deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5091
Published: 2008-11-14
Description: Buffer overflow in the LDAP Service in Novell eDirectory 8.7.3 before SP10a and 8.8 before SP3 allows attackers to cause a denial of service (application crash) via vectors involving an "invalid extensibleMatch filter."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.novell.com/documentation/edir873/sp10_readme/netware/readme.txt; http://www.novell.com/support/viewContent.do?externalId=3426981; http://www.novell.com/support/viewContent.do?externalId=3477912
CVE: CVE-2008-5092
Published: 2008-11-14
Description: Heap-based buffer overflows in Novell eDirectory HTTP protocol stack (HTTPSTK) before 8.8 SP3 have unknown impact and attack vectors related to the (1) HTTP language header and (2) HTTP content-length header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.novell.com/support/viewContent.do?externalId=3426981; http://www.securityfocus.com/bid/30947; http://www.securitytracker.com/id?1020786
CVE: CVE-2008-5093
Published: 2008-11-14
Description: Cross-site scripting (XSS) vulnerability in the HTTP Protocol Stack (HTTPSTK) in Novell eDirectory before 8.8 SP3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.novell.com/support/viewContent.do?externalId=3426981; http://www.securityfocus.com/bid/30947; http://www.securitytracker.com/id?1020785
CVE: CVE-2008-5094
Published: 2008-11-14
Description: Heap-based buffer overflow in the NDS Service in Novell eDirectory before 8.8 SP3 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.novell.com/support/viewContent.do?externalId=3426981; http://www.securityfocus.com/bid/30947; http://www.securitytracker.com/id?1020787
CVE: CVE-2008-5095
Published: 2008-11-14
Description: Cross-site scripting (XSS) vulnerability in the Novell User Application 3.0.1, 3.5.0, and 3.5.1; and Identity Manager Roles Based Provisioning Module 3.6.0 and 3.6.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.novell.com/support/viewContent.do?externalId=7001157&sliceId=1; http://www.securityfocus.com/bid/30947; http://www.securitytracker.com/id?1020792
CVE: CVE-2008-5096
Published: 2008-11-14
Description: Unspecified vulnerability in the TYPO3 File List (file_list) extension 0.2.1 and earlier allows remote attackers to obtain sensitive information via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/; http://www.securityfocus.com/bid/31262; https://exchange.xforce.ibmcloud.com/vulnerabilities/45258
CVE: CVE-2008-5097
Published: 2008-11-14
Description: SQL injection vulnerability in index.php in MyFWB 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31954; http://securityreason.com/securityalert/4597; http://www.securityfocus.com/archive/1/496553/100/0/threaded
CVE: CVE-2008-3623
Published: 2008-11-17
Description: Heap-based buffer overflow in CoreGraphics in Apple Safari before 3.2 on Windows, in iPhone OS 1.0 through 2.2.1, and in iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image, related to improper handling of color spaces.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html; http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html; http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
CVE: CVE-2008-3644
Published: 2008-11-17
Description: Apple Safari before 3.2 does not properly prevent caching of form data for form fields that have autocomplete disabled, which allows local users to obtain sensitive information by reading the browser's page cache.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html; http://lists.apple.com/archives/security-announce/2008/Nov/msg00002.html; http://secunia.com/advisories/32706
CVE: CVE-2008-4216
Published: 2008-11-17
Description: The plug-in interface in WebKit in Apple Safari before 3.2 does not prevent plug-ins from accessing local URLs, which allows remote attackers to obtain sensitive information via vectors that "launch local files."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html; http://secunia.com/advisories/32706; http://support.apple.com/kb/HT3298
CVE: CVE-2008-5098
Published: 2008-11-17
Description: Cross-site scripting (XSS) vulnerability in Sun Java System Messaging Server 6.2 and 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2007-2904.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/49836; http://secunia.com/advisories/32670; http://securitytracker.com/id?1021223
CVE: CVE-2008-5099
Published: 2008-11-17
Description: Sun Logical Domain Manager (aka LDoms Manager or ldm) 1.0 through 1.0.3 displays the value of the OpenBoot PROM (OBP) security-password variable in cleartext, which allows local users to bypass the SPARC firmware's password protection, and gain privileges or obtain data access, via the "ldm ls -l" command, a different vulnerability than CVE-2008-4992.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/32674; http://securitytracker.com/id?1021224; http://sunsolve.sun.com/search/document.do?assetkey=1-21-139395-02-1
CVE: CVE-2008-5100
Published: 2008-11-17
Description: The strong name (SN) implementation in Microsoft .NET Framework 2.0.50727 relies on the digital signature Public Key Token embedded in the pathname of a DLL file instead of the digital signature of this file itself, which makes it easier for attackers to bypass Global Assembly Cache (GAC) and Code Access Security (CAS) protection mechanisms, aka MSRC ticket MSRC8566gs.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://securityreason.com/securityalert/4605; http://www.applicationsecurity.co.il/.NET-Framework-Rootkits.aspx; http://www.applicationsecurity.co.il/LinkClick.aspx?fileticket=ycIS1bewMBI%3d&tabid=161&mid=555
CVE: CVE-2008-5101
Published: 2008-11-17
Description: Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505399; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://openwall.com/lists/oss-security/2008/11/12/1
CVE: CVE-2008-5102
Published: 2008-11-17
Description: PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.gentoo.org/show_bug.cgi?id=246411; http://mail.zope.org/pipermail/zope/2008-August/174025.html; http://openwall.com/lists/oss-security/2008/11/12/2
CVE: CVE-2008-5103
Published: 2008-11-17
Description: The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! argument, which configures the root account with a cleartext password of ! (exclamation point) and allows attackers to bypass intended login restrictions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-255
References: http://launchpadlibrarian.net/19619929/vm-builder_0.9-0ubuntu3.1.debdiff; http://osvdb.org/49996; http://secunia.com/advisories/32697
CVE: CVE-2008-5104
Published: 2008-11-17
Description: Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm-builder or (2) ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.10, have ! (exclamation point) as the default root password, which allows attackers to bypass intended login restrictions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-255
References: http://launchpadlibrarian.net/19619929/vm-builder_0.9-0ubuntu3.1.debdiff; http://secunia.com/advisories/32697; http://www.securityfocus.com/bid/32292
CVE: CVE-2008-5105
Published: 2008-11-17
Description: KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash or hang) via certain (1) APPE, (2) CWD, (3) DELE, (4) MKD, (5) RMD, (6) RETR, (7) RNFR, (8) RNTO, (9) SIZE, and (10) STOR commands.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/4603; http://www.securityfocus.com/archive/1/488198/100/200/threaded; http://www.securityfocus.com/bid/27817
CVE: CVE-2008-5106
Published: 2008-11-17
Description: Buffer overflow in KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long argument to an arbitrary command, which triggers the overflow when the SamyFtp.binlog log file is viewed in the management console.  NOTE: this may overlap CVE-2006-0441 and CVE-2006-2212.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4603; http://www.securityfocus.com/archive/1/488198/100/200/threaded; http://www.securityfocus.com/bid/27817
CVE: CVE-2008-5107
Published: 2008-11-17
Description: The installation process for Citrix Presentation Server 4.5 and Desktop Server 1.0, when MSI logging is enabled, stores database credentials in MSI log files, which allows local users to obtain these credentials by reading the log files.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://support.citrix.com/article/CTX116228; http://www.securityfocus.com/bid/28047; http://www.vupen.com/english/advisories/2008/0705/references
CVE: CVE-2008-4824
Published: 2008-11-17
Description: Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute arbitrary code via unknown vectors related to "input validation errors."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html; http://osvdb.org/49958; http://secunia.com/advisories/32702
CVE: CVE-2008-5108
Published: 2008-11-17
Description: Unspecified vulnerability in Adobe AIR 1.1 and earlier allows context-dependent attackers to execute untrusted JavaScript in an AIR application via unknown attack vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/49915; http://secunia.com/advisories/32772; http://www.adobe.com/support/security/bulletins/apsb08-23.html
CVE: CVE-2008-5110
Published: 2008-11-17
Description: syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.
CVSS Score: 9.3 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791; http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083; http://secunia.com/advisories/35748
CVE: CVE-2006-5268
Published: 2008-11-17
Description: Unspecified vulnerability in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via vectors related to obtaining "administrative access to the RPC interface."
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://blogs.iss.net/archive/trend.html; http://secunia.com/advisories/32618; http://www.iss.net/threats/307.html
CVE: CVE-2006-5269
Published: 2008-11-17
Description: Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, probably related to an RPC interface.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blogs.iss.net/archive/trend.html; http://secunia.com/advisories/32618; http://www.iss.net/threats/308.html
CVE: CVE-2007-0072
Published: 2008-11-17
Description: Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a read operation over RPC.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blogs.iss.net/archive/trend.html; http://secunia.com/advisories/32618; http://www.iss.net/threats/309.html
CVE: CVE-2007-0073
Published: 2008-11-17
Description: Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a file read operation over RPC.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blogs.iss.net/archive/trend.html; http://secunia.com/advisories/32618; http://www.iss.net/threats/309.html
CVE: CVE-2007-0074
Published: 2008-11-17
Description: Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a folder read operation over RPC.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blogs.iss.net/archive/trend.html; http://secunia.com/advisories/32618; http://www.iss.net/threats/309.html
CVE: CVE-2008-0012
Published: 2008-11-17
Description: Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to the product's configuration, a different vulnerability than CVE-2008-0013 and CVE-2008-0014.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blogs.iss.net/archive/trend.html; http://secunia.com/advisories/32618; http://www.iss.net/threats/310.html
CVE: CVE-2008-0013
Published: 2008-11-17
Description: Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to the product's configuration, a different vulnerability than CVE-2008-0012 and CVE-2008-0014.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blogs.iss.net/archive/trend.html; http://secunia.com/advisories/32618; http://www.iss.net/threats/310.html
CVE: CVE-2008-0014
Published: 2008-11-17
Description: Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to the product's configuration, a different vulnerability than CVE-2008-0012 and CVE-2008-0013.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blogs.iss.net/archive/trend.html; http://secunia.com/advisories/32618; http://www.iss.net/threats/310.html
CVE: CVE-2008-4415
Published: 2008-11-17
Description: Unspecified vulnerability in HP Service Manager (HPSM) before 7.01.71 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0271&w=2; http://osvdb.org/49831; http://secunia.com/advisories/32712
CVE: CVE-2008-4832
Published: 2008-11-17
Description: rc.sysinit in initscripts 8.12-8.21 and 8.56.15-0.1 on rPath allows local users to delete arbitrary files via a symlink attack on a directory under (1) /var/lock or (2) /var/run.  NOTE: this issue exists because of a race condition in an incorrect fix for CVE-2008-3524. NOTE: exploitation may require an unusual scenario in which rc.sysinit is executed other than at boot time.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://secunia.com/advisories/32710; http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0318; https://exchange.xforce.ibmcloud.com/vulnerabilities/46700
CVE: CVE-2008-5025
Published: 2008-11-17
Description: Stack-based buffer overflow in the hfs_cat_find_brec function in fs/hfs/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service (memory corruption or system crash) via an hfs filesystem image with an invalid catalog namelength field, a related issue to CVE-2008-4933.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=d38b7aa7fc3371b52d036748028db50b585ade2e; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00010.html
CVE: CVE-2008-5111
Published: 2008-11-17
Description: Unspecified vulnerability in the socket function in Sun Solaris 10 and OpenSolaris snv_57 through snv_91, when InfiniBand hardware is not installed, allows local users to cause a denial of service (panic) via unknown vectors, related to the socksdpv_close function.
CVSS Score: 4.7 (MEDIUM)
References: http://osvdb.org/49854; http://secunia.com/advisories/32611; http://securitytracker.com/id?1021231
CVE: CVE-2008-5112
Published: 2008-11-17
Description: The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt depending on whether the user account exists and is permitted to login, which allows remote attackers to enumerate valid usernames via a series of LDAP bind requests, as demonstrated by ldapuserenum.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://labs.portcullis.co.uk/application/ldapuserenum/; http://www.portcullis-security.com/294.php; http://www.securityfocus.com/bid/32305
CVE: CVE-2008-5113
Published: 2008-11-17
Description: WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access).  NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-352
References: http://bugs.debian.org/504771; http://openwall.com/lists/oss-security/2008/11/14/1; http://www.debian.org/security/2009/dsa-1871
CVE: CVE-2008-5114
Published: 2008-11-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/49765; http://secunia.com/advisories/32606; http://sunsolve.sun.com/search/document.do?assetkey=1-26-243386-1
CVE: CVE-2008-5115
Published: 2008-11-18
Description: Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to hijack the authentication of administrators for requests that update the password via idm/admin/changeself.jsp.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/49766; http://secunia.com/advisories/32606; http://sunsolve.sun.com/search/document.do?assetkey=1-26-243386-1
CVE: CVE-2008-5116
Published: 2008-11-18
Description: Directory traversal vulnerability in idm/includes/helpServer.jsp in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to read arbitrary files in the filesystem of the IDM server via directory traversal sequences in the ext parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://osvdb.org/49767; http://secunia.com/advisories/32606; http://sunsolve.sun.com/search/document.do?assetkey=1-26-243386-1
CVE: CVE-2008-5117
Published: 2008-11-18
Description: Open redirect vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/49768; http://secunia.com/advisories/32606; http://sunsolve.sun.com/search/document.do?assetkey=1-26-243386-1
CVE: CVE-2008-5118
Published: 2008-11-18
Description: Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via unspecified vectors, related to "frame injection."
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/49769; http://secunia.com/advisories/32606; http://sunsolve.sun.com/search/document.do?assetkey=1-26-243386-1
CVE: CVE-2008-5119
Published: 2008-11-18
Description: Cross-site scripting (XSS) vulnerability in search.php in Scripts4Profit DXShopCart 4.30mc allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-08/0414.html; http://www.securityfocus.com/bid/30790; https://exchange.xforce.ibmcloud.com/vulnerabilities/44587
CVE: CVE-2008-5120
Published: 2008-11-18
Description: Stack-based buffer overflow in the Process Software MultiNet finger service (aka FINGERD) for HP OpenVMS 8.3 allows remote attackers to execute arbitrary code via a long request string.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4602; http://www.securityfocus.com/archive/1/495207/100/0/threaded; http://www.securityfocus.com/bid/30589
CVE: CVE-2008-5121
Published: 2008-11-18
Description: dne2000.sys in Citrix Deterministic Network Enhancer (DNE) 2.21.7.233 through 3.21.7.17464, as used in (1) Cisco VPN Client, (2) Blue Coat WinProxy, and (3) SafeNet SoftRemote and HighAssurance Remote, allows local users to gain privileges via a crafted DNE_IOCTL DeviceIoControl request to the \\.\DNE device interface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30728; http://secunia.com/advisories/30744; http://secunia.com/advisories/30747
CVE: CVE-2008-5122
Published: 2008-11-18
Description: SQL injection vulnerability in WorkArea/ContentRatingGraph.aspx in Ektron CMS400.NET 7.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the res parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30824; http://www.digitrustgroup.com/advisories/web-application-security-ektron.html; http://www.securityfocus.com/bid/29857
CVE: CVE-2008-5123
Published: 2008-11-18
Description: SQL injection vulnerability in admin.php in CCleague Pro 1.2 allows remote attackers to execute arbitrary SQL commands via the u parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30796; http://securityreason.com/securityalert/4604; http://www.securityfocus.com/bid/29876
CVE: CVE-2008-5124
Published: 2008-11-18
Description: JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key, which makes it easier for remote attackers to perform man-in-the-middle attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/30822; http://securityreason.com/securityalert/4606; http://www.jscape.com/sftpapplet/docs/HTML/index.html?introhistory.html
CVE: CVE-2008-5125
Published: 2008-11-18
Description: admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/30796; http://securityreason.com/securityalert/4604; http://www.securityfocus.com/bid/29871
CVE: CVE-2008-5126
Published: 2008-11-18
Description: Cross-site scripting (XSS) vulnerability in search.php in BoutikOne CMS allows remote attackers to inject arbitrary web script or HTML via the search_query parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0811-exploits/boutikone-xss.txt; http://secunia.com/advisories/32757; http://www.securityfocus.com/bid/32321