deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0294
Published: 2008-01-16
Description: Unspecified vulnerability in the seat-locking implementation in FreeSeat before 1.1.5d allows attackers to book a seat more than once via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/28459; http://sourceforge.net/project/shownotes.php?release_id=568374&group_id=160239; http://www.securityfocus.com/bid/27270
CVE: CVE-2008-0295
Published: 2008-01-16
Description: Heap-based buffer overflow in modules/access/rtsp/real_sdpplin.c in the Xine library, as used in VideoLAN VLC Media Player 0.8.6d and earlier, allows user-assisted remote attackers to cause a denial of service (crash) or execute arbitrary code via long Session Description Protocol (SDP) data.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/vlcxhof-adv.txt; http://secunia.com/advisories/28383; http://secunia.com/advisories/29284
CVE: CVE-2008-0296
Published: 2008-01-16
Description: Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows might allow remote RTSP servers to cause a denial of service (application crash) or execute arbitrary code via a long string.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/vlcxhof-adv.txt; http://secunia.com/advisories/29284; http://secunia.com/advisories/29766
CVE: CVE-2008-0081
Published: 2008-01-16
Description: Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted macros, aka "Macro Validation Vulnerability," a different vulnerability than CVE-2007-3490.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908, CWE-908
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7305&w=2; http://secunia.com/advisories/28506; http://securitytracker.com/id?1019200
CVE: CVE-2008-0297
Published: 2008-01-16
Description: PhotoKorn allows remote attackers to obtain database credentials via a direct request to update/update3.php, which includes the credentials in its output.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/39652; https://www.exploit-db.com/exploits/4897; https://exchange.xforce.ibmcloud.com/vulnerabilities/39652
CVE: CVE-2008-0298
Published: 2008-01-16
Description: KHTML WebKit as used in Apple Safari 2.x allows remote attackers to cause a denial of service (browser crash) via a crafted web page, possibly involving a STYLE attribute of a DIV element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/3549; http://www.s21sec.com/avisos/s21sec-039-en.txt; http://www.securityfocus.com/archive/1/486202/100/0/threaded
CVE: CVE-2008-0299
Published: 2008-01-16
Description: common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706; http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch; http://secunia.com/advisories/28488
CVE: CVE-2008-0188
Published: 2008-01-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its requester.  Further investigation showed that it was not a new security issue.  Notes: none
CVE: CVE-2008-0189
Published: 2008-01-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its requester.  Further investigation showed that it was not a new security issue.  Notes: none
CVE: CVE-2007-6681
Published: 2008-01-17
Description: Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via a long subtitle in a (1) MicroDvd, (2) SSA, and (3) Vplayer file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/vlcboffs-adv.txt; http://mailman.videolan.org/pipermail/vlc-devel/2007-June/032672.html; http://mailman.videolan.org/pipermail/vlc-devel/2007-June/033394.html
CVE: CVE-2007-6682
Published: 2008-01-17
Description: Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via format string specifiers in the Connection parameter.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/vlcboffs-adv.txt; http://osvdb.org/42208; http://secunia.com/advisories/28233
CVE: CVE-2007-6683
Published: 2008-01-17
Description: The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.
CVSS Score: 5.0 (MEDIUM)
References: http://mailman.videolan.org/pipermail/vlc-devel/2007-December/037726.html; http://osvdb.org/42205; http://osvdb.org/42206
CVE: CVE-2007-6684
Published: 2008-01-17
Description: The RTSP module in VideoLAN VLC 0.8.6d allows remote attackers to cause a denial of service (crash) via a request without a Transport parameter, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://mailman.videolan.org/pipermail/vlc-devel/2007-September/034722.html; http://secunia.com/advisories/29284; http://trac.videolan.org/vlc/changeset/22023
CVE: CVE-2007-6685
Published: 2008-01-17
Description: Unspecified vulnerability in the Publish XP module Menalto Gallery before 2.2.4 allows attackers to create albums and upload files via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://bugs.gentoo.org/show_bug.cgi?id=203217; http://gallery.menalto.com/gallery_2.2.4_released; http://osvdb.org/41675
CVE: CVE-2007-6686
Published: 2008-01-17
Description: The URL rewrite module in Menalto Gallery before 2.2.4 allows attackers to include and execute arbitrary local files via unknown vectors related to the admin controller.
CVSS Score: 10.0 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=203217; http://gallery.menalto.com/gallery_2.2.4_released; http://osvdb.org/41674
CVE: CVE-2007-6687
Published: 2008-01-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Menalto Gallery before 2.2.4 allow remote attackers to inject arbitrary web script or HTML via crafted filenames to the (1) Core or (2) add-item modules; or via (3) HTTP PROPPATCH in the WebDAV module.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.gentoo.org/show_bug.cgi?id=203217; http://gallery.menalto.com/gallery_2.2.4_released; http://osvdb.org/41671
CVE: CVE-2007-6688
Published: 2008-01-17
Description: Unspecified vulnerability in the Installation application in Menalto Gallery before 2.2.4 has unknown impact and attack vectors related to "web-accessibility protection of the storage folder."
CVSS Score: 10.0 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=203217; http://gallery.menalto.com/gallery_2.2.4_released; http://osvdb.org/41670
CVE: CVE-2007-6689
Published: 2008-01-17
Description: Menalto Gallery before 2.2.4 does not properly check for malicious file extensions during file uploads, which allows attackers to execute arbitrary code via the (1) Core application or (2) MIME module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=203217; http://gallery.menalto.com/gallery_2.2.4_released; http://osvdb.org/41669
CVE: CVE-2007-6690
Published: 2008-01-17
Description: The Gallery Remote module in Menalto Gallery before 2.2.4 does not check permissions for unspecified GR commands, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://bugs.gentoo.org/show_bug.cgi?id=203217; http://gallery.menalto.com/gallery_2.2.4_released; http://osvdb.org/41668
CVE: CVE-2007-6691
Published: 2008-01-17
Description: Multiple unspecified vulnerabilities in Menalto Gallery before 2.2.4 have unknown impact, related to (1) "hotlink protection" in the URL rewrite module, (2) a WebDAV view in the WebDAV module, (3) a comment view in the Comment module, (4) unspecified "item information disclosure attacks" in the Core module Gallery application, (5) the slideshow in the Slideshow module, and (6) multiple Print modules.
CVSS Score: 10.0 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=203217; http://gallery.menalto.com/gallery_2.2.4_released; http://osvdb.org/41662
CVE: CVE-2007-6692
Published: 2008-01-17
Description: Open redirect vulnerability in Menalto Gallery before 2.2.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) Core and (2) print modules.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-59
References: http://bugs.gentoo.org/show_bug.cgi?id=203217; http://gallery.menalto.com/gallery_2.2.4_released; http://osvdb.org/41660
CVE: CVE-2007-6693
Published: 2008-01-17
Description: Unspecified vulnerability in the WebCam module in Menalto Gallery before 2.2.4 has unknown impact and attack vectors related to a "proxied request."
CVSS Score: 10.0 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=203217; http://gallery.menalto.com/gallery_2.2.4_released; http://osvdb.org/41659
CVE: CVE-2008-0302
Published: 2008-01-17
Description: Untrusted search path vulnerability in apt-listchanges.py in apt-listchanges before 2.82 allows local users to execute arbitrary code via a malicious apt-listchanges program in the current working directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://git.madism.org/?p=apt-listchanges.git%3Ba=commitdiff%3Bh=1bcfbf3dc55413bb83a1782dc9a54515a963fb32; http://packages.debian.org/changelogs/pool/main/a/apt-listchanges/apt-listchanges_2.82/changelog; http://secunia.com/advisories/28513
CVE: CVE-2008-0027
Published: 2008-01-17
Description: Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM) 4.2 before 4.2(3)SR3 and 4.3 before 4.3(1)SR1, and CallManager 4.0 and 4.1 before 4.1(3)SR5c, allows remote attackers to cause a denial of service or execute arbitrary code via a long request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-08-02; http://secunia.com/advisories/28530; http://securityreason.com/securityalert/3551
CVE: CVE-2008-0324
Published: 2008-01-17
Description: Cisco Systems VPN Client IPSec Driver (CVPNDRVA.sys) 5.0.02.0090 allows local users to cause a denial of service (crash) by calling the 0x80002038 IOCTL with a small size value, which triggers memory corruption.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/28472; http://www.securityfocus.com/bid/27289; http://www.securitytracker.com/id?1019240
CVE: CVE-2008-0325
Published: 2008-01-17
Description: SQL injection vulnerability in show.php in FaScript FaPersian Petition allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28522; http://www.securityfocus.com/bid/27302; https://exchange.xforce.ibmcloud.com/vulnerabilities/39716
CVE: CVE-2008-0326
Published: 2008-01-17
Description: SQL injection vulnerability in class/show.php in FaScript FaPersianHack 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to show.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28565; http://www.securityfocus.com/bid/27302; https://exchange.xforce.ibmcloud.com/vulnerabilities/39717
CVE: CVE-2008-0327
Published: 2008-01-17
Description: SQL injection vulnerability in show.php in FaScript FaMp3 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/40330; http://secunia.com/advisories/28566; http://www.securityfocus.com/bid/27302
CVE: CVE-2008-0328
Published: 2008-01-17
Description: SQL injection vulnerability in page.php in FaScript FaName 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28528; http://www.securityfocus.com/bid/27303; https://exchange.xforce.ibmcloud.com/vulnerabilities/39715
CVE: CVE-2008-0329
Published: 2008-01-17
Description: LulieBlog 1.0.1 and 1.0.2 does not restrict access to (1) article_suppr.php, (2) comment_accepter.php, and (3) comment_refuser.php in Admin/, which allows remote attackers to accept comments, delete comments, and delete articles via the id parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28432; http://www.securityfocus.com/bid/27290; https://exchange.xforce.ibmcloud.com/vulnerabilities/39669
CVE: CVE-2008-0330
Published: 2008-01-17
Description: Open System Consultants (OSC) Radiator before 4.0 allows remote attackers to cause a denial of service (daemon crash) via malformed RADIUS requests, as demonstrated by packets sent by nmap.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/28463; http://www.open.com.au/radiator/history.html; http://www.securityfocus.com/bid/27306
CVE: CVE-2008-0331
Published: 2008-01-17
Description: Unspecified vulnerability in Funkwerk System Software before 7.4.1 PATCH 9 for certain Funkwerk Router / VPN devices allows remote attackers to cause a denial of service (panic and reboot) via unspecified DNS requests.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/42782; http://secunia.com/advisories/28085; http://www.funkwerk-ec.com/portal/downloadcenter/dateien/x2300/r7401p09/readme_741p9_en.pdf
CVE: CVE-2008-0332
Published: 2008-01-17
Description: Directory traversal vulnerability in arias/help/effect.php in aria 0.99-6 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/486406/100/0/threaded; http://www.securityfocus.com/bid/27311; https://exchange.xforce.ibmcloud.com/vulnerabilities/39712
CVE: CVE-2008-0333
Published: 2008-01-17
Description: Directory traversal vulnerability in download_view_attachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers to read arbitrary files via a .. (dot dot) in the temp_filename parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28521; http://www.securityfocus.com/bid/27312; https://exchange.xforce.ibmcloud.com/vulnerabilities/39724
CVE: CVE-2008-0334
Published: 2008-01-17
Description: Cross-site scripting (XSS) vulnerability in pm/language/spanish/preferences.php in PMachine Pro 2.4.1 allows remote attackers to inject arbitrary web script or HTML via the L_PREF_NAME[855] parameter.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.org/0801-exploits/pMachinePro-241-xss.txt; http://www.securityfocus.com/bid/27282; http://packetstormsecurity.org/0801-exploits/pMachinePro-241-xss.txt
CVE: CVE-2008-0335
Published: 2008-01-17
Description: Cross-site scripting (XSS) vulnerability in BugTracker.NET before 2.7.2 allows remote attackers to inject arbitrary web script or HTML via an arbitrary custom text field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28481; http://sourceforge.net/project/shownotes.php?release_id=568160; http://sourceforge.net/tracker/index.php?func=detail&aid=1867089&group_id=66812&atid=515837
CVE: CVE-2008-0336
Published: 2008-01-17
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in BugTracker.NET before 2.7.2 allow remote attackers to delete arbitrary bugs and perform other administrative tasks via unspecified vectors, possibly related to delete_*.aspx pages, and massedit.aspx, subscribe.aspx, flag.aspx, and relationships.aspx.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/28481; http://sourceforge.net/project/shownotes.php?group_id=66812&release_id=568160; http://sourceforge.net/tracker/index.php?func=detail&aid=1867089&group_id=66812&atid=515837
CVE: CVE-2008-0337
Published: 2008-01-17
Description: Heap-based buffer overflow in the _mwProcessReadSocket function in http.c in MiniWeb HTTP Server 0.8.19 allows remote attackers to execute arbitrary code via a long URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28512; http://www.bugtraq.ir/adv/miniweb_english.pdf; http://www.securityfocus.com/bid/27319
CVE: CVE-2008-0338
Published: 2008-01-17
Description: Directory traversal vulnerability in the mwGetLocalFileName function in http.c in MiniWeb HTTP Server 0.8.19 allows remote attackers to read arbitrary files and list arbitrary directories via a (1) .%2e (partially encoded dot dot) or (2) %2e%2e (encoded dot dot) in the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28512; http://www.bugtraq.ir/adv/miniweb_english.pdf; http://www.securityfocus.com/bid/27319
CVE: CVE-2008-0171
Published: 2008-01-17
Description: regex/v4/perl_matcher_non_recursive.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (failed assertion and crash) via an invalid regular expression.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=205955; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html; http://secunia.com/advisories/28511
CVE: CVE-2008-0172
Published: 2008-01-17
Description: The get_repeat_type function in basic_regex_creator.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (NULL dereference and crash) via an invalid regular expression.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=205955; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html; http://secunia.com/advisories/28511
CVE: CVE-2008-0339
Published: 2008-01-17
Description: Unspecified vulnerability in the XML DB component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 has unknown impact and remote attack vectors, aka DB01.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-0340
Published: 2008-01-17
Description: Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 have unknown impact and remote attack vectors, related to the (1) Advanced Queuing component (DB02) and (2) Oracle Spatial component (DB04).
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-0341
Published: 2008-01-17
Description: Unspecified vulnerability in the Advanced Queuing component in Oracle Database 9.0.1.5 FIPS+ and 10.1.0.5 has unknown impact and remote attack vectors, aka DB03.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-0342
Published: 2008-01-17
Description: Unspecified vulnerability in the Upgrade/Downgrade component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and remote attack vectors, aka DB05.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-0343
Published: 2008-01-17
Description: Unspecified vulnerability in the Oracle Spatial component in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 has unknown impact and remote attack vectors, aka DB06.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-0344
Published: 2008-01-17
Description: Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.3 has unknown impact and remote attack vectors, aka DB07.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-0345
Published: 2008-01-17
Description: Unspecified vulnerability in the Core RDBMS component in Oracle Database 11.1.0.6 has unknown impact and remote attack vectors, aka DB08.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-0346
Published: 2008-01-17
Description: Unspecified vulnerability in the Oracle Jinitiator component in Oracle Application Server 1.3.1.27 and E-Business Suite 11.5.10.2 has unknown impact and remote attack vectors, aka AS01.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://osvdb.org/40294; http://secunia.com/advisories/28518
CVE: CVE-2008-0347
Published: 2008-01-17
Description: Unspecified vulnerability in the Oracle Ultra Search component in Oracle Collaboration Suite 10.1.2; Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; and Application Server 9.0.4.3 and 10.1.2.0.2; has unknown impact and local attack vectors, aka OCS01.  NOTE: Oracle has not disputed a reliable claim that this issue is related to WKSYS schema privileges.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-0348
Published: 2008-01-17
Description: Multiple unspecified vulnerabilities in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.22.18, 8.48.15, and 8.49.07 have unknown impact and remote attack vectors, aka (1) PSE01, (2) PSE03, and (3) PSE04.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-0349
Published: 2008-01-17
Description: Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.15 and 8.49.07 has unknown impact and remote attack vectors, aka PSE02.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-0350
Published: 2008-01-18
Description: admin/index.php in Evilsentinel 1.0.9 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to gain administrative privileges and make arbitrary configuration changes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://evilsentinel.altervista.org/forum/index.php?topic=49.0; http://secunia.com/advisories/28427; http://www.securityfocus.com/bid/27227
CVE: CVE-2008-0351
Published: 2008-01-18
Description: admin/config.php in Evilsentinel 1.0.9 and earlier allows remote attackers to bypass the CAPTCHA test by omitting the es_security_captcha parameter and not invoking captcha.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/27227; https://www.exploit-db.com/exploits/4884; http://www.securityfocus.com/bid/27227
CVE: CVE-2008-0352
Published: 2008-01-18
Description: The Linux kernel 2.6.20 through 2.6.21.1 allows remote attackers to cause a denial of service (panic) via a certain IPv6 packet, possibly involving the Jumbo Payload hop-by-hop option (jumbogram).
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://bugzilla.kernel.org/show_bug.cgi?id=8450; http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.21.2; https://exchange.xforce.ibmcloud.com/vulnerabilities/39643