deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3789
Published: 2008-08-27
Description: Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Unix groups.
CVSS Score: 2.1 (LOW)
CWE: CWE-732
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496073; http://samba.org/samba/security/CVE-2008-3789.html; http://secunia.com/advisories/31601
CVE: CVE-2008-3790
Published: 2008-08-27
Description: The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://groups.google.com/group/comp.lang.ruby/browse_thread/thread/19f69e8a081fc0d1/e138e014b74352ca; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/31602
CVE: CVE-2008-3838
Published: 2008-08-27
Description: Unspecified vulnerability in the NFS Remote Procedure Calls (RPC) zones implementation in Sun Solaris 10 and OpenSolaris before snv_88 allows local administrators of non-global zones to read and modify NFS traffic for arbitrary non-global zones, possibly leading to file modifications or a denial of service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31622; http://sunsolve.sun.com/search/document.do?assetkey=1-26-240866-1; http://www.securityfocus.com/bid/30853
CVE: CVE-2008-3839
Published: 2008-08-27
Description: Unspecified vulnerability in the NFS module in the kernel in Sun Solaris 10 and OpenSolaris snv_59 through snv_87, when configured as an NFS server without the nodevices option, allows local users to cause a denial of service (panic) via unspecified vectors.
CVSS Score: 4.7 (MEDIUM)
References: http://secunia.com/advisories/31598; http://sunsolve.sun.com/search/document.do?assetkey=1-26-241066-1; http://support.avaya.com/elmodocs2/security/ASA-2008-369.htm
CVE: CVE-2008-3840
Published: 2008-08-27
Description: Crafty Syntax Live Help (CSLH) 2.14.6 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://securityreason.com/securityalert/4192; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8; http://www.securityfocus.com/archive/1/495729/100/0/threaded
CVE: CVE-2008-3841
Published: 2008-08-27
Description: Cross-site scripting (XSS) vulnerability in admin/search_links.php in Freeway eCommerce 1.4.1.171 allows remote attackers to inject arbitrary web script or HTML via the search_link parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31475; http://securityreason.com/securityalert/4181; http://www.openfreeway.org/download/change-log.html
CVE: CVE-2008-3842
Published: 2008-08-27
Description: Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "</" (less-than slash) sequence.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4193; http://www.procheckup.com/PDFs/bypassing-dot-NET-ValidateRequest.pdf; http://www.securityfocus.com/archive/1/495667/100/0/threaded
CVE: CVE-2008-3843
Published: 2008-08-27
Description: Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "<~/" (less-than tilde slash) sequence followed by a crafted STYLE element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4193; http://www.procheckup.com/PDFs/bypassing-dot-NET-ValidateRequest.pdf; http://www.procheckup.com/Vulnerability_PR08-20.php
CVE: CVE-2008-3844
Published: 2008-08-27
Description: Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact.  NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points.  As of 20080827, no unofficial distributions of this software are known.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31575; http://secunia.com/advisories/32241; http://securitytracker.com/id?1020730
CVE: CVE-2008-3845
Published: 2008-08-27
Description: Multiple SQL injection vulnerabilities in Crafty Syntax Live Help (CSLH) 2.14.6 and earlier allow remote attackers to execute arbitrary SQL commands via the department parameter to (1) is_xmlhttp.php and (2) is_flush.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31573; http://security.craftysyntax.com/updates/?v=2.14.6; http://securityreason.com/securityalert/4192
CVE: CVE-2008-3846
Published: 2008-08-27
Description: Cross-site scripting (XSS) vulnerability in mysql-lists 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://aqua.sun.ddns.vc/free/php_script/mysql.html; http://jvn.jp/en/jp/JVN27417220/index.html; http://secunia.com/advisories/31611
CVE: CVE-2008-3847
Published: 2008-08-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in AN Guestbook (ANG) before 0.7.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31608; http://sourceforge.net/forum/forum.php?forum_id=860304; http://www.securityfocus.com/bid/30830
CVE: CVE-2008-3848
Published: 2008-08-27
Description: SQL injection vulnerability in single.php in Z-Breaknews 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30831; https://exchange.xforce.ibmcloud.com/vulnerabilities/44675; https://www.exploit-db.com/exploits/6309
CVE: CVE-2008-3849
Published: 2008-08-27
Description: Cross-site scripting (XSS) vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving (1) month, (2) day, and (3) year fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31609; http://secunia.com/advisories/31641; http://sourceforge.net/project/shownotes.php?group_id=234663&release_id=621954
CVE: CVE-2008-3850
Published: 2008-08-27
Description: Cross-site scripting (XSS) vulnerability in Accellion File Transfer FTA_7_0_135 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to courier/forgot_password.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31572; http://www.securityfocus.com/bid/30796; http://zebux.free.fr/pub/Advisory/Advisory_Accellion_XSS_Vulnerability_200808.txt
CVE: CVE-2008-3851
Published: 2008-08-27
Description: Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local files via a ..\ (dot dot backslash) in the (1) blogpost, (2) cat, and (3) file parameters to data/inc/themes/predefined_variables.php, as reachable through index.php; and the (4) blogpost and (5) cat parameters to data/inc/blog_include_react.php, as reachable through index.php.  NOTE: the issue involving vectors 1 through 3 reportedly exists because of an incomplete fix for CVE-2008-3194.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31607; http://securityreason.com/securityalert/4195; http://www.pluck-cms.org/releasenotes.php#4.5.3
CVE: CVE-2008-3852
Published: 2008-08-28
Description: Unspecified vulnerability in the CLR stored procedure deployment from IBM Database Add-Ins for Visual Studio in the Visual Studio Net component in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 2 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30558; http://secunia.com/advisories/31635; http://www-1.ibm.com/support/docview.wss?uid=swg1JR28431
CVE: CVE-2008-3853
Published: 2008-08-28
Description: Buffer overflow in the DAS server program in the Core DAS function component in IBM DB2 9.1 before FP4a and 9.5 before FP1 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via unspecified vectors. NOTE: this might be related to CVE-2007-3676.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://secunia.com/advisories/29784; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ12406
CVE: CVE-2008-3854
Published: 2008-08-28
Description: Multiple stack-based buffer overflows in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 1 allow remote attackers to cause a denial of service (system outage) via vectors related to (1) use of XQuery to issue statements; the (2) XMLQUERY, (3) XMLEXISTS, and (4) XMLTABLE statements; and the (5) sqlrlaka function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30558; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ16346; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ18431
CVE: CVE-2008-3855
Published: 2008-08-28
Description: Unspecified vulnerability in the DB2 Administration Server (DAS) in the Core DAS function component in IBM DB2 9.1 before Fixpak 5 allows local users to gain privileges, aka a "FILE CREATION VULNERABILITY." NOTE: this may be the same as CVE-2007-5664.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30558; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ12735; http://www-1.ibm.com/support/docview.wss?uid=swg21255607
CVE: CVE-2008-3856
Published: 2008-08-28
Description: The routine infrastructure component in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP1 on Unix and Linux does not change the ownership of the db2fmp process, which has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://secunia.com/advisories/29784
CVE: CVE-2008-3857
Published: 2008-08-28
Description: The Base Service Utilities component in IBM DB2 9.1 before Fixpak 5 retains a cleartext password in memory after the database connection that sent the password is fully established, which might allow local users to obtain sensitive information by reading a memory dump.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://www-1.ibm.com/support/docview.wss?uid=swg1JR27422; http://www-1.ibm.com/support/docview.wss?uid=swg21255607; http://www.securityfocus.com/bid/29601
CVE: CVE-2008-3858
Published: 2008-08-28
Description: The Downlevel DB2RA Support component in IBM DB2 9.1 before Fixpak 4a allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT data stream that simulates a V7 client connect request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/48428; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ07299; http://www-1.ibm.com/support/docview.wss?uid=swg21255607
CVE: CVE-2008-3859
Published: 2008-08-29
Description: Davlin Thickbox Gallery 2 allows remote attackers to obtain the administrative username and MD5 password hash via a direct request to conf/admins.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://securityreason.com/securityalert/4196; http://www.securityfocus.com/bid/30845; https://exchange.xforce.ibmcloud.com/vulnerabilities/44682
CVE: CVE-2008-3860
Published: 2008-08-29
Description: Multiple cross-site scripting (XSS) vulnerabilities (1) in the WYSIWYG editors, (2) during local group creation, (3) during HTML redirects, (4) in the HTML import, (5) in the Rich text editor, and (6) in link-page in IBM Lotus Quickr 8.1 services for Lotus Domino before Hotfix 15 allow remote attackers to inject arbitrary web script or HTML via unknown vectors, including (7) the Imported Page.  NOTE: the vulnerability in the WYSIWYG editors may exist because of an incomplete fix for CVE-2008-2163.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/49772; http://osvdb.org/49776; http://secunia.com/advisories/31634
CVE: CVE-2008-3861
Published: 2008-08-29
Description: Multiple SQL injection vulnerabilities in phpMyRealty (PMR) 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in pages.php and (2) the price_max parameter in search.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31613; http://securityreason.com/securityalert/4198; http://www.securityfocus.com/bid/30862
CVE: CVE-2008-3480
Published: 2008-08-29
Description: Stack-based buffer overflow in the Anzio Web Print Object (WePO) ActiveX control 3.2.19 and 3.2.24, as used in Anzio Print Wizard, allows remote attackers to execute arbitrary code via a long mainurl parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31554; http://securityreason.com/securityalert/4197; http://www.coresecurity.com/content/anzio-web-print-object-buffer-overflow
CVE: CVE-2008-3873
Published: 2008-08-29
Description: The System.setClipboard method in ActionScript in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to populate the clipboard with a URL that is difficult to delete and does not require user interaction to populate the clipboard, as exploited in the wild in August 2008.
CVSS Score: 4.3 (MEDIUM)
References: http://blogs.adobe.com/psirt/2008/08/clipboard_attack.html; http://blogs.zdnet.com/security/?p=1733; http://blogs.zdnet.com/security/?p=1759
CVE: CVE-2008-3874
Published: 2008-08-29
Description: Cross-site scripting (XSS) vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field (aka Label ==> Value pairs).  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lussumo.com/community/discussion/8559/vanilla-115-release-candidate-1/; http://lussumo.com/docs/doku.php?id=vanilla:releasenotes; http://secunia.com/advisories/31527
CVE: CVE-2008-2928
Published: 2008-08-29
Description: Multiple buffer overflows in the adminutil library in CGI applications in Red Hat Directory Server 7.1 before SP7 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted Accept-Language HTTP header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861; http://secunia.com/advisories/31565; http://secunia.com/advisories/31702
CVE: CVE-2008-2929
Published: 2008-08-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject arbitrary web script or HTML via input values that use % (percent) escaping.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861; http://secunia.com/advisories/31565; http://secunia.com/advisories/31612
CVE: CVE-2008-2930
Published: 2008-08-29
Description: Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service (CPU consumption and search outage) via crafted LDAP search requests with patterns, related to a single-threaded regular-expression subsystem.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861; http://secunia.com/advisories/31565; http://secunia.com/advisories/31627
CVE: CVE-2008-3282
Published: 2008-08-29
Description: Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1, on 64-bit platforms, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document, related to a "numeric truncation error," a different vulnerability than CVE-2008-2152.
CVSS Score: 7.8 (HIGH)
CWE: CWE-681, CWE-681
References: http://secunia.com/advisories/31640; http://secunia.com/advisories/31646; http://secunia.com/advisories/31778
CVE: CVE-2008-3283
Published: 2008-08-29
Description: Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 and earlier allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) the authentication / bind phase and (2) anonymous LDAP search requests.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861; http://secunia.com/advisories/31565; http://secunia.com/advisories/31627
CVE: CVE-2008-2727
Published: 2008-09-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-2725.  Reason: This candidate is a duplicate of CVE-2008-2725.  Notes: All CVE users should reference CVE-2008-2725 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-2728
Published: 2008-09-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-2726.  Reason: This candidate is a duplicate of CVE-2008-2726.  Notes: All CVE users should reference CVE-2008-2726 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-3146
Published: 2008-09-02
Description: Multiple buffer overflows in packet_ncp2222.inc in Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted NCP packet that causes an invalid pointer to be used.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2675; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html; http://secunia.com/advisories/31687
CVE: CVE-2008-3538
Published: 2008-09-02
Description: Unspecified vulnerability in HP Enterprise Discovery 2.0 through 2.52 on Windows allows remote authenticated users to execute arbitrary code via unknown vectors.  NOTE: the initial description of this CVE was inadvertently associated with libxml2, but it should be for HP Enterprise Discovery.
CVSS Score: 9.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4288&w=2; http://secunia.com/advisories/31616; http://securitytracker.com/id?1020760
CVE: CVE-2008-3875
Published: 2008-09-02
Description: The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_90 allows local users to bypass chroot, zones, and the Solaris Trusted Extensions multi-level security policy, and establish a covert communication channel, via unspecified vectors involving system calls.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31667; http://sunsolve.sun.com/search/document.do?assetkey=1-26-240706-1; http://www.securityfocus.com/bid/30880
CVE: CVE-2008-3876
Published: 2008-09-02
Description: Apple iPhone 2.0.2, in some configurations, allows physically proximate attackers to bypass intended access restrictions, and obtain sensitive information or make arbitrary use of the device, via an Emergency Call tap and a Home double-tap, followed by a tap of any contact's blue arrow.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://forums.macrumors.com/showpost.php?p=6121914&postcount=118; http://forums.macrumors.com/showthread.php?t=551617; http://securitytracker.com/id?1020763
CVE: CVE-2008-3877
Published: 2008-09-02
Description: Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execute arbitrary code via a crafted .mx4 file.  NOTE: it was later reported that version 3 is also affected.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31595; http://securityreason.com/securityalert/4199; http://www.securityfocus.com/bid/30879
CVE: CVE-2008-3878
Published: 2008-09-02
Description: Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware Ultra Office Control allows remote attackers to execute arbitrary code via long strUrl, strFile, and strPostData parameters to the HttpUpload method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31632; http://securityreason.com/securityalert/4200; http://www.securityfocus.com/bid/30861
CVE: CVE-2008-3879
Published: 2008-09-02
Description: The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument (SaveAsDocument argument) to the Save method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31632; http://securityreason.com/securityalert/4201; http://www.securityfocus.com/bid/30863
CVE: CVE-2008-3880
Published: 2008-09-02
Description: SQL injection vulnerability in zm_html_view_event.php in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary SQL commands via the filter array parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31636; http://www.securityfocus.com/archive/1/495745/100/0/threaded; http://www.securityfocus.com/bid/30843
CVE: CVE-2008-3881
Published: 2008-09-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified "zm_html_view_*.php" files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31636; http://www.securityfocus.com/archive/1/495745/100/0/threaded; http://www.securityfocus.com/bid/30843
CVE: CVE-2008-3882
Published: 2008-09-02
Description: Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary commands via (1) the executeFilter function in zm_html_view_events.php and (2) the run_state parameter to zm_html_view_state.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/31636; http://www.securityfocus.com/archive/1/495745/100/0/threaded; http://www.securityfocus.com/bid/30843
CVE: CVE-2008-3883
Published: 2008-09-02
Description: configvar in Caudium 1.4.12 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/roken#####.pike temporary file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496404; http://dev.gentoo.org/~rbu/security/debiantemp/caudium; http://secunia.com/advisories/31656