deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4669
Published: 2008-10-22
Description: Cross-site scripting (XSS) vulnerability in search.php in Dan Fletcher Recipe Script allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/31442; http://www.securityfocus.com/bid/31442/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/45489
CVE: CVE-2008-4670
Published: 2008-10-22
Description: Cross-site scripting (XSS) vulnerability in search.php in Ed Pudol Clickbank Portal allows remote attackers to inject arbitrary web script or HTML via the search box.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/31438; http://www.securityfocus.com/bid/31438/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/45483
CVE: CVE-2008-4671
Published: 2008-10-22
Description: Cross-site scripting (XSS) vulnerability in wp-admin/wp-blogs.php in Wordpress MU (WPMU) before 2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) s and (2) ip_address parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064748.html; http://secunia.com/advisories/32060; http://www.securityfocus.com/bid/31482
CVE: CVE-2008-4672
Published: 2008-10-22
Description: Cross-site scripting (XSS) vulnerability in search_results.php in buymyscripts Lyrics Script allows remote attackers to inject arbitrary web script or HTML via the k parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/31437; http://www.securityfocus.com/bid/31437/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/45474
CVE: CVE-2008-4673
Published: 2008-10-22
Description: PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Calendar 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the (1) path[docroot] and (2) component parameters.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32053; http://securityreason.com/securityalert/4461; http://www.securityfocus.com/bid/31471
CVE: CVE-2008-4674
Published: 2008-10-22
Description: SQL injection vulnerability in realestate-index.php in Conkurent Real Estate Manager 1.01 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in browse mode.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32049; http://securityreason.com/securityalert/4469; http://www.securityfocus.com/bid/31443
CVE: CVE-2008-4675
Published: 2008-10-22
Description: SQL injection vulnerability in index.php in PHPcounter 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the name parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4465; http://www.securityfocus.com/bid/31451; https://exchange.xforce.ibmcloud.com/vulnerabilities/45493
CVE: CVE-2008-4676
Published: 2008-10-22
Description: Unspecified vulnerability in Citrix XenApp (formerly Presentation Server) 4.5 Feature Pack 1 and earlier, Presentation Server 4.0, and Access Essentials 1.0, 1.5, and 2.0 allows local users to gain privileges via unknown attack vectors related to creating an unspecified file.  NOTE: this might be the same issue as CVE-2008-3485, but the vendor advisory is too vague to be certain.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/32017; http://support.citrix.com/article/CTX116310; http://www.securityfocus.com/bid/31484
CVE: CVE-2008-4677
Published: 2008-10-22
Description: autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords.  NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://secunia.com/advisories/31464
CVE: CVE-2008-4678
Published: 2008-10-22
Description: The HTTP_Request_Parser method in the HTTP Transport component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 allows remote attackers to cause a denial of service (controller 0C4 abend and application hang) via a long HTTP Host header, related to "storage overlay" on the stack and a "parse failure."
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/32296; http://www-01.ibm.com/support/docview.wss?uid=swg27006876; http://www-1.ibm.com/support/docview.wss?uid=swg1PK69371
CVE: CVE-2008-4679
Published: 2008-10-22
Description: The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists (CRL), does not call the setRevocationEnabled method on the PKIXBuilderParameters object, which prevents the "Java security method" from checking the revocation status of X.509 certificates and allows remote attackers to bypass intended access restrictions via a SOAP message with a revoked certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/32296; http://www-01.ibm.com/support/docview.wss?uid=swg27006876; http://www-01.ibm.com/support/docview.wss?uid=swg27007951
CVE: CVE-2008-4680
Published: 2008-10-22
Description: packet-usb.c in the USB dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via a malformed USB Request Block (URB).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32355; http://secunia.com/advisories/34144; http://securitytracker.com/id?1021069
CVE: CVE-2008-4681
Published: 2008-10-22
Description: Unspecified vulnerability in the Bluetooth RFCOMM dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via unknown packets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-399
References: http://secunia.com/advisories/32355; http://secunia.com/advisories/34144; http://securitytracker.com/id?1021069
CVE: CVE-2008-4682
Published: 2008-10-22
Description: wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application abort) via a malformed Tamos CommView capture file (aka .ncf file) with an "unknown/unexpected packet type" that triggers a failed assertion.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/32355; http://secunia.com/advisories/34144; http://securityreason.com/securityalert/4462
CVE: CVE-2008-4683
Published: 2008-10-22
Description: The dissect_btacl function in packet-bthci_acl.c in the Bluetooth ACL dissector in Wireshark 0.99.2 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via a packet with an invalid length, related to an erroneous tvb_memcpy call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32355; http://secunia.com/advisories/32944; http://secunia.com/advisories/34144
CVE: CVE-2008-4684
Published: 2008-10-22
Description: packet-frame in Wireshark 0.99.2 through 1.0.3 does not properly handle exceptions thrown by post dissectors, which allows remote attackers to cause a denial of service (application crash) via a certain series of packets, as demonstrated by enabling the (1) PRP or (2) MATE post dissector.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32355; http://secunia.com/advisories/32944; http://secunia.com/advisories/34144
CVE: CVE-2008-4685
Published: 2008-10-22
Description: Use-after-free vulnerability in the dissect_q931_cause_ie function in packet-q931.c in the Q.931 dissector in Wireshark 0.10.3 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via certain packets that trigger an exception.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32355; http://secunia.com/advisories/32944; http://secunia.com/advisories/34144
CVE: CVE-2008-4686
Published: 2008-10-22
Description: Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=d859e6b9537af2d7326276f70de25a840f554dc3; http://www.openwall.com/lists/oss-security/2008/10/19/2; http://www.openwall.com/lists/oss-security/2008/10/22/6
CVE: CVE-2008-4687
Published: 2008-10-22
Description: manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/utility_api.php?r1=5679&r2=5678&pathrev=5679; http://secunia.com/advisories/32314; http://secunia.com/advisories/32975
CVE: CVE-2008-4688
Published: 2008-10-22
Description: core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified issue number.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384; http://secunia.com/advisories/32243; http://secunia.com/advisories/32975
CVE: CVE-2008-4689
Published: 2008-10-22
Description: Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32975; http://www.gentoo.org/security/en/glsa/glsa-200812-07.xml; http://www.mantisbt.org/bugs/changelog_page.php
CVE: CVE-2008-4690
Published: 2008-10-22
Description: lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929.  NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html; http://secunia.com/advisories/32416; http://secunia.com/advisories/32967
CVE: CVE-2008-4691
Published: 2008-10-22
Description: Unspecified vulnerability in the SQLNLS_UNPADDEDCHARLEN function in the New Compiler (aka Starburst derived compiler) component in the server in IBM DB2 9.1 before FP6 allows attackers to cause a denial of service (segmentation violation and trap) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT; http://secunia.com/advisories/32368; http://www-01.ibm.com/support/docview.wss?uid=swg1LI73364
CVE: CVE-2008-4692
Published: 2008-10-22
Description: The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT; http://secunia.com/advisories/31787; http://secunia.com/advisories/32368
CVE: CVE-2008-4693
Published: 2008-10-22
Description: The SORT/LIST SERVICES component in IBM DB2 9.1 before FP6 and 9.5 before FP2 writes sensitive information to the trace output, which allows attackers to obtain sensitive information by reading "PASSWORD-RELATED CONNECTION STRING KEYWORD VALUES."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT; http://secunia.com/advisories/32368; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ23915
CVE: CVE-2008-4699
Published: 2008-10-22
Description: Insecure method vulnerability in the ActiveX control (PAWWeb11.ocx) in Peachtree Accounting 2004 allows remote attackers to execute arbitrary programs via the ExecutePreferredApplication method.
CVSS Score: 9.3 (HIGH)
References: http://jbrownsec.blogspot.com/2008/09/peachtree-accounting-is-not-safe.html; http://secunia.com/advisories/31809; http://securityreason.com/securityalert/4471
CVE: CVE-2008-4700
Published: 2008-10-22
Description: SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the libera_staff_pass cookie parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31811; http://securityreason.com/securityalert/4472; http://www.securityfocus.com/bid/31102
CVE: CVE-2008-4701
Published: 2008-10-22
Description: SQL injection vulnerability in admin.php in Libera CMS 1.12, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the libera_staff_user cookie parameter, a different vector than CVE-2008-4700.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31811; http://www.securityfocus.com/bid/31102; https://exchange.xforce.ibmcloud.com/vulnerabilities/45011
CVE: CVE-2008-4702
Published: 2008-10-22
Description: Multiple directory traversal vulnerabilities in PhpWebGallery 1.3.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) user[language] and (2) user[template] parameters to (a) init.inc.php, and (b) the user[language] parameter to isadmin.inc.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4419; https://exchange.xforce.ibmcloud.com/vulnerabilities/45060; https://www.exploit-db.com/exploits/6425
CVE: CVE-2008-4703
Published: 2008-10-23
Description: SQL injection vulnerability in news.php in BosDev BosNews 4.0 allows remote attackers to execute arbitrary SQL commands via the article parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4474; http://www.securityfocus.com/bid/28778; https://exchange.xforce.ibmcloud.com/vulnerabilities/41806
CVE: CVE-2008-4704
Published: 2008-10-23
Description: PHP remote file inclusion vulnerability in SezHooTabsAndActions.php in SezHoo 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the IP parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4473; http://www.securityfocus.com/bid/31756; https://exchange.xforce.ibmcloud.com/vulnerabilities/45859
CVE: CVE-2008-4705
Published: 2008-10-23
Description: SQL injection vulnerability in success_story.php in php Online Dating Software MyPHPDating allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32268; http://securityreason.com/securityalert/4477; http://www.securityfocus.com/bid/31763
CVE: CVE-2008-4706
Published: 2008-10-23
Description: SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute arbitrary SQL commands via the mapid parameter in a showdetails action to (1) vbgooglemaphse.php and (2) mapa.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32054; http://securityreason.com/securityalert/4480; http://www.securityfocus.com/bid/31453
CVE: CVE-2008-4707
Published: 2008-10-23
Description: Directory traversal vulnerability in index.php in BbZL.PhP 0.92 allows remote attackers to access unauthorized directories via a .. (dot dot) in the lien_2 parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4493; http://www.securityfocus.com/bid/31464; https://exchange.xforce.ibmcloud.com/vulnerabilities/45497
CVE: CVE-2008-4708
Published: 2008-10-23
Description: BbZL.PhP 0.92 allows remote attackers to bypass authentication and gain administrative access by setting the phorum_admin_session cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/4495; http://www.securityfocus.com/bid/31462; https://exchange.xforce.ibmcloud.com/vulnerabilities/45498
CVE: CVE-2008-4709
Published: 2008-10-23
Description: SQL injection vulnerability in news_read.php in Pilot Group (PG) eTraining allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31969; http://securityreason.com/securityalert/4496; http://www.securityfocus.com/bid/31455
CVE: CVE-2008-4710
Published: 2008-10-23
Description: Cross-site scripting (XSS) vulnerability in the stock quotes page in Stock 6.x before 6.x-1.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/312923; http://www.securityfocus.com/bid/31389; https://exchange.xforce.ibmcloud.com/vulnerabilities/45405
CVE: CVE-2008-4711
Published: 2008-10-23
Description: SQL injection vulnerability in Joovili 3.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.blog.php, (2) view.event.php, (3) view.group.php, (4) view.music.php, (5) view.picture.php, and (6) view.video.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4486; http://www.securityfocus.com/bid/31444; https://exchange.xforce.ibmcloud.com/vulnerabilities/45486
CVE: CVE-2008-4712
Published: 2008-10-23
Description: Directory traversal vulnerability in pages/showblog.php in LnBlog 0.9.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the plugin parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32032; http://securityreason.com/securityalert/4481; http://www.securityfocus.com/bid/31459
CVE: CVE-2008-4713
Published: 2008-10-23
Description: SQL injection vulnerability in view.php in 212cafe Board 0.07 allows remote attackers to execute arbitrary SQL commands via the qID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4482; http://www.securityfocus.com/bid/31426; https://exchange.xforce.ibmcloud.com/vulnerabilities/45428
CVE: CVE-2008-4714
Published: 2008-10-23
Description: Atomic Photo Album 1.1.0 pre4 does not properly handle the apa_cookie_login and apa_cookie_password cookies, which probably allows remote attackers to bypass authentication and gain administrative access via modified cookies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/4497; http://www.securityfocus.com/bid/31427; https://www.exploit-db.com/exploits/6580
CVE: CVE-2008-4715
Published: 2008-10-23
Description: SQL injection vulnerability in the Jpad (com_jpad) 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4485; http://www.securityfocus.com/bid/28923; https://exchange.xforce.ibmcloud.com/vulnerabilities/41983
CVE: CVE-2008-4716
Published: 2008-10-23
Description: SQL injection vulnerability in show.php in BitmixSoft PHP-Lance 1.52 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32027; http://securityreason.com/securityalert/4500; http://www.securityfocus.com/bid/31446
CVE: CVE-2008-4717
Published: 2008-10-23
Description: SQL injection vulnerability in bannerclick.php in ZEELYRICS 2.0 allows remote attackers to execute arbitrary SQL commands via the adid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32020; http://securityreason.com/securityalert/4479; http://www.securityfocus.com/bid/31449
CVE: CVE-2008-4718
Published: 2008-10-23
Description: Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the help_file parameter, a different vector than CVE-2006-2156.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4499; https://exchange.xforce.ibmcloud.com/vulnerabilities/45495; https://www.exploit-db.com/exploits/6592
CVE: CVE-2008-4719
Published: 2008-10-23
Description: PHP remote file inclusion vulnerability in cms/classes/openengine/filepool.php in openEngine 2.0 beta2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the oe_classpath parameter, a different vector than CVE-2008-4329.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4478; http://www.securityfocus.com/bid/31423; https://exchange.xforce.ibmcloud.com/vulnerabilities/45482
CVE: CVE-2008-4720
Published: 2008-10-23
Description: Multiple PHP remote file inclusion vulnerabilities in The Gemini Portal 4.7 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) page/forums/bottom.php and (2) page/forums/category.php.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32057; http://securityreason.com/securityalert/4503; http://www.securityfocus.com/bid/31433
CVE: CVE-2008-4721
Published: 2008-10-23
Description: PHP Jabbers Post Comment 3.0 allows remote attackers to bypass authentication and gain administrative access by setting the PostCommentsAdmin cookie to "logged."
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-287
References: http://secunia.com/advisories/27991; http://securityreason.com/securityalert/4502; https://exchange.xforce.ibmcloud.com/vulnerabilities/45503
CVE: CVE-2007-4349
Published: 2008-10-23
Description: The Shared Trace Service (aka OVTrace) in HP Performance Agent C.04.70 (aka 4.70), HP OpenView Performance Agent C.04.60 and C.04.61, HP Reporter 3.8, and HP OpenView Reporter 3.7 (aka Report 3.70) allows remote attackers to cause a denial of service via an unspecified series of RPC requests (aka Trace Event Messages) that triggers an out-of-bounds memory access, related to an erroneous object reference.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8654&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0961&w=2; http://secunia.com/advisories/27054