deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5783
Published: 2008-12-31
Description: admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32603; http://securityreason.com/securityalert/4843; http://www.securityfocus.com/bid/32216
CVE: CVE-2008-5784
Published: 2008-12-31
Description: V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-565
References: http://secunia.com/advisories/32603; http://www.securityfocus.com/bid/32216; http://www.vupen.com/english/advisories/2008/3071
CVE: CVE-2008-5785
Published: 2008-12-31
Description: SQL injection vulnerability in V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4846; http://www.securityfocus.com/bid/32214; http://www.vupen.com/english/advisories/2008/3071
CVE: CVE-2008-5786
Published: 2008-12-31
Description: Cross-site scripting (XSS) vulnerability in the Silva Find extension 1.1.5 and earlier in Silva 1.x before 1.6.3.2, Silva 2.0 before 2.0.12.2, and Silva 2.1 before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the fulltext parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/91/45/; http://secunia.com/advisories/32585; http://www.infrae.com/newsitems/silva_security_bulletin_08-11-07
CVE: CVE-2008-5787
Published: 2008-12-31
Description: Directory traversal vulnerability in mod.php in Arab Portal 2.1 on Windows allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, in conjunction with a show action.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32590; http://securityreason.com/securityalert/4851; http://www.securityfocus.com/archive/1/498092/100/0/threaded
CVE: CVE-2008-5788
Published: 2008-12-31
Description: SQL injection vulnerability in index.php in Domain Seller Pro 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32637; http://securityreason.com/securityalert/4833; http://www.securityfocus.com/bid/32201
CVE: CVE-2008-5789
Published: 2008-12-31
Description: Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (com_feederator) component 1.0.5 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the (1) mosConfig_absolute_path parameter to (a) add_tmsp.php, (b) edit_tmsp.php and (c) tmsp.php in includes/tmsp/; and the (2) GLOBALS[mosConfig_absolute_path] parameter to (d) includes/tmsp/subscription.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4827; http://www.securityfocus.com/bid/32194; https://exchange.xforce.ibmcloud.com/vulnerabilities/46438
CVE: CVE-2008-5790
Published: 2008-12-31
Description: Multiple PHP remote file inclusion vulnerabilities in the Recly!Competitions (com_competitions) component 1.0 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[mosConfig_absolute_path] parameter to (a) add.php and (b) competitions.php in includes/competitions/, and the (2) mosConfig_absolute_path parameter to (c) includes/settings/settings.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/32192; https://www.exploit-db.com/exploits/7039; http://www.securityfocus.com/bid/32192
CVE: CVE-2008-5791
Published: 2008-12-31
Description: Multiple unspecified vulnerabilities in PrestaShop e-Commerce Solution before 1.1 Beta 2 (aka 1.1.0.1) have unknown impact and attack vectors, related to the (1) bankwire module, (2) cheque module, and other components.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/32486; http://sourceforge.net/project/shownotes.php?release_id=638105; http://www.prestashop.com/download/changelog_1.1.0.1.txt
CVE: CVE-2008-5792
Published: 2008-12-31
Description: PHP remote file inclusion vulnerability in show_joined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.  NOTE: the researcher also points out the analogous directory traversal issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/32628; http://securityreason.com/securityalert/4853; http://www.bugreport.ir/index_57.htm
CVE: CVE-2008-5793
Published: 2008-12-31
Description: Multiple PHP remote file inclusion vulnerabilities in the Clickheat - Heatmap stats (com_clickheat) component 1.0.1 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[mosConfig_absolute_path] parameter to (a) install.clickheat.php, (b) Cache.php and (c) Clickheat_Heatmap.php in Recly/Clickheat/, and (d) Recly/common/GlobalVariables.php; and the (2) mosConfig_absolute_path parameter to (e) _main.php and (f) main.php in includes/heatmap, and (g) includes/overview/main.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://securityreason.com/securityalert/4841; http://www.securityfocus.com/bid/32190; https://exchange.xforce.ibmcloud.com/vulnerabilities/46439
CVE: CVE-2008-5794
Published: 2008-12-31
Description: Directory traversal vulnerability in system/admin/images.php in LoveCMS 1.6.2 Final allows remote attackers to delete arbitrary files via a .. (dot dot) in the delete parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4834; http://www.securityfocus.com/bid/32158; https://exchange.xforce.ibmcloud.com/vulnerabilities/46452
CVE: CVE-2008-5795
Published: 2008-12-31
Description: Cross-site scripting (XSS) vulnerability in the eluna Page Comments (eluna_pagecomments) extension 1.1.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32638; http://typo3.org/teams/security/security-bulletins/typo3-20081110-2/; http://www.securityfocus.com/bid/32228
CVE: CVE-2008-5796
Published: 2008-12-31
Description: SQL injection vulnerability in the eluna Page Comments (eluna_pagecomments) extension 1.1.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32638; http://typo3.org/teams/security/security-bulletins/typo3-20081110-2/; http://www.securityfocus.com/bid/32228
CVE: CVE-2008-5797
Published: 2008-12-31
Description: SQL injection vulnerability in the advCalendar extension 0.3.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20081110-2/; http://www.securityfocus.com/bid/32230; https://exchange.xforce.ibmcloud.com/vulnerabilities/46469
CVE: CVE-2008-5798
Published: 2008-12-31
Description: SQL injection vulnerability in the CMS Poll system (cms_poll) extension before 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20081110-2/; http://www.securityfocus.com/bid/32231; https://exchange.xforce.ibmcloud.com/vulnerabilities/46470
CVE: CVE-2008-5799
Published: 2008-12-31
Description: Cross-site scripting (XSS) vulnerability in the Wir ber uns (fsmi_people) extension 0.0.24 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-20081110-2/; http://www.securityfocus.com/bid/32237; https://exchange.xforce.ibmcloud.com/vulnerabilities/46471
CVE: CVE-2008-5800
Published: 2008-12-31
Description: SQL injection vulnerability in the Wir ber uns [sic] (fsmi_people) extension 0.0.24 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20081110-2/; http://www.securityfocus.com/bid/32237; https://exchange.xforce.ibmcloud.com/vulnerabilities/46472
CVE: CVE-2008-5801
Published: 2008-12-31
Description: Unspecified vulnerability in the Dictionary (rtgdictionary) extension 0.1.9 and earlier for TYPO3 allows attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://typo3.org/teams/security/security-bulletins/typo3-20081110-2/; http://www.securityfocus.com/bid/32234; https://exchange.xforce.ibmcloud.com/vulnerabilities/46473
CVE: CVE-2008-5802
Published: 2008-12-31
Description: SQL injection vulnerability in index.php in E-topbiz Online Store 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32641; http://www.securityfocus.com/bid/32197; http://www.vupen.com/english/advisories/2008/3078
CVE: CVE-2008-5803
Published: 2008-12-31
Description: SQL injection vulnerability in admin/login.php in E-topbiz Online Store 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka username field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32641; http://securityreason.com/securityalert/4855; http://www.securityfocus.com/bid/32188
CVE: CVE-2008-5804
Published: 2008-12-31
Description: SQL injection vulnerability in admin/admin_catalog.php in e-topbiz Number Links 1 Php Script allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32639; http://securityreason.com/securityalert/4828; http://www.securityfocus.com/bid/32198
CVE: CVE-2008-5805
Published: 2008-12-31
Description: SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the siteid parameter, a different vector than CVE-2006-5828.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32161; http://www.securityfocus.com/bid/32191; http://www.vupen.com/english/advisories/2008/3079
CVE: CVE-2008-5806
Published: 2008-12-31
Description: SQL injection vulnerability in login.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the admin_username parameter (aka admin field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32586; http://securityreason.com/securityalert/4837; http://www.securityfocus.com/bid/32161
CVE: CVE-2008-5807
Published: 2008-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) Testproject Names and (2) Testplan Names in planEdit.php, and possibly (3) Testcaseprefixes in projectview.tpl.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32599; http://sourceforge.net/project/shownotes.php?release_id=638751; http://www.securityfocus.com/bid/32173
CVE: CVE-2006-7236
Published: 2009-01-02
Description: The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
CVSS Score: 9.3 (HIGH)
CWE: CWE-16
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384593; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030; http://secunia.com/advisories/33388
CVE: CVE-2008-2383
Published: 2009-01-02
Description: CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
CVE: CVE-2008-5808
Published: 2009-01-02
Description: Cross-site scripting (XSS) vulnerability in Six Apart Movable Type Enterprise (MTE) 1.x before 1.56; Movable Type (MT) 3.x before 3.38; and Movable Type, Movable Type Open Source (MTOS), and Movable Type Enterprise 4.x before 4.23 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to "application management."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN02216739/index.html; http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000067.html; http://secunia.com/advisories/32935
CVE: CVE-2008-5809
Published: 2009-01-02
Description: futomi CGI Cafe Access Analyzer CGI Standard 4.0.1 and earlier and Access Analyzer CGI Professional 4.11.3 and earlier use a predictable session id, which makes it easier for remote attackers to hijack sessions, and obtain sensitive information about analysis results, via a modified id.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN07468800/index.html; http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000083.html; http://www.futomi.com/library/info/2008/20081212.html
CVE: CVE-2008-5810
Published: 2009-01-02
Description: WBPublish (aka WBPublish.exe) in Fujitsu-Siemens WebTransactions 7.0, 7.1, and possibly other versions allows remote attackers to execute arbitrary commands via shell metacharacters in input that is sent through HTTP and improperly used during temporary session data cleanup, possibly related to (1) directory names, (2) template names, and (3) session IDs.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://bs2www.fujitsu-siemens.de/update/securitypatch.htm#english; http://secunia.com/advisories/33168; http://securityreason.com/securityalert/4856
CVE: CVE-2008-5811
Published: 2009-01-02
Description: SQL injection vulnerability in the PaxGallery (com_paxgallery) component 0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gid parameter in a table action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51009; http://secunia.com/advisories/33352; http://securityreason.com/securityalert/4857
CVE: CVE-2008-5812
Published: 2009-01-02
Description: Multiple unspecified vulnerabilities in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/33307; http://www.securityfocus.com/bid/33061; http://www.spip-contrib.net/SPIP-1-8-3b-1-9-2g-2-2
CVE: CVE-2008-5813
Published: 2009-01-02
Description: SQL injection vulnerability in inc/rubriques.php in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33307; http://www.securityfocus.com/bid/33021; http://www.securityfocus.com/bid/33061
CVE: CVE-2008-5814
Published: 2009-01-02
Description: Cross-site scripting (XSS) vulnerability in PHP, possibly 5.2.7 and earlier, when display_errors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444; http://jvn.jp/en/jp/JVN50327700/index.html; http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000084.html
CVE: CVE-2008-5815
Published: 2009-01-02
Description: SQL injection vulnerability in Acomment.php in phpAlumni allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4859; http://www.securityfocus.com/bid/33055; https://www.exploit-db.com/exploits/7621
CVE: CVE-2008-5816
Published: 2009-01-02
Description: SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ref_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4858; http://www.securityfocus.com/bid/33006; https://exchange.xforce.ibmcloud.com/vulnerabilities/47615
CVE: CVE-2008-5817
Published: 2009-01-02
Description: Multiple SQL injection vulnerabilities in index.php in Web Scribble Solutions webClassifieds 2005 allow remote attackers to execute arbitrary SQL commands via the (1) user and (2) password fields in a sign_in action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/33337; http://securityreason.com/securityalert/4860; http://www.securityfocus.com/bid/33028
CVE: CVE-2008-5818
Published: 2009-01-02
Description: Directory traversal vulnerability in index.php in eDreamers eDContainer 2.22, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lg parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33335; http://securityreason.com/securityalert/4861; http://www.securityfocus.com/bid/33026
CVE: CVE-2008-5819
Published: 2009-01-02
Description: Directory traversal vulnerability in eDNews_archive.php in eDreamers eDNews 2, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lg parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33336; http://securityreason.com/securityalert/4864; http://www.securityfocus.com/bid/33027
CVE: CVE-2008-5820
Published: 2009-01-02
Description: SQL injection vulnerability in eDNews_view.php in eDreamers eDNews 2 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33336; http://securityreason.com/securityalert/4863; http://www.securityfocus.com/bid/33054
CVE: CVE-2008-2381
Published: 2009-01-02
Description: SQL injection vulnerability in the create function in common/include/GroupJoinRequest.class in GForge 4.5 and 4.6 allows remote attackers to execute arbitrary SQL commands via the comments variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://gforge.org/scm/viewvc.php/branches/Branch_4_5/gforge/common/include/GroupJoinRequest.class?root=gforge&r1=4590&r2=6709; http://gforge.org/scm/viewvc.php/branches/Branch_4_5/gforge/common/include/GroupJoinRequest.class?root=gforge&view=log; http://secunia.com/advisories/33229
CVE: CVE-2008-5821
Published: 2009-01-02
Description: Memory leak in WebKit.dll in WebKit, as used by Apple Safari 3.2 on Windows Vista SP1, allows remote attackers to cause a denial of service (memory consumption and browser crash) via a long ALINK attribute in a BODY element in an HTML document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://jbrownsec.blogspot.com/2008/12/new-year-research-are-upon-us.html; http://packetstormsecurity.org/0812-exploits/safari_webkit_ml.txt; http://www.securityfocus.com/bid/33080
CVE: CVE-2008-5822
Published: 2009-01-02
Description: Memory leak in Libxul, as used in Mozilla Firefox 3.0.5 and other products, allows remote attackers to cause a denial of service (memory consumption and browser hang) via a long CLASS attribute in an HR element in an HTML document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://jbrownsec.blogspot.com/2008/12/new-year-research-are-upon-us.html; http://www.packetstormsecurity.org/0812-exploits/mzff_libxul_ml.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/47758
CVE: CVE-2008-5823
Published: 2009-01-02
Description: An ActiveX control in prtstb06.dll in Microsoft Money 2006, when used with WScript in Windows Script Host (WSH) on Windows Vista, allows remote attackers to cause a denial of service (access violation and application crash) via a zero value for the Startup property.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://jbrownsec.blogspot.com/2008/12/new-year-research-are-upon-us.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/47756; http://jbrownsec.blogspot.com/2008/12/new-year-research-are-upon-us.html
CVE: CVE-2008-5824
Published: 2009-01-02
Description: Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html; http://musicpd.org/mantis/view.php?id=1915
CVE: CVE-2008-5825
Published: 2009-01-02
Description: The SmartPoster implementation on the Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware does not properly display the URI record when the Title record contains a certain combination of space, CR (aka \r), and . (dot) characters, which allows remote attackers to trick a user into loading an arbitrary URI via a crafted NDEF tag, as demonstrated by (1) an http: URI for a malicious web site, (2) a tel: URI for a premium-rate telephone number, and (3) an sms: URI that triggers purchase of a ringtone.
CVSS Score: 2.6 (LOW)
CWE: CWE-59
References: http://archives.neohapsis.com/archives/bugtraq/2008-08/0186.html; http://archives.neohapsis.com/archives/fulldisclosure/2008-08/0344.html; http://events.ccc.de/congress/2008/Fahrplan/attachments/1109_collin_mulliner_eusecwest08_attacking_nfc_phones_slim.pdf
CVE: CVE-2008-5826
Published: 2009-01-02
Description: The Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware allows remote attackers to cause a denial of service (device crash) via (1) a large value in the payload length field in an NDEF record, or a certain length for a (2) tel: or (3) sms: NDEF URI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2008-08/0186.html; http://archives.neohapsis.com/archives/fulldisclosure/2008-08/0344.html; http://events.ccc.de/congress/2008/Fahrplan/attachments/1109_collin_mulliner_eusecwest08_attacking_nfc_phones_slim.pdf
CVE: CVE-2008-5827
Published: 2009-01-02
Description: The Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware automatically installs software upon completing the download of a JAR file, which makes it easier for remote attackers to execute arbitrary code via a crafted URI record in an NDEF tag.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://events.ccc.de/congress/2008/Fahrplan/attachments/1109_collin_mulliner_eusecwest08_attacking_nfc_phones_slim.pdf; http://events.ccc.de/congress/2008/Fahrplan/events/2639.en.html; http://www.mulliner.org/nfc/feed/collin_mulliner_25c3_attacking_nfc_phones.pdf