deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0170
Published: 2009-01-16
Description: Sun Java System Access Manager 6.3 2005Q1, 7 2005Q4, and 7.1 allows remote authenticated users with console privileges to discover passwords, and obtain unspecified other "access to resources," by visiting the Configuration Items component in the console.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-255, CWE-264
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-02-1; http://sunsolve.sun.com/search/document.do?assetkey=1-26-242166-1; http://www.securityfocus.com/bid/33265
CVE: CVE-2009-0171
Published: 2009-01-16
Description: The Sun SPARC Enterprise M4000 and M5000 Server, within a certain range of serial numbers, allows remote attackers to use the manufacturing root password, perform a root login to the eXtended System Control Facility Unit (aka XSCFU or Service Processor), and have unspecified other impact.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-249126-1; http://www.securityfocus.com/bid/33280; http://www.securitytracker.com/id?1021602
CVE: CVE-2009-0172
Published: 2009-01-16
Description: Unspecified vulnerability in IBM DB2 8 before FP17a, 9.1 before FP6a, and 9.5 before FP3a allows remote attackers to cause a denial of service (infinite loop) via a crafted CONNECT data stream.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT
CVE: CVE-2009-0173
Published: 2009-01-16
Description: Unspecified vulnerability in the server in IBM DB2 8 before FP17a, 9.1 before FP6a, and 9.5 before FP3a allows remote authenticated users to cause a denial of service (trap) via a crafted data stream.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT
CVE: CVE-2008-5911
Published: 2009-01-20
Description: Multiple buffer overflows in RealNetworks Helix Server and Helix Mobile Server 11.x before 11.1.8 and 12.x before 12.0.1 allow remote attackers to (1) cause a denial of service via three crafted RTSP SETUP commands, or execute arbitrary code via (2) an NTLM authentication request with malformed base64-encoded data, (3) an RTSP DESCRIBE command, or (4) a DataConvertBuffer request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://docs.real.com/docs/security/SecurityUpdate121508HS.pdf; http://secunia.com/advisories/33360; http://www.securitytracker.com/id?1021498
CVE: CVE-2009-0174
Published: 2009-01-20
Description: Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in the HREF attribute of a REF element in a .asx file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4918; http://www.securityfocus.com/bid/33185; https://exchange.xforce.ibmcloud.com/vulnerabilities/47851
CVE: CVE-2009-0175
Published: 2009-01-20
Description: Heap-based buffer overflow in Heathco Software MP3 TrackMaker 1.5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string in an invalid .mp3 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4920; http://www.securityfocus.com/bid/33183; https://exchange.xforce.ibmcloud.com/vulnerabilities/47852
CVE: CVE-2009-0176
Published: 2009-01-20
Description: Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 allow user-assisted remote attackers to execute arbitrary code via (1) a crafted stream in a .pdf file, related to "symWidths"; or (2) a crafted data stream in a .pdf file, related to "bitmaps."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=764; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=765; http://secunia.com/advisories/33534
CVE: CVE-2009-0177
Published: 2009-01-20
Description: vmwarebase.dll, as used in the vmware-authd service (aka vmware-authd.exe), in VMware Workstation 6.5.1 build 126130, 6.5.1 and earlier; VMware Player 2.5.1 build 126130, 2.5.1 and earlier; VMware ACE 2.5.1 and earlier; VMware Server 2.0.x before 2.0.1 build 156745; and VMware Fusion before 2.0.2 build 147997 allows remote attackers to cause a denial of service (daemon crash) via a long (1) USER or (2) PASS command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.vmware.com/pipermail/security-announce/2009/000054.html; http://osvdb.org/51180; http://seclists.org/fulldisclosure/2009/Apr/0036.html
CVE: CVE-2007-6720
Published: 2009-01-20
Description: libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playback calculations, which allows user-assisted attackers to cause a denial of service (application crash) by loading multiple songs (aka MOD files) with different numbers of channels.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=422021; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=461519; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
CVE: CVE-2008-2367
Published: 2009-01-20
Description: Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/33540; http://securitytracker.com/id?1021608; http://www.securityfocus.com/bid/33288
CVE: CVE-2008-2368
Published: 2009-01-20
Description: Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/33540; http://securitytracker.com/id?1021608; http://www.securityfocus.com/bid/33288
CVE: CVE-2008-4388
Published: 2009-01-20
Description: The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly validate downloaded files, which allows remote attackers to execute arbitrary code via the installAppMgr method and unspecified other methods.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securitytracker.com/id?1021609; http://www.kb.cert.org/vuls/id/194505; http://www.securityfocus.com/bid/33247
CVE: CVE-2008-5516
Published: 2009-01-20
Description: The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00002.html; http://repo.or.cz/w/git.git?a=commitdiff%3Bh=c582abae
CVE: CVE-2008-5912
Published: 2009-01-20
Description: An unspecified function in the JavaScript implementation in Microsoft Internet Explorer creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 2.1 (LOW)
References: http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html; http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161; http://www.infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html
CVE: CVE-2008-5913
Published: 2009-01-20
Description: The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack."
CVSS Score: 4.9 (MEDIUM)
References: http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html
CVE: CVE-2008-5914
Published: 2009-01-20
Description: An unspecified function in the JavaScript implementation in Apple Safari creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 2.1 (LOW)
References: http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html; http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161; http://www.infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html
CVE: CVE-2008-5915
Published: 2009-01-20
Description: An unspecified function in the JavaScript implementation in Google Chrome creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 2.1 (LOW)
References: http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html; http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161; http://www.infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html
CVE: CVE-2009-0178
Published: 2009-01-20
Description: Unspecified vulnerability in IBM Hardware Management Console (HMC) 7 release 3.2.0 SP1 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/51432; http://secunia.com/advisories/33518; http://www-1.ibm.com/support/docview.wss?uid=isg1MB02834
CVE: CVE-2009-0179
Published: 2009-01-20
Description: libmikmod 3.1.11 through 3.2.0, as used by MikMod and possibly other products, allows user-assisted attackers to cause a denial of service (application crash) by loading an XM file.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476339; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://openwall.com/lists/oss-security/2009/01/13/2
CVE: CVE-2009-0180
Published: 2009-01-20
Description: Certain Fedora build scripts for nfs-utils before 1.1.2-9.fc9 on Fedora 9, and before 1.1.4-6.fc10 on Fedora 10, omit TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions, possibly a related issue to CVE-2008-1376.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/33545; http://www.securityfocus.com/bid/33294; https://bugzilla.redhat.com/show_bug.cgi?id=477864
CVE: CVE-2009-0181
Published: 2009-01-20
Description: Buffer overflow in VUPlayer allows user-assisted attackers to have an unknown impact via a long file, as demonstrated by a file composed entirely of 'A' characters.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4921; http://www.securityfocus.com/archive/1/499810/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/48169
CVE: CVE-2009-0182
Published: 2009-01-20
Description: Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in a File line in a .pls file, as demonstrated by an http URL on a File1 line.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://packetstormsecurity.com/files/165489/VUPlayer-2.49-Buffer-Overflow.html; http://securityreason.com/securityalert/4923; https://exchange.xforce.ibmcloud.com/vulnerabilities/48170
CVE: CVE-2009-0219
Published: 2009-01-21
Description: The PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 performs delete operations on uninitialized pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted data stream in a .pdf file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=766; http://secunia.com/advisories/33534; http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB17118
CVE: CVE-2008-5916
Published: 2009-01-21
Description: gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=git&m=[PII_REDACTED]0860&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]0863&w=2:; http://osvdb.org/50918
CVE: CVE-2008-5917
Published: 2009-01-21
Description: Cross-site scripting (XSS) vulnerability in the XSS filter (framework/Text_Filter/Filter/xss.php) in Horde Application Framework 3.2.2 and 3.3, when Internet Explorer is being used, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to style attributes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cvs.horde.org/diff.php/framework/Text_Filter/Filter/xss.php?r1=1.17&r2=1.18; http://lists.horde.org/archives/announce/2008/000462.html; http://lists.horde.org/archives/announce/2008/000464.html
CVE: CVE-2008-5918
Published: 2009-01-21
Description: Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32338; http://secunia.com/advisories/34191; http://securityreason.com/securityalert/4928
CVE: CVE-2008-5919
Published: 2009-01-21
Description: Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to overwrite arbitrary files via directory traversal sequences in the rev parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32338; http://secunia.com/advisories/34191; http://securityreason.com/securityalert/4928
CVE: CVE-2008-5920
Published: 2009-01-21
Description: The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a crafted username that is processed by the preg_replace function with the eval switch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4928; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8; http://www.securityfocus.com/bid/31891
CVE: CVE-2009-0031
Published: 2009-01-21
Description: Memory leak in the keyctl_join_session_keyring function (security/keys/keyctl.c) in Linux kernel 2.6.29-rc2 and earlier allows local users to cause a denial of service (kernel memory consumption) via unknown vectors related to a "missing kfree."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git2.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0d54ee1c7850a954026deec4cd4885f331da35cc; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00003.html; http://osvdb.org/51501
CVE: CVE-2009-0240
Published: 2009-01-21
Description: listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted projects via a modified repname parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191; http://secunia.com/advisories/32338; http://secunia.com/advisories/33945
CVE: CVE-2009-0241
Published: 2009-01-21
Description: Stack-based buffer overflow in the process_path function in gmetad/server.c in Ganglia 3.1.1 allows remote attackers to cause a denial of service (crash) via a request to the gmetad service with a long pathname.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugzilla.ganglia.info/cgi-bin/bugzilla/show_bug.cgi?id=223; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html; http://secunia.com/advisories/33506
CVE: CVE-2009-0242
Published: 2009-01-21
Description: Rejected reason: gmetad in Ganglia 3.1.1, when supporting multiple requests per connection on an interactive port, allows remote attackers to cause a denial of service via a request to the gmetad service with a path that does not exist, which causes Ganglia to (1) perform excessive CPU computation and (2) send the entire tree, which consumes network bandwidth.  NOTE: the vendor and original researcher have disputed this issue, since legitimate requests can generate the same amount of resource consumption.  CVE concurs with the dispute, so this identifier should not be used
CVE: CVE-2008-5921
Published: 2009-01-21
Description: SQL injection vulnerability in albums.php in Umer Inc Songs Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4924; http://www.securityfocus.com/bid/32802; https://exchange.xforce.ibmcloud.com/vulnerabilities/47300
CVE: CVE-2008-5922
Published: 2009-01-21
Description: Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Cant Find A Gaming CMS (CFAGCMS) 1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) main and (2) right parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4926; http://www.bugreport.ir/index_58.htm; http://www.securityfocus.com/archive/1/499213/100/0/threaded
CVE: CVE-2008-5923
Published: 2009-01-21
Description: SQL injection vulnerability in default.asp in ASP-DEv XM Events Diary allows remote attackers to execute arbitrary SQL commands the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0812-exploits/aspdevxmdiary-sqldisclose.txt; http://secunia.com/advisories/33152; http://www.securityfocus.com/bid/32809
CVE: CVE-2008-5924
Published: 2009-01-21
Description: SQL injection vulnerability in diary_viewC.asp in ASP-DEv XM Events Diary allows remote attackers to execute arbitrary SQL commands via the cat parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33152; http://www.securityfocus.com/bid/33499; http://secunia.com/advisories/33152
CVE: CVE-2008-5925
Published: 2009-01-21
Description: ASP-DEv XM Events Diary stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for diary.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/0812-exploits/aspdevxmdiary-sqldisclose.txt; http://packetstormsecurity.org/0812-exploits/aspdevxmdiary-sqldisclose.txt
CVE: CVE-2008-5926
Published: 2009-01-21
Description: Multiple SQL injection vulnerabilities in login.asp in ASP-DEv Internal E-Mail System allow remote attackers to execute arbitrary SQL commands via the (1) login parameter (aka user field) or the (2) password parameter (aka pass field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33103; http://securityreason.com/securityalert/4925; http://www.securityfocus.com/bid/32808
CVE: CVE-2008-5927
Published: 2009-01-21
Description: Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPNews 0.0.6 allow remote attackers to execute arbitrary SQL commands via the (1) checkuser parameter (aka username field) or (2) checkpass parameter (aka password field) to admin/index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33114; http://securityreason.com/securityalert/4927; http://www.securityfocus.com/bid/32810
CVE: CVE-2008-5928
Published: 2009-01-21
Description: SQL injection vulnerability in redir.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33075; http://securityreason.com/securityalert/4929; http://www.securityfocus.com/bid/32813
CVE: CVE-2008-5929
Published: 2009-01-21
Description: VP-ASP Shopping Cart 6.50 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database containing the password via a direct request for database/shopping650.mdb.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://securityreason.com/securityalert/4930; https://exchange.xforce.ibmcloud.com/vulnerabilities/47298; https://www.exploit-db.com/exploits/7438
CVE: CVE-2008-5930
Published: 2009-01-21
Description: SQL injection vulnerability in admin/blog_comments.asp in The Net Guys ASPired2Blog allows remote attackers to execute arbitrary SQL commands via the BlogID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33134; http://securityreason.com/securityalert/4931; http://www.securityfocus.com/bid/32797
CVE: CVE-2008-5931
Published: 2009-01-21
Description: The Net Guys ASPired2Blog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing usernames and passwords via a direct request for admin/blog.mdb.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33134; http://securityreason.com/securityalert/4931; https://exchange.xforce.ibmcloud.com/vulnerabilities/47294
CVE: CVE-2008-5932
Published: 2009-01-21
Description: CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a direct request for _private/CAForum.mdb.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33100; http://securityreason.com/securityalert/4932; https://www.exploit-db.com/exploits/7450