deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2771
Published: 2008-06-18
Description: The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attackers with "access content" permissions to bypass restrictions and modify the node hierarchy via unspecified attack vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/269473; http://secunia.com/advisories/30622; http://www.securityfocus.com/bid/29675
CVE: CVE-2008-2772
Published: 2008-06-18
Description: The Magic Tabs module 5.x before 5.x-1.1 for Drupal allows remote attackers to execute arbitrary PHP code via unspecified URL arguments, possibly related to a missing "whitelist of callbacks."
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://drupal.org/node/269321; http://secunia.com/advisories/30632; http://www.securityfocus.com/bid/29682
CVE: CVE-2008-2773
Published: 2008-06-18
Description: Cross-site scripting (XSS) vulnerability in the Taxonomy Image module 5.x before 5.x-1.3 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/269389; http://secunia.com/advisories/30631; http://www.securityfocus.com/bid/29683
CVE: CVE-2008-2774
Published: 2008-06-19
Description: SQL injection vulnerability in item.php in CartKeeper CKGold Shopping Cart 2.5 and 2.7 allows remote attackers to execute arbitrary SQL commands via the category_id parameter, a different vector than CVE-2007-4736.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30392; http://www.vupen.com/english/advisories/2008/1677; https://exchange.xforce.ibmcloud.com/vulnerabilities/42646
CVE: CVE-2008-2775
Published: 2008-06-19
Description: SQL injection vulnerability in search.asp in DT Centrepiece 4.0 allows remote attackers to execute arbitrary SQL commands via the searchFor parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30382; http://www.securityfocus.com/bid/29403; https://exchange.xforce.ibmcloud.com/vulnerabilities/42663
CVE: CVE-2008-2776
Published: 2008-06-19
Description: Cross-site scripting (XSS) vulnerability in search.asp in DT Centrepiece 4.0 allows remote attackers to inject arbitrary web script or HTML via the searchFor parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30382; http://www.securityfocus.com/bid/29403; https://exchange.xforce.ibmcloud.com/vulnerabilities/42662
CVE: CVE-2008-2777
Published: 2008-06-19
Description: Cross-site scripting (XSS) vulnerability in Ortro before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30398; http://www.ortro.net/changelog#release_1.3.1_2008.05.27; http://www.vupen.com/english/advisories/2008/1679/references
CVE: CVE-2008-2778
Published: 2008-06-19
Description: SQL injection vulnerability in inc/class_search.php in the Search System in RevokeBB 1.0 RC11 allows remote attackers to execute arbitrary SQL commands via the search parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29393; http://www.vupen.com/english/advisories/2008/1676/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/42647
CVE: CVE-2008-2779
Published: 2008-06-19
Description: Directory traversal vulnerability in GlobalSCAPE CuteFTP Home 8.2.0 Build 02.26.2008.4 and CuteFTP Pro 8.2.0 Build 04.01.2008.1 allows remote FTP servers to create or overwrite arbitrary files via ..\ (dot dot backslash) sequences in responses to LIST commands, a related issue to CVE-2002-1345.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/29760; http://vuln.sg/cuteftp820-en.html; http://www.securitytracker.com/id?1020113
CVE: CVE-2008-2780
Published: 2008-06-19
Description: The Anubis (aka Anubis+Ripe160) plugin before 1.3 for encrypt stores the unencrypted file's size in cleartext in the header of the encrypted file, which allows attackers to distinguish between encrypted data and random padding at the end of the encrypted file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/30388; http://www.vupen.com/english/advisories/2008/1663/references; https://albinoloverats.net/index.php?option=com_content&task=view&id=60&Itemid=2
CVE: CVE-2008-2781
Published: 2008-06-19
Description: SQL injection vulnerability in index.php in DZOIC Handshakes 3.5 allows remote attackers to execute arbitrary SQL commands via the fname parameter in a members search action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3954; http://www.securityfocus.com/archive/1/492556/100/0/threaded; http://www.securityfocus.com/bid/29353
CVE: CVE-2008-2782
Published: 2008-06-19
Description: Multiple directory traversal vulnerabilities in OtomiGenX 2.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to (1) library_rss.php and (2) rss.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-200
References: http://sourceforge.net/forum/forum.php?forum_id=834373; http://www.vupen.com/english/advisories/2008/1678/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/42665
CVE: CVE-2008-2783
Published: 2008-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow remote attackers to inject arbitrary web script or HTML via the timestamp parameter to (1) week.php, (2) workweek.php, and (3) day.php; and (4) the horde parameter in the PATH_INFO to the default URI.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29365; https://exchange.xforce.ibmcloud.com/vulnerabilities/42640; http://www.securityfocus.com/bid/29365
CVE: CVE-2008-2784
Published: 2008-06-19
Description: The smtp_filter function in spamdyke before 3.1.8 does not filter RCPT commands after encountering the first DATA command, which allows remote attackers to use the server as an open mail relay by sending RCPT commands with invalid recipients, followed by a DATA command, followed by arbitrary RCPT commands and a second DATA command.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30408; http://www.spamdyke.org/documentation/Changelog.txt; http://www.vupen.com/english/advisories/2008/1684/references
CVE: CVE-2008-2785
Published: 2008-06-19
Description: Mozilla Firefox before 2.0.0.16 and 3.x before 3.0.1, Thunderbird before 2.0.0.16, and SeaMonkey before 1.1.11 use an incorrect integer data type as a CSS object reference counter in the CSSValue array (aka nsCSSValue:Array) data structure, which allows remote attackers to execute arbitrary code via a large number of references to a common CSS object, leading to a counter overflow and a free of in-use memory, aka ZDI-CAN-349.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://blog.mozilla.com/security/2008/06/18/new-security-issue-under-investigation/; http://dvlabs.tippingpoint.com/blog/2008/06/18/vulnerability-in-mozilla-firefox-30; http://rhn.redhat.com/errata/RHSA-2008-0616.html
CVE: CVE-2008-2786
Published: 2008-06-19
Description: Buffer overflow in Firefox 3.0 and 2.0.x has unknown impact and attack vectors.  NOTE: due to lack of details as of 20080619, it is not clear whether this is the same issue as CVE-2008-2785.  A CVE identifier has been assigned for tracking purposes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-June/062832.html; http://www.securityfocus.com/bid/29794; https://exchange.xforce.ibmcloud.com/vulnerabilities/43317
CVE: CVE-2008-2665
Published: 2008-06-20
Description: Directory traversal vulnerability in the posix_access function in PHP 5.2.6 and earlier allows remote attackers to bypass safe_mode restrictions via a .. (dot dot) in an http URL, which results in the URL being canonicalized to a local filename after the safe_mode check has successfully run.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1607&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1762&w=2
CVE: CVE-2008-2666
Published: 2008-06-20
Description: Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1607&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1762&w=2
CVE: CVE-2008-2787
Published: 2008-06-20
Description: Cross-site scripting (XSS) vulnerability in out.php in OpenDocMan 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the last_message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30750; http://securityreason.com/securityalert/3948; http://www.s21sec.com/avisos/s21sec-044-en.txt
CVE: CVE-2008-2788
Published: 2008-06-20
Description: Cross-site scripting (XSS) vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30750; http://sourceforge.net/tracker/index.php?func=detail&aid=1975163&group_id=69505&atid=524753; http://secunia.com/advisories/30750
CVE: CVE-2008-2789
Published: 2008-06-20
Description: SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/basiccms-sqlxss.txt; http://secunia.com/advisories/30645; http://www.securityfocus.com/bid/29771
CVE: CVE-2008-2790
Published: 2008-06-20
Description: SQL injection vulnerability in detail.php in MountainGrafix easyTrade 2.x allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30673; http://shop.mountaingrafix.at/media/patches/etv_patch_2_3_2.zip; http://www.securityfocus.com/bid/29775
CVE: CVE-2008-2791
Published: 2008-06-20
Description: SQL injection vulnerability in product.detail.php in Kalptaru Infotech Comparison Engine Power Script 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30729; http://www.securityfocus.com/bid/29768; https://exchange.xforce.ibmcloud.com/vulnerabilities/43138
CVE: CVE-2008-2792
Published: 2008-06-20
Description: SQL injection vulnerability in index.php in eroCMS 1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the site parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30723; http://www.securityfocus.com/bid/29781; https://exchange.xforce.ibmcloud.com/vulnerabilities/43157
CVE: CVE-2008-2793
Published: 2008-06-20
Description: SQL injection vulnerability in group_posts.php in ClipShare before 3.0.1 allows remote attackers to execute arbitrary SQL commands via the tid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28313; http://www.securityfocus.com/bid/29779; https://exchange.xforce.ibmcloud.com/vulnerabilities/43142
CVE: CVE-2008-2794
Published: 2008-06-20
Description: Unspecified vulnerability in the GUI in Symantec Altiris Notification Server Agent 6.x before 6.0 SP3 R8 allows local users to gain privileges via unknown attack vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30741; http://securityresponse.symantec.com/avcenter/security/Content/2008.06.17.html; http://www.securityfocus.com/bid/29708
CVE: CVE-2008-2795
Published: 2008-06-20
Description: Directory traversal vulnerability in the FTP and SFTP clients in IDM Computer Solutions Inc UltraEdit 14.00b allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) or a ..\ (dot dot backslash) in a response to a LIST command.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30749; http://vuln.sg/ultraedit1400b-en.html; http://www.securityfocus.com/bid/29784
CVE: CVE-2008-2796
Published: 2008-06-20
Description: SQL injection vulnerability in index.php in FreeCMS 0.2 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3973; http://www.securityfocus.com/bid/29773; https://exchange.xforce.ibmcloud.com/vulnerabilities/43141
CVE: CVE-2008-2797
Published: 2008-06-20
Description: Cross-site scripting (XSS) vulnerability in MainLayout.do in ManageEngine OpUtils 5.0 allows remote attackers to inject arbitrary web script or HTML via the hostName parameter, when viewing an SNMP graph.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30745; http://www.securityfocus.com/bid/29785; https://exchange.xforce.ibmcloud.com/vulnerabilities/43158
CVE: CVE-2008-2813
Published: 2008-06-23
Description: Directory traversal vulnerability in index.php in WallCity-Server Shoutcast Admin Panel 2.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30678; http://www.securityfocus.com/bid/29733; https://exchange.xforce.ibmcloud.com/vulnerabilities/43109
CVE: CVE-2008-2814
Published: 2008-06-23
Description: Cross-site scripting (XSS) vulnerability in WallCity-Server Shoutcast Admin Panel 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter to the login interface.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30678; https://exchange.xforce.ibmcloud.com/vulnerabilities/43108; http://secunia.com/advisories/30678
CVE: CVE-2008-2815
Published: 2008-06-23
Description: SQL injection vulnerability in shopping/index.php in MyMarket 1.72 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30692; http://www.securityfocus.com/bid/29754; https://exchange.xforce.ibmcloud.com/vulnerabilities/43117
CVE: CVE-2008-2816
Published: 2008-06-23
Description: SQL injection vulnerability in post.php in Oxygen (aka O2PHP Bulletin Board) 2.0 allows remote attackers to execute arbitrary SQL commands via the repquote parameter in a reply action, a different vector than CVE-2006-1572.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29729; https://exchange.xforce.ibmcloud.com/vulnerabilities/43113; https://www.exploit-db.com/exploits/5828
CVE: CVE-2008-2817
Published: 2008-06-23
Description: SQL injection vulnerability in albums.php in NiTrO Web Gallery 1.4.3 and earlier allows remote attackers to execute arbitrary SQL commands via the CatId parameter in a show action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29753; https://exchange.xforce.ibmcloud.com/vulnerabilities/43100; https://www.exploit-db.com/exploits/5830
CVE: CVE-2008-2818
Published: 2008-06-23
Description: Directory traversal vulnerability in Easy-Clanpage 3.0 b1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the section parameter to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29707; https://exchange.xforce.ibmcloud.com/vulnerabilities/43073; https://www.exploit-db.com/exploits/5801
CVE: CVE-2008-2819
Published: 2008-06-23
Description: SQL injection vulnerability in BlognPlus (BURO GUN +) 2.5.4 and earlier MySQL and PostgreSQL editions allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/jp/JVN14072646/index.html; http://secunia.com/advisories/30642; http://www.blogn.org/index.php?e=170
CVE: CVE-2008-2820
Published: 2008-06-23
Description: Directory traversal vulnerability in lang/lang-system.php in Open Azimyt CMS 0.22 minimal and 0.21 stable allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://open-azimyt-cms.googlecode.com/files/security_patch.zip; http://secunia.com/advisories/30691; http://securityreason.com/securityalert/3955
CVE: CVE-2008-2821
Published: 2008-06-23
Description: Directory traversal vulnerability in the FTP client in Glub Tech Secure FTP before 2.5.16 on Windows allows remote FTP servers to create or overwrite arbitrary files via a ..\ (dot dot backslash) in a response to a LIST command, a related issue to CVE-2002-1345.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30725; http://vuln.sg/glubsecureftp2515-en.html; http://www.securityfocus.com/bid/29741
CVE: CVE-2008-2822
Published: 2008-06-23
Description: Multiple directory traversal vulnerabilities in the FTP client in 3D-FTP Client 8.01 (8.0 build 1) allow remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response to a (1) LIST or (2) MLSD command.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30651; http://vuln.sg/3dftp801-en.html; http://www.3dftp.com/3dftp_versions.htm
CVE: CVE-2008-2823
Published: 2008-06-23
Description: SQL injection vulnerability in newsarchive.php in PHPeasyblog (formerly phpeasynews) 1.13 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the post parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29735; https://exchange.xforce.ibmcloud.com/vulnerabilities/43104; https://www.exploit-db.com/exploits/5820
CVE: CVE-2008-2824
Published: 2008-06-23
Description: Unspecified vulnerability in the Extensible Interface Platform in Web Services in Xerox WorkCentre 7655, 7665, and 7675 allows remote attackers to make configuration changes via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30670; http://www.securityfocus.com/bid/29691; http://www.securitytracker.com/id?1020281
CVE: CVE-2008-2825
Published: 2008-06-23
Description: Cross-site scripting (XSS) vulnerability in the embedded Web Server in Xerox WorkCentre M123, M128, and 133 and WorkCentre Pro 123, 128, and 133 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30669; http://www.securityfocus.com/bid/29689; http://www.securitytracker.com/id?1020280
CVE: CVE-2008-1952
Published: 2008-06-23
Description: The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://lists.xensource.com/archives/html/xen-devel/2008-05/msg00421.html; http://secunia.com/advisories/32088; http://www.openwall.com/lists/oss-security/2008/05/21/9
CVE: CVE-2008-2827
Published: 2008-06-23
Description: The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448 and CVE-2004-0452.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=487319; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html; http://rt.cpan.org/Public/Bug/Display.html?id=36982
CVE: CVE-2008-2828
Published: 2008-06-23
Description: Stack-based buffer overflow in tmsnc allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an MSN packet with a UBX command containing a large UBX payload length field.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=487222; http://secunia.com/advisories/34235; http://security.gentoo.org/glsa/glsa-200903-26.xml
CVE: CVE-2008-2306
Published: 2008-06-23
Description: Apple Safari before 3.1.2 on Windows does not properly interpret the URLACTION_SHELL_EXECUTE_HIGHRISK Internet Explorer zone setting, which allows remote attackers to bypass intended access restrictions, and force a client system to download and execute arbitrary files.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html; http://secunia.com/advisories/30775; http://www.kb.cert.org/vuls/id/127185
CVE: CVE-2008-2307
Published: 2008-06-23
Description: Unspecified vulnerability in WebKit in Apple Safari before 3.1.2, as distributed in Mac OS X before 10.5.4, and standalone for Windows and Mac OS X 10.4, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors involving JavaScript arrays that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html; http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2008//Jun/msg00003.html
CVE: CVE-2008-2829
Published: 2008-06-23
Description: php_imap.c in PHP 5.2.5, 5.2.6, 4.x, and other versions, uses obsolete API calls that allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long IMAP request, which triggers an "rfc822.c legacy routine buffer overflow" error message, related to the rfc822_write_address function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://bugs.php.net/bug.php?id=42862; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html
CVE: CVE-2008-2830
Published: 2008-06-23
Description: Open Scripting Architecture in Apple Mac OS X 10.4.11 and 10.5.4, and some other 10.4 and 10.5 versions, does not properly restrict the loading of scripting addition plugins, which allows local users to gain privileges via scripting addition commands to a privileged application, as originally demonstrated by an osascript tell command to ARDAgent.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://it.slashdot.org/it/08/06/18/1919224.shtml; http://lists.apple.com/archives/security-announce//2008//Sep/msg00006.html; http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html
CVE: CVE-2008-2427
Published: 2008-06-24
Description: Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD allows user-assisted remote attackers to execute arbitrary code via a crafted format keyword in a Sun TAAC file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30416; http://secunia.com/advisories/30789; http://secunia.com/secunia_research/2008-24/advisory/