deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-7207
Published: 2009-09-11
Description: RivetTracker before 1.0 stores passwords in cleartext in config.php, which allows local users to discover passwords by reading config.php.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://osvdb.org/42433; http://www.rivetcode.com/files/rivettracker/rivettracker_1-0.zip; http://osvdb.org/42433
CVE: CVE-2008-7208
Published: 2009-09-11
Description: Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username parameter ($usernameb variable) to a_login.php or (2) user parameter to staff.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/51057; http://osvdb.org/51058; http://sourceforge.net/forum/forum.php?forum_id=774946
CVE: CVE-2008-7209
Published: 2009-09-11
Description: Unrestricted file upload vulnerability in the add2 action in a_upload.php in OneCMS 2.4, and possibly earlier, allows remote attackers to execute arbitrary code by uploading a file with an executable extension and using a safe content type such as image/gif, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/51117; http://sourceforge.net/forum/forum.php?forum_id=774946; http://www.bugreport.ir/index_26.htm
CVE: CVE-2008-7210
Published: 2009-09-11
Description: directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter with a value matching the s parameter's hash value, which prevents the associated $_GET["s"] variable from being unset.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in AJChat.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27241; https://exchange.xforce.ibmcloud.com/vulnerabilities/39600; https://www.exploit-db.com/exploits/4890
CVE: CVE-2008-7211
Published: 2009-09-11
Description: CreativeLabs es1371mp.sys 5.1.3612.0 WDM audio driver, as used in Ensoniq PCI 1371 sound cards and when running on Windows Vista, does not create a Functional Device Object (FDO) to prevent user-moade access to the Physical Device Object (PDO), which allows local users to gain SYSTEM privileges via a crafted IRP request that dereferences a NULL FsContext pointer.
CVSS Score: 6.9 (MEDIUM)
References: http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=54; http://www.securityfocus.com/archive/1/485848/100/200/threaded; http://www.securityfocus.com/bid/27179
CVE: CVE-2008-7212
Published: 2009-09-11
Description: MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html; http://forum.mambo-foundation.org/showthread.php?t=10158; http://osvdb.org/42529
CVE: CVE-2008-7213
Published: 2009-09-11
Description: Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html; http://forum.mambo-foundation.org/showthread.php?t=10158; http://osvdb.org/42530
CVE: CVE-2008-7214
Published: 2009-09-11
Description: Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a com_users action, as demonstrated using a separate XSS vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html; http://forum.mambo-foundation.org/showthread.php?t=10158; http://osvdb.org/42531
CVE: CVE-2008-7215
Published: 2009-09-11
Description: The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified file[NewFile][name], file[NewFile][tmp_name], and file[NewFile][size] parameters in a FileUpload command, which are used to modify equivalent variables in $_FILES that are accessed when the is_uploaded_file check fails.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html; http://forum.mambo-foundation.org/showthread.php?t=10158; http://osvdb.org/42532
CVE: CVE-2008-7216
Published: 2009-09-11
Description: Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attackers to bypass CAPTCHA protection by reading certain bytes from the generated clip.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://docs.google.com/View?docid=df36cd52_19xzmkwqcg; http://www.securityfocus.com/archive/1/486331/100/200/threaded; http://www.securityfocus.com/bid/27287
CVE: CVE-2009-2800
Published: 2009-09-11
Description: Buffer overflow in Alias Manager in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted alias file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/57947; http://secunia.com/advisories/36701
CVE: CVE-2009-3167
Published: 2009-09-11
Description: Directory traversal vulnerability in index.php in Anantasoft Gazelle CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33686; http://www.exploit-db.com/exploits/7895; http://www.exploit-db.com/exploits/9425
CVE: CVE-2009-3168
Published: 2009-09-11
Description: Mevin Productions Basic PHP Events Lister 2.0 does not properly restrict access to (1) admin/reset.php and (2) admin/user_add.php, which allows remote authenticated users to reset administrative passwords or add administrators via a direct request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862, CWE-862
References: http://secunia.com/advisories/36525; http://www.exploit-db.com/exploits/9558; http://www.osvdb.org/57595
CVE: CVE-2009-3169
Published: 2009-09-11
Description: Multiple unspecified vulnerabilities in Hitachi JP1/File Transmission Server/FTP before 09-00 allow remote attackers to execute arbitrary code via unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/36645; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS09-015/index.html; http://www.securityfocus.com/bid/36307
CVE: CVE-2009-3170
Published: 2009-09-11
Description: Stack-based buffer overflow in AIMP2 Audio Converter 2.53 (build 330) and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long File1 argument in a (1) .pls or (2) .m3u playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/35295; http://www.exploit-db.com/exploits/9561; http://www.vupen.com/english/advisories/2009/2530
CVE: CVE-2009-3171
Published: 2009-09-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user parameter to user.php or (2) lookup parameter to search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0909-exploits/gazellecms-xss.txt; http://secunia.com/advisories/33686; http://www.exploit-db.com/exploits/9425
CVE: CVE-2009-3172
Published: 2009-09-11
Description: Unspecified vulnerability in Hitachi Groupmax Groupware Server 07-00 through 07-50-/A, Groupmax Server Set 03-00 through 06-52, Groupware Server Set 03-00 through 06-52, and Scheduler Server Set 03-00 through 06-52 has unknown impact and attack vectors related to invalid access rights.
CVSS Score: 7.5 (HIGH)
References: http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001930.html; http://secunia.com/advisories/36527; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS09-012/index.html
CVE: CVE-2009-3173
Published: 2009-09-11
Description: Unrestricted file upload vulnerability in admin/add_album.php in The Rat CMS Alpha 2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/.
CVSS Score: 6.8 (MEDIUM)
References: http://www.exploit-db.com/exploits/9599; http://www.securityfocus.com/bid/36295; https://exchange.xforce.ibmcloud.com/vulnerabilities/53087
CVE: CVE-2009-3174
Published: 2009-09-11
Description: PHP remote file inclusion vulnerability in fonctions_racine.php in OBOphiX 2.7.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the chemin_lib parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9600; http://www.exploit-db.com/exploits/9600
CVE: CVE-2009-3175
Published: 2009-09-11
Description: Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allow remote attackers to execute arbitrary SQL commands via the user_id parameter to (1) view.php, (2) photos.php, and (3) motm.php; and the (4) id parameter to forum_message.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9603; http://www.exploit-db.com/exploits/9603
CVE: CVE-2009-3176
Published: 2009-09-11
Description: Buffer overflow in the ActiveX control in Novell iPrint Client 4.38 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.1, "Novell iPrint Client 4.38 ActiveX exploit." NOTE: as of 20090909, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36579; http://www.osvdb.org/57922
CVE: CVE-2009-3177
Published: 2009-09-11
Description: Unspecified vulnerability in Kaspersky Online Scanner 7.0 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, (1) "Kaspersky Online Antivirus Scanner 7.0 exploit (Linux)" and (2) "Kaspersky Online Antivirus Scanner 7.0 exploit (Windows)." NOTE: as of 20090909, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36570; http://www.securityfocus.com/bid/36243
CVE: CVE-2009-3178
Published: 2009-09-11
Description: Unspecified vulnerability in mm.exe in Symantec Altiris Deployment Solution 6.9 allows remote attackers to cause a denial of service via unknown attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.18, "Symantec Altiris Deployment Solution 6.9 DoS." NOTE: as of 20090909, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.8 (HIGH)
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36587; http://www.securityfocus.com/bid/36247
CVE: CVE-2009-3179
Published: 2009-09-11
Description: Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might allow remote attackers to execute arbitrary code via unknown client-side attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.17, as identified by (1) "Symantec Altiris Deployment Solution 6.9 exploit, (2) "Symantec Altiris Deployment Solution 6.9 exploit (II)," and (3) "Symantec Altiris Deployment Solution 6.9 exploit (III)." NOTE: as of 20090909, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36587; http://www.securityfocus.com/bid/36247
CVE: CVE-2009-3180
Published: 2009-09-11
Description: Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/33686; http://www.exploit-db.com/exploits/9425; http://secunia.com/advisories/33686
CVE: CVE-2009-3181
Published: 2009-09-11
Description: Directory traversal vulnerability in Anantasoft Gazelle CMS 1.0 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the customizetemplate parameter in a direct request to admin/settemplate.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33686; http://www.exploit-db.com/exploits/9425; http://secunia.com/advisories/33686
CVE: CVE-2009-3182
Published: 2009-09-11
Description: Unrestricted file upload vulnerability in admin/editor/filemanager/browser.html in Anantasoft Gazelle CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in user/File/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33686; http://www.exploit-db.com/exploits/9433; http://secunia.com/advisories/33686
CVE: CVE-2007-6731
Published: 2009-09-13
Description: Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value, which bypasses a check in (1) test_oxm and (2) decrunch_oxm functions in misc/oxm.c, leading to a buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://aluigi.altervista.org/adv/xmpbof-adv.txt; http://www.securityfocus.com/bid/27047; http://www.vupen.com/english/advisories/2008/0009
CVE: CVE-2007-6732
Published: 2009-09-13
Description: Multiple buffer overflows in the dtt_load function in loaders/dtt_load.c Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via unspecified vectors related to an untrusted length value and the (1) pofs and (2) plen arrays.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/xmpbof-adv.txt; http://www.securityfocus.com/bid/27047; http://www.vupen.com/english/advisories/2008/0009
CVE: CVE-2008-7217
Published: 2009-09-13
Description: Microsoft Office 2008 for Mac, when running on Macintosh systems that restrict Office access to administrators, does not enforce this restriction for user ID 502, which allows local users with that ID to bypass intended security policy and access Office programs, related to permissions and ownership for certain directories.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/44959; http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3B948488; http://osvdb.org/44959
CVE: CVE-2008-7218
Published: 2009-09-13
Description: Unspecified vulnerability in the Horde API in Horde 3.1 before 3.1.6 and 3.2 before 3.2 before 3.2-RC2; Turba H3 2.1 before 2.1.6 and 2.2 before 2.2-RC2; Kronolith H3 2.1 before 2.1.7 and H3 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and 2.2 before 2.2-RC2; Horde Groupware 1.0 before 1.0.3 and 1.1 before 1.1-RC2; and Groupware Webmail Edition 1.0 before 1.0.4 and 1.1 before 1.1-RC2 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.horde.org/archives/announce/2008/000360.html; http://lists.horde.org/archives/announce/2008/000361.html; http://lists.horde.org/archives/announce/2008/000362.html
CVE: CVE-2008-7219
Published: 2009-09-13
Description: Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and H3 2.2 before 2.2-RC2; Groupware 1.0 before 1.0.3 and 1.1 before 1.1-RC2; and Groupware Webmail Edition 1.0 before 1.0.4 and 1.1 before 1.1-RC2 does not validate ownership when performing share changes, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.horde.org/archives/announce/2008/000362.html; http://lists.horde.org/archives/announce/2008/000363.html; http://lists.horde.org/archives/announce/2008/000364.html
CVE: CVE-2008-7220
Published: 2009-09-13
Description: Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://github.com/sstephenson/prototype/blob/master/CHANGELOG; http://osvdb.org/46312; http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
CVE: CVE-2008-7221
Published: 2009-09-14
Description: Cross-site request forgery (CSRF) vulnerability in RunCMS 1.6.1 allows remote attackers to hijack the authentication of administrators for requests that (1) add new administrators or (2) modify user profiles via a crafted request to system/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/archive/1/488287/100/200/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/40628; http://www.securityfocus.com/archive/1/488287/100/200/threaded
CVE: CVE-2008-7222
Published: 2009-09-14
Description: Cross-site scripting (XSS) vulnerability in system/admin.php in RunCMS 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the rank_title parameter in a RankForumAdd action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/488287/100/200/threaded; http://www.securityfocus.com/bid/27852; https://exchange.xforce.ibmcloud.com/vulnerabilities/40630
CVE: CVE-2008-7223
Published: 2009-09-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via (1) ftp/index.php, (2) viewer.php, (3) functions/other.php, (4) include/left_menu.class.php, or (5) plugins/stats/stats_view.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://freshmeat.net/projects/linpha/releases/271366; http://linpha.cvs.sourceforge.net/linpha/linpha/ChangeLog?view=markup; http://osvdb.org/43191
CVE: CVE-2008-7224
Published: 2009-09-14
Description: Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of service (crash) via a crafted link.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380347; http://linuxfromscratch.org/pipermail/elinks-users/2008-February/001604.html; http://osvdb.org/41949
CVE: CVE-2008-7225
Published: 2009-09-14
Description: Heap-based buffer overflow in Foxit Remote Access Server (aka WAC Server) 2.0 Build 3503 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long SSH packets, a different vulnerability than CVE-2008-0151.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.org/adv/wachof-adv.txt; http://www.securityfocus.com/archive/1/488366/100/200/threaded; http://www.securityfocus.com/bid/27873
CVE: CVE-2008-7226
Published: 2009-09-14
Description: SQL injection vulnerability in index.php in the Recipes module 1.3, 1.4, and possibly other versions for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the recipeid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52224; http://www.securityfocus.com/archive/1/488649/100/100/threaded; http://www.securityfocus.com/bid/27955
CVE: CVE-2008-7227
Published: 2009-09-14
Description: PartialBufferOutputStream2 in GeoServer before 1.6.1 and 1.7.0-beta1 attempts to flush buffer contents even when it is handling an "in memory buffer," which prevents the reporting of a service exception, with unknown impact and attack vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://jira.codehaus.org/browse/GEOS-1747; http://osvdb.org/43266; http://jira.codehaus.org/browse/GEOS-1747
CVE: CVE-2008-7228
Published: 2009-09-14
Description: Multiple format string vulnerabilities in White_Dune before 0.29beta851 have unspecified impact and attack vectors, a different vulnerability than CVE-2008-0101.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/apps/freshmeat/2008-02/0005.html; http://osvdb.org/42677; http://archives.neohapsis.com/archives/apps/freshmeat/2008-02/0005.html
CVE: CVE-2008-7229
Published: 2009-09-14
Description: GreenSQL Firewall (greensql-fw) before 0.9.2 allows remote attackers to bypass SQL injection protection via a crafted string, possibly involving an encoded space character (%20).
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/48906; http://www.greensql.net/node/41; http://www.greensql.net/security
CVE: CVE-2008-7230
Published: 2009-09-14
Description: Unspecified vulnerability in Small Footprint CIM Broker (SFCB) before 1.2.5 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://freshmeat.net/projects/sfcb/releases/269256; http://osvdb.org/50224; http://freshmeat.net/projects/sfcb/releases/269256
CVE: CVE-2008-7231
Published: 2009-09-14
Description: Cross-site scripting (XSS) vulnerability in Meridio Document and Records Management before 4.3 SR1 allows remote authenticated users to inject arbitrary web script or HTML via the Title field in a (1) document (subGeneralProps:dmpvDocTitle:PROP_W_title) or (2) container (subGeneralProps:dmpvContainerTitle:PROP_W_title).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://labs.mwrinfosecurity.com/advisories/meridio_cross_site_scripting_vulnerability/; http://labs.mwrinfosecurity.com/files/Advisories/mwri_meridio-advisory-embedded-xss_2008-01-15.pdf; http://www.securityfocus.com/bid/27721
CVE: CVE-2008-7232
Published: 2009-09-14
Description: Buffer overflow in the report function in xtacacsd 4.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted CONNECT TACACS command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/xtacacsdz-adv.txt; http://aluigi.org/poc/xtacacsdz.zip; https://exchange.xforce.ibmcloud.com/vulnerabilities/39551
CVE: CVE-2008-7233
Published: 2009-09-14
Description: Unspecified vulnerability in the E-Business Application client, as used in Oracle Application Server 1.1.8.26 and E-Business Suite 11.5.10.2, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Oracle Jinitiator component, aka AS02.
CVSS Score: 9.3 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-7234
Published: 2009-09-14
Description: Unspecified vulnerability in the Oracle BPEL Worklist Application component in Oracle Application Server 10.1.2.2 and 10.1.3.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, aka AS03.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556