deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1950
Published: 2008-05-21
Description: Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b; http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00051.html; http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00055.html
CVE: CVE-2008-2241
Published: 2008-05-21
Description: Directory traversal vulnerability in caloggerd in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allows remote attackers to append arbitrary data to arbitrary files via directory traversal sequences in unspecified input fields, which are used in log messages.  NOTE: this can be leveraged for code execution in many installation environments by writing to a startup file or configuration file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30300; http://www.securityfocus.com/archive/1/492266/100/0/threaded; http://www.securityfocus.com/archive/1/492274/100/0/threaded
CVE: CVE-2008-2242
Published: 2008-05-21
Description: Multiple buffer overflows in xdr functions in the server in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allow remote attackers to execute arbitrary code, as demonstrated by a stack-based buffer overflow via a long parameter to the xdr_rwsstring function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30300; http://www.securityfocus.com/archive/1/492274/100/0/threaded; http://www.securityfocus.com/archive/1/492291/100/0/threaded
CVE: CVE-2008-2357
Published: 2008-05-21
Description: Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record.  NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: ftp://ftp.bitwizard.nl/mtr/mtr-0.73.diff; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html; http://seclists.org/fulldisclosure/2008/May/0488.html
CVE: CVE-2008-2390
Published: 2008-05-21
Description: Hpufunction.dll 4.0.0.1 in HP Software Update exposes the unsafe (1) ExecuteAsync and (2) Execute methods, which allows remote attackers to execute arbitrary code via an absolute pathname in the first argument.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/42249; https://www.exploit-db.com/exploits/5511; https://exchange.xforce.ibmcloud.com/vulnerabilities/42249
CVE: CVE-2008-2391
Published: 2008-05-21
Description: SubSonic allows remote attackers to bypass pagesize limits and cause a denial of service (CPU consumption) via a pageindex (aka data page number) of -1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/3898; http://www.codeplex.com/subsonic/WorkItem/View.aspx?WorkItemId=16112; http://www.portcullis-security.com/uplds/wildcard_attacks.pdf
CVE: CVE-2008-2392
Published: 2008-05-21
Description: Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/3897; http://www.securityfocus.com/archive/1/492230/100/0/threaded; http://www.securityfocus.com/bid/29276
CVE: CVE-2008-2393
Published: 2008-05-21
Description: SQL injection vulnerability in play.php in EntertainmentScript 1.4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30311; http://www.securityfocus.com/bid/29284; https://exchange.xforce.ibmcloud.com/vulnerabilities/42538
CVE: CVE-2008-2394
Published: 2008-05-21
Description: Multiple SQL injection vulnerabilities in TAGWORX.CMS 3.00.02 allow remote attackers to execute arbitrary SQL commands via the (1) cid parameter to contact.php and the (2) nid parameter to news.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30149; http://www.tagworx.net/webdesign_seo_muenchen.php?cid=79&pid=5; http://www.vupen.com/english/advisories/2008/1561/references
CVE: CVE-2008-2395
Published: 2008-05-21
Description: SQL injection vulnerability in thread.php in AlkalinePHP 0.80.00 beta and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29281; https://exchange.xforce.ibmcloud.com/vulnerabilities/42520; https://www.exploit-db.com/exploits/5652
CVE: CVE-2008-2396
Published: 2008-05-21
Description: PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in an arbitrary element of the PAGES array parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30264; http://www.securityfocus.com/bid/29278; https://exchange.xforce.ibmcloud.com/vulnerabilities/42518
CVE: CVE-2008-2397
Published: 2008-05-21
Description: Cross-site scripting (XSS) vulnerability in search-results.dot in dotCMS 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30307; http://www.securityfocus.com/bid/29287; https://exchange.xforce.ibmcloud.com/vulnerabilities/42525
CVE: CVE-2008-2398
Published: 2008-05-21
Description: Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30333; http://securityreason.com/securityalert/3896; http://www.securityfocus.com/archive/1/492271/100/0/threaded
CVE: CVE-2007-5962
Published: 2008-05-22
Description: Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service (memory consumption) via a large number of CWD commands, as demonstrated by an attack on a daemon with the deny_file configuration option.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/30341; http://secunia.com/advisories/30354; http://securitytracker.com/id?1020079
CVE: CVE-2008-0534
Published: 2008-05-22
Description: The SSH server in (1) Cisco Service Control Engine (SCE) before 3.1.6, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (device restart or daemon outage) via a high rate of login attempts, aka Bug ID CSCsi68582.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30316; http://secunia.com/advisories/30590; http://securitytracker.com/id?1020074
CVE: CVE-2008-0535
Published: 2008-05-22
Description: Unspecified vulnerability in the SSH server in (1) Cisco Service Control Engine (SCE) before 3.1.6, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (device instability) via "SSH credentials that attempt to change the authentication method," aka Bug ID CSCsm14239.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/30316; http://secunia.com/advisories/30590; http://securitytracker.com/id?1020074
CVE: CVE-2008-0536
Published: 2008-05-22
Description: Unspecified vulnerability in the SSH server in (1) Cisco Service Control Engine (SCE) 3.0.x before 3.0.7 and 3.1.x before 3.1.0, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (management interface outage) via SSH traffic that occurs during management operations and triggers "illegal I/O operations," aka Bug ID CSCsh49563.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/30316; http://secunia.com/advisories/30590; http://securitytracker.com/id?1020074
CVE: CVE-2008-1159
Published: 2008-05-22
Description: Multiple unspecified vulnerabilities in the SSH server in Cisco IOS 12.4 allow remote attackers to cause a denial of service (device restart) via unknown vectors, aka Bug ID (1) CSCsk42419, (2) CSCsk60020, and (3) CSCsh51293.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/30322; http://securitytracker.com/id?1020073; http://www.cisco.com/en/US/products/products_security_advisory09186a008099567f.shtml
CVE: CVE-2008-1804
Published: 2008-05-22
Description: preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment.
CVSS Score: 6.8 (MEDIUM)
References: http://cvs.snort.org/viewcvs.cgi/snort/ChangeLog?rev=1.534.2.11; http://cvs.snort.org/viewcvs.cgi/snort/src/preprocessors/spp_frag3.c.diff?r1=text&tr1=1.46.2.4&r2=text&tr2=1.46.2.5&diff_format=h; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=701
CVE: CVE-2008-2006
Published: 2008-05-22
Description: Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a .ics file containing (1) a large 16-bit integer on a TRIGGER line, or (2) a large integer in a COUNT field on an RRULE line.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/3901; http://www.coresecurity.com/?action=item&id=2219; http://www.securityfocus.com/archive/1/492414/100/0/threaded
CVE: CVE-2008-2007
Published: 2008-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-1035.  Reason: This candidate is a reservation duplicate of CVE-2008-1035.  Notes: All CVE users should reference CVE-2008-1035 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CWE: CWE-20
CVE: CVE-2008-2053
Published: 2008-05-22
Description: Unspecified vulnerability in Cisco Unified Customer Voice Portal (CVP) 4.0.x before 4.0(2)_ES14, 4.1.x before 4.1(1)_ES11, and 7.x before 7.0(1) allows remote authenticated users with administrator role privileges to create, modify, or delete a superuser account.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/30289; http://securitytracker.com/id?1020080; http://www.cisco.com/en/US/products/products_security_advisory09186a008099beae.shtml
CVE: CVE-2008-2240
Published: 2008-05-22
Description: Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long Accept-Language HTTP header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30310; http://secunia.com/advisories/30332; http://www-1.ibm.com/support/docview.wss?uid=swg21303057
CVE: CVE-2008-2399
Published: 2008-05-22
Description: Directory traversal vulnerability in the FireFTP add-on before 0.98.20080518 for Firefox allows remote FTP servers to create or overwrite arbitrary files via ..\ (dot dot backslash) sequences in responses to (1) MLSD and (2) LIST commands, a related issue to CVE-2002-1345.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30284; http://vuln.sg/fireftp0971-en.html; http://www.kb.cert.org/vuls/id/906907
CVE: CVE-2008-2400
Published: 2008-05-22
Description: Unspecified vulnerability in stunnel before 4.23, when running as a service on Windows, allows local users to gain privileges via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30297; http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000034.html; http://www.securityfocus.com/bid/29285
CVE: CVE-2008-2410
Published: 2008-05-22
Description: Cross-site scripting (XSS) vulnerability in the servlet engine and Web container in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30310; http://secunia.com/advisories/30332; http://www-1.ibm.com/support/docview.wss?uid=swg21303296
CVE: CVE-2008-2411
Published: 2008-05-22
Description: SQL injection vulnerability in index.php in SazCart 1.5.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the prodid parameter in a details action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30148; http://securityreason.com/securityalert/3900; http://www.securityfocus.com/archive/1/491892/100/0/threaded
CVE: CVE-2008-2412
Published: 2008-05-22
Description: SQL injection vulnerability in glossaire.php in ACGV News 0.9.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29253; http://www.z0rlu.ownspace.org/index.php?/archives/84-ACGV-News-v0.9.1-2003-SQL-inj.-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/42490
CVE: CVE-2008-2413
Published: 2008-05-22
Description: Cross-site scripting (XSS) vulnerability in glossaire.php in ACGV News 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29253; http://www.z0rlu.ownspace.org/index.php?/archives/84-ACGV-News-v0.9.1-2003-SQL-inj.-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/42491
CVE: CVE-2008-2414
Published: 2008-05-22
Description: Cross-site scripting (XSS) vulnerability in send_email.php in AN Guestbook (ANG) 0.4 allows remote attackers to inject arbitrary web script or HTML via the postid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29254; http://www.z0rlu.ownspace.org/index.php?/archives/86-ANG-AN-Guestbook-version-0.4-xss.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/42489
CVE: CVE-2008-2415
Published: 2008-05-22
Description: Directory traversal vulnerability in template/purpletech/base_include.php in DigitalHive (aka hive) 2.0 RC2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29255; http://www.z0rlu.ownspace.org/index.php?/archives/85-hive-v2.0-RC2-LFi.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/42495
CVE: CVE-2008-2416
Published: 2008-05-22
Description: SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via the category parameter in a Fiction action, possibly related to sources/fiction.class.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29265; http://www.vupen.com/english/advisories/2008/1564/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/42515
CVE: CVE-2008-2417
Published: 2008-05-22
Description: SQL injection vulnerability in showQAnswer.asp in How2ASP.net Webboard 4.1 allows remote attackers to execute arbitrary SQL commands via the qNo parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30295; http://www.securityfocus.com/bid/29263; http://www.vupen.com/english/advisories/2008/1565/references
CVE: CVE-2007-5495
Published: 2008-05-23
Description: sealert in setroubleshoot 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the sealert.log temporary file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://secunia.com/advisories/30339; http://securitytracker.com/id?1020077; http://www.redhat.com/support/errata/RHSA-2008-0061.html
CVE: CVE-2007-5496
Published: 2008-05-23
Description: Cross-site scripting (XSS) vulnerability in setroubleshoot 2.0.5 allows local users to inject arbitrary web script or HTML via a crafted (1) file or (2) process name, which triggers an Access Vector Cache (AVC) log entry in a log file used during composition of HTML documents for sealert.
CVSS Score: 1.9 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/30339; http://securitytracker.com/id?1020078; http://www.redhat.com/support/errata/RHSA-2008-0061.html
CVE: CVE-2007-5961
Published: 2008-05-23
Description: Cross-site scripting (XSS) vulnerability in the Red Hat Network channel search feature, as used in RHN and Red Hat Network Satellite before 5.0.2, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/45765; http://www.redhat.com/support/errata/RHSA-2008-0261.html; http://www.securitytracker.com/id?1020051
CVE: CVE-2008-1767
Published: 2008-05-23
Description: Buffer overflow in pattern.c in libxslt before 1.1.24 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XSL style sheet file with a long XSLT "transformation match" condition that triggers a large number of steps.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugzilla.gnome.org/show_bug.cgi?id=527297; http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html; http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html
CVE: CVE-2008-2302
Published: 2008-05-23
Description: Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30250; http://secunia.com/advisories/30291; http://securitytracker.com/id?1020028
CVE: CVE-2008-2333
Published: 2008-05-23
Description: Cross-site scripting (XSS) vulnerability in ldap_test.cgi in Barracuda Spam Firewall (BSF) before 3.5.11.025 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30362; http://www.barracudanetworks.com/ns/support/tech_alert.php; http://www.irmplc.com/index.php/168-Advisory-027
CVE: CVE-2008-2407
Published: 2008-05-23
Description: Stack-based buffer overflow in AIM.DLL in Cerulean Studios Trillian before 3.1.10.0 allows user-assisted remote attackers to execute arbitrary code via a long attribute value in a FONT tag in a message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30336; http://securitytracker.com/id?1020104; http://www.securityfocus.com/archive/1/492433/100/0/threaded
CVE: CVE-2008-2408
Published: 2008-05-23
Description: Heap-based buffer overflow in the XML parsing functionality in talk.dll in Cerulean Studios Trillian Pro before 3.1.10.0 allows remote attackers to execute arbitrary code via a malformed attribute in an IMG tag.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2008-05/0284.html; http://secunia.com/advisories/30336; http://securitytracker.com/id?1020105
CVE: CVE-2008-2409
Published: 2008-05-23
Description: Stack-based buffer overflow in Cerulean Studios Trillian before 3.1.10.0 allows remote attackers to execute arbitrary code via unspecified attributes in the X-MMS-IM-FORMAT header in an MSN message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2008-05/0285.html; http://secunia.com/advisories/30336; http://securitytracker.com/id?1020106
CVE: CVE-2008-2418
Published: 2008-05-23
Description: Race condition in the STREAMS Administrative Driver (sad) in Sun Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/30357; http://sunsolve.sun.com/search/document.do?assetkey=1-26-237584-1; http://www.securityfocus.com/bid/29326
CVE: CVE-2008-2419
Published: 2008-05-23
Description: Mozilla Firefox 2.0.0.14 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code by triggering an error condition during certain Iframe operations between a JSframe write and a JSframe close, as demonstrated by an error in loading an empty Java applet defined by a 'src="javascript:"' sequence.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www.0x000000.com/?i=576; http://www.securityfocus.com/bid/29318; https://exchange.xforce.ibmcloud.com/vulnerabilities/42589
CVE: CVE-2008-2420
Published: 2008-05-23
Description: The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by using revoked certificates.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30335; http://secunia.com/advisories/30425; http://secunia.com/advisories/31438
CVE: CVE-2008-2421
Published: 2008-05-23
Description: Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc/gui/sap/its/webgui/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30334; http://www.securityfocus.com/archive/1/492376/100/0/threaded; http://www.securityfocus.com/bid/29317
CVE: CVE-2008-2422
Published: 2008-05-23
Description: SQL injection vulnerability in index.php in Web Slider 0.6 allows remote attackers to execute arbitrary SQL commands via the slide parameter in a slides action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29296; https://exchange.xforce.ibmcloud.com/vulnerabilities/42555; http://www.securityfocus.com/bid/29296
CVE: CVE-2008-2423
Published: 2008-05-23
Description: Unspecified vulnerability in Interchange before 5.6.0 and before 5.5.2 allows remote attackers to cause a denial of service via crafted HTTP requests.  NOTE: this might overlap CVE-2007-2635.
CVSS Score: 10.0 (HIGH)
References: http://ftp.icdevgroup.org/interchange/5.6/ANNOUNCEMENT-5.6.0.txt; http://ftp.icdevgroup.org/pub/interchange/5.5/ANNOUNCEMENT-5.5.2.txt; http://secunia.com/advisories/30346
CVE: CVE-2008-2424
Published: 2008-05-23
Description: Unspecified vulnerability in the 404 error page for the "Standard demo" in Interchange before 5.6.0 and before 5.5.2 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://ftp.icdevgroup.org/interchange/5.6/ANNOUNCEMENT-5.6.0.txt; http://ftp.icdevgroup.org/pub/interchange/5.5/ANNOUNCEMENT-5.5.2.txt; http://secunia.com/advisories/30346