deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0397
Published: 2008-01-23
Description: Multiple SQL injection vulnerabilities in aflog 1.01, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to comments.php and (2) an unspecified parameter to view.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28594; http://www.securityfocus.com/bid/27398; http://www.vupen.com/english/advisories/2008/0255
CVE: CVE-2008-0398
Published: 2008-01-23
Description: Cross-site scripting (XSS) vulnerability in aflog 1.01, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the comment form.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28594; http://www.securityfocus.com/bid/27398; http://www.vupen.com/english/advisories/2008/0255
CVE: CVE-2008-0399
Published: 2008-01-23
Description: Multiple buffer overflows in Toshiba Surveillance (Surveillix) RecordSend ActiveX control (MeIpCamX.DLL 1.0.0.4) allow remote attackers to execute arbitrary code via long arguments to the (1) SetPort and (2) SetIpAddress methods.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://retrogod.altervista.org/rgod_toshiba_control.html; http://secunia.com/advisories/28557; http://www.securityfocus.com/bid/27360
CVE: CVE-2008-0400
Published: 2008-01-23
Description: Cross-site scripting (XSS) vulnerability in header.tpl.php in the modern template for Singapore 0.10.1 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter to default.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28573; http://trew.icenetx.net/toolz/advisory-singapore-modern-template.txt; http://www.securityfocus.com/bid/27382
CVE: CVE-2008-0401
Published: 2008-01-23
Description: Buffer overflow in the logging functionality of the HTTP server in IBM Tivoli Provisioning Manager for OS Deployment (TPMfOSD) before 5.1.0.3 Interim Fix 3 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via an HTTP request with a long method string to port 443/tcp.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=647; http://secunia.com/advisories/28604; http://www-1.ibm.com/support/docview.wss?uid=swg24018010
CVE: CVE-2008-0402
Published: 2008-01-23
Description: Unspecified vulnerability in IBM WebSphere Business Modeler Basic and Advanced 6.0.2.1 before Interim Fix 11 allows remote authenticated users to bypass intended access restrictions and delete unspecified repository resources via unknown vectors, even when they are not administrators or members of the repository's owning group.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28586; http://www-1.ibm.com/support/docview.wss?uid=swg24018060; http://www-1.ibm.com/support/docview.wss?uid=swg24018061
CVE: CVE-2008-0403
Published: 2008-01-23
Description: The web server in Belkin Wireless G Plus MIMO Router F5D9230-4 does not require authentication for SaveCfgFile.cgi, which allows remote attackers to read and modify configuration via a direct request to SaveCfgFile.cgi.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/28554; http://securityreason.com/securityalert/3566; http://www.securityfocus.com/archive/1/486748/100/0/threaded
CVE: CVE-2008-0404
Published: 2008-01-23
Description: Cross-site scripting (XSS) vulnerability in Mantis before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to the "Most active bugs" summary.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28577; http://secunia.com/advisories/28591; http://sourceforge.net/project/shownotes.php?release_id=569765
CVE: CVE-2007-6425
Published: 2008-01-23
Description: Unspecified vulnerability in HP-UX B.11.31, when running ARPA Transport, allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28612; http://www.securityfocus.com/archive/1/486852/100/0/threaded; http://www.securitytracker.com/id?1019260
CVE: CVE-2008-0028
Published: 2008-01-23
Description: Unspecified vulnerability in Cisco PIX 500 Series Security Appliance and 5500 Series Adaptive Security Appliance (ASA) before 7.2(3)6 and 8.0(3), when the Time-to-Live (TTL) decrement feature is enabled, allows remote attackers to cause a denial of service (device reload) via a crafted IP packet.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/28625; http://www.cisco.com/warp/public/707/cisco-sa-20080123-asa.shtml; http://www.securityfocus.com/bid/27418
CVE: CVE-2008-0029
Published: 2008-01-23
Description: Cisco Application Velocity System (AVS) before 5.1.0 is installed with default passwords for some system accounts, which allows remote attackers to gain privileges.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.cisco.com/warp/public/707/cisco-sa-20080123-avs.shtml; http://www.securityfocus.com/bid/27421; http://www.securitytracker.com/id?1019259
CVE: CVE-2008-0421
Published: 2008-01-23
Description: SQL injection vulnerability in Invision Gallery 2.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in a rate command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/4966; https://www.exploit-db.com/exploits/4966
CVE: CVE-2008-0422
Published: 2008-01-23
Description: SQL injection vulnerability in mail.php in boastMachine (aka bMachine) 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3563; http://www.securityfocus.com/archive/1/486737/100/0/threaded; http://www.securityfocus.com/archive/1/498521/100/0/threaded
CVE: CVE-2008-0423
Published: 2008-01-23
Description: Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MY_CONF[classRoot] parameter to (1) inc.steps.access_error.php, (2) inc.steps.check_login.php, or (3) inc.steps.init_system.php in admin/functions/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/28442; http://www.securityfocus.com/bid/27380; http://www.vupen.com/english/advisories/2008/0230
CVE: CVE-2008-0424
Published: 2008-01-23
Description: SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary SQL commands via the month parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27377; http://www.vupen.com/english/advisories/2008/0226; https://exchange.xforce.ibmcloud.com/vulnerabilities/39816
CVE: CVE-2008-0425
Published: 2008-01-23
Description: Absolute path traversal vulnerability in explorerdir.php in Frimousse 0.0.2 allows remote attackers to read arbitrary files and list arbitrary directories via a full pathname in the name parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/27385; http://www.vupen.com/english/advisories/2008/0216; https://exchange.xforce.ibmcloud.com/vulnerabilities/39797
CVE: CVE-2008-0426
Published: 2008-01-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PacerCMS before 0.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) headline, or (3) text field in a message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pacercms.sourceforge.net/index.php/2008/01/21/pacercms-061-streamlines-code-base-addresses-security-issue/; http://secunia.com/advisories/28605; http://www.securityfocus.com/archive/1/486796/100/0/threaded
CVE: CVE-2008-0427
Published: 2008-01-23
Description: Directory traversal vulnerability in file.php in bloofoxCMS 0.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://bugreport.ir/?/27; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0107&w=2; http://secunia.com/advisories/28415
CVE: CVE-2008-0428
Published: 2008-01-23
Description: Multiple SQL injection vulnerabilities in the login function in system/class_permissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to admin/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugreport.ir/?/27; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0107&w=2; http://secunia.com/advisories/28415
CVE: CVE-2008-0429
Published: 2008-01-23
Description: SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange 2.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter in a forum_catview action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28581; http://www.securityfocus.com/bid/27381; http://www.vupen.com/english/advisories/2008/0231
CVE: CVE-2008-0430
Published: 2008-01-23
Description: SQL injection vulnerability in form.php in 360 Web Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the IDFM parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27364; http://www.vupen.com/english/advisories/2008/0217; https://exchange.xforce.ibmcloud.com/vulnerabilities/39796
CVE: CVE-2008-0431
Published: 2008-01-23
Description: Directory traversal vulnerability in administrator/download.php in IDMOS (aka Phoenix) 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28436; http://www.securityfocus.com/bid/27379; http://www.vupen.com/english/advisories/2008/0229
CVE: CVE-2008-0432
Published: 2008-01-23
Description: Cross-site scripting (XSS) vulnerability in index.php in phpAutoVideo 2.21 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28580; http://securityreason.com/securityalert/3567; http://www.securityfocus.com/archive/1/486591/100/0/threaded
CVE: CVE-2008-0433
Published: 2008-01-23
Description: PHP remote file inclusion vulnerability in theme/phpAutoVideo/LightTwoOh/sidebar.php in Agares phpAutoVideo 2.21 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the loadpage parameter, a different vector than CVE-2007-6614.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28580; http://securityreason.com/securityalert/3567; http://www.securityfocus.com/archive/1/486591/100/0/threaded
CVE: CVE-2008-0434
Published: 2008-01-23
Description: Format string vulnerability in the AXIMilter module in AXIGEN Mail Server 5.0.2 allows remote attackers to execute arbitrary code via format string specifiers in the CNHO command.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059788.html; http://secunia.com/advisories/28562; http://securityreason.com/securityalert/3570
CVE: CVE-2008-0435
Published: 2008-01-23
Description: Directory traversal vulnerability in index.php in OZJournals 2.1.1 allows remote attackers to read portions of arbitrary files via a .. (dot dot) in the id parameter in a printpreview action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28582; http://www.securityfocus.com/bid/27375; http://www.vupen.com/english/advisories/2008/0228
CVE: CVE-2008-0436
Published: 2008-01-23
Description: Cross-site scripting (XSS) vulnerability in profile-upload/upload.asp in PD9 Software MegaBBS 1.5.14b allows remote attackers to inject arbitrary web script or HTML via the target parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3565; http://www.securityfocus.com/archive/1/486723/100/0/threaded; http://www.securityfocus.com/bid/27368
CVE: CVE-2008-0437
Published: 2008-01-23
Description: Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installation process for HP Virtual Rooms, allow remote attackers to execute arbitrary code via a long (1) AuthenticationURL, (2) PortalAPIURL, or (3) cabroot property value.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8333&w=2; http://secunia.com/advisories/28595; http://www.securityfocus.com/bid/27384
CVE: CVE-2008-0438
Published: 2008-01-23
Description: Cross-site scripting (XSS) vulnerability in the font rendering functionality in Novemberborn sIFR 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the txt parameter to a Flash (SWF) file, as demonstrated by fonts/FuturaLt.swf.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://novemberborn.net/sifr/2.0.3; http://osvdb.org/41006; http://securityreason.com/securityalert/3571
CVE: CVE-2008-0439
Published: 2008-01-23
Description: Cross-site scripting (XSS) vulnerability in templates/default/admincp/attachments_header.php in DeluxeBB 1.1 allows remote attackers to inject arbitrary web script or HTML via the lang_listofmatches parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3564; http://www.securityfocus.com/archive/1/486804/100/0/threaded; http://www.securityfocus.com/bid/27401
CVE: CVE-2008-0440
Published: 2008-01-23
Description: AlstraSoft Forum Pay Per Post Exchange 2.0 stores passwords in cleartext, which makes it easier for attackers to access user accounts.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: https://www.exploit-db.com/exploits/4956; https://www.exploit-db.com/exploits/4956
CVE: CVE-2007-6415
Published: 2008-01-25
Description: scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute arbitrary code by invoking scp, as implemented by OpenSSH, with the -F and -o options.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=437148; http://bugs.gentoo.org/show_bug.cgi?id=203099; http://secunia.com/advisories/28538
CVE: CVE-2008-0441
Published: 2008-01-25
Description: IBM Tivoli Business Service Manager (TBSM) 4.1.1 stores passwords in cleartext (1) after external authentication, which triggers writing the password to SM_server.log; and (2) after a reconfig action; which allows local users to obtain sensitive information.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/28603; http://www-1.ibm.com/support/docview.wss?uid=swg24017939; http://www.securityfocus.com/bid/27388
CVE: CVE-2008-0442
Published: 2008-01-25
Description: PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the ffile parameter, a different vector than CVE-2008-0376.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/28568; http://www.securityfocus.com/bid/27383; http://secunia.com/advisories/28568
CVE: CVE-2008-0443
Published: 2008-01-25
Description: Heap-based buffer overflow in the FileUploader.FUploadCtl.1 ActiveX control in FileUploader.dll 2.0.0.2 in Lycos FileUploader Module allows remote attackers to execute arbitrary code via a long HandwriterFilename property value.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28599; http://www.securityfocus.com/bid/27411; http://www.vupen.com/english/advisories/2008/0253
CVE: CVE-2008-0444
Published: 2008-01-25
Description: Cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via subtext parameter to unspecified components.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://midas.psi.ch/elog/download/ChangeLog; http://osvdb.org/41681; http://secunia.com/advisories/28589
CVE: CVE-2008-0445
Published: 2008-01-25
Description: The replace_inline_img function in elogd in Electronic Logbook (ELOG) before 2.7.1 allows remote attackers to cause a denial of service (infinite loop) via crafted logbook entries.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/28589; http://www.securityfocus.com/bid/27399; http://www.vupen.com/english/advisories/2008/0265
CVE: CVE-2008-0446
Published: 2008-01-25
Description: SQL injection vulnerability in voircom.php in LulieBlog 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27416; https://exchange.xforce.ibmcloud.com/vulnerabilities/39854; https://www.exploit-db.com/exploits/4969
CVE: CVE-2008-0447
Published: 2008-01-25
Description: SQL injection vulnerability in index.php in Foojan WMS PHP Weblog 1.0 allows remote attackers to execute arbitrary SQL commands via the story parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27415; https://exchange.xforce.ibmcloud.com/vulnerabilities/39855; https://www.exploit-db.com/exploits/4968
CVE: CVE-2008-0448
Published: 2008-01-25
Description: PHP remote file inclusion vulnerability in utils/class_HTTPRetriever.php in phpSearch allows remote attackers to execute arbitrary PHP code via a URL in the libcurlemuinc parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1293&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/39805; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1293&w=2
CVE: CVE-2008-0449
Published: 2008-01-25
Description: SQL injection vulnerability in paypalresult.asp in VP-ASP Shopping Cart 6.50 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27347; https://exchange.xforce.ibmcloud.com/vulnerabilities/39811; http://www.securityfocus.com/bid/27347
CVE: CVE-2008-0450
Published: 2008-01-25
Description: Multiple PHP remote file inclusion vulnerabilities in BLOG:CMS 4.2.1.c allow remote attackers to execute arbitrary PHP code via a URL in the (1) DIR_PLUGINS parameter to (a) index.php, and the (2) DIR_LIBS parameter to (b) media.php and (c) xmlrpc/server.php in admin/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/3576; http://www.securityfocus.com/archive/1/486743/100/0/threaded; http://securityreason.com/securityalert/3576
CVE: CVE-2008-0451
Published: 2008-01-25
Description: Multiple SQL injection vulnerabilities in PacerCMS 0.6 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) siteadmin/article-edit.php; and unspecified parameters to (2) submitted-edit.php, (3) page-edit.php, (4) section-edit.php, (5) staff-edit.php, and (6) staff-access.php in siteadmin/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pacercms.sourceforge.net/index.php/2008/01/21/pacercms-061-streamlines-code-base-addresses-security-issue/; http://securityreason.com/securityalert/3574; http://www.securityfocus.com/archive/1/486796/100/0/threaded
CVE: CVE-2008-0452
Published: 2008-01-25
Description: Directory traversal vulnerability in articles.php in Siteman 1.1.9 allows remote attackers to read arbitrary files via directory traversal sequences in the cat parameter in a viewart action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/27422; https://www.exploit-db.com/exploits/4973; http://www.securityfocus.com/bid/27422
CVE: CVE-2008-0453
Published: 2008-01-25
Description: SQL injection vulnerability in list.php in Easysitenetwork Recipe allows remote attackers to execute arbitrary SQL commands via the categoryid parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27405; https://exchange.xforce.ibmcloud.com/vulnerabilities/39853; https://www.exploit-db.com/exploits/4960
CVE: CVE-2007-4850
Published: 2008-01-25
Description: curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different vulnerability than CVE-2006-2563.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://cvs.php.net/viewcvs.cgi/php-src/NEWS?revision=1.2027.2.547.2.1047&view=markup; http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
CVE: CVE-2007-5764
Published: 2008-01-25
Description: Buffer overflow in the pioout program in printers.rte in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via a long command line option.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=648; http://secunia.com/advisories/28609; http://www-1.ibm.com/support/docview.wss?uid=isg1IZ10840
CVE: CVE-2008-0454
Published: 2008-01-25
Description: Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1) Dailymotion and possibly (2) Metacafe movie in the Skype video gallery, accessible through a search within the "Add video to chat" dialog, aka "videomood XSS."
CVSS Score: 9.3 (HIGH)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0337.html; http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0363.html; http://aviv.raffon.net/2008/01/17/SkypeCrosszoneScriptingVulnerability.aspx
CVE: CVE-2008-0455
Published: 2008-01-25
Description: Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2012-1591.html; http://rhn.redhat.com/errata/RHSA-2012-1592.html; http://rhn.redhat.com/errata/RHSA-2012-1594.html
CVE: CVE-2008-0456
Published: 2008-01-25
Description: CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
CVSS Score: 2.6 (LOW)
CWE: CWE-74
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://rhn.redhat.com/errata/RHSA-2013-0130.html; http://secunia.com/advisories/29348