deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5617
Published: 2008-12-17
Description: The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32857; http://www.rsyslog.com/Article322.phtml; http://www.rsyslog.com/Article327.phtml
CVE: CVE-2008-5618
Published: 2008-12-17
Description: imudp in rsyslog 4.x before 4.1.2, 3.21 before 3.21.9 beta, and 3.20 before 3.20.2 generates a message even when it is sent by an unauthorized sender, which allows remote attackers to cause a denial of service (disk consumption) via a large number of spurious messages.
CVSS Score: 5.0 (MEDIUM)
References: http://www.rsyslog.com/Topic4.phtml; http://www.rsyslog.com/Topic4.phtml
CVE: CVE-2008-5619
Published: 2008-12-17
Description: html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://mahara.org/interaction/forum/topic.php?id=533; http://osvdb.org/53893; http://secunia.com/advisories/33145
CVE: CVE-2008-5620
Published: 2008-12-17
Description: RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://sourceforge.net/forum/forum.php?forum_id=898542; http://www.vupen.com/english/advisories/2008/3418; https://exchange.xforce.ibmcloud.com/vulnerabilities/47550
CVE: CVE-2008-5621
Published: 2008-12-17
Description: Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter.  NOTE: other unspecified pages are also reachable, but they have the same root cause.  NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html; http://osvdb.org/50894; http://secunia.com/advisories/33076
CVE: CVE-2008-5622
Published: 2008-12-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-5621.  Reason: This candidate is a duplicate of CVE-2008-5621.  Notes: All CVE users should reference CVE-2008-5621 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-5558
Published: 2008-12-17
Description: Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service (crash) via authentication attempts involving (1) an unknown user or (2) a user using hostname matching.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://downloads.digium.com/pub/security/AST-2008-012.html; http://osvdb.org/50675; http://secunia.com/advisories/32956
CVE: CVE-2008-5624
Published: 2008-12-17
Description: PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to bypass safe_mode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the error_log variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1607&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1762&w=2; http://osvdb.org/50483
CVE: CVE-2008-5625
Published: 2008-12-17
Description: PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "php_value error_log" entry in a .htaccess file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2008-11/0152.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1607&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1762&w=2
CVE: CVE-2008-5626
Published: 2008-12-17
Description: XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument to the NLST command, as demonstrated by a -1 argument.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://securityreason.com/securityalert/4766; http://www.securityfocus.com/bid/31739; http://www.vupen.com/english/advisories/2008/2803
CVE: CVE-2008-5627
Published: 2008-12-17
Description: SQL injection vulnerability in account.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands via the (1) username parameter (aka Email field) or the (2) password parameter. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32941; https://exchange.xforce.ibmcloud.com/vulnerabilities/46911; https://www.exploit-db.com/exploits/7282
CVE: CVE-2008-5628
Published: 2008-12-17
Description: SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands via the term parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4781; http://www.securityfocus.com/bid/32523; https://exchange.xforce.ibmcloud.com/vulnerabilities/46931
CVE: CVE-2008-5629
Published: 2008-12-17
Description: SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a play action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32890; http://www.securityfocus.com/bid/32511; https://exchange.xforce.ibmcloud.com/vulnerabilities/46935
CVE: CVE-2008-5630
Published: 2008-12-17
Description: SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 3 and 3.1.4 allows remote attackers to execute arbitrary SQL commands via the umprof_status parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32898; http://securityreason.com/securityalert/4780; http://www.securityfocus.com/bid/32487
CVE: CVE-2008-5631
Published: 2008-12-17
Description: SQL injection vulnerability in start.asp in Active eWebquiz 8.0 allows remote attackers to execute arbitrary SQL commands via the (1) useremail parameter (aka username field) or the (2) password parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32927; https://exchange.xforce.ibmcloud.com/vulnerabilities/46910; https://www.exploit-db.com/exploits/7279
CVE: CVE-2008-5632
Published: 2008-12-17
Description: SQL injection vulnerability in Account.asp in Active Time Billing 3.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32895; http://www.vupen.com/english/advisories/2008/3295; https://www.exploit-db.com/exploits/7301
CVE: CVE-2008-5633
Published: 2008-12-17
Description: SQL injection vulnerability in register.asp in ActiveVotes 2.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32895; https://exchange.xforce.ibmcloud.com/vulnerabilities/46925; https://www.exploit-db.com/exploits/7275
CVE: CVE-2008-5634
Published: 2008-12-17
Description: SQL injection vulnerability in account.asp in Active Force Matrix 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32895; https://exchange.xforce.ibmcloud.com/vulnerabilities/46927; https://www.exploit-db.com/exploits/7273
CVE: CVE-2008-5635
Published: 2008-12-17
Description: SQL injection vulnerability in account.asp in Active Membership 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32895; https://exchange.xforce.ibmcloud.com/vulnerabilities/46917; https://www.exploit-db.com/exploits/7278
CVE: CVE-2008-5636
Published: 2008-12-17
Description: SQL injection vulnerability in cate.php in Lito Lite CMS, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32910; http://securityreason.com/securityalert/4779; http://www.securityfocus.com/bid/32538
CVE: CVE-2008-5637
Published: 2008-12-17
Description: SQL injection vulnerability in blog.asp in ParsBlogger (Pb) allows remote attackers to execute arbitrary SQL commands via the wr parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4778; http://www.securityfocus.com/bid/32488; http://www.vupen.com/english/advisories/2008/3270
CVE: CVE-2008-5638
Published: 2008-12-17
Description: Multiple SQL injection vulnerabilities in Active Price Comparison 4 allow remote attackers to execute arbitrary SQL commands via the (1) ProductID parameter to reviews.aspx or the (2) linkid parameter to links.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32896; http://securityreason.com/securityalert/4768; https://exchange.xforce.ibmcloud.com/vulnerabilities/46908
CVE: CVE-2008-5639
Published: 2008-12-17
Description: Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via a .. (dot dot) in the m parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4777; http://www.securityfocus.com/bid/32498; https://exchange.xforce.ibmcloud.com/vulnerabilities/46902
CVE: CVE-2008-5640
Published: 2008-12-17
Description: SQL injection vulnerability in bidhistory.asp in Active Bids 3.5 allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32920; http://securityreason.com/securityalert/4776; http://www.securityfocus.com/bid/32544
CVE: CVE-2008-5641
Published: 2008-12-17
Description: SQL injection vulnerability in account.asp in Active Photo Gallery 6.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32901; http://securityreason.com/securityalert/4767; http://www.vupen.com/english/advisories/2008/3297
CVE: CVE-2008-5642
Published: 2008-12-17
Description: Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32924; http://securityreason.com/securityalert/4775; http://www.securityfocus.com/bid/32535
CVE: CVE-2008-5643
Published: 2008-12-17
Description: SQL injection vulnerability in the Books (com_books) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter in a book_details action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4774; http://www.securityfocus.com/bid/32255; https://exchange.xforce.ibmcloud.com/vulnerabilities/46561
CVE: CVE-2008-5644
Published: 2008-12-17
Description: Cross-site scripting (XSS) vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32689; http://typo3.org/teams/security/security-bulletins/typo3-20081113-1/; http://www.securityfocus.com/bid/32284
CVE: CVE-2008-5645
Published: 2008-12-17
Description: Directory traversal vulnerability in the media server in Orb Networks Orb before 2.01.0022 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP GET request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8526&w=2; http://secunia.com/advisories/32592; http://securityreason.com/securityalert/4773
CVE: CVE-2008-5646
Published: 2008-12-17
Description: Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certain wiki markup."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/32652; http://trac.edgewall.org/wiki/ChangeLog; http://www.securityfocus.com/bid/32226
CVE: CVE-2008-5647
Published: 2008-12-17
Description: Unspecified vulnerability in the HTML sanitizer filter in Trac before 0.11.2 allows attackers to conduct phishing attacks via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/32652; http://trac.edgewall.org/wiki/ChangeLog; http://www.securityfocus.com/bid/32226
CVE: CVE-2008-5648
Published: 2008-12-17
Description: SQL injection vulnerability in admin/login.php in DeltaScripts PHP Shop 1.0 allows remote attackers to execute arbitrary SQL commands via the admin_username parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32583; http://www.securityfocus.com/bid/32162; https://exchange.xforce.ibmcloud.com/vulnerabilities/46429
CVE: CVE-2008-5649
Published: 2008-12-17
Description: SQL injection vulnerability in admin/admin.php in AlstraSoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32665; http://securityreason.com/securityalert/4772; http://www.securityfocus.com/bid/32276
CVE: CVE-2008-5650
Published: 2008-12-17
Description: SQL injection vulnerability in the login directory in AlstraSoft Web Host Directory allows remote attackers to execute arbitrary SQL commands via the pwd parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32660; http://securityreason.com/securityalert/4771; http://www.securityfocus.com/bid/32298
CVE: CVE-2008-5651
Published: 2008-12-17
Description: SQL injection vulnerability in plugins/bookmarker/bookmarker_backend.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the Parent parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49690; http://secunia.com/advisories/32636; http://www.securityfocus.com/bid/32200
CVE: CVE-2008-5652
Published: 2008-12-17
Description: SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49701; http://secunia.com/advisories/32673; http://securityreason.com/securityalert/4770
CVE: CVE-2008-5653
Published: 2008-12-17
Description: SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49700; http://secunia.com/advisories/32673; http://www.securityfocus.com/bid/32199
CVE: CVE-2008-5654
Published: 2008-12-17
Description: SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyCalendar 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter, a different vector than CVE-2008-1344.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49702; http://secunia.com/advisories/32673; http://www.securityfocus.com/bid/32199
CVE: CVE-2008-5655
Published: 2008-12-17
Description: Multiple SQL injection vulnerabilities in MyioSoft EasyBookMarker 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) delete_folder and (2) delete_link parameters to unspecified vectors, possibly to (a) plugins/bookmarker/bookmarker_backend.php or (b) ajaxp.php, different vectors than CVE-2008-5654.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.vupen.com/english/advisories/2008/3075; https://exchange.xforce.ibmcloud.com/vulnerabilities/47684; http://www.vupen.com/english/advisories/2008/3075
CVE: CVE-2008-5656
Published: 2008-12-17
Description: Cross-site scripting (XSS) vulnerability in the frontend plugin for the felogin system extension in TYPO3 4.2.0, 4.2.1 and 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-20081113-2/; http://www.securityfocus.com/bid/32284; https://exchange.xforce.ibmcloud.com/vulnerabilities/46591
CVE: CVE-2008-5657
Published: 2008-12-17
Description: CRLF injection vulnerability in Quassel Core before 0.3.0.3 allows remote attackers to spoof IRC messages as other users via a crafted CTCP message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506550; http://quassel-irc.org/node/89; http://secunia.com/advisories/32470
CVE: CVE-2008-5658
Published: 2008-12-17
Description: Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2008-12/0039.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1607&w=2
CVE: CVE-2008-5659
Published: 2008-12-17
Description: The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=38417; http://www.openwall.com/lists/oss-security/2008/12/06/2; https://exchange.xforce.ibmcloud.com/vulnerabilities/47574
CVE: CVE-2008-5660
Published: 2008-12-17
Description: Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://secunia.com/advisories/33041; http://secunia.com/advisories/33046; http://secunia.com/advisories/33082
CVE: CVE-2008-5661
Published: 2008-12-17
Description: The IPv4 Forwarding feature in Sun Solaris 10 and OpenSolaris snv_47 through snv_82, with certain patches installed, allows remote attackers to cause a denial of service (panic) via unknown vectors that trigger a NULL pointer dereference.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/33148; http://sunsolve.sun.com/search/document.do?assetkey=1-26-241126-1; http://www.securityfocus.com/bid/32861
CVE: CVE-2008-5662
Published: 2008-12-17
Description: Multiple buffer overflows in Sun Java Wireless Toolkit (WTK) for CLDC 2.5.2 and earlier allow downloaded programs to execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33159; http://sunsolve.sun.com/search/document.do?assetkey=1-26-247566-1; http://sunsolve.sun.com/search/document.do?assetkey=1-77-1019851.1-1
CVE: CVE-2008-5500
Published: 2008-12-17
Description: The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to (1) a reachable assertion or (2) an integer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/33184; http://secunia.com/advisories/33188; http://secunia.com/advisories/33189
CVE: CVE-2008-5501
Published: 2008-12-17
Description: The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service via vectors that trigger an assertion failure.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/33188; http://secunia.com/advisories/33189; http://secunia.com/advisories/33203
CVE: CVE-2008-5502
Published: 2008-12-17
Description: The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) via vectors that trigger memory corruption, related to the GetXMLEntity and FastAppendChar functions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/33188; http://secunia.com/advisories/33189; http://secunia.com/advisories/33203
CVE: CVE-2008-5503
Published: 2008-12-17
Description: The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other domains via crafted XBL bindings.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/33184; http://secunia.com/advisories/33189; http://secunia.com/advisories/33204
CVE: CVE-2008-5504
Published: 2008-12-17
Description: Mozilla Firefox 2.x before 2.0.0.19 allows remote attackers to run arbitrary JavaScript with chrome privileges via vectors related to the feed preview, a different vulnerability than CVE-2008-3836.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/33184; http://secunia.com/advisories/33189; http://secunia.com/advisories/33231
CVE: CVE-2008-5505
Published: 2008-12-17
Description: Mozilla Firefox 3.x before 3.0.5 allows remote attackers to bypass intended privacy restrictions by using the persist attribute in an XUL element to create and access data entities that are similar to cookies.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33188; http://secunia.com/advisories/33203; http://secunia.com/advisories/33216