deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3760
Published: 2008-08-21
Description: Cross-site request forgery (CSRF) vulnerability in the sign-out page in Vanilla 1.1.4 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout via a SignOutNow action to people.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://lussumo.com/bugs/discussion/88/csrf-attack-hole/; http://lussumo.com/community/discussion/8463/possible-security-flaw/#Comment_88511; http://lussumo.com/community/discussion/8559/vanilla-115-release-candidate-1/
CVE: CVE-2008-3761
Published: 2008-08-21
Description: hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://lists.vmware.com/pipermail/security-announce/2009/000054.html; http://seclists.org/fulldisclosure/2009/Apr/0036.html; http://securityreason.com/securityalert/4177
CVE: CVE-2008-3762
Published: 2008-08-21
Description: SQL injection vulnerability in onlinestatus_html.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the dep parameter, related to lack of input sanitization in the get function in global.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31521; http://securityreason.com/securityalert/4178; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8
CVE: CVE-2008-3763
Published: 2008-08-21
Description: Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is enabled, allows remote attackers to overwrite arbitrary variables related to the db config file.  NOTE: this can be leveraged for code injection by overwriting the language file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://demos.turnkeywebtools.com/phplivehelper/docs/change_log.txt; http://secunia.com/advisories/31521; http://securityreason.com/securityalert/4178
CVE: CVE-2008-3764
Published: 2008-08-21
Description: Eval injection vulnerability in globalsoff.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attackers to execute arbitrary PHP code via the test parameter, and probably arbitrary parameters, to chat.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://demos.turnkeywebtools.com/phplivehelper/docs/change_log.txt; http://secunia.com/advisories/31521; http://securityreason.com/securityalert/4178
CVE: CVE-2008-3765
Published: 2008-08-21
Description: SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0808-exploits/quickpoll-sql.txt; http://www.securityfocus.com/bid/30724; http://www.vupen.com/english/advisories/2008/3141
CVE: CVE-2008-3766
Published: 2008-08-22
Description: Realtime Internet Band Rehearsal Low-Latency (Internet) Connection tool (llcon) before 2.1.2 allows remote attackers to cause a denial of service (application crash) via malformed protocol messages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/31496; http://sourceforge.net/project/shownotes.php?group_id=158367&release_id=619929; http://www.securityfocus.com/bid/30770
CVE: CVE-2008-3767
Published: 2008-08-22
Description: SQL injection vulnerability in classified.php in phpBazar 2.0.2 allows remote attackers to execute arbitrary SQL commands via the adid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31555; http://securityreason.com/securityalert/4179; http://www.securityfocus.com/bid/30773
CVE: CVE-2008-3768
Published: 2008-08-22
Description: Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in an edit_registry action to index.php, (2) a vector involving the check_email function, and other vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://demos.turnkeywebtools.com/ss4/docs/change_log.txt; http://secunia.com/advisories/31539; http://securityreason.com/securityalert/4180
CVE: CVE-2008-3769
Published: 2008-08-22
Description: PHP remote file inclusion vulnerability in admin/create_order_new.php in Freeway 1.4.1.171, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the include_page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/31475; http://securityreason.com/securityalert/4181; http://www.openfreeway.org/download/change-log.html
CVE: CVE-2008-3770
Published: 2008-08-22
Description: Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to (1) includes/events_application_top.php; (2) english/account.php, (3) french/account.php, and (4) french/account_newsletters.php in includes/languages/; (5) includes/modules/faqdesk/faqdesk_article_require.php; (6) includes/modules/newsdesk/newsdesk_article_require.php; (7) card1.php, (8) loginbox.php, and (9) whos_online.php in templates/Freeway/boxes/; and (10) templates/Freeway/mainpage_modules/mainpage.php.  NOTE: vector 1 may be the same as CVE-2008-3677.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31475; http://securityreason.com/securityalert/4181; http://www.openfreeway.org/download/change-log.html
CVE: CVE-2008-3771
Published: 2008-08-22
Description: Cross-site scripting (XSS) vulnerability in members.php in Pars4u Videosharing 1 allows remote attackers to inject arbitrary web script or HTML via the PageNo parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/30779; https://exchange.xforce.ibmcloud.com/vulnerabilities/44581; https://www.exploit-db.com/exploits/6279
CVE: CVE-2008-3772
Published: 2008-08-22
Description: SQL injection vulnerability in categories_portal.php in Pars4u Videosharing 1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31571; http://www.securityfocus.com/bid/30779; https://exchange.xforce.ibmcloud.com/vulnerabilities/44579
CVE: CVE-2008-3773
Published: 2008-08-22
Description: Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a private message subject (aka newpm[title]).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3788&w=2; http://secunia.com/advisories/31552; http://securityreason.com/securityalert/4182
CVE: CVE-2008-3774
Published: 2008-08-22
Description: SQL injection vulnerability in index.php in Simasy CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0808-exploits/simasycms-sql.txt; http://www.securityfocus.com/bid/30774; http://www.securityfocus.com/bid/30774/exploit
CVE: CVE-2008-3775
Published: 2008-08-22
Description: Folder Lock 5.9.5 and earlier uses weak encryption (ROT-25) for the password, which allows local administrators to obtain sensitive information by reading and decrypting the QualityControl\_pack registry value.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-327, CWE-327
References: http://secunia.com/advisories/31559; http://securityreason.com/securityalert/4183; http://www.securityfocus.com/archive/1/495612/100/0/threaded
CVE: CVE-2008-3776
Published: 2008-08-25
Description: Directory traversal vulnerability in Fujitsu Web-Based Admin View 2.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2008/Aug/0411.html; http://www.securityfocus.com/bid/30780; http://www.securitytracker.com/id?1020726
CVE: CVE-2008-3777
Published: 2008-08-25
Description: The SIP Enablement Services (SES) Server in Avaya SIP Enablement Services 5.0, and Communication Manager (CM) 5.0 on the S8300C with SES enabled, writes account names and passwords to the (1) alarm and (2) system logs during failed login attempts, which allows local users to obtain login credentials by reading these logs.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://support.avaya.com/elmodocs2/security/ASA-2008-347.htm; http://www.securityfocus.com/bid/30758; https://exchange.xforce.ibmcloud.com/vulnerabilities/44586
CVE: CVE-2008-3778
Published: 2008-08-25
Description: The remote management interface in SIP Enablement Services (SES) Server in Avaya SIP Enablement Services 5.0, and Communication Manager (CM) 5.0 on the S8300C with SES enabled, proceeds with Core router updates even when a login is invalid, which allows remote attackers to cause a denial of service (messaging outage) or gain privileges via an update request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://support.avaya.com/elmodocs2/security/ASA-2008-347.htm; http://www.securityfocus.com/bid/30758; https://exchange.xforce.ibmcloud.com/vulnerabilities/44585
CVE: CVE-2008-3779
Published: 2008-08-26
Description: Cross-site scripting (XSS) vulnerability in search/index.php in Five Star Review Script allows remote attackers to inject arbitrary web script or HTML via the words parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31585; http://securityreason.com/securityalert/4184; http://www.securityfocus.com/bid/30808
CVE: CVE-2008-3780
Published: 2008-08-26
Description: SQL injection vulnerability in recommend.php in Five Star Review Script allows remote attackers to execute arbitrary SQL commands via the item_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31585; http://securityreason.com/securityalert/4184; http://www.securityfocus.com/bid/30808
CVE: CVE-2008-3781
Published: 2008-08-26
Description: Cross-site scripting (XSS) vulnerability in GMOD GBrowse before 1.69 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://gmod.org/wiki/GMOD_News#GBrowse_1.69_Released; http://secunia.com/advisories/31596; http://sourceforge.net/project/shownotes.php?release_id=621342&group_id=27707
CVE: CVE-2008-3782
Published: 2008-08-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in ACG-PTP 1.0.6 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) Category name field under Advertisement Packages, the (2) Reason field under Credit/Debit Users, and the (3) FAQ question and (4) FAQ answer fields under Add New FAQ Entry.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064038.html; http://secunia.com/advisories/31591; http://www.securityfocus.com/bid/30793
CVE: CVE-2008-3783
Published: 2008-08-26
Description: Multiple SQL injection vulnerabilities in index.php in Matterdaddy Market 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) type parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31564; http://securityreason.com/securityalert/4185; http://www.securityfocus.com/bid/30809
CVE: CVE-2008-3784
Published: 2008-08-26
Description: SQL injection vulnerability in scrape.php in BtiTracker 1.4.7 and earlier and xBtiTracker 2.0.542 and earlier allows remote attackers to execute arbitrary SQL commands via the info_hash parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31556; http://securityreason.com/securityalert/4186; http://www.btiteam.org/
CVE: CVE-2008-3785
Published: 2008-08-26
Description: Multiple SQL injection vulnerabilities in the com_content component in MiaCMS 4.6.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) view, (2) category, or (3) blogsection action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31584; http://securityreason.com/securityalert/4189; http://www.securityfocus.com/bid/30805
CVE: CVE-2008-3786
Published: 2008-08-26
Description: Cross-site scripting (XSS) vulnerability in index.php in PICTURESPRO Photo Cart 3.9 allows remote attackers to inject arbitrary web script or HTML via the qtitle parameter (aka "Gallery or event name" field) in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064046.html; http://secunia.com/advisories/31589; http://www.securityfocus.com/bid/30798
CVE: CVE-2008-3787
Published: 2008-08-26
Description: SQL injection vulnerability in listing_view.php in Web Directory Script 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the name parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4187; http://www.securityfocus.com/bid/30807; https://exchange.xforce.ibmcloud.com/vulnerabilities/44638
CVE: CVE-2008-3788
Published: 2008-08-26
Description: Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) qtitle, (2) qid, and (3) qyear parameters to (a) search.php, and the (4) email and (5) password parameters to (b) _login.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/0808-exploits/photocart-sql.txt; http://securityreason.com/securityalert/4188; http://www.securityfocus.com/bid/30786
CVE: CVE-2008-3794
Published: 2008-08-26
Description: Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers to execute arbitrary code via a crafted mmst link with a negative size value, which bypasses a size check and triggers an integer overflow followed by a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://mailman.videolan.org/pipermail/vlc-devel/2008-August/048488.html; http://security.gentoo.org/glsa/glsa-200809-06.xml; http://securityreason.com/securityalert/4190
CVE: CVE-2008-3740
Published: 2008-08-27
Description: Cross-site scripting (XSS) vulnerability in the output filter in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/295053; http://secunia.com/advisories/31462; http://secunia.com/advisories/31825
CVE: CVE-2008-3741
Published: 2008-08-27
Description: The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading files containing arbitrary web script or HTML.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/295053; http://secunia.com/advisories/31462; http://secunia.com/advisories/31825
CVE: CVE-2008-3742
Published: 2008-08-27
Description: Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, which is not validated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/295053; http://secunia.com/advisories/31462; http://secunia.com/advisories/31825
CVE: CVE-2008-3743
Published: 2008-08-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1) cached forms and (2) forms with AHAH elements.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/295053; http://secunia.com/advisories/31462; http://secunia.com/advisories/31825
CVE: CVE-2008-3744
Published: 2008-08-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) delete user access rules.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/295053; http://secunia.com/advisories/31462; http://secunia.com/advisories/31825
CVE: CVE-2008-3745
Published: 2008-08-27
Description: The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/295053; http://secunia.com/advisories/31825; http://www.securityfocus.com/bid/30689
CVE: CVE-2008-3746
Published: 2008-08-27
Description: neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and crash) via vectors related to Digest authentication, Digest domain parameter support, and the parse_domain function.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476571; http://lists.manyfish.co.uk/pipermail/neon/2008-August/000038.html; http://lists.manyfish.co.uk/pipermail/neon/2008-August/000040.html
CVE: CVE-2008-3747
Published: 2008-08-27
Description: The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://trac.wordpress.org/ticket/7359; http://www.openwall.com/lists/oss-security/2008/08/19/1; http://www.openwall.com/lists/oss-security/2008/08/20/3
CVE: CVE-2008-3795
Published: 2008-08-27
Description: Buffer overflow in Ipswitch WS_FTP Home client allows remote FTP servers to have an unknown impact via a long "message response."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4173; http://www.securityfocus.com/bid/30728; https://exchange.xforce.ibmcloud.com/vulnerabilities/44744
CVE: CVE-2008-3796
Published: 2008-08-27
Description: Swfdec 0.6 before 0.6.8 allows remote attackers to cause a denial of service (application crash) via a 1x1 JPEG image.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.freedesktop.org/archives/swfdec/2008-July/001801.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://www.openwall.com/lists/oss-security/2008/08/19/2
CVE: CVE-2007-1682
Published: 2008-08-27
Description: Multiple stack-based buffer overflows in the FileManager ActiveX control in SAFmgPws.dll in SoftArtisans XFile before 2.4.0 allow remote attackers to execute arbitrary code via unspecified calls to the (1) BuildPath, (2) GetDriveName, (3) DriveExists, or (4) DeleteFile method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31615; http://support.softartisans.com/Support-114.aspx; http://www.kb.cert.org/vuls/id/914785
CVE: CVE-2008-2327
Published: 2008-08-27
Description: Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling of the CODE_CLEAR code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=234080; http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html; http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
CVE: CVE-2008-2433
Published: 2008-08-27
Description: The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks.  NOTE: this can be leveraged for code execution through an unspecified "manipulation of the configuration."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: http://secunia.com/advisories/31373; http://secunia.com/secunia_research/2008-31/advisory/; http://securityreason.com/securityalert/4191
CVE: CVE-2008-3281
Published: 2008-08-27
Description: libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-776
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
CVE: CVE-2008-3526
Published: 2008-08-27
Description: Integer overflow in the sctp_setsockopt_auth_key function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service (panic) or possibly have unspecified other impact via a crafted sca_keylength field associated with the SCTP_AUTH_KEY option.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git%3Ba=commit%3Bh=30c2235cbc477d4629983d440cdc4f496fec9246; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html; http://secunia.com/advisories/31881
CVE: CVE-2008-3736
Published: 2008-08-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (a) change passwords or (b) change configurations.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN83428818/index.html; http://secunia.com/advisories/31574; http://secunia.com/advisories/31582
CVE: CVE-2008-3737
Published: 2008-08-27
Description: Unspecified vulnerability in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allows remote attackers to execute arbitrary PHP scripts, and delete files, read files, and possibly have unknown other impact.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN53886050/index.html; http://secunia.com/advisories/31574; http://secunia.com/advisories/31582
CVE: CVE-2008-3738
Published: 2008-08-27
Description: Session fixation vulnerability in SpaceTag LacoodaST 2.1.3 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://jvn.jp/en/jp/JVN31723154/index.html; http://secunia.com/advisories/31582; http://www.securityfocus.com/bid/30791
CVE: CVE-2008-3739
Published: 2008-08-27
Description: Cross-site scripting (XSS) vulnerability in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving upload of files containing XSS sequences.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN27417220/index.html; http://jvn.jp/en/jp/JVN52557009/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000048.html