deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4117
Published: 2008-09-18
Description: Unspecified vulnerability in a web page in the PRM module in Sun Management Center (SunMC) 3.6.1 and 4.0 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/31841; http://sunsolve.sun.com/search/document.do?assetkey=1-26-241686-1; http://www.securityfocus.com/bid/31194
CVE: CVE-2008-4118
Published: 2008-09-18
Description: Cross-site scripting (XSS) vulnerability in High Norm Sound Master 2nd 1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://high-norm.rash.jp/script_soundmaster2nd.html; http://high-norm.rash.jp/script_soundmaster2nd.html.; http://jvn.jp/en/jp/JVN55010230/index.html
CVE: CVE-2008-4099
Published: 2008-09-18
Description: PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-16
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=490217; http://packages.debian.org/changelogs/pool/main/p/python-dns/python-dns_2.3.3-1/changelog; http://www.openwall.com/lists/oss-security/2008/09/11/1
CVE: CVE-2008-4100
Published: 2008-09-18
Description: GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.  NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-16
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698; http://www.openwall.com/lists/oss-security/2008/09/11/1; http://www.openwall.com/lists/oss-security/2008/09/16/4
CVE: CVE-2008-4101
Published: 2008-09-18
Description: Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://ftp.vim.org/pub/vim/patches/7.2/7.2.010; http://groups.google.com/group/vim_dev/attach/9290f26f9bc11b33/K-arbitrary-command-execution.patch.v3?part=2; http://groups.google.com/group/vim_dev/attach/dd32ad3a84f36bb2/K-arbitrary-command-execution.patch?part=2
CVE: CVE-2008-4102
Published: 2008-09-18
Description: Joomla! 1.5 before 1.5.7 initializes PHP's PRNG with a weak seed, which makes it easier for attackers to guess the pseudo-random values produced by PHP's mt_rand function, as demonstrated by guessing password reset tokens, a different vulnerability than CVE-2008-3681.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://developer.joomla.org/security/news/[PII_REDACTED]2-core-random-number-generation-flaw.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]5232&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]9084&w=2
CVE: CVE-2008-4103
Published: 2008-09-18
Description: The mailto (aka com_mailto) component in Joomla! 1.5 before 1.5.7 sends e-mail messages without validating the URL, which allows remote attackers to transmit spam.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://developer.joomla.org/security/news/[PII_REDACTED]3-core-commailto-spam.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]5232&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]9084&w=2
CVE: CVE-2008-4104
Published: 2008-09-18
Description: Multiple open redirect vulnerabilities in Joomla! 1.5 before 1.5.7 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a "passed in" URL.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-59
References: http://developer.joomla.org/security/news/[PII_REDACTED]4-core-redirect-spam.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]5232&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]9084&w=2
CVE: CVE-2008-4105
Published: 2008-09-18
Description: JRequest in Joomla! 1.5 before 1.5.7 does not sanitize variables that were set with JRequest::setVar, which allows remote attackers to conduct "variable injection" attacks and have unspecified other impact.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-jrequest-variable-injection.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]5232&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]9084&w=2
CVE: CVE-2008-4106
Published: 2008-09-18
Description: WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user's password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability." NOTE: the attacker can discover the random password by also exploiting CVE-2008-4107.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]7099&w=2; http://secunia.com/advisories/31737; http://secunia.com/advisories/31870
CVE: CVE-2008-4107
Published: 2008-09-18
Description: The (1) rand and (2) mt_rand functions in PHP 5.2.6 do not produce cryptographically strong random numbers, which allows attackers to leverage exposures in products that rely on these functions for security-relevant functionality, as demonstrated by the password-reset functionality in Joomla! 1.5.x and WordPress before 2.6.2, a different vulnerability than CVE-2008-2107, CVE-2008-2108, and CVE-2008-4102.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-189
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]7099&w=2; http://osvdb.org/48700; http://secunia.com/advisories/31737
CVE: CVE-2008-4108
Published: 2008-09-18
Description: Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard moving tool) in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file.  NOTE: there may not be common usage scenarios in which tmp$RANDOM.tmp is located in an untrusted directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498899; http://marc.info/?l=oss-security&m=[PII_REDACTED]3513&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]7434&w=2
CVE: CVE-2008-4125
Published: 2008-09-18
Description: The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain potentially sensitive information, as demonstrated by a cross-application attack against WordPress, a different vulnerability than CVE-2006-0632.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.suspekt.org/2008/08/17/mt_srand-and-not-so-random-numbers/; https://exchange.xforce.ibmcloud.com/vulnerabilities/45415; http://www.suspekt.org/2008/08/17/mt_srand-and-not-so-random-numbers/
CVE: CVE-2008-4126
Published: 2008-09-18
Description: PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transaction IDs for DNS retries, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4099.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-16
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=490217; http://packages.debian.org/changelogs/pool/main/p/python-dns/python-dns_2.3.3-1/changelog; http://www.openwall.com/lists/oss-security/2008/09/11/1
CVE: CVE-2008-4127
Published: 2008-09-18
Description: Mshtml.dll in Microsoft Internet Explorer 7 Gold 7.0.5730 and 8 Beta 8.0.6001 on Windows XP SP2 allows remote attackers to cause a denial of service (failure of subsequent image rendering) via a crafted PNG file, related to an infinite loop in the CDwnTaskExec::ThreadExec function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://securityreason.com/securityalert/4273; http://www.securityfocus.com/archive/1/496483/100/0/threaded; http://www.securityfocus.com/bid/31215
CVE: CVE-2008-2470
Published: 2008-09-18
Description: The InstallShield Update Service Agent ActiveX control in isusweb.dll allows remote attackers to cause a denial of service (memory corruption and browser crash) and possibly execute arbitrary code via a call to ExecuteRemote with a URL that results in a 404 error response.
CVSS Score: 9.3 (HIGH)
References: http://support.installshield.com/kb/view.asp?articleid=Q113020; http://www.kb.cert.org/vuls/id/630017; http://www.securityfocus.com/bid/31235
CVE: CVE-2008-3662
Published: 2008-09-18
Description: Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://gallery.menalto.com/gallery_1.5.9_released; http://gallery.menalto.com/gallery_2.2.6_released; http://int21.de/cve/CVE-2008-3662-gallery.html
CVE: CVE-2008-4128
Published: 2008-09-18
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-352
References: http://jbrownsec.blogspot.com/2008/09/cisco-0day-released.html; http://www.securityfocus.com/bid/31218; https://exchange.xforce.ibmcloud.com/vulnerabilities/45226
CVE: CVE-2008-4129
Published: 2008-09-18
Description: Gallery before 1.5.9, and 2.x before 2.2.6, does not properly handle ZIP archives containing symbolic links, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files via vectors related to the archive upload (aka zip upload) functionality.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://gallery.menalto.com/gallery_1.5.9_released; http://gallery.menalto.com/gallery_2.2.6_released; http://secunia.com/advisories/31912
CVE: CVE-2008-4130
Published: 2008-09-18
Description: Cross-site scripting (XSS) vulnerability in Gallery 2.x before 2.2.6 allows remote attackers to inject arbitrary web script or HTML via a crafted Flash animation, related to the ability of the animation to "interact with the embedding page."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://gallery.menalto.com/gallery_2.2.6_released; http://secunia.com/advisories/31858; http://secunia.com/advisories/32662
CVE: CVE-2008-4131
Published: 2008-09-19
Description: Multiple unspecified vulnerabilities in Sun Solaris 8 through 10 allow local users to gain privileges via vectors related to handling of tags with (1) the -t option and (2) the :tag command in the (a) vi, (b) ex, (c) vedit, (d) view, and (e) edit programs.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31895; http://secunia.com/advisories/31907; http://securitytracker.com/id?1020898
CVE: CVE-2008-4132
Published: 2008-09-19
Description: Stack-based buffer overflow in the VSFlexGrid.VSFlexGridL ActiveX control in ComponentOne VSFlexGrid 7.0.1.151 and 8.0.20072.239 allows remote attackers to execute arbitrary code via a long first argument to the Archive method.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/31200; https://exchange.xforce.ibmcloud.com/vulnerabilities/45184; http://www.securityfocus.com/bid/31200
CVE: CVE-2008-4133
Published: 2008-09-19
Description: The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0133.html; http://secunia.com/advisories/31767; http://securityreason.com/securityalert/4276
CVE: CVE-2008-4134
Published: 2008-09-19
Description: PHP remote file inclusion vulnerability in manager/static/view.php in phpRealty 0.03 and earlier, and possibly other versions before 0.05, allows remote attackers to execute arbitrary PHP code via a URL in the INC parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://php-realty.com/; http://secunia.com/advisories/31874; http://securityreason.com/securityalert/4277
CVE: CVE-2008-4135
Published: 2008-09-19
Description: Symbian OS S60 3rd edition on the Nokia E90 Communicator 07.40.1.2 Ra-6 and Nseries N82 allows remote attackers to cause a denial of service (device crash) via multiple deauthentication (DeAuth) frames.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/31857; http://securityreason.com/securityalert/4278; http://www.securityfocus.com/bid/31175
CVE: CVE-2008-4154
Published: 2008-09-19
Description: SQL injection vulnerability in living-e webEdition CMS allows remote attackers to execute arbitrary SQL commands via the we_objectID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31560; http://securityreason.com/securityalert/4279; http://www.securityfocus.com/bid/30778
CVE: CVE-2008-4155
Published: 2008-09-19
Description: Multiple directory traversal vulnerabilities in EasySite 2.3 allow remote attackers to read arbitrary files or list directories via a .. (dot dot) in the (1) module or (2) action parameter in (a) www/index.php; the (3) module, (4) ss_module, or (5) ss_action parameter in (b) modules/Module/index.php or (c) modules/Themes/index.php; or the (6) module parameter in (d) inc/vmenu.php.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31570; http://securityreason.com/securityalert/4280; http://www.securityfocus.com/bid/30784
CVE: CVE-2008-4156
Published: 2008-09-19
Description: SQL injection vulnerability in print.php in CustomCms (CCMS) Gaming Portal 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31562; http://securityreason.com/securityalert/4281; http://www.securityfocus.com/bid/30787
CVE: CVE-2008-4157
Published: 2008-09-22
Description: SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter, a different vector than CVE-2007-3610.  NOTE: it was later reported that 1.2.3 is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/48018; http://packetstormsecurity.com/files/122746/PHP-VID-XSS-SQL-Injection-CRLF-Injection.html; http://packetstormsecurity.com/files/130754/Vastal-I-tech-phpVID-1.2.3-SQL-Injection.html
CVE: CVE-2008-4158
Published: 2008-09-22
Description: Multiple directory traversal vulnerabilities in index.php in Zanfi CMS lite 1.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) flag and (2) inc parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4290; https://exchange.xforce.ibmcloud.com/vulnerabilities/45027; https://www.exploit-db.com/exploits/6413
CVE: CVE-2008-4159
Published: 2008-09-22
Description: SQL injection vulnerability in index.php in Jaw Portal and Zanfi CMS lite and allows remote attackers to execute arbitrary SQL commands via the page (pageid) parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4283; http://www.securityfocus.com/bid/31116; https://exchange.xforce.ibmcloud.com/vulnerabilities/45029
CVE: CVE-2008-4165
Published: 2008-09-22
Description: admin/user/create_user.php in Kolab Groupware Server 1.0.0 places a user password in an HTTP GET request, which allows local administrators, and possibly remote attackers, to obtain cleartext passwords by reading the ssl_access_log file or the referer string.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:193; http://www.securityfocus.com/bid/31165; https://exchange.xforce.ibmcloud.com/vulnerabilities/45124
CVE: CVE-2008-4166
Published: 2008-09-22
Description: Integer overflow in the JavaScript engine in Avant Browser 11.7 Build 9 and earlier allows remote attackers to cause a denial of service (application crash) by attempting to URL encode a string containing many instances of an invalid character.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://securityreason.com/securityalert/4284; http://www.securityfocus.com/archive/1/496301/100/0/threaded; http://www.securityfocus.com/bid/31155
CVE: CVE-2008-4167
Published: 2008-09-22
Description: useradmin.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 does not require administrative authentication, which allows remote attackers to (1) add or (2) remove an Administrator account.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/31774; http://securityreason.com/securityalert/4282; http://www.securityfocus.com/bid/31161
CVE: CVE-2008-4168
Published: 2008-09-22
Description: Cross-site scripting (XSS) vulnerability in verify_login.jsp in Pro2col Stingray FTS allows remote attackers to inject arbitrary web script or HTML via the form_username parameter (aka user name field).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4285; http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3809; http://www.securityfocus.com/archive/1/496302/100/0/threaded
CVE: CVE-2008-4169
Published: 2008-09-22
Description: SQL injection vulnerability in detaillist.php in iScripts EasyIndex, possibly 1.0, allows remote attackers to execute arbitrary SQL commands via the produid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31788; http://securityreason.com/securityalert/4286; http://www.securityfocus.com/bid/31202
CVE: CVE-2008-4170
Published: 2008-09-22
Description: create_account.php in osCommerce 2.2 RC 2a allows remote attackers to obtain sensitive information via an invalid dob parameter, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://securityreason.com/securityalert/4293; http://www.securityfocus.com/archive/1/496417/100/0/threaded; http://www.securityfocus.com/bid/31209
CVE: CVE-2008-4171
Published: 2008-09-22
Description: SQL injection vulnerability in xmlout.php in Invision Power Board (IP.Board or IPB) 2.2.x and 2.3.x allows remote attackers to execute arbitrary SQL commands via the name parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forums.invisionpower.com/index.php?showtopic=276512; http://www.securityfocus.com/bid/31288; http://www.securitytracker.com/id?1020817
CVE: CVE-2008-4172
Published: 2008-09-22
Description: SQL injection vulnerability in page.php in Cars & Vehicle (aka Cars-Vehicle Script) allows remote attackers to execute arbitrary SQL commands via the lnkid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0809-exploits/carsvehicle-sql.txt; http://www.securityfocus.com/bid/31214; https://exchange.xforce.ibmcloud.com/vulnerabilities/45210
CVE: CVE-2008-4173
Published: 2008-09-22
Description: SQL injection vulnerability in ProArcadeScript 1.3 allows remote attackers to execute arbitrary SQL commands via the random parameter to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31931; http://securityreason.com/securityalert/4292; http://www.securityfocus.com/bid/31238
CVE: CVE-2008-3949
Published: 2008-09-22
Description: emacs/lisp/progmodes/python.el in Emacs 22.1 and 22.2 imports Python script from the current working directory during editing of a Python file, which allows local users to execute arbitrary code via a Trojan horse Python file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html; http://secunia.com/advisories/31982
CVE: CVE-2008-4160
Published: 2008-09-22
Description: Unspecified vulnerability in the UFS module in Sun Solaris 8 through 10 and OpenSolaris allows local users to cause a denial of service (NULL pointer dereference and kernel panic) via unknown vectors related to the Solaris Access Control List (ACL) implementation.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/31919; http://secunia.com/advisories/32125; http://sunsolve.sun.com/search/document.do?assetkey=1-26-242267-1
CVE: CVE-2008-4161
Published: 2008-09-22
Description: SQL injection vulnerability in search_inv.php in Assetman 2.5b allows remote attackers to execute arbitrary SQL commands and conduct session fixation attacks via a combination of crafted order and order_by parameters in a search_all action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31935; http://securityreason.com/securityalert/4287; http://www.securityfocus.com/bid/31248
CVE: CVE-2008-4162
Published: 2008-09-22
Description: Open redirect vulnerability in admin/auth.php in NooMS 1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the g_site_url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-59
References: http://securityreason.com/securityalert/4289; http://www.securityfocus.com/archive/1/496236/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/45075
CVE: CVE-2008-4163
Published: 2008-09-22
Description: Unspecified vulnerability in ISC BIND 9.3.5-P2-W1, 9.4.2-P2-W1, and 9.5.0-P2-W1 on Windows allows remote attackers to cause a denial of service (UDP client handler termination) via unknown vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://marc.info/?l=bind-announce&m=[PII_REDACTED]8376&w=2; http://marc.info/?l=bind-announce&m=[PII_REDACTED]8378&w=2; http://marc.info/?l=bind-announce&m=[PII_REDACTED]0150&w=2
CVE: CVE-2008-4164
Published: 2008-09-22
Description: cron.php in MemHT Portal 3.9.0 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://securityreason.com/securityalert/4288; https://exchange.xforce.ibmcloud.com/vulnerabilities/45413; https://www.exploit-db.com/exploits/6393
CVE: CVE-2008-3519
Published: 2008-09-23
Description: The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain sensitive information (non-EJB classes) via a download request, a different vulnerability than CVE-2008-3273.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=458823; http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp04/html-single/readme/index.html; http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp02/html-single/readme/index.html