deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1192
Published: 2008-03-06
Description: Unspecified vulnerability in the Java Plug-in for Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier, and 1.3.1_21 and earlier; allows remote attackers to bypass the same origin policy and "execute local applications" via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-254
References: http://dev2dev.bea.com/pub/advisory/277; http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html
CVE: CVE-2008-1193
Published: 2008-03-06
Description: Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to gain privileges via an untrusted application.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://dev2dev.bea.com/pub/advisory/277; http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html
CVE: CVE-2008-1194
Published: 2008-03-06
Description: Multiple unspecified vulnerabilities in the color management library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to cause a denial of service (crash) via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/277; http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html
CVE: CVE-2008-1195
Published: 2008-03-06
Description: Unspecified vulnerability in Sun JDK and Java Runtime Environment (JRE) 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to access arbitrary network services on the local host via unspecified vectors related to JavaScript and Java APIs.
CVSS Score: 9.3 (HIGH)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html
CVE: CVE-2008-1196
Published: 2008-03-06
Description: Stack-based buffer overflow in Java Web Start (javaws.exe) in Sun JDK and JRE 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to execute arbitrary code via a crafted JNLP file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=q5exhSqeBjA~; http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html
CVE: CVE-2008-1198
Published: 2008-03-06
Description: The default IPSec ifup script in Red Hat Enterprise Linux 3 through 5 configures racoon to use aggressive IKE mode instead of main IKE mode, which makes it easier for remote attackers to conduct brute force attacks by sniffing an unencrypted preshared key (PSK) hash.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/48045; http://www.ernw.de/download/pskattack.pdf; http://www.securitytracker.com/id?1019563
CVE: CVE-2008-1199
Published: 2008-03-06
Description: Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-16, CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html; http://secunia.com/advisories/29226; http://secunia.com/advisories/29385
CVE: CVE-2008-1200
Published: 2008-03-06
Description: Unspecified vulnerability in Microsoft Access allows remote user-assisted attackers to execute arbitrary code via a crafted .MDB file, possibly related to Jet Engine (msjet40.dll).  NOTE: this is probably a different issue than CVE-2007-6026.
CVSS Score: 9.3 (HIGH)
References: http://pandalabs.pandasecurity.com/archive/New-MS-Access-exploit.aspx; http://www.securityfocus.com/bid/28087; http://pandalabs.pandasecurity.com/archive/New-MS-Access-exploit.aspx
CVE: CVE-2008-1204
Published: 2008-03-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Administration Console in Sun Java System Access Manager 7.1 and 7 2005Q4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the (1) Help and (2) Version windows.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29252; http://sunsolve.sun.com/search/document.do?assetkey=1-26-201251-1; http://www.securityfocus.com/bid/28113
CVE: CVE-2008-1205
Published: 2008-03-08
Description: Unspecified vulnerability in the ipsecah kernel module in Sun Solaris 10, when a key management daemon for IPsec security associations is running, allows local users to cause a denial of service (panic) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/29253; http://sunsolve.sun.com/search/document.do?assetkey=1-26-233761-1; http://www.securityfocus.com/bid/28112
CVE: CVE-2008-1206
Published: 2008-03-08
Description: Format string vulnerability in the log_message function in lks.c in Linux Kiss Server 1.2, when background (daemon) mode is disabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in an invalid command.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3326&w=2; http://secunia.com/advisories/29219; http://www.securityfocus.com/bid/28099
CVE: CVE-2008-1207
Published: 2008-03-08
Description: Multiple unspecified vulnerabilities in Fujitsu Interstage Smart Repository, as used in multiple Fujitsu Interstage products, allow remote attackers to cause a denial of service (daemon crash) via (1) an invalid request or (2) a large amount of data sent to the registered attribute value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/29250; http://www.fujitsu.com/global/support/software/security/products-f/interstage-sr-200801e.html; http://www.fujitsu.com/global/support/software/security/products-f/interstage-sr-200802e.html
CVE: CVE-2008-1208
Published: 2008-03-08
Description: Cross-site scripting (XSS) vulnerability in the login page in Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x allows remote attackers to inject arbitrary web script or HTML via the user parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29243; http://www.louhi.fi/advisory/checkpoint_080306.txt; http://www.securityfocus.com/archive/1/489203/100/0/threaded
CVE: CVE-2008-1209
Published: 2008-03-08
Description: Cross-site scripting (XSS) vulnerability in redirect.do in Xitex WebContent M1 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29222; http://www.securityfocus.com/bid/28115; https://exchange.xforce.ibmcloud.com/vulnerabilities/41021
CVE: CVE-2008-1210
Published: 2008-03-08
Description: Stack-based buffer overflow in the ctags parsing code in Programmer's Notepad before 2.0.8.718 allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted .c file, when the victim selects the Jump To dialog.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29233; http://sourceforge.net/project/shownotes.php?release_id=581499&group_id=45545; http://www.securityfocus.com/bid/28119
CVE: CVE-2008-1211
Published: 2008-03-08
Description: Cross-site scripting (XSS) vulnerability in BosDates 3.x and 4.x allows remote attackers to inject arbitrary web script or HTML via (1) the type parameter in calendar.php and (2) the category parameter in calendar_search.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29255; http://www.securityfocus.com/bid/28117; https://exchange.xforce.ibmcloud.com/vulnerabilities/41020
CVE: CVE-2008-1212
Published: 2008-03-08
Description: Cross-site scripting (XSS) vulnerability in set_permissions.php in Podcast Generator 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the scriptlang parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28106; https://exchange.xforce.ibmcloud.com/vulnerabilities/41130; http://www.securityfocus.com/bid/28106
CVE: CVE-2008-1213
Published: 2008-03-08
Description: Cross-site scripting (XSS) vulnerability in Numara FootPrints for Linux 8.1 allows remote attackers to inject arbitrary web script or HTML via the Title form field when setting an appointment.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28659; http://www.securityfocus.com/bid/28103; https://exchange.xforce.ibmcloud.com/vulnerabilities/41003
CVE: CVE-2008-1214
Published: 2008-03-08
Description: MRcgi/MRProcessIncomingForms.pl in Numara FootPrints 8.1 on Linux allows remote attackers to execute arbitrary code via shell metacharacters in the PROJECTNUM parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28659; https://exchange.xforce.ibmcloud.com/vulnerabilities/41005; http://secunia.com/advisories/28659
CVE: CVE-2007-6705
Published: 2008-03-09
Description: The WebSphere MQ XA 5.3 before FP13 and 6.0.x before 6.0.2.1 client for Windows, when running in an MTS or a COM+ environment, grants the PROCESS_DUP_HANDLE privilege to the Everyone group upon connection to a queue manager, which allows local users to duplicate an arbitrary handle and possibly hijack an arbitrary process.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://osvdb.org/43167; http://securitytracker.com/id?1019529; http://www-1.ibm.com/support/docview.wss?uid=swg1IC50431
CVE: CVE-2007-6706
Published: 2008-03-09
Description: Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH or 7.0.3, and possibly 8.0 allows remote attackers to execute arbitrary code via crafted text in an e-mail message sent over SMTP.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/40956; http://secunia.com/advisories/27279; http://securitytracker.com/id?1019464
CVE: CVE-2008-1215
Published: 2008-03-09
Description: Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/29234; http://secunia.com/advisories/29238; http://secunia.com/advisories/29240
CVE: CVE-2008-1216
Published: 2008-03-09
Description: IBM Lotus Quickr 8.0 server, and possibly QuickPlace 7.x, does not properly identify URIs containing cross-site scripting (XSS) attack strings, which allows remote attackers to inject arbitrary web script or HTML via a Calendar OpenDocument action to main.nsf with a Count parameter containing a JavaScript event in a malformed element, as demonstrated by an onload event in an IFRAME element.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/29072; http://securityreason.com/securityalert/3721; http://www.securityfocus.com/archive/1/488620/100/100/threaded
CVE: CVE-2008-1217
Published: 2008-03-09
Description: Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH, and 8.0.x before 8.0.1 allows remote attackers to execute arbitrary code via a crafted attachment in an e-mail message sent over SMTP, a variant of CVE-2007-6706.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1019464; http://www-1.ibm.com/support/docview.wss?uid=swg21271957; http://securitytracker.com/id?1019464
CVE: CVE-2008-1219
Published: 2008-03-10
Description: SQL injection vulnerability in the Kutub-i Sitte (KutubiSitte) 1.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the kid parameter in a hadisgoster action to modules.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29279; http://securityreason.com/securityalert/3722; http://www.rbt-4.net/forum/viewthread.php?forum_id=51&thread_id=3058
CVE: CVE-2008-1220
Published: 2008-03-10
Description: SQL injection vulnerability in the 4nChat 0.91 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the roomid parameter in an index action to modules.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28128; https://exchange.xforce.ibmcloud.com/vulnerabilities/41051; http://www.securityfocus.com/bid/28128
CVE: CVE-2008-1221
Published: 2008-03-10
Description: Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console (aka eScan Server) 9.0.742.1 allows remote attackers to read arbitrary files via an absolute pathname in the RETR (get) command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/escaz-adv.txt; http://secunia.com/advisories/29246; http://securityreason.com/securityalert/3723
CVE: CVE-2008-1222
Published: 2008-03-10
Description: Cross-site scripting (XSS) vulnerability in Dokeos 1.8.4 before SP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://projects.dokeos.com/index.php?do=details&task_id=2312; http://secunia.com/advisories/29254; http://www.dokeos.com/wiki/index.php/Security
CVE: CVE-2008-1223
Published: 2008-03-10
Description: Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://projects.dokeos.com/index.php?do=details&task_id=2312; http://secunia.com/advisories/29254; http://www.dokeos.com/wiki/index.php/Security
CVE: CVE-2008-1224
Published: 2008-03-10
Description: Cross-site scripting (XSS) vulnerability in account.php in BosClassifieds Classified Ads System 3.0 allows remote attackers to inject arbitrary web script or HTML via the returnTo parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29261; http://www.securityfocus.com/bid/28140; https://exchange.xforce.ibmcloud.com/vulnerabilities/41045
CVE: CVE-2008-1225
Published: 2008-03-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a (1) mail message or (2) discussion board message.  NOTE: this might overlap CVE-2005-1076.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9467&w=2; http://secunia.com/advisories/29227; http://www.balupton.com/blogs/dev?title=webct_session_stealer_exploit
CVE: CVE-2008-1226
Published: 2008-03-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment, possibly involving a (1) .jpg or (2) .gif image attachment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000004.html; http://secunia.com/advisories/29263
CVE: CVE-2008-1227
Published: 2008-03-10
Description: Stack-based buffer overflow in the silc_fingerprint function in lib/silcutil/silcutil.c in Secure Internet Live Conferencing (SILC) Toolkit 1.1.5, and unspecified earlier versions, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via long input data.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html; http://secunia.com/advisories/29174; http://secunia.com/advisories/29323
CVE: CVE-2008-1228
Published: 2008-03-10
Description: Cross-site scripting (XSS) vulnerability in admin.php in MG2 (formerly Minigal) allows remote attackers to inject arbitrary web script or HTML via the list parameter in an import action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3452&w=2; http://www.securityfocus.com/bid/28098; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3452&w=2
CVE: CVE-2008-1229
Published: 2008-03-10
Description: Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject arbitrary web script or HTML via the editor parameter, a different vector than CVE-2007-5120.b.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1544&w=2; http://secunia.com/advisories/28969; http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0
CVE: CVE-2008-1230
Published: 2008-03-10
Description: Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an "entry page."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1544&w=2; http://secunia.com/advisories/28969; http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0
CVE: CVE-2008-1231
Published: 2008-03-10
Description: Directory traversal vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to include and execute arbitrary local .jsp files, and obtain sensitive information, via a .. (dot dot) in the editor parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1544&w=2; http://secunia.com/advisories/28969; http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0
CVE: CVE-2008-1242
Published: 2008-03-10
Description: The control panel on the Belkin F5D7230-4 router with firmware 9.01.10 maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user, a different vulnerability than CVE-2005-3802.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29345; http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1243
Published: 2008-03-10
Description: Cross-site scripting (XSS) vulnerability on the Linksys WRT300N router with firmware 2.00.20, when Mozilla Firefox or Apple Safari is used, allows remote attackers to inject arbitrary web script or HTML via the dyndns_domain parameter to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.bulix.org/cx46qa-65489; http://code.bulix.org/koom78-65490; http://www.gnucitizen.org/projects/router-hacking-challenge/
CVE: CVE-2008-1244
Published: 2008-03-10
Description: cgi-bin/setup_dns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to perform administrative actions, as demonstrated by changing a DNS server via the dns1_1, dns1_2, dns1_3, and dns1_4 parameters.  NOTE: it was later reported that F5D7632-4V6 with firmware 6.01.08 is also affected.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/29345; http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1245
Published: 2008-03-10
Description: cgi-bin/setup_virtualserver.exe on the Belkin F5D7230-4 router with firmware 9.01.10 allows remote attackers to cause a denial of service (control center outage) via an HTTP request with invalid POST data and a "Connection: Keep-Alive" header.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/29345; http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1246
Published: 2008-03-10
Description: The Cisco PIX/ASA Finesse Operation System 7.1 and 7.2 allows local users to gain privileges by entering characters at the enable prompt, erasing these characters via the Backspace key, and then holding down the Backspace key for one second after erasing the final character. NOTE: third parties, including one who works for the vendor, have been unable to reproduce the flaw unless the enable password is blank
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://hackathology.blogspot.com/2008/01/pixasa-finesse-71-72-privilege.html; http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.securityfocus.com/archive/1/486938
CVE: CVE-2008-1247
Published: 2008-03-10
Description: The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri.  NOTE: the Security.tri vector is already covered by CVE-2006-5202.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://kinqpinz.info/lib/wrt54g/own.txt; http://secunia.com/advisories/29344; http://www.gnucitizen.org/projects/router-hacking-challenge/
CVE: CVE-2008-1248
Published: 2008-03-10
Description: The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field.  NOTE: this might overlap CVE-2007-3440.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.securityfocus.com/archive/1/489009/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/41171
CVE: CVE-2008-1249
Published: 2008-03-10
Description: snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service (application crash and corruption of call logs) via a "'); (double quote, quote, close parenthesis, semicolon) sequence in the "Call a number" field.
CVSS Score: 9.4 (HIGH)
CWE: CWE-20
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.securityfocus.com/archive/1/489009/100/0/threaded; http://www.gnucitizen.org/projects/router-hacking-challenge/