deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2016
Published: 2008-04-30
Description: PHP remote file inclusion vulnerability in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter to the default URI under install/.  NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/3837; http://www.securityfocus.com/archive/1/491369/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/42144
CVE: CVE-2008-2017
Published: 2008-04-30
Description: Directory traversal vulnerability in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the operation parameter to the default URI under install/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3837; http://www.securityfocus.com/archive/1/491369/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/42144
CVE: CVE-2008-2018
Published: 2008-04-30
Description: The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '{' and '}' characters, which allows remote authenticated users to obtain sensitive information via a comment containing a macro, as demonstrated by a "{user.password}" comment in the profile of the admin user.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/28954; https://exchange.xforce.ibmcloud.com/vulnerabilities/42143; https://www.exploit-db.com/exploits/5506
CVE: CVE-2008-2019
Published: 2008-04-30
Description: Simple Machines Forum (SMF), probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file (aka audio) CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances.  NOTE: this issue reportedly exists because of an insufficient fix for CVE-2007-3308.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://securityreason.com/securityalert/3836; http://www.rooksecurity.com/blog/?p=6; http://www.securityfocus.com/archive/1/491128/100/0/threaded
CVE: CVE-2008-2020
Published: 2008-04-30
Description: The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux 2.3, (5) e107 0.7.11, (6) WebZE 0.5.9, (7) Open Media Collectors Database (aka OpenDb) 1.5.0b4, and (8) Labgab 1.1 uses a code_bg.jpg background image and the PHP ImageString function in a way that produces an insufficient number of different images, which allows remote attackers to pass the CAPTCHA test via an automated attack using a table of all possible image checksums and their corresponding digit strings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: http://securityreason.com/securityalert/3834; http://www.rooksecurity.com/blog/?p=6; http://www.securityfocus.com/archive/1/491127/100/0/threaded
CVE: CVE-2008-2021
Published: 2008-04-30
Description: Heap-based buffer overflow in Lhaplus before 1.57 allows remote attackers to execute arbitrary code via a long comment field in a ZOO archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/29972; http://www.fourteenforty.jp/research/advisory.cgi?FFRRA-20080428
CVE: CVE-2008-2022
Published: 2008-04-30
Description: Mulatiple cross-site scripting (XSS) vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) toid parameter to send-private-message.asp and the (2) redirect parameter to admin/impersonate.asp.  NOTE: vector 2 requires authentication.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29979; http://www.bugreport.ir/?/37; http://www.securityfocus.com/bid/28961
CVE: CVE-2008-2023
Published: 2008-04-30
Description: Multiple SQL injection vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) invisible and (2) timeoffset parameters to profile/controlpanel.asp and the (3) attachmentid parameter to forums/attach-file.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29979; http://www.bugreport.ir/?/37; http://www.securityfocus.com/bid/28961
CVE: CVE-2008-2024
Published: 2008-04-30
Description: Cross-site scripting (XSS) vulnerability in index.php in miniBB 2.2, and possibly earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the glang[] parameter in a registernew action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29997; http://www.minibb.net/forums/9_5110_0.html; http://www.securityfocus.com/bid/28930
CVE: CVE-2008-2026
Published: 2008-04-30
Description: Cross-site scripting (XSS) vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258, and other versions before 5.3.3.378, allows remote attackers to inject arbitrary web script or HTML via a URL-encoded postdata parameter.  NOTE: this is different than CVE-2005-1118, but it might be the same as CVE-2008-1470.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/14954; http://securityreason.com/securityalert/3848; http://www.securityfocus.com/archive/1/491247/100/0/threaded
CVE: CVE-2008-2027
Published: 2008-04-30
Description: Open redirect vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258 for Web for IIS, when accessed via certain browsers such as Mozilla Firefox, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an ftp URL in the url parameter to a Redirect action.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://securityreason.com/securityalert/3850; http://www.procheckup.com/Vulnerability_PR07-43.php; http://www.securityfocus.com/archive/1/491237/100/0/threaded
CVE: CVE-2008-2028
Published: 2008-04-30
Description: miniBB 2.2, and possibly earlier, when register_globals is enabled, allows remote attackers to obtain the full path via a direct request to the glang parameter in a registernew action to index.php, which leaks the path in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/29997/; http://www.minibb.net/forums/9_5110_0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/42012
CVE: CVE-2008-2029
Published: 2008-04-30
Description: Multiple SQL injection vulnerabilities in (1) setup_mysql.php and (2) setup_options.php in miniBB 2.2 and possibly earlier, when register_globals is enabled, allow remote attackers to execute arbitrary SQL commands via the xtr parameter in a userinfo action to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29997; http://www.minibb.net/forums/9_5110_0.html; http://www.securityfocus.com/bid/28930
CVE: CVE-2008-2030
Published: 2008-04-30
Description: Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers to inject arbitrary web script or HTML via the query string.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/28902.html; http://secunia.com/advisories/29931; http://www.securityfocus.com/bid/28902
CVE: CVE-2008-2031
Published: 2008-04-30
Description: VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command, which triggers a NULL pointer dereference.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/29943; http://www.securityfocus.com/bid/28967; https://exchange.xforce.ibmcloud.com/vulnerabilities/42074
CVE: CVE-2008-2032
Published: 2008-04-30
Description: The FTP service in Acritum Femitter Server 1.03 allows remote attackers to cause a denial of service (crash) by sending multiple crafted RETR commands.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/29967; http://www.securityfocus.com/bid/28973; https://exchange.xforce.ibmcloud.com/vulnerabilities/42075
CVE: CVE-2008-2033
Published: 2008-04-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-1381.  Reason: This candidate is a duplicate of CVE-2008-1381.  Notes: All CVE users should reference CVE-2008-1381 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-2034
Published: 2008-04-30
Description: SQL injection vulnerability in wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29876; http://www.securityfocus.com/bid/28975; https://exchange.xforce.ibmcloud.com/vulnerabilities/42094
CVE: CVE-2008-2035
Published: 2008-04-30
Description: Cross-site scripting (XSS) vulnerability in the Bluemoon, Inc. (1) BackPack 0.91 and earlier, (2) BmSurvey 0.84 and earlier, (3) newbb_fileup 1.83 and earlier, (4) News_embed (news_fileup) 1.44 and earlier, and (5) PopnupBlog 3.19 and earlier modules for XOOPS 2.0.x, XOOPS Cube 2.1, and ImpressCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/29993; http://www.bluemooninc.biz/~xoops/modules/news/article.php?storyid=69
CVE: CVE-2008-2036
Published: 2008-04-30
Description: SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL commands via the poll_id parameter in a poll action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29789; http://securityreason.com/securityalert/3843; http://www.securityfocus.com/archive/1/490889/100/0/threaded
CVE: CVE-2008-2037
Published: 2008-04-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in EditeurScripts EsContacts 1.0 allow remote authenticated users to inject arbitrary web script or HTML via the msg parameter to (1) login.php, (2) importer.php, (3) add_groupe.php, (4) contacts.php, (5) groupes.php, and (6) search.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/29877; http://www.securityfocus.com/bid/28825; http://www.z0rlu.ownspace.org/index.php?/archives/50-EScontacts-XSS.html
CVE: CVE-2008-2038
Published: 2008-04-30
Description: Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) orderby and (2) sort parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29811; http://www.securityfocus.com/bid/28832; https://exchange.xforce.ibmcloud.com/vulnerabilities/41882
CVE: CVE-2008-2040
Published: 2008-04-30
Description: Stack-based buffer overflow in the HTTP::getAuthUserPass function (core/common/http.cpp) in Peercast 0.1218 and gnome-peercast allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Basic Authentication string with a long (1) username or (2) password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=478573; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=478680; http://secunia.com/advisories/29962
CVE: CVE-2008-2041
Published: 2008-04-30
Description: Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web server has write access to a directory under the web document root.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30073; http://www.egroupware.org/news; http://www.gentoo.org/security/en/glsa/glsa-200805-04.xml
CVE: CVE-2007-6339
Published: 2008-05-01
Description: The Akamai Download Manager (aka DLM or dlmanager) ActiveX control (DownloadManagerV2.ocx) before 2.2.3.5 allows remote attackers to force the download and execution of arbitrary code via unspecified "undocumented object parameters."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=695; http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061923.html; http://secunia.com/advisories/30037
CVE: CVE-2008-1381
Published: 2008-05-01
Description: ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/29995; http://secunia.com/advisories/30189; http://www.awe.com/mark/blog/[PII_REDACTED]30.html
CVE: CVE-2008-2043
Published: 2008-05-01
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in cPanel, possibly 11.18.3 and 11.19.3, allow remote attackers to (1) execute arbitrary code via the command1 parameter to frontend/x2/cron/editcronsimple.html, and perform various administrative actions via (2) frontend/x2/sql/adddb.html, (3) frontend/x2/sql/adduser.html, and (4) frontend/x2/ftp/doaddftp.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/30027; http://www.kb.cert.org/vuls/id/584089; http://www.rooksecurity.com/blog/?p=7
CVE: CVE-2008-2044
Published: 2008-05-01
Description: includes/library.php in netOffice Dwins 1.3 p2 compares the demoSession variable to the 'true' string literal instead of the true boolean literal, which allows remote attackers to bypass authentication and execute arbitrary code by setting this variable to 1, as demonstrated by uploading a PHP script via an add action to projects_site/uploadfile.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://netofficedwins.sourceforge.net/modules/news/article.php?storyid=47; http://secunia.com/advisories/29193; http://securityreason.com/securityalert/3845
CVE: CVE-2008-2045
Published: 2008-05-01
Description: Absolute path traversal vulnerability in SugarCRM Sugar Community Edition 4.5.1 and 5.0.0 allows remote attackers to read arbitrary files via a full path in the URL parameter to modules/Feeds/Feed.php, which places the contents into a related cache file in the .cache/feeds directory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30002; http://securityreason.com/securityalert/3844; http://www.security-assessment.com/files/advisories/2008-04-29_SugarCRM_local_file_disclosure.pdf
CVE: CVE-2008-2046
Published: 2008-05-01
Description: Cross-site scripting (XSS) vulnerability in index.php in Softpedia SiteXS CMS 0.1.1 Pre-Alpha allows remote attackers to inject arbitrary web script or HTML via the user parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7846&w=2; http://www.securityfocus.com/bid/28984; https://exchange.xforce.ibmcloud.com/vulnerabilities/42093
CVE: CVE-2008-2047
Published: 2008-05-01
Description: Multiple SQL injection vulnerabilities in Angelo-Emlak 1.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) hpz/profil.asp and (2) hpz/prodetail.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29998; http://www.securityfocus.com/bid/28949; http://www.vupen.com/english/advisories/2008/1385
CVE: CVE-2008-2048
Published: 2008-05-01
Description: Cross-site scripting (XSS) vulnerability in hpz/admin/Default.asp in Angelo-Emlak 1.0 allows remote attackers to inject arbitrary web script or HTML via the sayfa parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29998; http://www.securityfocus.com/bid/28949; http://www.vupen.com/english/advisories/2008/1385
CVE: CVE-2008-2049
Published: 2008-05-01
Description: The POP3 server (EPSTPOP3S.EXE) 4.22 in E-Post Mail Server 4.10 allows remote attackers to obtain sensitive information via multiple crafted APOP commands for a known POP3 account, which displays the password in a POP3 error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/29990; http://vuln.sg/epostmailserver410-en.html; http://www.e-postinc.jp/Mail_Server.html
CVE: CVE-2008-6339
Published: 2008-05-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-6339.  Reason: This candidate is a duplicate of CVE-2007-6339.  Notes: All CVE users should reference CVE-2007-6339 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-1294
Published: 2008-05-02
Description: Linux kernel 2.6.17, and other versions before 2.6.22, does not check when a user attempts to set RLIMIT_CPU to 0 until after the change is made, which allows local users to bypass intended resource limits.
CVSS Score: 2.1 (LOW)
CWE: CWE-20, CWE-399
References: http://bugs.gentoo.org/show_bug.cgi?id=215000; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=9926e4c74300c4b31dee007298c6475d33369df0; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22
CVE: CVE-2008-1375
Published: 2008-05-02
Description: Race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00002.html
CVE: CVE-2008-1675
Published: 2008-05-02
Description: The bdx_ioctl_priv function in the tehuti driver (tehuti.c) in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]9706&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]9718&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]8998&w=2
CVE: CVE-2008-2052
Published: 2008-05-02
Description: Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://holisticinfosec.org/content/view/62/45/; https://exchange.xforce.ibmcloud.com/vulnerabilities/42157; http://holisticinfosec.org/content/view/62/45/
CVE: CVE-2008-2063
Published: 2008-05-02
Description: SQL injection vulnerability in browse.videos.php in Joovili 3.1 allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29991; http://www.securityfocus.com/bid/28979; https://exchange.xforce.ibmcloud.com/vulnerabilities/42086
CVE: CVE-2008-2064
Published: 2008-05-02
Description: Multiple unspecified vulnerabilities in PhpGedView before 4.1.5 have unknown impact and attack vectors related to "a fundamental design flaw in the interface (API) to connect phpGedView with external programs like content management systems."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29989; http://secunia.com/advisories/30256; http://sourceforge.net/project/shownotes.php?group_id=55456&release_id=595222
CVE: CVE-2008-2065
Published: 2008-05-02
Description: SQL injection vulnerability in jokes.php in YourFreeWorld Jokes Site Script allows remote attackers to execute arbitrary SQL commands via the catagorie parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29981; http://www.securityfocus.com/bid/28963; https://exchange.xforce.ibmcloud.com/vulnerabilities/42047
CVE: CVE-2008-2066
Published: 2008-05-02
Description: Cross-site scripting (XSS) vulnerability in bb_admin.php in miniBB 2.2a allows remote attackers to inject arbitrary web script or HTML via the whatus parameter in a searchusers2 action.  NOTE: it was later reported that other versions before 3.0.1 are also vulnerable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/95122; http://seclists.org/fulldisclosure/2013/Jul/102; http://secunia.com/advisories/30004
CVE: CVE-2008-2067
Published: 2008-05-02
Description: SQL injection vulnerability in bb_admin.php in miniBB 2.2a allows remote attackers to execute arbitrary SQL commands via the whatus parameter in a searchusers2 action.  NOTE: it was later reported that other versions before 3.0.1 are also vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/95121; http://seclists.org/fulldisclosure/2013/Jul/102; http://secunia.com/advisories/30004
CVE: CVE-2008-2068
Published: 2008-05-02
Description: Cross-site scripting (XSS) vulnerability in WordPress 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29965; http://wordpress.org/development/2008/04/wordpress-251/; https://exchange.xforce.ibmcloud.com/vulnerabilities/42029
CVE: CVE-2008-2069
Published: 2008-05-02
Description: Buffer overflow in Novell GroupWise 7 allows remote attackers to cause a denial of service or execute arbitrary code via a long argument in a mailto: URI.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/3847; http://www.securityfocus.com/archive/1/491376/100/0/threaded; http://www.securityfocus.com/archive/1/491576/100/0/threaded
CVE: CVE-2008-2072
Published: 2008-05-05
Description: Cross-site scripting (XSS) vulnerability in index.php in Virtual Design Studio vlbook 1.21 allows remote attackers to inject arbitrary web script or HTML via the l parameter, a different vector than CVE-2006-3260.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30046; http://securityreason.com/securityalert/3854; http://www.securityfocus.com/archive/1/491519/100/0/threaded
CVE: CVE-2008-2073
Published: 2008-05-05
Description: Directory traversal vulnerability in include/global.inc.php in Virtual Design Studio vlbook 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the l parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30046; http://securityreason.com/securityalert/3854; http://www.securityfocus.com/archive/1/491519/100/0/threaded
CVE: CVE-2008-2074
Published: 2008-05-05
Description: Multiple PHP remote file inclusion vulnerabilities Harris Yusuf Arifin Harris Wap Chat 1.0, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the sysFileDir parameter to (1) eng.writeMsg.php, (2) eng.adCreate.php, (3) eng.adCreateSave.php, (4) eng.adDispByTypeOptions.php, (5) eng.createRoom.php, (6) eng.forward.php, (7) eng.pageLogout.php, (8) eng.resultMember.php, (9) eng.roomDeleteConfirm.php, (10) eng.saveNewRoom.php, and (11) eng.searchMember.php in src/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30022; http://www.securityfocus.com/bid/28995; https://exchange.xforce.ibmcloud.com/vulnerabilities/42112