deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1972
Published: 2008-04-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the user account creation feature in Exponent CMS 0.96.6-GA20071003 and earlier, when the Allow Registration? configuration option is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) firstname, (3) lastname, and (4) e-mail address fields.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29875; http://sourceforge.net/project/shownotes.php?release_id=592961&group_id=118524; http://www.exponentcms.org/index.php?action=view&id=64&module=newsmodule&src=%40random44fe03276195
CVE: CVE-2008-1973
Published: 2008-04-27
Description: Heap-based buffer overflow in SubEdit Player build 4056 and 4066 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long subtitle file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29904; http://www.securityfocus.com/bid/28858; http://www.vupen.com/english/advisories/2008/1306
CVE: CVE-2008-1974
Published: 2008-04-27
Description: Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.aria-security.com/showthread.php?t=49; http://lists.horde.org/archives/kronolith/Week-of-Mon-20080421/006807.html; http://osvdb.org/51238
CVE: CVE-2008-1975
Published: 2008-04-27
Description: SQL injection vulnerability in index.php in E-RESERV 2.1 allows remote attackers to execute arbitrary SQL commands via the ID_loc parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29914; http://www.securityfocus.com/bid/28899; http://www.vupen.com/english/advisories/2008/1345/references
CVE: CVE-2008-1976
Published: 2008-04-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Drupal modules (1) Internationalization (i18n) 5.x before 5.x-2.3 and 5.x-1.1 and 6.x before 6.x-1.0 beta 1; and (2) Localizer 5.x before 5.x-3.4, 5.x-2.1, and 5.x-1.11; allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/250344; http://secunia.com/advisories/29961; http://www.securityfocus.com/bid/28916
CVE: CVE-2008-1977
Published: 2008-04-27
Description: Cross-site request forgery (CSRF) vulnerability in the Internationalization (i18n) Drupal module 5.x before 5.x-2.3 and 5.x-1.1, and 6.x before 6.x-1.0 beta 1, allows remote attackers to change node translation relationships via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/250344; http://secunia.com/advisories/29961; http://www.securityfocus.com/bid/28916
CVE: CVE-2008-1978
Published: 2008-04-27
Description: Cross-site scripting (XSS) vulnerability in the Ubercart 5.x before 5.x-1.0 rc3 module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via node titles related to unspecified product features, a different vector than CVE-2008-1428.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/250343; http://secunia.com/advisories/29950; http://www.securityfocus.com/bid/28914
CVE: CVE-2008-1979
Published: 2008-04-27
Description: The Discovery Service (casdscvc) in CA ARCserve Backup 12.0.5454.0 and earlier allows remote attackers to cause a denial of service (crash) via a packet with a large integer value used in an increment to TCP port 41523, which triggers a buffer over-read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/carcbackazz-adv.txt; http://secunia.com/advisories/29855; http://www.securityfocus.com/archive/1/493430/100/0/threaded
CVE: CVE-2008-1980
Published: 2008-04-27
Description: Cross-site scripting (XSS) vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/250408; http://secunia.com/advisories/29960; http://www.vupen.com/english/advisories/2008/1353/references
CVE: CVE-2008-1981
Published: 2008-04-27
Description: Cross-site request forgery (CSRF) vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attackers to perform unauthorized actions as other users via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/250408; http://secunia.com/advisories/29960; http://www.vupen.com/english/advisories/2008/1353/references
CVE: CVE-2008-1982
Published: 2008-04-27
Description: SQL injection vulnerability in ss_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29938; http://timrohrer.com/blog/?p=120; http://www.securityfocus.com/bid/28894
CVE: CVE-2008-1983
Published: 2008-04-27
Description: Cross-site scripting (XSS) vulnerability in Advanced Electron Forum (AEF) 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the beg parameter in a members action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29923; http://www.securityfocus.com/bid/28865; http://www.z0rlu.ownspace.org/index.php?/archives/60-Advanced-Electron-Forum-AEF-1.0.6-XSS.html
CVE: CVE-2008-1984
Published: 2008-04-27
Description: The eTrust Common Services (Transport) Daemon (eCSqdmn) in CA Secure Content Manager 8.0.28000.511 and earlier allows remote attackers to cause a denial of service (crash or CPU consumption) via a malformed packet to TCP port 1882.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/ecsqdamn-adv.txt; http://secunia.com/advisories/29895; http://www.securityfocus.com/bid/28888
CVE: CVE-2008-1985
Published: 2008-04-27
Description: Cross-site scripting (XSS) vulnerability in base.php in DigitalHive 2.0 RC2 allows remote attackers to inject arbitrary web script or HTML via the mt parameter, possibly related to membres.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28918; http://www.z0rlu.ownspace.org/index.php?/archives/65-hive-v2.RC2-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/42006
CVE: CVE-2008-1986
Published: 2008-04-27
Description: Cross-site scripting (XSS) vulnerability in liste_article.php in Blog Pixel Motion (aka PixelMotion) allows remote attackers to inject arbitrary web script or HTML via the jours parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28920; http://www.z0rlu.ownspace.org/index.php?/archives/63-Blog-PixelMotion-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/42011
CVE: CVE-2008-1987
Published: 2008-04-27
Description: Cross-site scripting (XSS) vulnerability in search.php in EncapsGallery 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29824; http://www.encaps.net/software/encapsgallery/download-image-album.php; http://www.securityfocus.com/bid/28887
CVE: CVE-2008-1988
Published: 2008-04-27
Description: Unrestricted file upload vulnerability in the file_upload function in core/misc.class.php in EncapsGallery 2.0.2 allows remote authenticated administrators to upload and execute arbitrary PHP files by uploading a file with an executable extension, then accessing it via a direct request to the file in the rwx_gallery directory.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/29824; http://www.securityfocus.com/bid/28887; https://exchange.xforce.ibmcloud.com/vulnerabilities/41949
CVE: CVE-2008-1989
Published: 2008-04-27
Description: PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the e107path parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/29870; http://www.securityfocus.com/bid/28828; https://exchange.xforce.ibmcloud.com/vulnerabilities/41867
CVE: CVE-2008-1990
Published: 2008-04-27
Description: Multiple SQL injection vulnerabilities in Acidcat CMS 3.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) cID parameter to default.asp and the (2) username parameter to main_login2.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugreport.ir/index.php?/36; http://secunia.com/advisories/29916; http://securityreason.com/securityalert/3842
CVE: CVE-2008-1991
Published: 2008-04-27
Description: Cross-site scripting (XSS) vulnerability in admin_colors_swatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the field parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugreport.ir/index.php?/36; http://secunia.com/advisories/29916; http://securityreason.com/securityalert/3842
CVE: CVE-2008-1992
Published: 2008-04-27
Description: Acidcat CMS 3.4.1 does not properly restrict access to (1) default_mail_aspemail.asp, (2) default_mail_cdosys.asp or (3) default_mail_jmail.asp, which allows remote attackers to bypass restrictions and relay email messages with modified From, FromName, and To fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://bugreport.ir/index.php?/36; http://secunia.com/advisories/29916; http://securityreason.com/securityalert/3842
CVE: CVE-2008-1993
Published: 2008-04-27
Description: Acidcat CMS 3.4.1 does not restrict access to the FCKEditor component, which allows remote attackers to upload arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://bugreport.ir/index.php?/36; http://securityreason.com/securityalert/3842; http://www.securityfocus.com/archive/1/491129/100/0/threaded
CVE: CVE-2008-1994
Published: 2008-04-27
Description: Multiple stack-based buffer overflows in (a) acon.c, (b) menu.c, and (c) child.c in Acon 1.0.5-5 through 1.0.5-7 allow local users to execute arbitrary code via (1) a long HOME environment variable or (2) a large number of terminal columns.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=475733; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476603; http://secunia.com/advisories/29909
CVE: CVE-2008-1670
Published: 2008-04-28
Description: Heap-based buffer overflow in the progressive PNG Image loader (decoders/pngloader.cpp) in KHTML in KDE 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://secunia.com/advisories/29980; http://www.kde.org/info/security/advisory-20080426-1.txt
CVE: CVE-2008-1671
Published: 2008-04-28
Description: start_kdeinit in KDE 3.5.5 through 3.5.9, when installed setuid root, allows local users to cause a denial of service and possibly execute arbitrary code via "user-influenceable input" (probably command-line arguments) that cause start_kdeinit to send SIGUSR1 signals to other processes.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-16
References: ftp://ftp.kde.org/pub/kde/security_patches/post-kde-3.5.5-kinit.diff; http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://secunia.com/advisories/29951
CVE: CVE-2008-1995
Published: 2008-04-28
Description: Sun Java System Directory Proxy Server 6.0, 6.1, and 6.2 classifies a connection using the "bind-dn" criteria, which can cause an incorrect application of policy and allows remote attackers to bypass intended access restrictions for the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29978; http://sunsolve.sun.com/search/document.do?assetkey=1-26-235381-1; http://www.securityfocus.com/bid/28941
CVE: CVE-2008-1103
Published: 2008-04-28
Description: Multiple unspecified vulnerabilities in Blender have unknown impact and attack vectors, related to "temporary file issues."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html; http://secunia.com/advisories/29842; http://secunia.com/advisories/29957
CVE: CVE-2008-1930
Published: 2008-04-28
Description: The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allows remote attackers to forge cookies by registering a username that results in the same concatenated string, as demonstrated by registering usernames beginning with "admin" to obtain administrator privileges, aka a "cryptographic splicing" issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-6013.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/29965; http://wordpress.org/development/2008/04/wordpress-251/; http://www.cl.cam.ac.uk/users/sjm217/advisories/wordpress-cookie-integrity.txt
CVE: CVE-2008-1996
Published: 2008-04-28
Description: licq before 1.3.6 allows remote attackers to cause a denial of service (file-descriptor exhaustion and application crash) via a large number of connections.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html; http://seclists.org/bugtraq/2008/Apr/0100.html; http://secunia.com/advisories/30055
CVE: CVE-2008-1997
Published: 2008-04-28
Description: Unspecified vulnerability in the ADMIN_SP_C2 procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the ADMIN_SP_C issue is already covered by CVE-2008-0699.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/29022; http://securityreason.com/securityalert/3841; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06972
CVE: CVE-2008-1998
Published: 2008-04-28
Description: The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29022; http://secunia.com/advisories/29784; http://securityreason.com/securityalert/3840
CVE: CVE-2008-1999
Published: 2008-04-28
Description: Apple Safari 3.1.1 allows remote attackers to spoof the address bar by placing many "invisible" characters in the userinfo subcomponent of the authority component of the URL (aka the user field), as demonstrated by %E3%80%80 sequences.
CVSS Score: 5.0 (MEDIUM)
References: http://es.geocities.com/jplopezy/pruebasafari3.html; http://secunia.com/advisories/29900; http://securityreason.com/securityalert/3833
CVE: CVE-2008-2000
Published: 2008-04-28
Description: Unspecified vulnerability in Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls document.write in an infinite loop.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://es.geocities.com/jplopezy/pruebasafari3.html; http://securityreason.com/securityalert/3833; http://www.securityfocus.com/archive/1/491192/100/0/threaded
CVE: CVE-2008-2001
Published: 2008-04-28
Description: Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via a file:///%E2 link that triggers an out-of-bounds access, possibly due to a NULL pointer dereference.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://es.geocities.com/jplopezy/pruebasafari3.html; http://securityreason.com/securityalert/3833; http://www.securityfocus.com/archive/1/491192/100/0/threaded
CVE: CVE-2008-2002
Published: 2008-04-28
Description: Multiple cross-site request forgery (CSRF) vulnerabilities on Motorola Surfboard with software SB5100-2.3.3.0-SCM00-NOSH allow remote attackers to (1) cause a denial of service (device reboot) via the "Restart Cable Modem" value in the BUTTON_INPUT parameter to configdata.html, and (2) cause a denial of service (hard reset) via the "Reset All Defaults" value in the BUTTON_INPUT parameter to configdata.html.
CVSS Score: 7.8 (HIGH)
CWE: CWE-352
References: http://secunia.com/advisories/30026; http://securityreason.com/securityalert/3839; http://www.kb.cert.org/vuls/id/643049
CVE: CVE-2008-2003
Published: 2008-04-28
Description: BadBlue 2.72 Personal Edition stores multiple programs in the web document root with insufficient access control, which allows remote attackers to (1) cause a denial of service via multiple invocations of uninst.exe, and have an unknown impact via (2) badblue.exe and (3) dyndns.exe.  NOTE: this can be leveraged for arbitrary remote code execution in conjunction with CVE-2007-6378.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://securityreason.com/securityalert/3832; http://www.securityfocus.com/archive/1/491282/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/42090
CVE: CVE-2008-1293
Published: 2008-04-29
Description: ldm in Linux Terminal Server Project (LTSP) 0.99 and 2 passes the -ac option to the X server on each LTSP client, which allows remote attackers to connect to this server via TCP port 6006 (aka display :6).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469462; http://secunia.com/advisories/29959; http://secunia.com/advisories/30099
CVE: CVE-2008-2008
Published: 2008-04-29
Description: Buffer overflow in the Display Names message feature in Cerulean Studios Trillian Basic and Pro 3.1.9.0 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long nickname in an MSN protocol message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29952; http://securityreason.com/securityalert/3849; http://www.securityfocus.com/archive/1/491281/100/0/threaded
CVE: CVE-2008-1735
Published: 2008-04-30
Description: BitDefender Antivirus 2[PII_REDACTED]8 and earlier allows local users to cause a denial of service (system crash) via an invalid pointer to the CLIENT_ID structure in a call to the NtOpenProcess hooked System Service Descriptor Table (SSDT) function.
CVSS Score: 4.9 (MEDIUM)
References: http://kb.bitdefender.com/KB419-en--Security-vulnerability-in-BitDefender-2008.html; http://secunia.com/advisories/30005; http://securityreason.com/securityalert/3838
CVE: CVE-2008-1736
Published: 2008-04-30
Description: Comodo Firewall Pro before 3.0 does not properly validate certain parameters to hooked System Service Descriptor Table (SSDT) functions, which allows local users to cause a denial of service (system crash) via (1) a crafted OBJECT_ATTRIBUTES structure in a call to the NtDeleteFile function, which leads to improper validation of a ZwQueryObject result; and unspecified calls to the (2) NtCreateFile and (3) NtSetThreadContext functions, different vectors than CVE-2007-0709.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/30006; http://securityreason.com/securityalert/3838; http://securitytracker.com/id?1019944
CVE: CVE-2008-1737
Published: 2008-04-30
Description: Sophos Anti-Virus 7.0.5, and other 7.x versions, when Runtime Behavioural Analysis is enabled, allows local users to cause a denial of service (reboot with the product disabled) and possibly gain privileges via a zero value in a certain length field in the ObjectAttributes argument to the NtCreateKey hooked System Service Descriptor Table (SSDT) function.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/29996; http://securityreason.com/securityalert/3838; http://securitytracker.com/id?1019945
CVE: CVE-2008-1738
Published: 2008-04-30
Description: Rising Antivirus 2008 before 20.38.20 allows local users to cause a denial of service (system crash) via an invalid pointer to the _CLIENT_ID structure in a call to the NtOpenProcess hooked System Service Descriptor Table (SSDT) function.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://secunia.com/advisories/30007; http://securityreason.com/securityalert/3838; http://securitytracker.com/id?1019946
CVE: CVE-2008-2010
Published: 2008-04-30
Description: Unspecified vulnerability in Apple QuickTime Player on Windows XP SP2 and Vista SP1 allows remote attackers to execute arbitrary code via a crafted QuickTime media file.  NOTE: as of 20080429, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 9.3 (HIGH)
References: http://www.gnucitizen.org/blog/quicktime-0day-for-vista-and-xp/; http://www.securityfocus.com/bid/28959; http://www.securitytracker.com/id?1019950
CVE: CVE-2008-2011
Published: 2008-04-30
Description: Cross-site scripting (XSS) vulnerability in the National Rail Enquiries Live Departure Boards gadget before 1.1 allows remote National Rail Enquiries servers or man-in-the-middle attackers to inject arbitrary web script or HTML, and execute arbitrary code, via a response body, as demonstrated by a SCRIPT element that references a vbscript: URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mwrinfosecurity.com/news/1690.html; http://www.mwrinfosecurity.com/publications/mwri_national-rail-enquiries-gadget-advisory_2008-04-24.pdf; http://www.securityfocus.com/bid/28933
CVE: CVE-2008-2012
Published: 2008-04-30
Description: SQL injection vulnerability in index.php in the PostSchedule 1.0 module for PostNuke allows remote attackers to execute arbitrary SQL commands via the eid parameter in an event action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28931; https://exchange.xforce.ibmcloud.com/vulnerabilities/42010; https://www.exploit-db.com/exploits/5495
CVE: CVE-2008-2013
Published: 2008-04-30
Description: SQL injection vulnerability in index.php in the pnFlashGames 1.5 through 2.5 module for PostNuke, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a display action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28948; https://exchange.xforce.ibmcloud.com/vulnerabilities/42019; https://www.exploit-db.com/exploits/5500
CVE: CVE-2008-2014
Published: 2008-04-30
Description: Mozilla Firefox 3.0 beta 5 allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls document.write in an infinite loop.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://es.geocities.com/jplopezy/pruebamozilla.html; http://securityreason.com/securityalert/3835; http://www.securityfocus.com/archive/1/491196/100/0/threaded
CVE: CVE-2008-2015
Published: 2008-04-30
Description: Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) CompactSave and (2) SaveSession method in one control, and the (3) saveRecordedExploreToFile method in a different control.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28940; http://www.securitytracker.com/id?1019948; https://exchange.xforce.ibmcloud.com/vulnerabilities/42077