deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0603
Published: 2008-02-06
Description: SQL injection vulnerability in index.php in the amazOOP Awesom! (com_awesom) 0.3.2component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter in a viewlist task.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27607; https://www.exploit-db.com/exploits/5058; http://www.securityfocus.com/bid/27607
CVE: CVE-2008-0604
Published: 2008-02-06
Description: The LDAP authentication feature in XLight FTP Server before 2.83, when used with some unspecified LDAP servers, does not check for blank passwords, which allows remote attackers to bypass intended access restrictions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/28755; http://www.securityfocus.com/bid/27602; http://www.xlightftpd.com/whatsnew.htm
CVE: CVE-2008-0605
Published: 2008-02-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in AstroSoft HelpDesk before 1.95.228 allow remote attackers to inject arbitrary web script or HTML via the (1) txtSearch parameter to operator/article/article_search_results.asp and the (2) Attach_Id parameter to operator/article/article_attachment.asp.  NOTE: for vector 2, the XSS occurs in a forced SQL error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3612; http://www.securityfocus.com/archive/1/487487/100/0/threaded; http://www.securityfocus.com/archive/1/488107/100/0/threaded
CVE: CVE-2008-0606
Published: 2008-02-06
Description: SQL injection vulnerability in index.php in the Shambo2 (com_shambo2) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27609; https://exchange.xforce.ibmcloud.com/vulnerabilities/40238; https://www.exploit-db.com/exploits/5059
CVE: CVE-2008-0607
Published: 2008-02-06
Description: SQL injection vulnerability in index.php in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) 2.5.3 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27617; https://www.exploit-db.com/exploits/5038; http://www.securityfocus.com/bid/27617
CVE: CVE-2008-0608
Published: 2008-02-06
Description: The Logging Server (ftplogsrv.exe) 7.9.14.0 and earlier in IPSwitch WS_FTP 6.1 allows remote attackers to cause a denial of service (loss of responsiveness) via a large number of large packets to port 5151/udp, which causes the listening socket to terminate and prevents log commands from being recorded, a different vulnerability than CVE-2007-3823.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/ftplogsrvz-adv.txt; http://secunia.com/advisories/28761; http://www.securityfocus.com/archive/1/487506/100/0/threaded
CVE: CVE-2008-0609
Published: 2008-02-06
Description: Directory traversal vulnerability in index.php in DivideConcept VHD Web Pack 2.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/28712; http://securityreason.com/securityalert/3613; http://www.securityfocus.com/archive/1/487485/100/0/threaded
CVE: CVE-2008-0610
Published: 2008-02-06
Description: Stack-based buffer overflow in the ClientConnection::NegotiateProtocolVersion function in vncviewer/ClientConnection.cpp in vncviewer for UltraVNC 1.0.2 and 1.0.4 before 01252008, when in LISTENING mode or when using the DSM plugin, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a modified size value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://forum.ultravnc.info/viewtopic.php?t=11850; http://secunia.com/advisories/28747; http://sourceforge.net/project/shownotes.php?release_id=571174&group_id=63887
CVE: CVE-2008-0611
Published: 2008-02-06
Description: SQL injection vulnerability in rmgs/images.php in the RMSOFT Gallery System 2.0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27623; https://www.exploit-db.com/exploits/5062; http://www.securityfocus.com/bid/27623
CVE: CVE-2008-0612
Published: 2008-02-06
Description: Directory traversal vulnerability in htdocs/install/index.php in XOOPS 2.0.18 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3614; http://www.securityfocus.com/archive/1/487484/100/0/threaded; http://www.securityfocus.com/bid/27622
CVE: CVE-2008-0613
Published: 2008-02-06
Description: Open redirect vulnerability in htdocs/user.php in XOOPS 2.0.18 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the xoops_redirect parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-59
References: http://securityreason.com/securityalert/3614; http://sourceforge.net/tracker/index.php?func=detail&atid=430840&aid=1881236&group_id=41586; http://www.securityfocus.com/archive/1/487484/100/0/threaded
CVE: CVE-2008-0614
Published: 2008-02-06
Description: SQL injection vulnerability in index.php in Photokorn Gallery 1.543 allows remote attackers to execute arbitrary SQL commands via the pic parameter in a showpic action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27627; https://www.exploit-db.com/exploits/5065; http://www.securityfocus.com/bid/27627
CVE: CVE-2008-0615
Published: 2008-02-06
Description: Directory traversal vulnerability in wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) folder and (2) file parameters.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28759; http://securityreason.com/securityalert/3615; http://www.securityfocus.com/archive/1/487437/100/0/threaded
CVE: CVE-2008-0616
Published: 2008-02-06
Description: SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors.  NOTE: it is not clear whether this issue crosses privilege boundaries.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/3615; http://www.securityfocus.com/archive/1/487437/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/40196
CVE: CVE-2008-0617
Published: 2008-02-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter to wp-admin/admin.php, or the (2) messagefield parameter in the guestbook page, and the (3) title parameter in the messagearea.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3615; http://www.securityfocus.com/archive/1/487437/100/0/threaded; http://www.securityfocus.com/bid/27575
CVE: CVE-2008-0618
Published: 2008-02-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) gbname, (2) gbemail, (3) gburl, and (4) gbmsg parameters to unspecified programs.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28759; http://secunia.com/advisories/28759
CVE: CVE-2008-0619
Published: 2008-02-06
Description: Buffer overflow in NeroMediaPlayer.exe in Nero Media Player 1.4.0.35 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (persistent crash) via a long URI in a .M3U file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28765; http://securityreason.com/securityalert/3616; http://www.securityfocus.com/archive/1/487578/100/0/threaded
CVE: CVE-2008-0620
Published: 2008-02-06
Description: SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to cause a denial of service (crash) via a 0x53 LPD command, which causes the server to terminate.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28786; http://secunia.com/advisories/28811; http://securityreason.com/securityalert/3619
CVE: CVE-2008-0621
Published: 2008-02-06
Description: Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the (1) 0x01, (2) 0x02, (3) 0x03, (4) 0x04, and (5) 0x05 LPD commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28786; http://secunia.com/advisories/28811; http://securityreason.com/securityalert/3619
CVE: CVE-2008-0622
Published: 2008-02-06
Description: Cross-site scripting (XSS) vulnerability in RaidenHTTPD 2.0.19 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the ulang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/28770; http://www.raidenhttpd.com/jp/security.html
CVE: CVE-2008-0212
Published: 2008-02-06
Description: ovtopmd in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allows remote attackers to cause a denial of service (crash) via a crafted TCP request that triggers an out-of-bounds memory access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=652; http://secunia.com/advisories/28798; http://www.securityfocus.com/archive/1/487586/100/0/threaded
CVE: CVE-2008-0623
Published: 2008-02-06
Description: Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows remote attackers to execute arbitrary code via a long argument to the AddImage method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/28757; http://www.kb.cert.org/vuls/id/101676; http://www.securityfocus.com/bid/27590
CVE: CVE-2008-0624
Published: 2008-02-06
Description: Buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! JukeBox 2.2.2.56 allows remote attackers to execute arbitrary code via a long argument to the AddButton method, a different vulnerability than CVE-2008-0623.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/28757; http://www.kb.cert.org/vuls/id/101676; http://www.securityfocus.com/bid/27579
CVE: CVE-2008-0625
Published: 2008-02-06
Description: Buffer overflow in the MediaGrid ActiveX control (mediagrid.dll) in Yahoo! Music Jukebox 2.2.2.56 allows remote attackers to execute arbitrary code via a long argument to the AddBitmap method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/28757; http://www.kb.cert.org/vuls/id/340860; http://www.securityfocus.com/bid/27578
CVE: CVE-2008-0626
Published: 2008-02-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-6303.  Reason: This candidate is a duplicate of CVE-2007-6303.  Notes: All CVE users should reference CVE-2007-6303 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-0627
Published: 2008-02-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-6304.  Reason: This candidate is a duplicate of CVE-2007-6304.  Notes: All CVE users should reference CVE-2007-6304 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-0628
Published: 2008-02-06
Description: The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://dev2dev.bea.com/pub/advisory/277; http://scary.beasts.org/security/CESA-2007-002.html; http://secunia.com/advisories/28746
CVE: CVE-2008-0629
Published: 2008-02-06
Description: Buffer overflow in stream_cddb.c in MPlayer 1.0rc2 and SVN before r25824 allows remote user-assisted attackers to execute arbitrary code via a CDDB database entry containing a long album title.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/28955; http://secunia.com/advisories/28956; http://secunia.com/advisories/29307
CVE: CVE-2008-0630
Published: 2008-02-06
Description: Buffer overflow in url.c in MPlayer 1.0rc2 and SVN before r25823 allows remote attackers to execute arbitrary code via a crafted URL that prevents the IPv6 parsing code from setting a pointer to NULL, which causes the buffer to be reused by the unescape code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/28955; http://secunia.com/advisories/28956; http://secunia.com/advisories/29307
CVE: CVE-2008-0631
Published: 2008-02-06
Description: Multiple ActiveX controls in MailBee.dll in MailBee Objects 5.5 allow remote attackers to (1) overwrite arbitrary files via the SaveToDisk method, or (2) modify files via the AddStringToFile method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/27481; https://exchange.xforce.ibmcloud.com/vulnerabilities/40011; https://www.exploit-db.com/exploits/4999
CVE: CVE-2008-0632
Published: 2008-02-06
Description: Unrestricted file upload vulnerability in cp_upload_image.php in LightBlog 9.5 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the blog's root directory.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://omni.netsons.org/blog/?p=11; http://secunia.com/advisories/28734; http://securityreason.com/securityalert/3617
CVE: CVE-2008-0633
Published: 2008-02-06
Description: Buffer overflow in Anon Proxy Server 0.102 and earlier, when user authentication is enabled, allows remote attackers to cause a denial of service (exception) via a user name with a large number of quotes, which triggers the overflow during escaping.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119
References: http://securityreason.com/securityalert/3618; http://www.securityfocus.com/archive/1/487446/100/0/threaded; http://www.securityfocus.com/bid/27593
CVE: CVE-2008-0634
Published: 2008-02-06
Description: Buffer overflow in the NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1, as used in Sejoong Namo ActiveSquare6, allows remote attackers to execute arbitrary code via a long argument to the Install method, a different vulnerability than CVE-2008-0551.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28649; https://exchange.xforce.ibmcloud.com/vulnerabilities/40199; https://www.exploit-db.com/exploits/5045
CVE: CVE-2008-0635
Published: 2008-02-06
Description: Unspecified vulnerability in the delivery engine in Openads 2.4.0 through 2.4.2 allows remote attackers to execute arbitrary PHP code via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28790; http://securityreason.com/securityalert/3620; http://www.securityfocus.com/archive/1/487486/100/0/threaded
CVE: CVE-2008-0457
Published: 2008-02-07
Description: Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/28787; http://seer.entsupport.symantec.com/docs/297171.htm; http://www.securityfocus.com/archive/1/487688/100/0/threaded
CVE: CVE-2008-0553
Published: 2008-02-07
Description: Stack-based buffer overflow in the ReadImage function in tkImgGIF.c in Tk (Tcl/Tk) before 8.5.1 allows remote attackers to execute arbitrary code via a crafted GIF image, a similar issue to CVE-2006-4484.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html; http://secunia.com/advisories/28784; http://secunia.com/advisories/28807
CVE: CVE-2008-0645
Published: 2008-02-07
Description: Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 allow remote attackers to execute arbitrary PHP code via a URL in the site_path parameter to (1) config/conf-activation.php, (2) menu/item.php, and (3) modules/conf_modules.php in admin/system/; and (4) system/login.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/27616; http://www.securityfocus.com/bid/27616
CVE: CVE-2008-0646
Published: 2008-02-07
Description: The bdecode_recursive function in include/libtorrent/bencode.hpp in Rasterbar Software libtorrent before 0.12.1, as used in Deluge before 0.5.8.3 and other products, allows context-dependent attackers to cause a denial of service (stack exhaustion and crash) via a crafted bencoded message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://deluge-torrent.org/Changelog.php; http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_12/include/libtorrent/bencode.hpp?r1=956&r2=1968&pathrev=1968; http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_12/include/libtorrent/bencode.hpp?view=log&pathrev=1968#rev1968
CVE: CVE-2008-0647
Published: 2008-02-07
Description: Multiple stack-based buffer overflows in the HanGamePluginCn18.HanGamePluginCn18.1 ActiveX control in HanGamePluginCn18.dll in Ourgame GLWorld 2.6.1.29 (aka Lianzong Game Platform) allow remote attackers to execute arbitrary code via long arguments to the (1) hgs_startGame and (2) hgs_startNotify methods, as exploited in the wild as of February 2008.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28809; http://www.securityfocus.com/bid/27626; http://www.symantec.com/enterprise/security_response/weblog/2008/02/zeroday_exploit_for_lianzong_g.html
CVE: CVE-2008-0648
Published: 2008-02-07
Description: Multiple PHP remote file inclusion vulnerabilities in OpenSiteAdmin 0.9.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) indexFooter.php; and (2) DatabaseManager.php, (3) FieldManager.php, (4) Filter.php, (5) Form.php, (6) FormManager.php, (7) LoginManager.php, and (8) Filters/SingleFilter.php in scripts/classes/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/27640; https://www.exploit-db.com/exploits/5068; http://www.securityfocus.com/bid/27640
CVE: CVE-2008-0649
Published: 2008-02-07
Description: SQL injection vulnerability in detail.php in Astanda Directory Project (ADP) 1.2 and 1.3 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27646; https://www.exploit-db.com/exploits/5071; http://www.securityfocus.com/bid/27646
CVE: CVE-2008-0650
Published: 2008-02-07
Description: SQL injection vulnerability in login.php in Simple OS CMS 0.1c beta allows remote attackers to execute arbitrary SQL commands via the username field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27589; http://www.securityfocus.com/bid/27589
CVE: CVE-2008-0651
Published: 2008-02-07
Description: SQL injection vulnerability in login.php in Pedro Santana Codice CMS allows remote attackers to execute arbitrary SQL commands via the username field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27592; http://www.securityfocus.com/bid/27592
CVE: CVE-2008-0652
Published: 2008-02-07
Description: SQL injection vulnerability in index.php in the Downloads (com_downloads) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in a selectfolder action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27648; https://www.exploit-db.com/exploits/5073; http://www.securityfocus.com/bid/27648
CVE: CVE-2008-0653
Published: 2008-02-07
Description: SQL injection vulnerability in index.php in the Ynews (com_ynews) 1.0.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showYNews action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27649; https://www.exploit-db.com/exploits/5072; http://www.securityfocus.com/bid/27649
CVE: CVE-2008-0654
Published: 2008-02-07
Description: Multiple directory traversal vulnerabilities in Azucar CMS 1.3 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _VIEW (view) parameter to (1) index.php, (2) html/sitio/index.php, or (3) src/sistema/vistas/template/tpl_inicio.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3622; http://www.securityfocus.com/archive/1/487595/100/0/threaded; http://securityreason.com/securityalert/3622
CVE: CVE-2008-0655
Published: 2008-02-07
Description: Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200, CWE-200
References: http://blogs.adobe.com/acroread/2008/02/adobe_reader_812_for_linux_and.html; http://kb.adobe.com/selfservice/viewContent.do?externalId=kb403079&sliceId=1; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00007.html
CVE: CVE-2008-0656
Published: 2008-02-07
Description: Unrestricted file upload vulnerability in dmclTrace.jsp in EMC Documentum Administrator 5.3.0.313 and Webtop 5.3.0.317 allows remote attackers to overwrite arbitrary files via the filename attribute.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/28810; http://securityreason.com/securityalert/3626; http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_Documentum_dmclTrace_Arbitrary_file_overwrite.pdf
CVE: CVE-2008-0657
Published: 2008-02-07
Description: Multiple unspecified vulnerabilities in the Java Runtime Environment in Sun JDK and JRE 6 Update 1 and earlier, and 5.0 Update 13 and earlier, allow context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://dev2dev.bea.com/pub/advisory/277; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html; http://secunia.com/advisories/28795