deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2922
Published: 2008-06-30
Description: Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long IRC message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30681; http://www.securityfocus.com/bid/29724; https://exchange.xforce.ibmcloud.com/vulnerabilities/43112
CVE: CVE-2008-2923
Published: 2008-06-30
Description: Cross-site scripting (XSS) vulnerability in read/search/results in Lyris ListManager 8.8, 8.95, and 9.3d allows remote attackers to inject arbitrary web script or HTML via the words parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/71/45/; http://osvdb.org/show/osvdb/46150; http://secunia.com/advisories/30662
CVE: CVE-2008-2924
Published: 2008-06-30
Description: Cross-site scripting (XSS) vulnerability in Webmatic before 2.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30656; http://www.securityfocus.com/bid/29748; http://www.valarsoft.com/index.php?page=home&notizie=si&notID=154&singlenot=1&no_home=1#2
CVE: CVE-2008-2925
Published: 2008-06-30
Description: SQL injection vulnerability in Webmatic before 2.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30656; http://www.securityfocus.com/bid/29748; http://www.valarsoft.com/index.php?page=home&notizie=si&notID=154&singlenot=1&no_home=1#2
CVE: CVE-2008-2942
Published: 2008-06-30
Description: Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html; http://secunia.com/advisories/31108; http://secunia.com/advisories/31110
CVE: CVE-2008-2365
Published: 2008-06-30
Description: Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux (RHEL) 4, allows local users to cause a denial of service (oops) via a long series of PTRACE_ATTACH ptrace calls to another user's process that trigger a conflict between utrace_detach and report_quiescent, related to "late ptrace_may_attach() check" and "race around &dead_engine_ops setting," a different vulnerability than CVE-2007-0771 and CVE-2008-1514.  NOTE: this issue might only affect kernel versions before 2.6.16.x.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=5ecfbae093f0c37311e89b29bfc0c9d586eace87; http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=f358166a9405e4f1d8e50d8f415c26d95505b6de; http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=f5b40e363ad6041a96e3da32281d8faa191597b9
CVE: CVE-2008-2943
Published: 2008-06-30
Description: Double free vulnerability in IBM Tivoli Directory Server (TDS) 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service (ABEND) and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate ibm-globalAdminGroup LDAP database entry.  NOTE: the vendor states "There is no real risk of a vulnerability," although there are likely scenarios in which a user is allowed to make administrative LDAP requests but does not have the privileges to stop the server.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/30786; http://www-1.ibm.com/support/docview.wss?uid=swg1IO09113; http://www.securityfocus.com/bid/30010
CVE: CVE-2008-2944
Published: 2008-06-30
Description: Double free vulnerability in the utrace support in the Linux kernel, probably 2.6.18, in Red Hat Enterprise Linux (RHEL) 5 and Fedora Core 6 (FC6) allows local users to cause a denial of service (oops), as demonstrated by a crash when running the GNU GDB testsuite, a different vulnerability than CVE-2008-2365.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-415
References: https://bugzilla.redhat.com/show_bug.cgi?id=207002; https://bugzilla.redhat.com/show_bug.cgi?id=449359; https://exchange.xforce.ibmcloud.com/vulnerabilities/43556
CVE: CVE-2008-0598
Published: 2008-06-30
Description: Unspecified vulnerability in the 32-bit and 64-bit emulation in the Linux kernel 2.6.9, 2.6.18, and probably other versions allows local users to read uninitialized memory via unknown vectors involving a crafted binary.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html
CVE: CVE-2008-2462
Published: 2008-06-30
Description: Cross-site scripting (XSS) vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30845; http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205%2C%202007; http://www.kb.cert.org/vuls/id/305208
CVE: CVE-2008-2729
Published: 2008-06-30
Description: arch/x86_64/lib/copy_user.S in the Linux kernel before 2.6.19 on some AMD64 systems does not erase destination memory locations after an exception during kernel memory copy, which allows local users to obtain sensitive information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=3022d734a54cbd2b65eea9a[PII_REDACTED]01b4a9a%3Bhp=f0f4c3432e5e1087b3a8c0e6bd4113d3c37497ff; http://rhn.redhat.com/errata/RHSA-2008-0508.html; http://secunia.com/advisories/30849
CVE: CVE-2008-2945
Published: 2008-06-30
Description: Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715, CVE-2007-3716, and CVE-2007-4289.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30893; http://sunsolve.sun.com/search/document.do?assetkey=1-26-201538-1; http://support.avaya.com/elmodocs2/security/ASA-2008-294.htm
CVE: CVE-2008-2946
Published: 2008-06-30
Description: The SNMP-DMI mapper subagent daemon (aka snmpXdmid) in Solstice Enterprise Agents in Sun Solaris 8 through 10 allows remote attackers to cause a denial of service (daemon crash) via malformed packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/30863; http://sunsolve.sun.com/search/document.do?assetkey=1-26-237985-1; http://www.securityfocus.com/bid/29965
CVE: CVE-2008-2947
Published: 2008-06-30
Description: Cross-domain vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 7 allows remote attackers to access restricted information from other domains via JavaScript that uses the Object data type for the value of a (1) location or (2) location.href property, related to incorrect determination of the origin of web script, aka "Window Location Property Cross-Domain Vulnerability." NOTE: according to Microsoft, CVE-2008-2948 and CVE-2008-2949 are duplicates of this issue, probably different attack vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: http://blogs.zdnet.com/security/?p=1348; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5998&w=2; http://secunia.com/advisories/30857
CVE: CVE-2008-2948
Published: 2008-06-30
Description: Cross-domain vulnerability in Microsoft Internet Explorer 7 and 8 allows remote attackers to change the location property of a frame via the Object data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with caballero-listener.  NOTE: according to Microsoft, this is a duplicate of CVE-2008-2947, possibly a different attack vector.
CVSS Score: 6.8 (MEDIUM)
References: http://blogs.zdnet.com/security/?p=1348; http://secunia.com/advisories/30851; http://sirdarckcat.blogspot.com/2008/05/ghosts-for-ie8-and-ie75730.html
CVE: CVE-2008-2949
Published: 2008-06-30
Description: Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to change the location property of a frame via the String data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with caballero-listener.  NOTE: according to Microsoft, this is a duplicate of CVE-2008-2947, possibly a different attack vector.
CVSS Score: 6.8 (MEDIUM)
References: http://blogs.zdnet.com/security/?p=1348; http://sirdarckcat.blogspot.com/2008/05/browsers-ghost-busters.html; http://technet.microsoft.com/en-us/security/cc405107.aspx#EHD
CVE: CVE-2008-2308
Published: 2008-07-01
Description: Unspecified vulnerability in Alias Manager in Apple Mac OS X 10.5.1 and earlier on Intel platforms allows local users to gain privileges or cause a denial of service (memory corruption and application crash) by resolving an alias that contains crafted AFP volume mount information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://secunia.com/advisories/30802; http://securitytracker.com/id?1020390
CVE: CVE-2008-2309
Published: 2008-07-01
Description: Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.5.4 allows user-assisted remote attackers to execute arbitrary code via a (1) .xht or (2) .xhtm file, which does not trigger a "potentially unsafe" warning message in (a) the Download Validation feature in Mac OS X 10.4 or (b) the Quarantine feature in Mac OS X 10.5.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://secunia.com/advisories/30802; http://securitytracker.com/id?1020391
CVE: CVE-2008-2310
Published: 2008-07-01
Description: Format string vulnerability in c++filt in Apple Mac OS X 10.5 before 10.5.4 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string in (1) C++ or (2) Java source code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://secunia.com/advisories/30802; http://securitytracker.com/id?1020392
CVE: CVE-2008-2311
Published: 2008-07-01
Description: Launch Services in Apple Mac OS X before 10.5, when Open Safe Files is enabled, allows remote attackers to execute arbitrary code via a symlink attack, probably related to a race condition and automatic execution of a downloaded file.
CVSS Score: 7.6 (HIGH)
CWE: CWE-59, CWE-362
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://secunia.com/advisories/30802; http://securitytracker.com/id?1020393
CVE: CVE-2008-2313
Published: 2008-07-01
Description: Apple Mac OS X before 10.5 uses weak permissions for the User Template directory, which allows local users to gain privileges by inserting a Trojan horse file into this directory.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://secunia.com/advisories/30802; http://securitytracker.com/id?1020394
CVE: CVE-2008-2314
Published: 2008-07-01
Description: Dock in Apple Mac OS X 10.5 before 10.5.4, when Exposé hot corners is enabled, allows physically proximate attackers to gain access to a locked session in (1) sleep mode or (2) screen saver mode via unspecified vectors.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://secunia.com/advisories/30802; http://securitytracker.com/id?1020395
CVE: CVE-2008-2952
Published: 2008-07-01
Description: liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00006.html; http://secunia.com/advisories/30853
CVE: CVE-2008-2953
Published: 2008-07-01
Description: Linux DC++ (linuxdcpp) before 0.707 allows remote attackers to cause a denial of service (crash) via "partial file list requests" that trigger a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://cvs.berlios.de/cgi-bin/viewcvs.cgi/linuxdcpp/linuxdcpp/client/ShareManager.cpp.diff?r1=1.14&r2=1.15&sortby=date; http://secunia.com/advisories/30812; http://secunia.com/advisories/30907
CVE: CVE-2008-2954
Published: 2008-07-01
Description: client/NmdcHub.cpp in Linux DC++ (linuxdcpp) before 0.707 allows remote attackers to cause a denial of service (crash) via an empty private message, which triggers an out-of-bounds read.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://cvs.berlios.de/cgi-bin/viewcvs.cgi/linuxdcpp/linuxdcpp/Changelog.txt; http://cvs.berlios.de/cgi-bin/viewcvs.cgi/linuxdcpp/linuxdcpp/client/NmdcHub.cpp.diff?r1=1.14&r2=1.15&sortby=date; http://dcplusplus.svn.sourceforge.net/viewvc/dcplusplus/dcplusplus/trunk/changelog.txt?r1=1027&r2=1026&pathrev=1027
CVE: CVE-2008-2955
Published: 2008-07-01
Description: Pidgin 2.4.1 allows remote attackers to cause a denial of service (crash) via a long filename that contains certain characters, as demonstrated using an MSN message that triggers the crash in the msn_slplink_process_msg function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/30881; http://secunia.com/advisories/32859; http://secunia.com/advisories/33102
CVE: CVE-2008-2956
Published: 2008-07-01
Description: Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem occurred and the original reporter wasn't able to supply any sort of reproduction details."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://crisp.cs.du.edu/?q=ca2007-1; http://secunia.com/advisories/31387; http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0246
CVE: CVE-2008-2957
Published: 2008-07-01
Description: The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or disk consumption) via a UDP packet that specifies an arbitrary URL.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://crisp.cs.du.edu/?q=ca2007-1; http://secunia.com/advisories/32859; http://secunia.com/advisories/33102
CVE: CVE-2008-2958
Published: 2008-07-01
Description: Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-362
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=488140; http://lists.alioth.debian.org/pipermail/secure-testing-team/2008-June/001672.html; http://secunia.com/advisories/30873
CVE: CVE-2008-2372
Published: 2008-07-02
Description: The Linux kernel 2.6.24 and 2.6.25 before 2.6.25.9 allows local users to cause a denial of service (memory consumption) via a large number of calls to the get_user_pages function, which lacks a ZERO_PAGE optimization and results in allocation of "useless newly zeroed pages."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=89f5b7da2a6bad2e84670422ab8192382a5aeb9f; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.9; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.html
CVE: CVE-2008-2826
Published: 2008-07-02
Description: Integer overflow in the sctp_getsockopt_local_addrs_old function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) functionality in the Linux kernel before 2.6.25.9 allows local users to cause a denial of service (resource consumption and system outage) via vectors involving a large addr_num field in an sctp_getaddrs_old data structure.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-190
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=735ce972fbc8a65fb17788debd7bbe7b4383cc62; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.9; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00009.html
CVE: CVE-2008-2959
Published: 2008-07-02
Description: Buffer overflow in a certain ActiveX control (vb6skit.dll) in Microsoft Visual Basic Enterprise Edition 6.0 SP6 might allow remote attackers to execute arbitrary code via a long lpstrLinkPath argument to the fCreateShellLink function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/29792; https://exchange.xforce.ibmcloud.com/vulnerabilities/43180; https://www.exploit-db.com/exploits/5851
CVE: CVE-2008-2960
Published: 2008-07-02
Description: Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when register_globals is enabled and .htaccess support is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving scripts in libraries/.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html; http://secunia.com/advisories/30813; http://secunia.com/advisories/30816
CVE: CVE-2008-2961
Published: 2008-07-02
Description: Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrary local files via a .. (dot dot) in the (1) path and (2) p parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29890; https://exchange.xforce.ibmcloud.com/vulnerabilities/43276; https://www.exploit-db.com/exploits/5896
CVE: CVE-2008-2962
Published: 2008-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in MyBlog allow remote attackers to inject arbitrary web script or HTML via the (1) s and (2) sort parameters to index.php, and the (3) id parameter to post.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29900; https://exchange.xforce.ibmcloud.com/vulnerabilities/43293; https://www.exploit-db.com/exploits/5913
CVE: CVE-2008-2963
Published: 2008-07-02
Description: Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the (1) view parameter to (a) index.php, and the (2) id parameter to (b) member.php and (c) post.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29900; https://exchange.xforce.ibmcloud.com/vulnerabilities/43292; https://www.exploit-db.com/exploits/5913
CVE: CVE-2008-2964
Published: 2008-07-02
Description: SQL injection vulnerability in guide.php in ResearchGuide 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/43261; https://www.exploit-db.com/exploits/5911; https://exchange.xforce.ibmcloud.com/vulnerabilities/43261
CVE: CVE-2008-2965
Published: 2008-07-02
Description: Cross-site scripting (XSS) vulnerability in viewforum.php in JaxUltraBB (JUBB) 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the forum parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29853; https://exchange.xforce.ibmcloud.com/vulnerabilities/43279; https://www.exploit-db.com/exploits/5877
CVE: CVE-2008-2966
Published: 2008-07-02
Description: Directory traversal vulnerability in viewprofile.php in JaxUltraBB 2.0 and earlier allows remote attackers to read arbitrary local files via a .. (dot dot) in the user parameter. party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29853; https://exchange.xforce.ibmcloud.com/vulnerabilities/43278; https://www.exploit-db.com/exploits/5877
CVE: CVE-2008-2967
Published: 2008-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) query string to login.php and the (2) glb_sid parameter to hta/htmlarea.js.php, and allow remote authenticated users to inject arbitrary web script or HTML via an unspecified field in room.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30763; http://securityreason.com/securityalert/3959; http://www.bugreport.ir/?/44
CVE: CVE-2008-2968
Published: 2008-07-02
Description: SQL injection vulnerability in rating.php in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the book_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30763; http://securityreason.com/securityalert/3959; http://www.bugreport.ir/?/44
CVE: CVE-2008-2969
Published: 2008-07-02
Description: Directory traversal vulnerability in download.php in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to read arbitrary files via a .. (dot dot) in the dfile parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/3959; http://www.bugreport.ir/?/44; http://www.securityfocus.com/archive/1/493472/100/0/threaded
CVE: CVE-2008-2970
Published: 2008-07-02
Description: Multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to (1) index.php and (2) login.php in homepg/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/3959; http://www.bugreport.ir/?/44; http://www.securityfocus.com/archive/1/493472/100/0/threaded
CVE: CVE-2008-2971
Published: 2008-07-02
Description: SQL injection vulnerability in links-extern.php in CiBlog 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30807; http://www.securityfocus.com/bid/29852; https://exchange.xforce.ibmcloud.com/vulnerabilities/43267
CVE: CVE-2008-2972
Published: 2008-07-02
Description: SQL injection vulnerability in index.php in KbLance allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a comment action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31123; http://www.securityfocus.com/bid/29859; https://exchange.xforce.ibmcloud.com/vulnerabilities/43272
CVE: CVE-2008-2973
Published: 2008-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in chathead.php in MM Chat 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sitename and (2) wmessage parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29910; https://exchange.xforce.ibmcloud.com/vulnerabilities/43331; https://www.exploit-db.com/exploits/5919
CVE: CVE-2008-2974
Published: 2008-07-02
Description: Directory traversal vulnerability in chatconfig.php in MM Chat 1.5, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the currentlang parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29910; https://exchange.xforce.ibmcloud.com/vulnerabilities/43327; https://www.exploit-db.com/exploits/5919