deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2169
Published: 2008-05-13
Description: Unspecified vulnerability in Avici routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.kb.cert.org/vuls/id/929656; http://www.securityfocus.com/bid/28999; http://www.kb.cert.org/vuls/id/929656
CVE: CVE-2008-2170
Published: 2008-05-13
Description: Unspecified vulnerability in Century routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.kb.cert.org/vuls/id/929656; http://www.securityfocus.com/bid/28999; http://www.kb.cert.org/vuls/id/929656
CVE: CVE-2008-2171
Published: 2008-05-13
Description: Unspecified vulnerability in AlaxalA AX routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30054; http://www.kb.cert.org/vuls/id/929656; http://www.kb.cert.org/vuls/id/MIMG-79UV2A
CVE: CVE-2008-2172
Published: 2008-05-13
Description: Unspecified vulnerability in Hitachi GR routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30028; http://www.kb.cert.org/vuls/id/929656; http://www.kb.cert.org/vuls/id/MIMG-79UV2A
CVE: CVE-2008-2173
Published: 2008-05-13
Description: Unspecified vulnerability in Yamaha routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.kb.cert.org/vuls/id/929656; http://www.securityfocus.com/bid/28999; http://www.kb.cert.org/vuls/id/929656
CVE: CVE-2008-2174
Published: 2008-05-13
Description: Multiple unspecified vulnerabilities in Robin Rawson-Tetley Animal Shelter Manager (ASM) before 2.2.2 have unknown impact and attack vectors, related to "various areas where security was missing."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30041; http://sourceforge.net/forum/forum.php?forum_id=818214; http://sourceforge.net/project/shownotes.php?group_id=82533&release_id=596220
CVE: CVE-2008-2175
Published: 2008-05-13
Description: SQL injection vulnerability in comments.php in Gamma Scripts BlogMe PHP 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30058; http://www.securityfocus.com/bid/29030; https://exchange.xforce.ibmcloud.com/vulnerabilities/42193
CVE: CVE-2008-2176
Published: 2008-05-13
Description: Cross-site scripting (XSS) vulnerability in admin/category.php in Zomplog 3.8.2 allows remote attackers to inject arbitrary web script or HTML via the catname parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30062; http://securityreason.com/securityalert/3870; http://www.securityfocus.com/archive/1/491553/100/0/threaded
CVE: CVE-2008-2177
Published: 2008-05-13
Description: Multiple SQL injection vulnerabilities in phpDirectorySource 1.1.06, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to show.php and the (2) login parameter to admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30056; http://www.securityfocus.com/bid/29039; http://www.vupen.com/english/advisories/2008/1432/references
CVE: CVE-2008-2178
Published: 2008-05-13
Description: Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the searchTerms parameter in an editArticleCategories operation (aka an admin category search).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lifetype.net/post/2008/05/04/lifetype-1.2.8-released; http://secunia.com/advisories/30075; http://securityreason.com/securityalert/3871
CVE: CVE-2008-2179
Published: 2008-05-13
Description: Cross-site scripting (XSS) vulnerability in SystemList.jsp in SysAid 5.1.08 allows remote attackers to inject arbitrary web script or HTML via the searchField parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30074; http://www.securityfocus.com/bid/29037; https://exchange.xforce.ibmcloud.com/vulnerabilities/42243
CVE: CVE-2008-2180
Published: 2008-05-13
Description: Multiple SQL injection vulnerabilities in cpLinks 1.03, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) admin_username parameter (aka the username field) to admin/index.php and the (2) search_text and (3) search_category parameters to search.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30024; http://www.securityfocus.com/bid/29035; http://www.vupen.com/english/advisories/2008/1431/references
CVE: CVE-2008-2181
Published: 2008-05-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the (1) search_text and (2) search_category parameters.  NOTE: the XSS reportedly occurs in a forced SQL error message.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30024; http://www.securityfocus.com/bid/29035; http://www.vupen.com/english/advisories/2008/1431/references
CVE: CVE-2008-2182
Published: 2008-05-13
Description: Cross-site scripting (XSS) vulnerability in the powermail extension before 1.1.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30079; http://typo3.org/teams/security/security-bulletins/typo3-20080505-2/; http://www.securityfocus.com/bid/29040
CVE: CVE-2008-2183
Published: 2008-05-13
Description: SQL injection vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to execute arbitrary SQL commands via the idt parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30057; http://www.securityfocus.com/bid/29033; https://exchange.xforce.ibmcloud.com/vulnerabilities/42190
CVE: CVE-2008-2184
Published: 2008-05-13
Description: Multiple SQL injection vulnerabilities in SMartBlog (aka SMBlog) 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) mois, (2) an, (3) jour, and (4) id parameters to index.php, and the (5) login parameter to gestion/logon.php, different vectors than CVE-2008-2183.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30057; http://www.securityfocus.com/bid/29043; https://exchange.xforce.ibmcloud.com/vulnerabilities/42190
CVE: CVE-2008-2185
Published: 2008-05-13
Description: Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrary local files via directory traversal sequences in the page parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30057; http://www.securityfocus.com/bid/29043; https://exchange.xforce.ibmcloud.com/vulnerabilities/42192
CVE: CVE-2008-2186
Published: 2008-05-13
Description: Cross-site scripting (XSS) vulnerability in index.php in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7192&w=2; http://secunia.com/advisories/30080; http://www.bugreport.ir/index_59.htm
CVE: CVE-2008-2187
Published: 2008-05-13
Description: Cross-site scripting (XSS) vulnerability in mjguest.php in Mjguest 6.7 GT Rev.01 allows remote attackers to inject arbitrary web script or HTML via the level parameter in a redirect action, possibly involving interface/redirect.htm.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30049; http://securityreason.com/securityalert/3872; http://www.mdsjack.bo.it/public/phpBB3/viewtopic.php?t=2049
CVE: CVE-2008-2188
Published: 2008-05-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) bookCopyright and (2) ver parameters to (a) footer.php, and the (3) bookName, (4) bookMetaTags, and (5) estiloCSS parameters to (b) header.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3873; http://www.securityfocus.com/archive/1/491549/100/0/threaded; http://www.securityfocus.com/bid/29015
CVE: CVE-2007-5803
Published: 2008-05-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in CGI programs in Nagios before 2.12 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2007-5624 and CVE-2008-1360.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://secunia.com/advisories/30202; http://secunia.com/advisories/30283
CVE: CVE-2008-1922
Published: 2008-05-13
Description: Multiple stack-based buffer overflows in Sarg might allow attackers to execute arbitrary code via unknown vectors, probably a crafted Squid log file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://secunia.com/advisories/30156; http://secunia.com/advisories/30202
CVE: CVE-2008-2189
Published: 2008-05-14
Description: SQL injection vulnerability in viewfaqs.php in AnServ Auction XL allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://advisories.echo.or.id/adv/adv92-K-159-2008.txt; http://secunia.com/advisories/30089; http://securityreason.com/securityalert/3874
CVE: CVE-2008-2190
Published: 2008-05-14
Description: SQL injection vulnerability in index.php in Online Rent (aka Online Rental Property Script) 4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter.  NOTE: it was later reported that 5.0 and earlier are also affected.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://advisories.echo.or.id/adv/adv91-K-159-2008.txt; http://secunia.com/advisories/30090; http://secunia.com/advisories/35147
CVE: CVE-2008-2191
Published: 2008-05-14
Description: SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a display_term action to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/3876; http://www.securityfocus.com/archive/1/491606/100/0/threaded; http://www.securityfocus.com/bid/29046
CVE: CVE-2008-2192
Published: 2008-05-14
Description: Static code injection vulnerability in box/minichat/boxpop.php in IT!CMS (aka itcms) 1.9 allows remote attackers to inject arbitrary PHP code into box/MiniChat/data/shouts.php via the shout parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30059; http://www.securityfocus.com/bid/29028; https://exchange.xforce.ibmcloud.com/vulnerabilities/42172
CVE: CVE-2008-2193
Published: 2008-05-14
Description: PHP remote file inclusion vulnerability in example.php in Thomas Gossmann ScorpNews 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the site parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29041; http://www.vupen.com/english/advisories/2008/1430/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/42517
CVE: CVE-2008-2194
Published: 2008-05-14
Description: SQL injection vulnerability in forums.php in DeluxeBB 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30084; http://www.securityfocus.com/bid/29062; https://exchange.xforce.ibmcloud.com/vulnerabilities/42224
CVE: CVE-2008-2195
Published: 2008-05-14
Description: Static code injection vulnerability in admincp.php in DeluxeBB 1.2 and earlier allows remote authenticated administrators to inject arbitrary PHP code into logs/cp.php via the URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/30084; http://www.securityfocus.com/bid/29062; https://exchange.xforce.ibmcloud.com/vulnerabilities/42225
CVE: CVE-2008-2196
Published: 2008-05-14
Description: Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the newBlogUserName parameter in an addBlogUser action, a different vector than CVE-2008-2178.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30092; http://securityreason.com/securityalert/3879; http://www.securityfocus.com/archive/1/491600/100/0/threaded
CVE: CVE-2008-2197
Published: 2008-05-14
Description: SQL injection vulnerability in the blogwriter module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL commands via the historymonth parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30085; http://www.securityfocus.com/bid/29061; https://exchange.xforce.ibmcloud.com/vulnerabilities/42220
CVE: CVE-2008-2198
Published: 2008-05-14
Description: PHP remote file inclusion vulnerability in kmitaadmin/kmitat/htmlcode.php in Kmita Tellfriend 2.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://advisories.echo.or.id/adv/adv93-K-159-2008.txt; http://securityreason.com/securityalert/3877; http://www.securityfocus.com/archive/1/491616/100/0/threaded
CVE: CVE-2008-2199
Published: 2008-05-14
Description: PHP remote file inclusion vulnerability in kmitaadmin/kmitam/htmlcode.php in Kmita Mail 3.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://advisories.echo.or.id/adv/adv94-K-159-2008.txt; http://secunia.com/advisories/30087; http://securityreason.com/securityalert/3878
CVE: CVE-2008-2200
Published: 2008-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Maian Weblog 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter to admin/index.php in a blogs search action, the (2) msg_charset and (3) msg_header9 parameters to admin/inc/header.php, and the (4) keywords parameter to index.php in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30060; http://securityreason.com/securityalert/3880; http://www.securityfocus.com/archive/1/491588/100/0/threaded
CVE: CVE-2008-2201
Published: 2008-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/header.php in Maian Recipe 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) header, (2) header2, (3) header3, (4) header4, (5) header5, (6) header6, (7) header7, (8) header8, and (9) header9 parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30067; http://securityreason.com/securityalert/3881; http://www.securityfocus.com/archive/1/491589/100/0/threaded
CVE: CVE-2008-2202
Published: 2008-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter to upload/admin/index.php in a search action, the (2) msg_charset and (3) msg_header9 parameters to admin/inc/header.php, and the (4) keywords parameter to index.php in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30096; http://securityreason.com/securityalert/3882; http://www.securityfocus.com/archive/1/491599/100/0/threaded
CVE: CVE-2008-2203
Published: 2008-05-14
Description: SQL injection vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary SQL commands via the keywords parameter in a search action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3883; http://www.securityfocus.com/archive/1/491586/100/0/threaded; http://www.securityfocus.com/bid/29032
CVE: CVE-2008-2204
Published: 2008-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/header.php in Maian Search 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) header, (2) header2, (3) header3, (4) header4, (5) header5, (6) header6, (7) header7, (8) header8, and (9) header9 parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3883; http://www.securityfocus.com/archive/1/491586/100/0/threaded; http://www.securityfocus.com/bid/29032
CVE: CVE-2008-2205
Published: 2008-05-14
Description: SQL injection vulnerability in index.php in Maian Music 1.1 allows remote attackers to execute arbitrary SQL commands via the album parameter in an album action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30066; http://securityreason.com/securityalert/3884; http://www.securityfocus.com/archive/1/491590/100/0/threaded
CVE: CVE-2008-2206
Published: 2008-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Maian Music 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter in a search action to index.php, and the (2) msg_script parameter to admin/inc/footer.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30066; http://securityreason.com/securityalert/3884; http://www.securityfocus.com/archive/1/491590/100/0/threaded
CVE: CVE-2008-2207
Published: 2008-05-14
Description: Cross-site scripting (XSS) vulnerability in admin/index.php in Maian Gallery 2.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30070; http://securityreason.com/securityalert/3885; http://www.securityfocus.com/archive/1/491583/100/0/threaded
CVE: CVE-2008-2208
Published: 2008-05-14
Description: SQL injection vulnerability in index.php in Maian Greeting 2.1 allows remote attackers to execute arbitrary SQL commands via the keywords parameter in a search action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30069; http://securityreason.com/securityalert/3887; http://www.securityfocus.com/archive/1/491582/100/0/threaded
CVE: CVE-2008-2209
Published: 2008-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/header.php in Maian Greeting 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script and (2) msg_script2 parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30069; http://securityreason.com/securityalert/3887; http://www.securityfocus.com/archive/1/491582/100/0/threaded
CVE: CVE-2008-2210
Published: 2008-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Maian Support 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script, (2) msg_script2, and (3) msg_script3 parameters to admin/inc/footer.php; and the (4) msg_script2 parameter to admin/inc/header.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30068; http://securityreason.com/securityalert/3888; http://www.securityfocus.com/archive/1/491587/100/0/threaded
CVE: CVE-2008-2211
Published: 2008-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/footer.php in Maian Guestbook 3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script2 and (2) msg_script3 parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30071; http://securityreason.com/securityalert/3890; http://www.securityfocus.com/archive/1/491584/100/0/threaded
CVE: CVE-2008-2212
Published: 2008-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Maian Cart 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_adminheader, (2) msg_adminheader2, (3) msg_adminheader3, (4) msg_adminheader4, and unspecified other parameters to admin/inc/header.php; the (5) msg_script3 and unspecified other parameters to admin/inc/footer.php; and the (6) keywords parameter to index.php in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3891; http://www.securityfocus.com/archive/1/491581/100/0/threaded; http://www.securityfocus.com/bid/29032
CVE: CVE-2008-2213
Published: 2008-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/footer.php in Maian Links 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script2 and (2) msg_script3 parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30065; http://securityreason.com/securityalert/3892; http://www.securityfocus.com/archive/1/491591/100/0/threaded
CVE: CVE-2008-1749
Published: 2008-05-14
Description: Memory leak in Cisco Content Switching Module (CSM) 4.2(3) up to 4.2(8) and Cisco Content Switching Module with SSL (CSM-S) 2.1(2) up to 2.1(7) allows remote attackers to cause a denial of service (memory consumption) via TCP segments with an unspecified combination of TCP flags.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/30223; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml; http://www.securityfocus.com/bid/29216
CVE: CVE-2008-1943
Published: 2008-05-14
Description: Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://secunia.com/advisories/29963; http://secunia.com/advisories/30781; http://www.redhat.com/support/errata/RHSA-2008-0194.html
CVE: CVE-2008-1944
Published: 2008-05-14
Description: Buffer overflow in the backend framebuffer of XenSource Xen Para-Virtualized Framebuffer (PVFB) Message 3.0 through 3.0.3 allows local users to cause a denial of service (SDL crash) and possibly execute arbitrary code via "bogus screen updates," related to missing validation of the "format of messages."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29963; http://www.redhat.com/support/errata/RHSA-2008-0194.html; http://www.securityfocus.com/bid/29186