deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0458
Published: 2008-01-25
Description: Directory traversal vulnerability in function/sources.php in SLAED CMS 2.5 Lite allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the newlang parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/27426; http://www.vupen.com/english/advisories/2008/0308; https://exchange.xforce.ibmcloud.com/vulnerabilities/39897
CVE: CVE-2008-0459
Published: 2008-01-25
Description: Directory traversal vulnerability in update/index.php in Liquid-Silver CMS 0.35, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the update parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28619; http://www.securityfocus.com/bid/27425; http://www.vupen.com/english/advisories/2008/0309
CVE: CVE-2008-0460
Published: 2008-01-25
Description: Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-January/000068.html; http://secunia.com/advisories/28629; http://secunia.com/advisories/29266
CVE: CVE-2008-0461
Published: 2008-01-25
Description: SQL injection vulnerability in index.php in the Search module in PHP-Nuke 8.0 FINAL and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sid parameter in a comments action to modules.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28624; http://www.securityfocus.com/bid/27408; http://www.vupen.com/english/advisories/2008/0264
CVE: CVE-2008-0462
Published: 2008-01-25
Description: Cross-site scripting (XSS) vulnerability in the Archive 5.x before 5.x-1.8 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/213478; http://secunia.com/advisories/28632; http://www.securityfocus.com/bid/27436
CVE: CVE-2008-0463
Published: 2008-01-25
Description: Cross-site scripting (XSS) vulnerability in the Workflow 4.7.x before 4.7.x-1.2 and 5.x before 5.x-1.2 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving node properties.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/213473; http://secunia.com/advisories/28633; http://www.securityfocus.com/bid/27444
CVE: CVE-2008-0464
Published: 2008-01-25
Description: Directory traversal vulnerability in archiv.cgi in absofort aconon Mail 2007 Enterprise SQL 11.7.0 and Mail 2004 Enterprise SQL 11.5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://burnachurch.com/67/directory-traversal-luecke-in-aconon-mail/; http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059856.html; http://secunia.com/advisories/28617
CVE: CVE-2008-0465
Published: 2008-01-25
Description: Directory traversal vulnerability in optimizer.php in Seagull 0.6.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the files parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://seagullproject.org/publisher/articleview/action/view/frmArticleID/98/; http://secunia.com/advisories/28646; http://www.attrition.org/pipermail/vim/2008-January/001891.html
CVE: CVE-2007-4770
Published: 2008-01-29
Description: libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html; http://rhn.redhat.com/errata/RHSA-2008-0090.html; http://secunia.com/advisories/28575
CVE: CVE-2007-4771
Published: 2008-01-29
Description: Heap-based buffer overflow in the doInterval function in regexcmp.cpp in libicu in International Components for Unicode (ICU) 3.8.1 and earlier allows context-dependent attackers to cause a denial of service (memory consumption) and possibly have unspecified other impact via a regular expression that writes a large amount of data to the backtracking stack.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html; http://rhn.redhat.com/errata/RHSA-2008-0090.html; http://secunia.com/advisories/28575
CVE: CVE-2008-0008
Published: 2008-01-29
Description: The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=207214; http://pulseaudio.org/changeset/2100; http://secunia.com/advisories/28608
CVE: CVE-2008-0405
Published: 2008-01-29
Description: Multiple directory traversal vulnerabilities in HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allow remote attackers to create arbitrary (1) files and (2) directories via a .. (dot dot) in an account name, when requesting the / URI; and (3) append arbitrary data to a file via a .. (dot dot) in an account name, when requesting a URI composed of a "/?%0a" sequence followed by the data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/28631; http://securityreason.com/securityalert/3581; http://www.rejetto.com/hfs/?f=wn
CVE: CVE-2008-0406
Published: 2008-01-29
Description: HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allows remote attackers to cause a denial of service (daemon crash) via a long account name.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/28631; http://securityreason.com/securityalert/3581; http://www.rejetto.com/hfs/?f=wn
CVE: CVE-2008-0407
Published: 2008-01-29
Description: HTTP File Server (HFS) before 2.2c tags HTTP request log entries with the username sent during HTTP Basic Authentication, regardless of whether authentication succeeded, which might make it more difficult for an administrator to determine who made a remote request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/28631; http://securityreason.com/securityalert/3582; http://www.rejetto.com/hfs/?f=wn
CVE: CVE-2008-0408
Published: 2008-01-29
Description: HTTP File Server (HFS) before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/28631; http://securityreason.com/securityalert/3582; http://www.rejetto.com/hfs/?f=wn
CVE: CVE-2008-0409
Published: 2008-01-29
Description: Cross-site scripting (XSS) vulnerability in HTTP File Server (HFS) before 2.2c allows remote attackers to inject arbitrary web script or HTML via the userinfo subcomponent of a URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28631; http://securityreason.com/securityalert/3583; http://www.rejetto.com/hfs/?f=wn
CVE: CVE-2008-0410
Published: 2008-01-29
Description: HTTP File Server (HFS) before 2.2c allows remote attackers to obtain configuration and usage details by using an id element such as <id>%version%</id> in HTTP Basic Authentication instead of a username and password, as demonstrated by placing this id element in the userinfo subcomponent of a URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/28631; http://securityreason.com/securityalert/3583; http://www.rejetto.com/hfs/?f=wn
CVE: CVE-2008-0466
Published: 2008-01-29
Description: Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files.  NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://securityreason.com/securityalert/3584; http://securitytracker.com/id?1019267; http://www.bugreport.ir/?/29
CVE: CVE-2007-4576
Published: 2008-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-4575.  Reason: This candidate is a reservation duplicate of CVE-2007-4575.  Notes: All CVE users should reference CVE-2007-4575 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-0174
Published: 2008-01-29
Description: GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the passwords and gain privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-312
References: http://securityreason.com/securityalert/3590; http://securitytracker.com/id?1019273; http://support.gefanuc.com/support/index?page=kbchannel&id=KB12459
CVE: CVE-2008-0175
Published: 2008-01-29
Description: Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/28678; http://securityreason.com/securityalert/3591; http://support.gefanuc.com/support/index?page=kbchannel&id=KB12460
CVE: CVE-2008-0176
Published: 2008-01-29
Description: Heap-based buffer overflow in w32rtr.exe in GE Fanuc CIMPLICITY HMI SCADA system 7.0 before 7.0 SIM 9, and earlier versions before 6.1 SP6 Hot fix - 010708_162517_6106, allow remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28663; http://securityreason.com/securityalert/3592; http://support.gefanuc.com/support/index?page=kbchannel&id=KB12458
CVE: CVE-2008-0387
Published: 2008-01-29
Description: Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) op_receive, (2) op_start, (3) op_start_and_receive, (4) op_send, (5) op_start_and_send, and (6) op_start_send_and_receive XDR requests, which triggers memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/29203; http://secunia.com/advisories/29501; http://security.gentoo.org/glsa/glsa-200803-02.xml
CVE: CVE-2008-0467
Published: 2008-01-29
Description: Stack-based buffer overflow in Firebird before 2.0.4, and 2.1.x before 2.1.0 RC1, might allow remote attackers to execute arbitrary code via a long username.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28596; http://secunia.com/advisories/29203; http://secunia.com/advisories/29501
CVE: CVE-2007-6694
Published: 2008-01-29
Description: The chrp_show_cpuinfo function (chrp/setup.c) in Linux kernel 2.4.21 through 2.6.18-53, when running on PowerPC, might allow local users to cause a denial of service (crash) via unknown vectors that cause the of_get_property function to fail, which triggers a NULL pointer dereference.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]9571&w=2; http://rhn.redhat.com/errata/RHSA-2008-0055.html; http://secunia.com/advisories/28696
CVE: CVE-2008-0468
Published: 2008-01-29
Description: SQL injection vulnerability in category.php in Flinx 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27448; http://www.vupen.com/english/advisories/2008/0313; https://exchange.xforce.ibmcloud.com/vulnerabilities/39930
CVE: CVE-2008-0469
Published: 2008-01-29
Description: SQL injection vulnerability in index.php in Tiger Php News System (TPNS) 1.0b and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter in a newscat action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28641; http://securityreason.com/securityalert/3587; http://www.securityfocus.com/archive/1/486961/100/0/threaded
CVE: CVE-2008-0470
Published: 2008-01-29
Description: A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.
CVSS Score: 9.3 (HIGH)
References: http://www.securityfocus.com/bid/27424; https://exchange.xforce.ibmcloud.com/vulnerabilities/39904; https://www.exploit-db.com/exploits/4974
CVE: CVE-2008-0471
Published: 2008-01-29
Description: Cross-site request forgery (CSRF) vulnerability in privmsg.php in phpBB 2.0.22 allows remote attackers to delete private messages (PM) as arbitrary users via a deleteall action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463589; http://secunia.com/advisories/28630; http://secunia.com/advisories/28871
CVE: CVE-2008-0472
Published: 2008-01-29
Description: Cross-site request forgery (CSRF) vulnerability in modcp.php in Woltlab Burning Board (wBB) 2.3.6 PL2 allows remote attackers to delete threads as moderators or administrators via a thread_del action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/28634; http://securityreason.com/securityalert/3586; http://www.securityfocus.com/archive/1/486884/100/0/threaded
CVE: CVE-2008-0473
Published: 2008-01-29
Description: RTE_popup_save_file.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload (1) .html and (2) .htm files via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/3584; http://www.bugreport.ir/?/31; http://www.securityfocus.com/archive/1/486868/100/0/threaded
CVE: CVE-2008-0474
Published: 2008-01-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the (1) showlink parameter to jsp/DiscoveryProfiles.jsp; the (2) attributeIDs, (3) attributeToSelect, (4) redirectto, and (5) resourceid parameters to (a) jsp/ThresholdActionConfiguration.jsp; the (6) page and (7) redirect parameters to (b) jsp/UpdateGlobalSettings.jsp; and the (8) haid and (9) returnpath parameters to (c) showTile.do.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28332; http://www.securityfocus.com/bid/27443; https://exchange.xforce.ibmcloud.com/vulnerabilities/39914
CVE: CVE-2008-0475
Published: 2008-01-29
Description: ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information ( Home->Summary) via an invalid URI, as demonstrated by the "/-" URI.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/28332; http://www.securityfocus.com/bid/27443; https://exchange.xforce.ibmcloud.com/vulnerabilities/39917
CVE: CVE-2008-0476
Published: 2008-01-29
Description: ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/28332; http://www.securityfocus.com/bid/27443; https://exchange.xforce.ibmcloud.com/vulnerabilities/39915
CVE: CVE-2008-0477
Published: 2008-01-29
Description: Stack-based buffer overflow in the QMPUpgrade.Upgrade.1 ActiveX control in QMPUpgrade.dll 1.0.0.1 in Move Networks Upgrade Manager allows remote attackers to execute arbitrary code via a long first argument to the Upgrade method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28647; http://www.securityfocus.com/bid/27438; http://www.securitytracker.com/id?1019270
CVE: CVE-2008-0478
Published: 2008-01-29
Description: Directory traversal vulnerability in index.php in SetCMS 3.6.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the set parameter, as demonstrated by sending a certain CLIENT_IP HTTP header in an enter action to index.php, and injecting PHP sequences into files/enter.set, which is then included by index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/27407; https://exchange.xforce.ibmcloud.com/vulnerabilities/39864; https://www.exploit-db.com/exploits/4962
CVE: CVE-2008-0479
Published: 2008-01-29
Description: Directory traversal vulnerability in RTE_file_browser.asp in Web Wiz NewsPad 1.02 allows remote attackers to list arbitrary directories, and .txt and .zip files, via a .....\\\ in the sub parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28416; http://securityreason.com/securityalert/3588; http://www.bugreport.ir/?/30
CVE: CVE-2008-0480
Published: 2008-01-29
Description: Multiple directory traversal vulnerabilities in Web Wiz Forums 9.07 and earlier allow remote attackers to list arbitrary directories, and .txt and .zip files, via a .....\\\ in the sub parameter to (1) RTE_file_browser.asp or (2) file_browser.asp.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28601; http://securityreason.com/securityalert/3589; http://www.bugreport.ir/?/29
CVE: CVE-2008-0481
Published: 2008-01-29
Description: Directory traversal vulnerability in RTE_file_browser.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to list arbitrary directories, and .txt and .zip files, via a .....\\\ in the sub parameter in a save action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28639; http://securityreason.com/securityalert/3584; http://securitytracker.com/id?1019267
CVE: CVE-2008-0487
Published: 2008-01-30
Description: Multiple SQL injection vulnerabilities in login.asp in ASPired2Protect allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28653; http://securityreason.com/securityalert/3598; http://www.securityfocus.com/archive/1/487137/100/0/threaded
CVE: CVE-2008-0488
Published: 2008-01-30
Description: Directory traversal vulnerability in tseekdir.cgi in VB Marketing allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the location parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3596; http://www.securityfocus.com/archive/1/487174/100/0/threaded; http://www.securityfocus.com/bid/27475
CVE: CVE-2008-0489
Published: 2008-01-30
Description: Directory traversal vulnerability in install.php in Clansphere 2007.4.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/3597; http://www.securityfocus.com/archive/1/487132/100/0/threaded; http://www.securityfocus.com/bid/27471
CVE: CVE-2008-0490
Published: 2008-01-30
Description: SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28683; http://www.securityfocus.com/bid/27465; http://www.vupen.com/english/advisories/2008/0348
CVE: CVE-2008-0491
Published: 2008-01-30
Description: SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the album parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27464; http://www.vupen.com/english/advisories/2008/0349; https://exchange.xforce.ibmcloud.com/vulnerabilities/39964
CVE: CVE-2008-0492
Published: 2008-01-30
Description: Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUpload 3.0 allows remote attackers to execute arbitrary code via a long argument to the AddFile method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/28660; http://www.securityfocus.com/bid/27456; http://www.vupen.com/english/advisories/2008/0315
CVE: CVE-2008-0493
Published: 2008-01-30
Description: fpx.dll 3.9.8.0 in the FlashPix plugin for IrfanView 4.10 allows remote attackers to execute arbitrary code via a crafted FlashPix (.FPX) file, which triggers heap corruption.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28688; http://www.securityfocus.com/bid/27479; http://www.vupen.com/english/advisories/2008/0318
CVE: CVE-2008-0494
Published: 2008-01-30
Description: Cross-site scripting (XSS) vulnerability in vpnum/userslist.php in Endian Firewall 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the psearch parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/27477.html; http://www.securityfocus.com/bid/27477; http://downloads.securityfocus.com/vulnerabilities/exploits/27477.html
CVE: CVE-2008-0495
Published: 2008-01-30
Description: Unspecified vulnerability in the Pegasus CIM Server in IBM Hardware Management Console (HMC) 7 R3.2.0 allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/28667; http://secunia.com/advisories/29056; http://www-1.ibm.com/support/docview.wss?uid=isg1MB02236
CVE: CVE-2008-0496
Published: 2008-01-30
Description: Cross-site scripting (XSS) vulnerability in index.php in AmpJuke 0.7.0 allows remote attackers to inject arbitrary web script or HTML via the limit parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28661; http://securityreason.com/securityalert/3594; http://www.securityfocus.com/archive/1/487258/100/0/threaded
CVE: CVE-2008-0497
Published: 2008-01-30
Description: Cross-site scripting (XSS) vulnerability in action.php in Nucleus CMS 3.31 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO, which is not quoted when processing PHP_SELF.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28680; http://securityreason.com/securityalert/3593; http://sourceforge.net/project/shownotes.php?group_id=66479&release_id=572117