deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0596
Published: 2008-02-26
Description: Memory leak in CUPS before 1.1.22, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption and daemon crash) via a large number of requests to add and remove shared printers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00000.html
CVE: CVE-2008-0597
Published: 2008-02-26
Description: Use-after-free vulnerability in CUPS before 1.1.22, and possibly other versions, allows remote attackers to cause a denial of service (crash) via crafted IPP packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00000.html; http://secunia.com/advisories/29087; http://secunia.com/advisories/29189
CVE: CVE-2008-0923
Published: 2008-02-26
Description: Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write arbitrary files on the host OS via a multibyte string that produces a wide character string containing .. (dot dot) sequences, which bypasses the protection mechanism, as demonstrated using a "%c0%2e%c0%2e" string.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-22
References: http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1004034; http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060457.html; http://lists.vmware.com/pipermail/security-announce/2008/000008.html
CVE: CVE-2008-0983
Published: 2008-02-26
Description: lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html; http://secunia.com/advisories/29066; http://secunia.com/advisories/29166
CVE: CVE-2008-0984
Published: 2008-02-26
Description: The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060481.html; http://secunia.com/advisories/29122; http://secunia.com/advisories/29153
CVE: CVE-2008-1037
Published: 2008-02-27
Description: Cross-site scripting (XSS) vulnerability in the file listing function in the web management interface in Packeteer PacketShaper and PolicyCenter 8.2.2 allows remote attackers to inject arbitrary web script or HTML via the FILELIST parameter to an arbitrary component, which triggers injection into an Error Report page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29119; http://securityreason.com/securityalert/3701; http://www.securityfocus.com/archive/1/488712/100/0/threaded
CVE: CVE-2008-1038
Published: 2008-02-27
Description: PHP remote file inclusion vulnerability in mod/mod.extmanager.php in DBHcms 1.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the extmanager_install parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29110; http://www.securityfocus.com/bid/27996; https://exchange.xforce.ibmcloud.com/vulnerabilities/40835
CVE: CVE-2008-1039
Published: 2008-02-27
Description: SQL injection vulnerability in question.asp in PORAR WEBBOARD allows remote attackers to execute arbitrary SQL commands via the QID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29102; http://www.securityfocus.com/bid/27989; https://exchange.xforce.ibmcloud.com/vulnerabilities/40839
CVE: CVE-2008-1040
Published: 2008-02-27
Description: Buffer overflow in the Single Sign-On function in Fujitsu Interstage Application Server 8.0.0 through 8.0.3 and 9.0.0, Interstage Studio 8.0.1 and 9.0.0, and Interstage Apworks 8.0.0 allows remote attackers to execute arbitrary code via a long URI.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29088; http://www.fujitsu.com/global/support/software/security/products-f/interstage-200804e.html; http://www.securityfocus.com/bid/27966
CVE: CVE-2008-1041
Published: 2008-02-27
Description: Cross-site scripting (XSS) vulnerability in mwhois.php in Matt Wilson Matt's Whois (MWhois) allows remote attackers to inject arbitrary web script or HTML via the domain parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29093; http://www.packetstormsecurity.org/0802-exploits/mattswhois-xss.txt; http://www.securityfocus.com/bid/27974
CVE: CVE-2008-1042
Published: 2008-02-27
Description: Directory traversal vulnerability in include/body.inc.php in Linux Web Shop (LWS) php Download Manager 1.0 and 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the content parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29089; http://www.securityfocus.com/bid/27961; https://exchange.xforce.ibmcloud.com/vulnerabilities/40795
CVE: CVE-2008-1043
Published: 2008-02-27
Description: PHP remote file inclusion vulnerability in templates/default/header.inc.php in Linux Web Shop (LWS) php User Base 1.3 BETA allows remote attackers to execute arbitrary PHP code via a URL in the menu parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/494140/100/0/threaded; http://www.securityfocus.com/bid/27963; https://exchange.xforce.ibmcloud.com/vulnerabilities/40794
CVE: CVE-2008-1044
Published: 2008-02-27
Description: Stack-based buffer overflow in the Quantum Streaming Player (Quantum Streaming IE Player) ActiveX control (aka QSP2IE.QSP2IE) in qsp2ie07076007.dll 7.7.6.7 and qsp2ie07074039.dll 7.7.4.39 in Move Media Player allows remote attackers to execute arbitrary code via a long argument to the UploadLogs method, a different vector than CVE-2007-4722.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060460.html; http://secunia.com/advisories/29108; http://www.securityfocus.com/bid/27995
CVE: CVE-2008-1045
Published: 2008-02-27
Description: Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29121; http://securityreason.com/securityalert/3702; http://www.securityfocus.com/archive/1/488708/100/0/threaded
CVE: CVE-2008-1046
Published: 2008-02-27
Description: PHP remote file inclusion vulnerability in footer.php in Quinsonnas Mail Checker 1.55 allows remote attackers to execute arbitrary PHP code via a URL in the op[footer_body] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://www.exploit-db.com/exploits/5176; https://www.exploit-db.com/exploits/5176
CVE: CVE-2008-1047
Published: 2008-02-27
Description: Cross-site scripting (XSS) vulnerability in tiki-edit_article.php in TikiWiki before 1.9.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev.tikiwiki.org/tiki-view_tracker_item.php?itemId=1498; http://secunia.com/advisories/29092; http://tikiwiki.org/ReleaseNotes1910
CVE: CVE-2008-1048
Published: 2008-02-27
Description: Cross-site scripting (XSS) vulnerability in manager/xmedia.php in Plume CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29116; http://www.digitrustgroup.com/advisories/web-application-security-plume-cms.html; http://www.securityfocus.com/bid/27999
CVE: CVE-2008-1049
Published: 2008-02-27
Description: Unspecified vulnerability in Parallels SiteStudio before 1.7.2, and 1.8.x before 1.8b, as used in Parallels H-Sphere 3.0 before Patch 9 and 2.5 before Patch 11, has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29084; http://www.psoft.net/misc/hs_ss_technical_update.html; http://www.securityfocus.com/bid/28002
CVE: CVE-2008-1050
Published: 2008-02-27
Description: SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitrary SQL commands via the sbcat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3703; http://www.securityfocus.com/archive/1/488706/100/0/threaded; http://www.securityfocus.com/bid/27973
CVE: CVE-2008-1051
Published: 2008-02-27
Description: PHP remote file inclusion vulnerability in include/body_comm.inc.php in phpProfiles 4.5.2 BETA allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/27952; https://www.exploit-db.com/exploits/5175; http://www.securityfocus.com/bid/27952
CVE: CVE-2008-1052
Published: 2008-02-27
Description: The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/surgeftpizza-adv.txt; http://secunia.com/advisories/29096; http://securityreason.com/securityalert/3704
CVE: CVE-2008-1053
Published: 2008-02-27
Description: Multiple SQL injection vulnerabilities in the Kose_Yazilari module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the artid parameter in a (1) viewarticle or (2) printpage action to modules.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27991; https://exchange.xforce.ibmcloud.com/vulnerabilities/40848; https://www.exploit-db.com/exploits/5186
CVE: CVE-2008-1054
Published: 2008-02-27
Description: Stack-based buffer overflow in the _lib_spawn_user_getpid function in (1) swatch.exe and (2) surgemail.exe in NetWin SurgeMail 38k4 and earlier, and beta 39a, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via an HTTP request with multiple long headers to webmail.exe and unspecified other CGI executables, which triggers an overflow when assigning values to environment variables.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/surgemailz-adv.txt; http://secunia.com/advisories/29105; http://securityreason.com/securityalert/3705
CVE: CVE-2008-1055
Published: 2008-02-27
Description: Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/surgemailz-adv.txt; http://secunia.com/advisories/29105; http://secunia.com/advisories/29137
CVE: CVE-2008-1056
Published: 2008-02-28
Description: Multiple stack-based buffer overflows in Symark PowerBroker 2.8 through 5.0.1 allow local users to gain privileges via a long argv[0] string when executing (1) pbrun, (2) pbsh, or (3) pbksh.  NOTE: the product is often installed in environments with trust relationships that facilitate subsequent remote compromises.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/29111; http://www.mnin.org/advisories/2008_symarkpb.pdf; http://www.securityfocus.com/bid/28015
CVE: CVE-2008-1057
Published: 2008-02-28
Description: The ip6_check_rh0hdr function in netinet6/ip6_input.c in OpenBSD 4.2 allows attackers to cause a denial of service (panic) via malformed IPv6 routing headers.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/29078; http://www.openbsd.org/errata42.html#008_ip6rthdr; http://www.securityfocus.com/bid/27965
CVE: CVE-2008-1058
Published: 2008-02-28
Description: The tcp_respond function in netinet/tcp_subr.c in OpenBSD 4.1 and 4.2 allows attackers to cause a denial of service (panic) via crafted TCP packets.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/29078; http://www.openbsd.org/errata41.html#013_tcprespond; http://www.openbsd.org/errata42.html#007_tcprespond
CVE: CVE-2008-1059
Published: 2008-02-28
Description: PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/29099; http://securityreason.com/securityalert/3706; http://www.securityfocus.com/archive/1/488734/100/0/threaded
CVE: CVE-2008-1060
Published: 2008-02-28
Description: Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via the text parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/29099; http://securityreason.com/securityalert/3706; http://www.securityfocus.com/archive/1/488734/100/0/threaded
CVE: CVE-2008-1061
Published: 2008-02-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly (d) modules/execute.php; the (2) url parameter to (e) view/admin/submenu.php; and the (3) page parameter to (f) view/admin/pager.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29099; http://securityreason.com/securityalert/3706; http://www.securityfocus.com/archive/1/488734/100/0/threaded
CVE: CVE-2008-1062
Published: 2008-02-28
Description: InterVideo IMC Server (aka IMCSvr.exe) and InterVideo Home Theater (aka IHT.exe) in InterVideo WinDVD Media Center 2.11.15.0 allow remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted packet with two CRLF sequences.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/28910; http://www.securityfocus.com/bid/28016; http://secunia.com/advisories/28910
CVE: CVE-2007-5397
Published: 2008-02-28
Description: Heap-based buffer overflow in the activePDF Server service (aka APServer.exe) in activePDF Server 3.8.4 and 3.8.5.14, and possibly other versions before 3.8.6.16, allows remote attackers to execute arbitrary code via a packet with a size field that is less than the actual size of the data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27371; http://secunia.com/secunia_research/2007-87/advisory/; http://www.securityfocus.com/bid/28013
CVE: CVE-2008-0124
Published: 2008-02-28
Description: Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1) the "Real name" field in Personal Settings, which is presented to readers of articles; or (2) a file upload, as demonstrated by a .htm, .html, or .js file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.s9y.org/archives/191-Serendipity-1.3-beta1-released.html; http://int21.de/cve/CVE-2008-0124-s9y.html; http://secunia.com/advisories/29128
CVE: CVE-2008-0308
Published: 2008-02-28
Description: Symantec Decomposer, as used in certain Symantec antivirus products including Symantec Scan Engine 5.1.2 and other versions before 5.1.6.31, allows remote attackers to cause a denial of service (memory consumption) via a malformed RAR file to the Internet Content Adaptation Protocol (ICAP) port (1344/tcp).
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=666; http://secunia.com/advisories/29140; http://www.securityfocus.com/bid/27911
CVE: CVE-2008-0309
Published: 2008-02-28
Description: Stack-based buffer overflow in Symantec Decomposer, as used in certain Symantec antivirus products including Symantec Scan Engine 5.1.2 and other versions before 5.1.6.31, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed RAR file to the Internet Content Adaptation Protocol (ICAP) port (1344/tcp).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=667; http://secunia.com/advisories/29140; http://www.securityfocus.com/bid/27913
CVE: CVE-2008-1063
Published: 2008-02-28
Description: Cross-site scripting (XSS) vulnerability index.php in the XM-Memberstats (xmmemberstats) module for XOOPS allows remote attackers to inject arbitrary web script or HTML via the sortby parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.xssing.com/index.php?x=3&y=12; https://exchange.xforce.ibmcloud.com/vulnerabilities/41001; http://www.xssing.com/index.php?x=3&y=12
CVE: CVE-2008-1064
Published: 2008-02-28
Description: Cross-site scripting (XSS) vulnerability in images.php in the Red Mexico RMSOFT Gallery System (GS) 2.0 module (aka rmgs) for XOOPS allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.xssing.com/index.php?x=3&y=12; https://exchange.xforce.ibmcloud.com/vulnerabilities/41013; http://www.xssing.com/index.php?x=3&y=12
CVE: CVE-2008-1065
Published: 2008-02-28
Description: Multiple SQL injection vulnerabilities in index.php in the XM-Memberstats (xmmemberstats) 2.0e module for XOOPS allow remote attackers to execute arbitrary SQL commands via the (1) letter or (2) sortby parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29107; http://www.securityfocus.com/bid/27979; http://www.xssing.com/index.php?x=3&y=12
CVE: CVE-2008-1066
Published: 2008-02-28
Description: The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used by Serendipity (S9Y) and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://blog.s9y.org/archives/191-Serendipity-1.3-beta1-released.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html; http://secunia.com/advisories/29241
CVE: CVE-2008-0411
Published: 2008-02-28
Description: Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00009.html; http://scary.beasts.org/security/CESA-2008-001.html; http://secunia.com/advisories/29101
CVE: CVE-2008-1067
Published: 2008-02-28
Description: Multiple PHP remote file inclusion vulnerabilities in phpQLAdmin 2.2.7 allow remote attackers to execute arbitrary PHP code via a URL in the _SESSION[path] parameter to (1) ezmlm.php and (2) tools/update_translations.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29076; https://www.exploit-db.com/exploits/5173; http://secunia.com/advisories/29076
CVE: CVE-2008-1068
Published: 2008-02-28
Description: Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the site_path parameter to (1) Vert/index.php, (2) Noir/index.php, and (3) Bleu/index.php in template/, different vectors than CVE-2008-0645.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/27962; https://www.exploit-db.com/exploits/5182; http://www.securityfocus.com/bid/27962
CVE: CVE-2008-1069
Published: 2008-02-28
Description: Multiple PHP remote file inclusion vulnerabilities in Quantum Game Library 0.7.2c allow remote attackers to execute arbitrary PHP code via a URL in the CONFIG[gameroot] parameter to (1) server_request.php and (2) qlib/smarty.inc.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29077; http://www.securityfocus.com/bid/27945; https://exchange.xforce.ibmcloud.com/vulnerabilities/40776
CVE: CVE-2008-1070
Published: 2008-02-28
Description: The SCTP dissector in Wireshark (formerly Ethereal) 0.99.5 through 0.99.7 allows remote attackers to cause a denial of service (crash) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html; http://secunia.com/advisories/29156; http://secunia.com/advisories/29188
CVE: CVE-2008-1071
Published: 2008-02-28
Description: The SNMP dissector in Wireshark (formerly Ethereal) 0.99.6 through 0.99.7 allows remote attackers to cause a denial of service (crash) via a malformed packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html; http://secunia.com/advisories/29156; http://secunia.com/advisories/29188
CVE: CVE-2008-1072
Published: 2008-02-28
Description: The TFTP dissector in Wireshark (formerly Ethereal) 0.6.0 through 0.99.7, when running on Ubuntu 7.10, allows remote attackers to cause a denial of service (crash or memory consumption) via a malformed packet, possibly related to a Cairo library bug.
CVSS Score: 4.7 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html; http://secunia.com/advisories/29156; http://secunia.com/advisories/29188
CVE: CVE-2008-1073
Published: 2008-02-29
Description: Cross-site scripting (XSS) vulnerability in the report interface in Internet Security Systems (ISS) Internet Scanner 7.0 Service Pack 2 Build 7.2.2005.52 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/29038; http://www.securityfocus.com/bid/28014
CVE: CVE-2008-1074
Published: 2008-02-29
Description: PHP remote file inclusion vulnerability in lib/head_auth.php in GROUP-E 1.6.41 allows remote attackers to execute arbitrary PHP code via a URL in the CFG[PREPEND_FILE] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29134; http://sourceforge.net/project/shownotes.php?group_id=196032&release_id=581434; http://www.securityfocus.com/bid/28024
CVE: CVE-2008-1075
Published: 2008-02-29
Description: Cross-site scripting (XSS) vulnerability in index.php in Maian Cart 1.1 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search command.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29114; http://www.securityfocus.com/bid/28028; http://secunia.com/advisories/29114