deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5506
Published: 2008-12-17
Description: Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy by causing the browser to issue an XMLHttpRequest to an attacker-controlled resource that uses a 302 redirect to a resource in a different domain, then reading content from the response, aka "response disclosure."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33184; http://secunia.com/advisories/33188; http://secunia.com/advisories/33189
CVE: CVE-2008-5507
Published: 2008-12-17
Description: Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to bypass the same origin policy and access portions of data from another domain via a JavaScript URL that redirects to the target resource, which generates an error if the target data does not have JavaScript syntax, which can be accessed using the window.onerror DOM API.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-200
References: http://scary.beasts.org/security/CESA-2008-011.html; http://secunia.com/advisories/33184; http://secunia.com/advisories/33188
CVE: CVE-2008-5508
Published: 2008-12-17
Description: Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/33184; http://secunia.com/advisories/33188; http://secunia.com/advisories/33189
CVE: CVE-2008-5510
Published: 2008-12-17
Description: The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 ignores the '\0' escaped null character, which might allow remote attackers to bypass protection mechanisms such as sanitization routines.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/33184; http://secunia.com/advisories/33188; http://secunia.com/advisories/33203
CVE: CVE-2008-5511
Published: 2008-12-17
Description: Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy and conduct cross-site scripting (XSS) attacks via an XBL binding to an "unloaded document."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33184; http://secunia.com/advisories/33188; http://secunia.com/advisories/33189
CVE: CVE-2008-5512
Published: 2008-12-17
Description: Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to run arbitrary JavaScript with chrome privileges via unknown vectors in which "page content can pollute XPCNativeWrappers."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33184; http://secunia.com/advisories/33188; http://secunia.com/advisories/33189
CVE: CVE-2008-5513
Published: 2008-12-17
Description: Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into documents associated with other domains, and conduct cross-site scripting (XSS) attacks via unknown vectors related to restoration of SessionStore data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33184; http://secunia.com/advisories/33188; http://secunia.com/advisories/33189
CVE: CVE-2008-5499
Published: 2008-12-18
Description: Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00006.html; http://osvdb.org/50796; http://secunia.com/advisories/33221
CVE: CVE-2008-5663
Published: 2008-12-19
Description: Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) load_receiver.php or (2) a shipainter action to paint_save.php, then accessing the uploaded file via a direct request to this file in their user directory.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4782; http://www.securityfocus.com/bid/31668; http://www.securityfocus.com/bid/31685
CVE: CVE-2008-5664
Published: 2008-12-19
Description: Stack-based buffer overflow in Realtek Media Player (aka Realtek Sound Manager, RtlRack, or rtlrack.exe) 1.15.0.0 allows remote attackers to execute arbitrary code via a crafted playlist (PLA) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/50715; http://secunia.com/advisories/33183; http://securityreason.com/securityalert/4783
CVE: CVE-2008-5665
Published: 2008-12-19
Description: SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL commands via the no parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4784; http://www.securityfocus.com/bid/31749; https://exchange.xforce.ibmcloud.com/vulnerabilities/45863
CVE: CVE-2008-5666
Published: 2008-12-19
Description: WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of service via a sequence of FTP sessions that include an invalid "NLST -1" command.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: http://secunia.com/advisories/32209; http://securityreason.com/securityalert/4785; http://www.securitytracker.com/id?1021040
CVE: CVE-2008-5667
Published: 2008-12-19
Description: The scanning engine in VirusBlokAda VBA32 Personal Antivirus 3.12.8.x allows remote attackers to cause a denial of service (memory corruption and application crash) via a malformed RAR archive.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/31560; https://exchange.xforce.ibmcloud.com/vulnerabilities/47573; https://www.exploit-db.com/exploits/6658
CVE: CVE-2008-5668
Published: 2008-12-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Textpattern (aka Txp CMS) 4.0.5 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to setup/index.php or (2) the name parameter to index.php in the comments preview section.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28793; http://securityreason.com/securityalert/4786; http://textpattern.com/weblog/310/textpattern-406-released
CVE: CVE-2008-5669
Published: 2008-12-19
Description: index.php in the comments preview section in Textpattern (aka Txp CMS) 4.0.5 allows remote attackers to cause a denial of service via a long message parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/28793; http://securityreason.com/securityalert/4786; http://textpattern.com/weblog/310/textpattern-406-released
CVE: CVE-2008-5670
Published: 2008-12-19
Description: Textpattern (aka Txp CMS) 4.0.5 does not ask for the old password during a password reset, which makes it easier for remote attackers to change a password after hijacking a session.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/28793; http://securityreason.com/securityalert/4786; http://www.securityfocus.com/archive/1/487483/100/200/threaded
CVE: CVE-2008-5671
Published: 2008-12-19
Description: PHP remote file inclusion vulnerability in index.php in Joomla! 1.0.11 through 1.0.14, when RG_EMULATION is enabled in configuration.php, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/29106; http://securityreason.com/securityalert/4787; http://www.joomla.org/announcements/release-news/4609-joomla-1015-released.html
CVE: CVE-2008-5672
Published: 2008-12-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in PHParanoid before 0.4 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) admin.php or (2) private messages.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/28847; http://sourceforge.net/project/shownotes.php?release_id=575358; https://exchange.xforce.ibmcloud.com/vulnerabilities/40518
CVE: CVE-2008-5673
Published: 2008-12-19
Description: PHParanoid before 0.4 does not properly restrict access to the members area by unauthenticated users, which has unknown impact and remote attack vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28847; http://sourceforge.net/project/shownotes.php?release_id=575358; https://exchange.xforce.ibmcloud.com/vulnerabilities/40516
CVE: CVE-2008-5674
Published: 2008-12-19
Description: Multiple array index errors in the HTTP server in Darkwet Network webcamXP 3.72.440.0 and earlier and beta 4.05.280 and earlier allow remote attackers to cause a denial of service (device crash) and read portions of memory via (1) an invalid camnum parameter to the pocketpc component and (2) an invalid id parameter to the show_gallery_pic component.
CVSS Score: 9.4 (HIGH)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/webcamxp-adv.txt; http://osvdb.org/42929; http://secunia.com/advisories/29007
CVE: CVE-2008-5675
Published: 2008-12-19
Description: Unspecified vulnerability in IBM WebSphere Portal 6.0 before 6.0.1.5 has unknown impact and attack vectors related to "Access problems with BasicAuthTAI."
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/33132; http://www-01.ibm.com/support/docview.wss?uid=swg27007603; http://www-1.ibm.com/support/docview.wss?uid=swg1PK75304
CVE: CVE-2008-5676
Published: 2008-12-19
Description: Multiple unspecified vulnerabilities in the ModSecurity (aka mod_security) module 2.5.0 through 2.5.5 for the Apache HTTP Server, when SecCacheTransformations is enabled, allow remote attackers to cause a denial of service (daemon crash) or bypass the product's functionality via unknown vectors related to "transformation caching."
CVSS Score: 5.0 (MEDIUM)
References: http://blog.modsecurity.org/2008/08/transformation.html; http://freshmeat.net/projects/modsecurity/?branch_id=34901&release_id=282329; http://secunia.com/advisories/32146
CVE: CVE-2008-5677
Published: 2008-12-19
Description: Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/32145; http://securityreason.com/securityalert/4789; http://www.securityfocus.com/bid/31568
CVE: CVE-2008-5678
Published: 2008-12-19
Description: Fretwell-Downing Informatics (FDI) OLIB7 WebView 2.5.1.1 allows remote authenticated users to obtain sensitive information from files via the infile parameter to the default URI under cgi/, as demonstrated by the (1) get_settings.ini, (2) setup.ini, and (3) text.ini files.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/4790; http://www.securityfocus.com/bid/31544; https://exchange.xforce.ibmcloud.com/vulnerabilities/45638
CVE: CVE-2008-5679
Published: 2008-12-19
Description: The HTML parsing engine in Opera before 9.63 allows remote attackers to execute arbitrary code via crafted web pages that trigger an invalid pointer calculation and heap corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/34294; http://security.gentoo.org/glsa/glsa-200903-30.xml; http://securityreason.com/securityalert/4791
CVE: CVE-2008-5680
Published: 2008-12-19
Description: Multiple buffer overflows in Opera before 9.63 might allow (1) remote attackers to execute arbitrary code via a crafted text area, or allow (2) user-assisted remote attackers to execute arbitrary code via a long host name in a file: URL.  NOTE: this might overlap CVE-2008-5178.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34294; http://security.gentoo.org/glsa/glsa-200903-30.xml; http://securitytracker.com/id?1021457
CVE: CVE-2008-5681
Published: 2008-12-19
Description: Opera before 9.63 does not block unspecified "scripted URLs" during the feed preview, which allows remote attackers to read existing subscriptions and force subscriptions to arbitrary feed URLs.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/34294; http://security.gentoo.org/glsa/glsa-200903-30.xml; http://www.opera.com/docs/changelogs/linux/963/
CVE: CVE-2008-5682
Published: 2008-12-19
Description: Cross-site scripting (XSS) vulnerability in Opera before 9.63 allows remote attackers to inject arbitrary web script or HTML via built-in XSLT templates.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/50951; http://secunia.com/advisories/34294; http://security.gentoo.org/glsa/glsa-200903-30.xml
CVE: CVE-2008-5683
Published: 2008-12-19
Description: Unspecified vulnerability in Opera before 9.63 allows remote attackers to "reveal random data" via unknown vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/34294; http://security.gentoo.org/glsa/glsa-200903-30.xml; http://securitytracker.com/id?1021459
CVE: CVE-2008-0971
Published: 2008-12-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Barracuda Spam Firewall (BSF) before 3.5.12.007, Message Archiver before 1.2.1.002, Web Filter before 3.3.0.052, IM Firewall before 3.1.01.017, and Load Balancer before 2.3.024 allow remote attackers to inject arbitrary web script or HTML via (1) the Policy Name field in Search Based Retention Policy in Message Archiver; unspecified parameters in the (2) IP Configuration, (3) Administration, (4) Journal Accounts, (5) Retention Policy, and (6) GroupWise Sync components in Message Archiver; (7) input to search operations in Web Filter; and (8) input used in error messages and (9) hidden INPUT elements in (a) Spam Firewall, (b) IM Firewall, and (c) Web Filter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://dcsl.ul.ie/advisories/03.htm; http://secunia.com/advisories/33164; http://securityreason.com/securityalert/4792
CVE: CVE-2008-1094
Published: 2008-12-19
Description: SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall (BSF) before 3.5.12.007 allows remote authenticated administrators to execute arbitrary SQL commands via a pattern_x parameter in a search_count_equals action, as demonstrated by the pattern_0 parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://dcsl.ul.ie/advisories/02.htm; http://secunia.com/advisories/33164; http://securityreason.com/securityalert/4793
CVE: CVE-2008-4122
Published: 2008-12-19
Description: Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://int21.de/cve/CVE-2008-4122-joomla.html; http://securityreason.com/securityalert/4794; http://www.securityfocus.com/archive/1/499295/100/0/threaded
CVE: CVE-2008-5078
Published: 2008-12-19
Description: Multiple buffer overflows in the (1) recognize_eps_file function (src/psgen.c) and (2) tilde_subst function (src/util.c) in GNU enscript 1.6.1, and possibly earlier, might allow remote attackers to execute arbitrary code via an epsf escape sequence with a long filename.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html; http://secunia.com/advisories/33181; http://support.avaya.com/elmodocs2/security/ASA-2008-504.htm
CVE: CVE-2008-5086
Published: 2008-12-19
Description: Multiple methods in libvirt 0.3.2 through 0.5.1 do not check if a connection is read-only, which allows local users to bypass intended access restrictions and perform administrative actions.
CVSS Score: 7.2 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://osvdb.org/50919; http://secunia.com/advisories/33198
CVE: CVE-2008-5249
Published: 2008-12-19
Description: Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through 1.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html; http://secunia.com/advisories/33133; http://secunia.com/advisories/33349
CVE: CVE-2008-5250
Published: 2008-12-19
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web script or HTML by editing a wiki page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html; http://secunia.com/advisories/33133
CVE: CVE-2008-5252
Published: 2008-12-19
Description: Cross-site request forgery (CSRF) vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and 1.13.x before 1.13.3 allows remote attackers to perform unspecified actions as authenticated users via unknown vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html; http://secunia.com/advisories/33133
CVE: CVE-2008-5684
Published: 2008-12-19
Description: Unspecified vulnerability in the X Inter Client Exchange library (aka libICE) in Sun Solaris 8 through 10 and OpenSolaris before snv_85 allows context-dependent attackers to cause a denial of service (application crash), as demonstrated by a port scan that triggers a segmentation violation in the Gnome session manager (aka gnome-session).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/33157; http://secunia.com/advisories/33325; http://securitytracker.com/id?1021391
CVE: CVE-2008-5685
Published: 2008-12-19
Description: Sun ScApp firmware 5.18.x, 5.19.x, and 5.20.0 through 5.20.10 on Sun Fire and Netra platforms allows remote attackers to access the System Controller (SC), the system console, and possibly the host OS, and cause a denial of service (shutdown or reboot), via spoofed IP packets.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/33158; http://securitytracker.com/id?1021392; http://sunsolve.sun.com/search/document.do?assetkey=1-21-114527-12-1
CVE: CVE-2008-5686
Published: 2008-12-19
Description: IBM Tivoli Provisioning Manager (TPM) before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticated users to execute SOAP commands that access arbitrary TPM functionality, as demonstrated by running provisioning workflows.
CVSS Score: 8.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/33143; http://securitytracker.com/id?1021394; http://www-01.ibm.com/support/docview.wss?uid=swg21330228
CVE: CVE-2008-5687
Published: 2008-12-19
Description: MediaWiki 1.11, and other versions before 1.13.3, does not properly protect against the download of backups of deleted images, which might allow remote attackers to obtain sensitive information via requests for files in images/deleted/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html; http://secunia.com/advisories/33349; https://exchange.xforce.ibmcloud.com/vulnerabilities/47678
CVE: CVE-2008-5688
Published: 2008-12-19
Description: MediaWiki 1.8.1, and other versions before 1.13.3, when the wgShowExceptionDetails variable is enabled, sometimes provides the full installation path in a debugging message, which might allow remote attackers to obtain sensitive information via unspecified requests that trigger an uncaught exception.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html; http://secunia.com/advisories/33349; http://www.mediawiki.org/wiki/Manual:%24wgShowExceptionDetails
CVE: CVE-2008-5689
Published: 2008-12-19
Description: tun in IP Tunnel in Solaris 10 and OpenSolaris snv_01 through snv_76 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted SIOCGTUNPARAM IOCTL request, which triggers a NULL pointer dereference.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/33160; http://securityreason.com/securityalert/4801; http://sunsolve.sun.com/search/document.do?assetkey=1-26-242266-1
CVE: CVE-2008-5690
Published: 2008-12-19
Description: The Kerberos credential renewal feature in Sun Solaris 8, 9, and 10, and OpenSolaris build snv_01 through snv_104, allows local users to cause a denial of service (authentication failure) via unspecified vectors related to incorrect cache file permissions, and lack of credential storage by the store_cred function in pam_krb5.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/33042; http://secunia.com/advisories/33313; http://sunsolve.sun.com/search/document.do?assetkey=1-21-112908-33-1
CVE: CVE-2008-5691
Published: 2008-12-19
Description: Heap-based buffer overflow in the Phoenician Casino FlashAX ActiveX control 1.0.0.7 allows remote attackers to execute arbitrary code via a long argument to the SetID method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4795; http://www.securityfocus.com/bid/32901; https://exchange.xforce.ibmcloud.com/vulnerabilities/47448
CVE: CVE-2008-5692
Published: 2008-12-19
Description: Ipswitch WS_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read logs via a logLogout action to FTPLogServer/login.asp followed by a request to FTPLogServer/LogViewer.asp with the localhostnull account name.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://aluigi.altervista.org/adv/wsftpweblog-adv.txt; http://docs.ipswitch.com/WS_FTP_Server611/ReleaseNotes/index.htm?k_id=ipswitch_ftp_documents_worldwide_ws_ftpserverv611releasenotes#link12; http://secunia.com/advisories/28822
CVE: CVE-2008-5693
Published: 2008-12-19
Description: Ipswitch WS_FTP Server Manager 6.1.0.0 and earlier, and possibly other Ipswitch products, might allow remote attackers to read the contents of custom ASP files in WSFTPSVR/ via a request with an appended dot character.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/wsftpweblog-adv.txt; http://securityreason.com/securityalert/4799; http://www.securityfocus.com/archive/1/487686/100/200/threaded