The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of arbitrary files via a URL in the propDownloadUrl parameter with the propPostDownloadAction parameter set to "run."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30512; http://securityreason.com/securityalert/3926; http://www.securityfocus.com/archive/1/493019/100/0/threaded
CVE: CVE-2007-5671
Published: 2008-06-05
Description: HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments in user-mode METHOD_NEITHER IOCTLs to the \\.\hgfs device, which allows guest OS users to modify arbitrary memory locations in guest kernel memory and gain privileges.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=712; http://secunia.com/advisories/30556; http://security.gentoo.org/glsa/glsa-201209-25.xml
CVE: CVE-2008-0967
Published: 2008-06-05
Description: Untrusted search path vulnerability in vmware-authd in VMware Workstation 5.x before 5.5.7 build 91707 and 6.x before 6.0.4 build 93057, VMware Player 1.x before 1.0.7 build 91707 and 2.x before 2.0.4 build 93057, and VMware Server before 1.0.6 build 91891 on Linux, and VMware ESXi 3.5 and VMware ESX 2.5.4 through 3.5, allows local users to gain privileges via a library path option in a configuration file.
CVSS Score: 6.9 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=713; http://secunia.com/advisories/30556; http://security.gentoo.org/glsa/glsa-201209-25.xml
CVE: CVE-2008-1518
Published: 2008-06-05
Description: Stack-based buffer overflow in kl1.sys in Kaspersky Anti-Virus 6.0 and 7.0 and Internet Security 6.0 and 7.0 allows local users to gain privileges via an IOCTL 0x800520e8 call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=704; http://secunia.com/advisories/30534; http://securitytracker.com/id?1020195
CVE: CVE-2008-2097
Published: 2008-06-05
Description: Buffer overflow in the openwsman management service in VMware ESXi 3.5 and ESX 3.5 allows remote authenticated users to gain privileges via an "invalid Content-Length."
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html; http://secunia.com/advisories/30556; http://secunia.com/advisories/30581
CVE: CVE-2008-2100
Published: 2008-06-05
Description: Multiple buffer overflows in VIX API 1.1.x before 1.1.4 build 93057 on VMware Workstation 5.x and 6.x, VMware Player 1.x and 2.x, VMware ACE 2.x, VMware Server 1.x, VMware Fusion 1.x, VMware ESXi 3.5, and VMware ESX 3.0.1 through 3.5 allow guest OS users to execute arbitrary code on the host OS via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30556; http://security.gentoo.org/glsa/glsa-201209-25.xml; http://securityreason.com/securityalert/3922
CVE: CVE-2008-2231
Published: 2008-06-05
Description: SQL injection vulnerability in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) R_2_5_0_94 and earlier allows remote attackers to execute SQL commands and read table information via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484499; http://marc.info/?l=oss-security&m=[PII_REDACTED]8005&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]7728&w=2
CVE: CVE-2008-2542
Published: 2008-06-05
Description: Stack-based buffer overflow in the getline function in Ppm/ppm.C in NASA Ames Research Center BigView 1.8 allows user-assisted remote attackers to execute arbitrary code via a crafted PNM file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/30546; http://securityreason.com/securityalert/3924; http://www.coresecurity.com/?action=item&id=2304
CVE: CVE-2008-2543
Published: 2008-06-05
Description: The ooh323 channel driver in Asterisk Addons 1.2.x before 1.2.9 and Asterisk-Addons 1.4.x before 1.4.7 creates a remotely accessible TCP port that is intended solely for localhost communication, and interprets some TCP application-data fields as addresses of memory to free, which allows remote attackers to cause a denial of service (daemon crash) via crafted TCP packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://downloads.digium.com/pub/security/AST-2008-009.html; http://secunia.com/advisories/30555; http://securitytracker.com/id?1020202
CVE: CVE-2008-2552
Published: 2008-06-05
Description: Unspecified vulnerability in the Service Tag Registry on Sun Solaris 10, and Sun Service Tag before 1.1.3, allows local users to cause a denial of service (disk consumption) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/30545; http://sunsolve.sun.com/search/document.do?assetkey=1-26-238414-1; http://sunsolve.sun.com/search/document.do?assetkey=1-77-1019316.1-1
CVE: CVE-2008-2553
Published: 2008-06-05
Description: Cross-site scripting (XSS) vulnerability in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) R_2_5_0_94 and earlier allows remote attackers to inject arbitrary web script or HTML via the userfield parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30551; http://secunia.com/advisories/31691; http://slashcode.cvs.sourceforge.net/slashcode/slash/Slash/Utility/Environment/Environment.pm?r1=1.223&r2=1.225
CVE: CVE-2008-2554
Published: 2008-06-05
Description: Multiple SQL injection vulnerabilities in BP Blog 6.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to template_permalink.asp and (2) cat parameter to template_archives_cat.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3925; http://www.securityfocus.com/archive/1/492902/100/0/threaded; http://www.securityfocus.com/bid/29460
CVE: CVE-2008-2555
Published: 2008-06-05
Description: SQL injection vulnerability in index.php in EasyWay CMS allows remote attackers to execute arbitrary SQL commands via the mid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30494; https://exchange.xforce.ibmcloud.com/vulnerabilities/42787; https://www.exploit-db.com/exploits/5706
CVE: CVE-2008-2556
Published: 2008-06-05
Description: SQL injection vulnerability in read.php in PHP Visit Counter 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the datespan parameter in a read action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/42789; https://www.exploit-db.com/exploits/5703; https://exchange.xforce.ibmcloud.com/vulnerabilities/42789
CVE: CVE-2008-2557
Published: 2008-06-05
Description: Cross-site scripting (XSS) vulnerability in CRE Loaded 6.2.13.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) Links and (2) Links Submit pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://oscommerceuniversity.com/lounge/index.php?topic=249.0; http://secunia.com/advisories/30655; http://www.securityfocus.com/bid/29786
CVE: CVE-2008-2558
Published: 2008-06-05
Description: CRE Loaded 6.2.13.1 and earlier does not set the "Secure" attribute for cookies that are sent over HTTPS, which might allow remote attackers to sniff the cookies if they are sent over HTTP.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://oscommerceuniversity.com/lounge/index.php?topic=255.0; https://exchange.xforce.ibmcloud.com/vulnerabilities/42889; http://oscommerceuniversity.com/lounge/index.php?topic=255.0
CVE: CVE-2008-2559
Published: 2008-06-05
Description: Integer overflow in Borland Interbase 2007 SP2 (8.1.0.256) allows remote attackers to execute arbitrary code via a malformed packet to TCP port 3050, which triggers a stack-based buffer overflow.  NOTE: this issue might be related to CVE-2008-0467.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/30299; http://securitytracker.com/id?1020092; http://www.coresecurity.com/?action=item&id=2278
CVE: CVE-2008-2560
Published: 2008-06-06
Description: SQL injection vulnerability in showpost.php in 427BB 2.3.1 allows remote attackers to execute arbitrary SQL commands via the post parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30520; http://www.securityfocus.com/bid/29564; https://exchange.xforce.ibmcloud.com/vulnerabilities/42876
CVE: CVE-2008-2561
Published: 2008-06-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in 427BB 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to (a) register.php, (b) reminder.php, and (c) search.php; the (2) uname, (3) email, and (4) email2 parameters to register.php; the (5) email parameter to reminder.php; and the (6) keywords parameter to search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30520; http://www.securityfocus.com/bid/29564; https://exchange.xforce.ibmcloud.com/vulnerabilities/42877
CVE: CVE-2008-2562
Published: 2008-06-06
Description: SQL injection vulnerability in edCss.php in PowerPhlogger 2.2.5 and earlier allows remote authenticated users to execute arbitrary SQL commands via the css_str parameter in an edit action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30423; http://www.securityfocus.com/bid/29566; https://exchange.xforce.ibmcloud.com/vulnerabilities/42870
CVE: CVE-2008-2563
Published: 2008-06-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) dsp_main.php and (2) dsp_task_editor.php in SamTodo 1.1 allow remote attackers to inject arbitrary web script or HTML via the (a) tid parameter in a main.taskeditor edit action, and the (b) completed parameter in a main.default action, to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30557; http://www.davidsopas.com/soapbox/samtodo.txt; http://www.securityfocus.com/bid/29568
CVE: CVE-2008-2564
Published: 2008-06-06
Description: SQL injection vulnerability in the JotLoader (com_jotloader) component 1.2.1.a and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30541; http://www.securityfocus.com/bid/29554; https://exchange.xforce.ibmcloud.com/vulnerabilities/42840
CVE: CVE-2008-2565
Published: 2008-06-06
Description: Multiple SQL injection vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.php and (2) edit.php.  NOTE: it was later reported that 4.0.x is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129789/PHP-Address-Book-Cross-Site-Scripting-SQL-Injection.html; http://secunia.com/advisories/30540; http://secunia.com/advisories/35590
CVE: CVE-2008-2566
Published: 2008-06-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the group parameter to (1) index.php or (2) the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129789/PHP-Address-Book-Cross-Site-Scripting-SQL-Injection.html; http://secunia.com/advisories/30540; https://exchange.xforce.ibmcloud.com/vulnerabilities/42856
CVE: CVE-2008-2567
Published: 2008-06-06
Description: Cross-site scripting (XSS) vulnerability in Fenriru Sleipnir 2.7.1 Release2 and earlier, Portable Sleipnir 2.7.1 Release2 and earlier, and Grani 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a history mechanism and favorites search, a different vulnerability than CVE-2007-6002.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN25448394/index.html; http://secunia.com/advisories/30487; http://www.fenrir.co.jp/sleipnir/note.html
CVE: CVE-2008-2568
Published: 2008-06-06
Description: SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) component 3.4 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a browse action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30461; http://www.securityfocus.com/bid/29565; https://exchange.xforce.ibmcloud.com/vulnerabilities/42871
CVE: CVE-2008-2569
Published: 2008-06-06
Description: SQL injection vulnerability in the EasyBook (com_easybook) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gbid parameter in a deleteentry action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30539; https://exchange.xforce.ibmcloud.com/vulnerabilities/42853; https://www.exploit-db.com/exploits/5740
CVE: CVE-2008-2570
Published: 2008-06-06
Description: Multiple unspecified vulnerabilities in LimeSurvey (formerly PHPSurveyor) before 1.71 have unknown impact and attack vectors.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/30495; http://sourceforge.net/project/shownotes.php?group_id=74605&release_id=603922; http://www.limesurvey.org/content/view/102/1/lang%2Cen/
CVE: CVE-2008-2571
Published: 2008-06-06
Description: Cross-site request forgery (CSRF) vulnerability in LimeSurvey (formerly PHPSurveyor) before 1.71 allows remote attackers to change arbitrary quotas as administrators via a "modify quota" action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30495; http://sourceforge.net/project/shownotes.php?group_id=74605&release_id=603922; http://www.limesurvey.org/content/view/102/1/lang%2Cen/
CVE: CVE-2008-2572
Published: 2008-06-06
Description: SQL injection vulnerability in php/leer_comentarios.php in FlashBlog allows remote attackers to execute arbitrary SQL commands via the articulo_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3927; http://www.securityfocus.com/archive/1/492748/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/43040
CVE: CVE-2008-2573
Published: 2008-06-06
Description: Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a long directory name in an SSH_FXP_OPENDIR (aka opendir) command.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30498; http://www.securityfocus.com/archive/1/493180/100/0/threaded; http://www.securityfocus.com/bid/29453
CVE: CVE-2008-1805
Published: 2008-06-06
Description: Incomplete blacklist vulnerability in Skype 3.6.0.248, and other versions before 3.8.0.139, allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI that ends in an executable extension that is not covered by the blacklist.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=711; http://secunia.com/advisories/30547; http://www.securityfocus.com/bid/29553
CVE: CVE-2008-2388
Published: 2008-06-06
Description: Multiple off-by-one errors in opensuse-updater in openSUSE 10.2 have unspecified impact and attack vectors.  NOTE: the vendor states that these "can be considered no security problem."
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html; http://secunia.com/advisories/30581; http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html
CVE: CVE-2008-2389
Published: 2008-06-06
Description: opensuse-updater in openSUSE 10.2 allows local users to access arbitrary files via a symlink attack.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html; http://secunia.com/advisories/30581; http://www.securityfocus.com/bid/29608
CVE: CVE-2008-2545
Published: 2008-06-06
Description: Skype 3.6.0.248, and other versions before 3.8.0.139, uses a case-sensitive comparison when checking for dangerous extensions, which allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI with a dangerous extension that uses a different case.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=711; http://secunia.com/advisories/30547; http://www.securityfocus.com/bid/29553
CVE: CVE-2008-2546
Published: 2008-06-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-1805.  Reason: This candidate is a reservation duplicate of CVE-2008-1805.  Notes: All CVE users should reference CVE-2008-1805 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-2574
Published: 2008-06-06
Description: Unrestricted file upload vulnerability in admin/Editor/imgupload.php in FlashBlog 0.31 beta allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the file in tus_imagenes/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/3928; http://www.dumenci.net/web-action/flashblog-beta0.31-remote-file-upload-vulnerability.html; http://www.flashblog.org
CVE: CVE-2008-2575
Published: 2008-06-06
Description: cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a (1) ZIP (aka .cbz) or (2) RAR (aka .cbr) archive filename.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://cvs.fedoraproject.org/viewcvs/rpms/cbrpager/devel/cbrpager-0.9.16-filen-shell-escaping.patch?rev=1.2; http://secunia.com/advisories/30417; http://secunia.com/advisories/30438
CVE: CVE-2008-1106
Published: 2008-06-09
Description: The management interface in Akamai Client (formerly Red Swoosh) 3322 and earlier allows remote attackers to bypass authentication via an HTTP request that contains (1) no Referer header, or (2) a spoofed Referer header that matches an approved domain, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and force the client to download and execute arbitrary files.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287, CWE-352
References: http://secunia.com/advisories/30135; http://secunia.com/secunia_research/2008-19/advisory/; http://securityreason.com/securityalert/3930
CVE: CVE-2008-1673
Published: 2008-06-10
Description: The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ddb2c43594f22843e9f3153da151deaba1a834c5; http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.6
CVE: CVE-2008-2358
Published: 2008-06-10
Description: Integer overflow in the dccp_feat_change function in net/dccp/feat.c in the Datagram Congestion Control Protocol (DCCP) subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html; http://secunia.com/advisories/30000; http://secunia.com/advisories/30818
CVE: CVE-2008-2626
Published: 2008-06-10
Description: SQL injection vulnerability in comment.asp in Battle Blog 1.25 and earlier allows remote attackers to execute arbitrary SQL commands via the entry parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30503; http://www.davethewebguy.com/battleblog/article.asp?entry=24; http://www.securityfocus.com/bid/29507
CVE: CVE-2008-2627
Published: 2008-06-10
Description: SQL injection vulnerability in the IDoBlog (com_idoblog) component b24 and earlier and 1.0, a component for Joomla!, allows remote attackers to execute arbitrary SQL commands via the userid parameter in a userblog action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30505; https://exchange.xforce.ibmcloud.com/vulnerabilities/42819; https://www.exploit-db.com/exploits/5730
CVE: CVE-2008-2628
Published: 2008-06-10
Description: SQL injection vulnerability in the eQuotes (com_equotes) component 0.9.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/42805; https://www.exploit-db.com/exploits/5723; https://exchange.xforce.ibmcloud.com/vulnerabilities/42805
CVE: CVE-2008-2629
Published: 2008-06-10
Description: SQL injection vulnerability in the LifeType (formerly pLog) module for Drupal allows remote attackers to execute arbitrary SQL commands via the albumId parameter in a ViewAlbum action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29495; https://exchange.xforce.ibmcloud.com/vulnerabilities/42808; https://www.exploit-db.com/exploits/5724
CVE: CVE-2008-2630
Published: 2008-06-10
Description: SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter in a category action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30443; http://www.vupen.com/english/advisories/2008/1736/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/42838
CVE: CVE-2008-2631
Published: 2008-06-10
Description: The WordClient interface in Alt-N Technologies MDaemon 9.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted HTTP POST request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/30474; https://exchange.xforce.ibmcloud.com/vulnerabilities/42809; http://secunia.com/advisories/30474
CVE: CVE-2008-2632
Published: 2008-06-10
Description: SQL injection vulnerability in the acctexp (com_acctexp) component 0.12.x and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the usage parameter in a subscribe action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/42794; https://www.exploit-db.com/exploits/5721; https://exchange.xforce.ibmcloud.com/vulnerabilities/42794