deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1791
Published: 2008-04-15
Description: SQL injection vulnerability in ladder.php in My Gaming Ladder 7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the ladderid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28671; http://www.vupen.com/english/advisories/2008/1138/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41698
CVE: CVE-2008-1792
Published: 2008-04-15
Description: Cross-site scripting (XSS) vulnerability in the insertion filter in the Flickr Drupal module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-alpha allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/241939; http://secunia.com/advisories/29658; http://www.securityfocus.com/bid/28594
CVE: CVE-2008-1793
Published: 2008-04-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in view.cgi in Smart Classified ADS Professional, Smart Photo ADS, and Smart Photo ADS Gold allow remote attackers to inject arbitrary web script or HTML via the (1) AdNum and (2) Department parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29623; http://www.securityfocus.com/bid/28595; https://exchange.xforce.ibmcloud.com/vulnerabilities/41611
CVE: CVE-2008-1794
Published: 2008-04-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Webform Drupal module 5.x before 5.x-1.10, 5.x-2.x before 5.x-2.0-beta3, and 6.x before 6.x-1.0-beta3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/242053; http://secunia.com/advisories/29633; http://www.securityfocus.com/bid/28597
CVE: CVE-2008-1795
Published: 2008-04-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Academic Suite 7.x and earlier, and possibly some 8.0 versions, allow remote attackers to inject arbitrary web script or HTML via (1) the searchText parameter in a Course action to webapps/blackboard/execute/viewCatalog or (2) the data__announcements___pk1_pk2__subject parameter in an ADD action to bin/common/announcement.pl.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secskill.wordpress.com/2008/03/27/hacking-blackboard-academic-suite-2/; http://secunia.com/advisories/29543; http://securityreason.com/securityalert/3810
CVE: CVE-2008-1796
Published: 2008-04-15
Description: Comix 3.6.4 creates temporary directories with predictable names, which allows local users to cause an unspecified denial of service.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/29956; http://security.gentoo.org/glsa/glsa-200804-29.xml; https://exchange.xforce.ibmcloud.com/vulnerabilities/41854
CVE: CVE-2008-1797
Published: 2008-04-15
Description: Unspecified vulnerability in Secure Computing Webwasher 5.30 before build 3159 and 6.3.0 before build 3150 allows remote attackers to cause a denial of service (freeze) via a crafted URL.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/29674; http://securityreason.com/securityalert/3811; http://www.securityfocus.com/archive/1/490406/100/0/threaded
CVE: CVE-2008-1798
Published: 2008-04-15
Description: Directory traversal vulnerability in forum/kietu/libs/calendrier.php in Dragoon 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cal[lng] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28638; https://exchange.xforce.ibmcloud.com/vulnerabilities/41669; https://www.exploit-db.com/exploits/5369
CVE: CVE-2008-1799
Published: 2008-04-15
Description: Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28623; https://exchange.xforce.ibmcloud.com/vulnerabilities/41672; https://www.exploit-db.com/exploits/5360
CVE: CVE-2008-1800
Published: 2008-04-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in DivXDB 2002 0.94b allow remote attackers to inject arbitrary web script or HTML via the (1) choice, (2) _page_, (3) zone_admin, (4) general_search, and (5) import parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28566; https://exchange.xforce.ibmcloud.com/vulnerabilities/41634; http://www.securityfocus.com/bid/28566
CVE: CVE-2008-1811
Published: 2008-04-16
Description: Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows_030000.wwv_execute_immediate, aka APEX01.  NOTE: the previous information was obtained from the April 2008 CPU.  Oracle has not commented on reliable researcher claims that APEX01 is for insufficient authorization checks for SQL commands in the run_ddl function in flows_030000.wwv_execute_immediate, allowing privilege escalation by certain non-DBA remote authenticated users.
CVSS Score: 5.5 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=690; http://secunia.com/advisories/29829; http://secunia.com/advisories/29874
CVE: CVE-2008-1812
Published: 2008-04-16
Description: Unspecified vulnerability in the Oracle Enterprise Manager component in Oracle Database 9.0.1.5 FIPS+; Application Server 1.0.2.2; and Enterprise Manager for AS 1.0.2.2 and Database 9.0.1.5 has unknown impact and local attack vectors, aka EM01.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1813
Published: 2008-04-16
Description: Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 have unknown impact and remote unauthenticated or authenticated attack vectors related to (1) SYS.DBMS_AQ in the Advanced Queuing component, aka DB01; (2) Core RDBMS, aka DB03; (3) SDO_GEOM in Oracle Spatial, aka DB06; (4) Export, aka DB12; and (5) DBMS_STATS in Query Optimizer, aka DB13.  NOTE: the previous information was obtained from the Oracle CPU.  Oracle has not commented on reliable researcher claims that DB06 is SQL injection, and DB13 occurs when the OUTLN account is reset to use a hard-coded password.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1814
Published: 2008-04-16
Description: Unspecified vulnerability in the Oracle Secure Enterprise Search or Ultrasearch component in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3 and 10.1.2.2; and Oracle Collaboration Suite 10.1.2; has unknown impact and remote attack vectors, aka DB04.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1815
Published: 2008-04-16
Description: Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.3, and 11.1.0.6 has unknown impact and remote authenticated attack vectors related to DBMS_CDC_UTILITY, aka DB02.  NOTE: the previous information was obtained from the April 2008 CPU.  Oracle has not commented on reliable researcher claims that DB02 is for SQL injection in LOCK_CHANGE_SET.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1816
Published: 2008-04-16
Description: Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.3 have unknown impact and remote authenticated attack vectors related to (1) SDO_UTIL in the Oracle Spatial component, aka DB05; or (2) fine grained auditing in the Audit component, aka DB14.  NOTE: the previous information was obtained from the Oracle CPU.  Oracle has not commented on reliable researcher claims that DB05 is SQL injection.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1817
Published: 2008-04-16
Description: Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 have unknown impact and remote attack vectors related to (1) SDO_IDX in the Spatial component, aka DB07; and (2) Core RDBMS, aka DB10.  NOTE: the previous information was obtained from the Oracle CPU.  Oracle has not commented on reliable researcher claims that DB07 is SQL injection.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1818
Published: 2008-04-16
Description: Unspecified vulnerability in the Authentication component in Oracle Database 11.1.0.6 has unknown impact and remote attack vectors, aka DB08.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1819
Published: 2008-04-16
Description: Unspecified vulnerability in the Oracle Net Services component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and local attack vectors, aka DB09.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1820
Published: 2008-04-16
Description: Unspecified vulnerability in the Data Pump component in Oracle Database 9.2.0.8, 10.1.0.5, 10.2.0.3, and 11.1.0.6 has unknown impact and remote attack vectors related to KUPF$FILE_INT, aka DB11.  NOTE: the previous information was obtained from the April 2008 CPU.  Oracle has not commented on reliable researcher claims that DB11 is for a buffer overflow in the SYS.KUPF$FILE_INT.GET_FULL_FILENAME procedure.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1821
Published: 2008-04-16
Description: Unspecified vulnerability in the Advanced Queuing component in Oracle Database 9.0.1.5 FIPS+, and 10.1.0.5 has unknown impact and remote attack vectors related to SYS.DBMS_AQJMS_INTERNAL, aka DB15.  NOTE: the previous information was obtained from the April 2008 CPU.  Oracle has not commented on reliable researcher claims that DB15 is for multiple buffer overflows in the (1) AQ$_REGISTER and (2) AQ$_UNREGISTER procedures.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1822
Published: 2008-04-16
Description: Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express 3.0.1 has unknown impact and remote attack vectors, aka APEX02.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1823
Published: 2008-04-16
Description: Unspecified vulnerability in the Oracle Jinitiator component in Oracle Application Server 1.3.1.14 has unknown impact and remote attack vectors, aka AS01.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1824
Published: 2008-04-16
Description: Unspecified vulnerability in the Oracle Dynamic Monitoring Service component in Oracle Application Server 9.0.4.3, 10.1.2.2, and 10.1.3.3 has unknown impact and remote attack vectors, aka AS02.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1825
Published: 2008-04-16
Description: Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3 has unknown impact and remote attack vectors, aka AS03.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1826
Published: 2008-04-16
Description: Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 have unknown impact and attack vectors related to (a) Advanced Pricing, aka (1) APP01 and (2) APP10; and (b) Applications Framework, aka (3) APP05.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1827
Published: 2008-04-16
Description: Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 and 12.0.4 have unknown impact and attack vectors related to (a) Advanced Pricing component, aka (1) APP02, (2) APP03, and (3) APP09; (b) Application Object Library component, aka (4) APP04, (5) APP07, and (6) APP11; (c) Applications Manager component, aka (7) APP06; (d) and Applications Technology Stack component, aka (8) APP08.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1828
Published: 2008-04-16
Description: Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.22.19, 8.48.16, and 8.49.09 has unknown impact and remote authenticated attack vectors, aka PSE01.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1829
Published: 2008-04-16
Description: Unspecified vulnerability in the PeopleSoft HCM Recruiting component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.8 SP1 has unknown impact and remote attack vectors, aka PSE02.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1830
Published: 2008-04-16
Description: Unspecified vulnerability in the PeopleSoft HCM ePerformance component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9 and 9.0 has unknown impact and remote attack vectors, aka PSE03.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-1831
Published: 2008-04-16
Description: Multiple unspecified vulnerabilities in the Siebel SimBuilder component in Oracle Siebel Enterprise 7.8.2 and 7.8.5 have unknown impact and remote or local attack vectors, aka (1) SEBL01, (2) SEBL02, (3) SEBL03, (4) SEBL04, (5) SEBL05, and (6) SEBL06.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29829; http://secunia.com/advisories/29874; http://www.oracle.com/technetwork/topics/security/cpuapr2008-082075.html
CVE: CVE-2008-0314
Published: 2008-04-16
Description: Heap-based buffer overflow in spin.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted PeSpin packed PE binary with a modified length value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://kolab.org/security/kolab-vendor-notice-20.txt; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=686; http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
CVE: CVE-2008-1771
Published: 2008-04-16
Description: Integer overflow in the ws_getpostvars function in Firefly Media Server (formerly mt-daapd) 0.2.4.1 (0.9~r1696-1.2 on Debian) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a large Content-Length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476241; http://secunia.com/advisories/29917; http://secunia.com/advisories/29919
CVE: CVE-2008-1832
Published: 2008-04-16
Description: lib/prefs.tcl in Cecilia 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the csvers temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476321; http://secunia.com/advisories/29832; http://www.securityfocus.com/bid/28805
CVE: CVE-2008-1833
Published: 2008-04-16
Description: Heap-based buffer overflow in pe.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted WWPack compressed PE binary.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://kolab.org/security/kolab-vendor-notice-20.txt; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=687; http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
CVE: CVE-2008-1387
Published: 2008-04-16
Description: ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive, as demonstrated by the PROTOS GENOME test suite for Archive Formats.
CVSS Score: 4.3 (MEDIUM)
References: http://int21.de/cve/CVE-2008-1387-clamav.html; http://kolab.org/security/kolab-vendor-notice-20.txt; http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
CVE: CVE-2008-1834
Published: 2008-04-16
Description: swfdec_load_object.c in Swfdec before 0.6.4 does not properly restrict local file access from untrusted sandboxes, which allows remote attackers to read arbitrary files via a crafted Flash file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://gitweb.freedesktop.org/?p=swfdec/swfdec.git%3Ba=commit%3Bh=326ee4ff631ecc11605f1251e1923a94561a3823; http://lists.freedesktop.org/archives/swfdec/2008-April/001321.html; http://secunia.com/advisories/29915
CVE: CVE-2008-1835
Published: 2008-04-16
Description: ClamAV before 0.93 allows remote attackers to bypass the scanning enging via a RAR file with an invalid version number, which cannot be parsed by ClamAV but can be extracted by Winrar.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00009.html; http://secunia.com/advisories/29891
CVE: CVE-2008-1836
Published: 2008-04-16
Description: The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via a crafted message that produces a string that is not null terminated, which triggers a buffer over-read.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00009.html; http://secunia.com/advisories/29891
CVE: CVE-2008-1837
Published: 2008-04-16
Description: libclamunrar in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via crafted RAR files that trigger "memory problems," as demonstrated by the PROTOS GENOME test suite for Archive Formats.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00009.html; http://secunia.com/advisories/29891
CVE: CVE-2008-1155
Published: 2008-04-16
Description: Cisco Network Admission Control (NAC) Appliance 3.5.x, 3.6.x before 3.6.4.4, 4.0.x before 4.0.6, and 4.1.x before 4.1.2 allows remote attackers to obtain the shared secret for the Clean Access Server (CAS) and Clean Access Manager (CAM) by sniffing error logs.
CVSS Score: 10.0 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/29822; http://www.cisco.com/en/US/products/products_security_advisory09186a008097bea0.shtml; http://www.securityfocus.com/bid/28807
CVE: CVE-2008-1786
Published: 2008-04-16
Description: The DSM gui_cm_ctrls ActiveX control (gui_cm_ctrls.ocx), as used in multiple CA products including BrightStor ARCServe Backup for Laptops and Desktops r11.5, Desktop Management Suite r11.1 through r11.2 C2; Unicenter r11.1 through r11.2 C2; and Desktop and Server Management r11.1 through r11.2 C2 allows remote attackers to execute arbitrary code via crafted function arguments.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2008/04/16/ca-dsm-gui-cm-ctrls-activex-control-vulnerability.aspx; http://secunia.com/advisories/29837; http://www.kb.cert.org/vuls/id/684883
CVE: CVE-2008-1838
Published: 2008-04-16
Description: SQL injection vulnerability in BosClassifieds Classified Ads System 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29799; http://www.securityfocus.com/bid/28760; https://exchange.xforce.ibmcloud.com/vulnerabilities/41799
CVE: CVE-2008-1839
Published: 2008-04-16
Description: Multgiple cross-site scripting (XSS) vulnerabilities in module/main.php in WORK system e-commerce 4.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) day, (2) month, and (3) year parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29823; http://www.securityfocus.com/bid/28785; https://exchange.xforce.ibmcloud.com/vulnerabilities/41811
CVE: CVE-2008-1840
Published: 2008-04-16
Description: SQL injection vulnerability in upload.php in Coppermine Photo Gallery (CPG) 1.4.16 and earlier allows remote authenticated users or user-assisted remote HTTP servers to execute arbitrary SQL commands via the Content-Type HTTP response header provided by the HTTP server that is used for an upload.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://forum.coppermine-gallery.net/index.php/topic%2C51787%2C0.html; http://secunia.com/advisories/29795; http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=592069
CVE: CVE-2008-1841
Published: 2008-04-16
Description: SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery (CPG) 1.4.17 and earlier allows remote attackers to execute arbitrary SQL commands via an input field associated with the session_id variable, as exploited in the wild in April 2008.  NOTE: the fix for CVE-2008-1840 was intended to address this vulnerability, but is actually inapplicable.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.4.x/bridge/coppermine.inc.php?r1=4380&r2=4381; http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.4.x/bridge/coppermine.inc.php?view=log; http://forum.coppermine-gallery.net/index.php/topic%2C51882.0.html