deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1459
Published: 2008-03-24
Description: SQL injection vulnerability in the Alberghi (com_alberghi) 2.1.3 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29473; http://www.securityfocus.com/bid/28331; https://exchange.xforce.ibmcloud.com/vulnerabilities/41285
CVE: CVE-2008-1460
Published: 2008-03-24
Description: SQL injection vulnerability in the Joovideo (com_joovideo) 1.0 and 1.2.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29474; http://www.securityfocus.com/bid/28318; https://exchange.xforce.ibmcloud.com/vulnerabilities/41279
CVE: CVE-2008-1461
Published: 2008-03-24
Description: Buffer overflow in XnView 1.92.1 allows user-assisted remote attackers to execute arbitrary code via a long filename argument on the command line.  NOTE: it is unclear whether there are common handler configurations in which this argument is controlled by an attacker.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/3761; http://www.click-internet.fr/index.php?cki=News&news=9; http://www.securityfocus.com/archive/1/489658/100/0/threaded
CVE: CVE-2008-1462
Published: 2008-03-24
Description: SQL injection vulnerability in the sections (Section) module in RunCMS allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28378; https://exchange.xforce.ibmcloud.com/vulnerabilities/41377; https://www.exploit-db.com/exploits/5285
CVE: CVE-2008-1463
Published: 2008-03-24
Description: Cross-site scripting (XSS) vulnerability in the management GUI in Imperva SecureSphere MX Management Server 5.0 allows remote attackers to inject arbitrary web script or HTML via an invalid or prohibited request to a web server protected by SecureSphere, which triggers injection into the "corrective action" section of an alert page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://imperva.com/go/secadv/20080318; http://secunia.com/advisories/29439; http://www.securityfocus.com/bid/28279
CVE: CVE-2008-1464
Published: 2008-03-24
Description: Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) query parameter to (a) search.php; (2) gusername and (3) gpassword parameters to (b) login.php; and the (4) username and (5) password parameters to (c) gadmin/index.php in a signin action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29399; http://secunia.com/advisories/29399
CVE: CVE-2008-1465
Published: 2008-03-24
Description: SQL injection vulnerability in the Detodas Restaurante (com_restaurante) 1.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php, a different product than CVE-2008-0562.
CVSS Score: 9.3 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29471; http://www.securityfocus.com/bid/28324; https://exchange.xforce.ibmcloud.com/vulnerabilities/41283
CVE: CVE-2008-1466
Published: 2008-03-24
Description: Multiple PHP remote file inclusion vulnerabilities in W-Agora 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the bn_dir_default parameter to (1) add_user.php, (2) create_forum.php, (3) create_user.php, (4) delete_notes.php, (5) delete_user.php, (6) edit_forum.php, (7) mail_users.php, (8) moderate_notes.php, and (9) reorder_forums.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28366; https://exchange.xforce.ibmcloud.com/vulnerabilities/41352; http://www.securityfocus.com/bid/28366
CVE: CVE-2008-1467
Published: 2008-03-24
Description: CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URI, related to "received URLs in the message window."  NOTE: this issue has been disputed due to the user-assisted nature, since the URL must be selected and launched by the victim
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29489; http://secunia.com/advisories/29597; http://www.securityfocus.com/bid/28362
CVE: CVE-2008-1468
Published: 2008-03-24
Description: Cross-site scripting (XSS) vulnerability in namazu.cgi in Namazu before 2.0.18 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded input, related to failure to set the charset, a different vector than CVE-2004-1318 and CVE-2001-1350. NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
CVE: CVE-2008-1469
Published: 2008-03-24
Description: Gallarific Free Edition 1.1 does not require authentication for (1) photos.php, (2) comments.php, and (3) gallery.php in gadmin/, which allows remote attackers to edit objects via a direct request, different vectors than CVE-2008-1327.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/29399; http://secunia.com/advisories/29399
CVE: CVE-2008-0073
Published: 2008-03-24
Description: Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html; http://secunia.com/advisories/28694
CVE: CVE-2008-0125
Published: 2008-03-24
Description: Cross-site scripting (XSS) vulnerability in phpstats.php in Michael Wagner phpstats 0.1 alpha allows remote attackers to inject arbitrary web script or HTML via the baseDir parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3765; http://www.securityfocus.com/archive/1/489722/100/0/threaded; http://www.securityfocus.com/bid/28291
CVE: CVE-2008-0951
Published: 2008-03-24
Description: Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and possibly physically proximate attackers, to execute arbitrary code by inserting a (1) CD-ROM device or (2) U3-enabled USB device containing a filesystem with an Autorun.inf file, and possibly other vectors related to (a) AutoRun and (b) AutoPlay actions.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/29458; http://www.kb.cert.org/vuls/id/889747; http://www.securityfocus.com/bid/28360
CVE: CVE-2008-1470
Published: 2008-03-24
Description: Incomplete blacklist vulnerability in IISWebAgentIF.dll in the WebID RSA Authentication Agent 5.3, and possibly earlier, allows remote attackers to conduct cross-site scripting (XSS) attacks via the postdata parameter, due to an incomplete fix for CVE-2005-1118.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3768; http://www.securityfocus.com/archive/1/489691/100/0/threaded; http://www.securityfocus.com/bid/28277
CVE: CVE-2008-1471
Published: 2008-03-24
Description: The cpoint.sys driver in Panda Internet Security 2008 and Antivirus+ Firewall 2008 allows local users to cause a denial of service (system crash or kernel panic), overwrite memory, or execute arbitrary code via a crafted IOCTL request that triggers an out-of-bounds write of kernel memory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/29311; http://www.pandasecurity.com/homeusers/support/card?id=41231&idIdioma=2&ref=ProdExp; http://www.pandasecurity.com/homeusers/support/card?id=41337&idIdioma=2&ref=ProdExp
CVE: CVE-2008-1472
Published: 2008-03-24
Description: Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Backup R11.5, Desktop Management Suite r11.1 through r11.2, and Unicenter products r11.1 through r11.2, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long argument to the AddColumn method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2008/3/28.aspx; http://secunia.com/advisories/29408; http://www.securityfocus.com/archive/1/489893/100/0/threaded
CVE: CVE-2008-1473
Published: 2008-03-24
Description: The Altiris Client Service (AClient.exe) in Symantec Altiris Deployment Solution 6.8.x before 6.9.164 allows local users to gain privileges via a "Shatter" style attack.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29319; http://securityresponse.symantec.com/avcenter/security/Content/2008.03.10.html; http://www.securityfocus.com/bid/28110
CVE: CVE-2008-1474
Published: 2008-03-24
Description: Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-site scripting (XSS).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://roundup.cvs.sourceforge.net/roundup/roundup/CHANGES.txt?revision=1.939&view=markup; http://secunia.com/advisories/29336; http://secunia.com/advisories/29375
CVE: CVE-2008-1475
Published: 2008-03-24
Description: The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/29336; http://secunia.com/advisories/29375; http://secunia.com/advisories/30274
CVE: CVE-2008-1476
Published: 2008-03-24
Description: Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.s9y.org/archives/192-Serendipity-1.3-released-addresses-security.html; http://secunia.com/advisories/29398; http://secunia.com/advisories/29502
CVE: CVE-2008-1477
Published: 2008-03-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in busca.php in eForum 0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) busca and (2) link parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://omni.playhack.net/blog/?p=10; http://secunia.com/advisories/29380; http://securityreason.com/securityalert/3767
CVE: CVE-2008-1478
Published: 2008-03-24
Description: Home FTP Server 1.4.5.89 allows remote attackers to cause a denial of service (crash) by opening a FTP passive mode connection, then closing the original FTP connection.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/29419; http://securityreason.com/securityalert/3766; http://www.securityfocus.com/archive/1/489706/100/0/threaded
CVE: CVE-2008-1479
Published: 2008-03-24
Description: Cross-site scripting (XSS) vulnerability in index.php in cyberfrogs.net cfnetgs 0.24 allows remote attackers to inject arbitrary web script or HTML via the directory parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28267; https://exchange.xforce.ibmcloud.com/vulnerabilities/41391; http://www.securityfocus.com/bid/28267
CVE: CVE-2008-1480
Published: 2008-03-24
Description: rpc.metad in Sun Solaris 10 allows remote attackers to cause a denial of service (daemon crash) via a malformed RPC request.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/29418; http://sunsolve.sun.com/search/document.do?assetkey=1-26-249146-1; http://support.avaya.com/elmodocs2/security/ASA-2009-015.htm
CVE: CVE-2008-1481
Published: 2008-03-24
Description: Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the board parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28294; http://www.securityfocus.com/bid/28294/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/41417
CVE: CVE-2008-1482
Published: 2008-03-24
Description: Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via (1) a crafted .FLV file, which triggers an overflow in demuxers/demux_flv.c; (2) a crafted .MOV file, which triggers an overflow in demuxers/demux_qt.c; (3) a crafted .RM file, which triggers an overflow in demuxers/demux_real.c; (4) a crafted .MVE file, which triggers an overflow in demuxers/demux_wc3movie.c; (5) a crafted .MKV file, which triggers an overflow in demuxers/ebml.c; or (6) a crafted .CAK file, which triggers an overflow in demuxers/demux_film.c.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119, CWE-189
References: http://aluigi.altervista.org/adv/xinehof-adv.txt; http://aluigi.org/poc/xinehof.zip; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html
CVE: CVE-2007-6711
Published: 2008-03-24
Description: Unspecified vulnerability in customer.php in FreeWebshop.org 2.2.5, 2.2.6 and 2.2.7WIP1/2 allows remote attackers to gain administrator privileges via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/43804; http://www.freewebshop.org/?Downloads:Fixes; http://www.freewebshop.org/?News
CVE: CVE-2008-1483
Published: 2008-03-24
Description: OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-005.txt.asc; http://aix.software.ibm.com/aix/efixes/security/ssh_advisory.asc; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463011
CVE: CVE-2008-1484
Published: 2008-03-24
Description: The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account.  NOTE: this issue might be related to CVE-2006-5737.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://osvdb.org/45561; http://punbb.org/download/changelogs/1.2.16_to_1.2.17.txt; http://punbb.org/forums/viewtopic.php?id=18460
CVE: CVE-2008-1485
Published: 2008-03-24
Description: Cross-site scripting (XSS) vulnerability in PunBB 1.2.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the get_host parameter to moderate.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/45561; http://punbb.org/download/changelogs/1.2.16_to_1.2.17.txt; http://secunia.com/advisories/29043
CVE: CVE-2008-1486
Published: 2008-03-24
Description: SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29519; http://www.phorum.org/phorum5/read.php?64%2C126815%2C126815; http://www.securityfocus.com/bid/28540
CVE: CVE-2008-1487
Published: 2008-03-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via (1) ftp/index.php, (2) viewer.php, (3) functions/other.php, (4) include/left_menu.class.php, and (5) plugins/stats/stats_view.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://linpha.cvs.sourceforge.net/linpha/linpha/ChangeLog?view=markup; http://linpha.sourceforge.net/wiki/index.php/Release_Notes#Version_1.3.3; http://secunia.com/advisories/29525
CVE: CVE-2008-1488
Published: 2008-03-24
Description: Stack-based buffer overflow in apc.c in Alternative PHP Cache (APC) 3.0.11 through 3.0.16 allows remote attackers to execute arbitrary code via a long filename.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://papasian.org/~dannyp/apcsmash.php.txt; http://pecl.php.net/bugs/bug.php?id=13415; http://secunia.com/advisories/29509
CVE: CVE-2008-1160
Published: 2008-03-25
Description: ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows remote attackers to gain privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.org/0803-exploits/ZyWALL.pdf; http://secunia.com/advisories/29237; http://www.secumania.org/exploits/remote/zyxel-zywall-quagga_zebra-%28default-pass%29-remote-root-vulnerability[PII_REDACTED]791/
CVE: CVE-2008-1489
Published: 2008-03-25
Description: Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF box that triggers a heap-based buffer overflow, a different vulnerability than CVE-2008-0984.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/29503; http://secunia.com/advisories/29766; http://secunia.com/advisories/29800
CVE: CVE-2008-1092
Published: 2008-03-25
Description: Buffer overflow in msjet40.dll before 4.0.9505.0 in Microsoft Jet Database Engine allows remote attackers to execute arbitrary code via a crafted Word file, as exploited in the wild in March 2008.  NOTE: as of 20080513, Microsoft has stated that this is the same issue as CVE-2007-6026.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3574&w=2; http://www.kb.cert.org/vuls/id/936529; http://www.microsoft.com/technet/security/advisory/950627.mspx
CVE: CVE-2008-1490
Published: 2008-03-25
Description: Buffer overflow in a certain Aurigma ActiveX control in ImageUploader4.ocx 4.1.36.0, as used with Piczo (aka Pizco) and possibly other online services, allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a long Action property, a different CLSID than CVE-2008-0659.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3813&w=2; http://secunia.com/advisories/29445; http://www.securityfocus.com/bid/28354
CVE: CVE-2008-1491
Published: 2008-03-25
Description: Stack-based buffer overflow in the DPC Proxy server (DpcProxy.exe) in ASUS Remote Console (aka ARC or ASMB3) 2.0.0.19 and 2.0.0.24 allows remote attackers to execute arbitrary code via a long string to TCP port 623.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/asuxdpc-adv.txt; http://secunia.com/advisories/29402; http://securityreason.com/securityalert/3771
CVE: CVE-2008-1492
Published: 2008-03-25
Description: Multiple directory traversal vulnerabilities in CoronaMatrix phpAddressBook 2.11 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter to (1) index.php and (2) install.php.  NOTE: it was later reported that vector 1 is also present in 2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://0x90.com.ar/Advisory/20080321.txt; http://secunia.com/advisories/29514; http://securityreason.com/securityalert/3772
CVE: CVE-2008-1493
Published: 2008-03-25
Description: Directory traversal vulnerability in login.php in Cuteflow Bin 1.5.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/490055/100/0/threaded; http://www.securityfocus.com/bid/28419; https://exchange.xforce.ibmcloud.com/vulnerabilities/41392
CVE: CVE-2008-1494
Published: 2008-03-25
Description: SQL injection vulnerability in inc/module/online.php in Easy-Clanpage 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a user details action, a different vector than CVE-2008-1425.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3773; http://www.securityfocus.com/archive/1/489888/100/0/threaded; http://www.securityfocus.com/bid/28329
CVE: CVE-2008-1495
Published: 2008-03-25
Description: Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modified content type in an ajout action, as demonstrated by (1) image/gif and (2) application/pdf.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://realn.free.fr/releases/70207; http://secunia.com/advisories/29466; http://www.securityfocus.com/bid/28346
CVE: CVE-2008-1496
Published: 2008-03-25
Description: Multiple SQL injection vulnerabilities in PEEL, possibly 3.x and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to (a) membre.php, and the (2) timestamp parameter to (b) the details action in achat/historique_commandes.php and (c) the facture action in factures/facture_html.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://realn.free.fr/releases/70207; http://secunia.com/advisories/29466; http://www.securityfocus.com/bid/28346
CVE: CVE-2008-1497
Published: 2008-03-25
Description: Stack-based buffer overflow in the IMAP service in NetWin SurgeMail 38k4-4 and earlier allows remote authenticated users to execute arbitrary code via long arguments to the LSUB command.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29105; http://securityreason.com/securityalert/3774; http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-03-07
CVE: CVE-2008-1498
Published: 2008-03-25
Description: Stack-based buffer overflow in the IMAP service in NetWin Surgemail 3.8k4-4 and earlier allows remote authenticated users to execute arbitrary code via a long first argument to the LIST command.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29105; http://www.netwinsite.com/surgemail/help/updates.htm; http://www.securityfocus.com/bid/28260
CVE: CVE-2008-1499
Published: 2008-03-25
Description: Cross-site scripting (XSS) vulnerability in frontend/x/manpage.html in cPanel 11.18.3 and 11.21.0-BETA allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3775; http://www.securityfocus.com/archive/1/489963/100/0/threaded; http://www.securityfocus.com/bid/28403
CVE: CVE-2008-1500
Published: 2008-03-25
Description: Cross-site scripting (XSS) vulnerability in index.php in TinyPortal 0.8.6 and 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28402; https://exchange.xforce.ibmcloud.com/vulnerabilities/41376; http://www.securityfocus.com/bid/28402