deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4403
Published: 2008-10-03
Description: The CGI modules in the server in Trend Micro OfficeScan 8.0 SP1 before build 2439 and 8.0 SP1 Patch 1 before build 3087 allow remote attackers to cause a denial of service (NULL pointer dereference and child process crash) via crafted HTTP headers, related to the "error handling mechanism."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32097; http://www.securityfocus.com/bid/31531; http://www.securitytracker.com/id?1020974
CVE: CVE-2008-4404
Published: 2008-10-03
Description: The IPv6 Neighbor Discovery Protocol (NDP) implementation on IBM zSeries servers does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB), a related issue to CVE-2008-2476.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/472363; http://www.kb.cert.org/vuls/id/MAPG-7H2RZ8; http://www.kb.cert.org/vuls/id/472363
CVE: CVE-2008-3832
Published: 2008-10-03
Description: A certain Fedora patch for the utrace subsystem in the Linux kernel before 2.6.26.5-28 on Fedora 8, and before 2.6.26.5-45 on Fedora 9, allows local users to cause a denial of service (NULL pointer dereference and system crash or hang) via a call to the utrace_control function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://kerneloops.org/oops.php?number=56705; http://www.openwall.com/lists/oss-security/2008/10/02/1; http://www.securityfocus.com/bid/31536
CVE: CVE-2008-3833
Published: 2008-10-03
Description: The generic_file_splice_write function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory, a different vulnerability than CVE-2008-4210.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.19.y.git%3Ba=commit%3Bh=8c34e2d63231d4bf4852bac[PII_REDACTED]d770fe3; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html; http://openwall.com/lists/oss-security/2008/10/03/1
CVE: CVE-2008-4359
Published: 2008-10-03
Description: lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://openwall.com/lists/oss-security/2008/09/30/1; http://openwall.com/lists/oss-security/2008/09/30/2
CVE: CVE-2008-4360
Published: 2008-10-03
Description: mod_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons on filename components in configuration options, which might allow remote attackers to bypass intended access restrictions, as demonstrated by a request for a .PHP file when there is a configuration rule for .php files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://openwall.com/lists/oss-security/2008/09/30/1; http://openwall.com/lists/oss-security/2008/09/30/2
CVE: CVE-2008-4405
Published: 2008-10-03
Description: xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid.  NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html; http://lists.xensource.com/archives/html/xen-devel/2008-09/msg00992.html; http://lists.xensource.com/archives/html/xen-devel/2008-09/msg00994.html
CVE: CVE-2008-4406
Published: 2008-10-03
Description: A certain Debian patch to the run scripts for sabre (aka xsabre) 0.2.4b allows local users to delete or overwrite arbitrary files via a symlink attack on unspecified .tmp files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/433996; http://openwall.com/lists/oss-security/2008/10/01/1; http://osvdb.org/48895
CVE: CVE-2008-4407
Published: 2008-10-03
Description: XRunSabre in sabre (aka xsabre) 0.2.4b relies on the ability to create /tmp/sabre.log, which allows local users to cause a denial of service (application unavailability) by creating a /tmp/sabre.log file that cannot be overwritten.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/433996; http://osvdb.org/48900; http://bugs.debian.org/433996
CVE: CVE-2008-4408
Published: 2008-10-03
Description: Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.1, 1.12.0, and possibly other versions before 1.13.2 allows remote attackers to inject arbitrary web script or HTML via the useskin parameter to an unspecified component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-October/000078.html; http://openwall.com/lists/oss-security/2008/10/02/3; http://secunia.com/advisories/32128
CVE: CVE-2008-4409
Published: 2008-10-03
Description: libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugzilla.gnome.org/show_bug.cgi?id=554660; http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
CVE: CVE-2008-4410
Published: 2008-10-03
Description: The vmi_write_ldt_entry function in arch/x86/kernel/vmi_32.c in the Virtual Machine Interface (VMI) in the Linux kernel 2.6.26.5 invokes write_idt_entry where write_ldt_entry was intended, which allows local users to cause a denial of service (persistent application failure) via crafted function calls, related to the Java Runtime Environment (JRE) experiencing improper LDT selector state, a different vulnerability than CVE-2008-3247.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git%3Ba=commit%3Bh=de59985e3a623d4d5d6207f1777398ca0606ab1c; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html; http://osvdb.org/48743
CVE: CVE-2008-4383
Published: 2008-10-03
Description: Stack-based buffer overflow in the Agranet-Emweb embedded management web server in Alcatel OmniSwitch OS7000, OS6600, OS6800, OS6850, and OS9000 Series devices with AoS 5.1 before 5.1.6.463.R02, 5.4 before 5.4.1.429.R01, 6.1.3 before 6.1.3.965.R01, 6.1.5 before 6.1.5.595.R01, and 6.3 before 6.3.1.966.R01 allows remote attackers to execute arbitrary code via a long Session cookie.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31435; http://securityreason.com/securityalert/4347; http://www.layereddefense.com/alcatel12aug.html
CVE: CVE-2008-4423
Published: 2008-10-03
Description: SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands via the item parameter in a contact modify action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31425; http://securityreason.com/securityalert/4350; http://www.securityfocus.com/archive/1/495313/100/0/threaded
CVE: CVE-2008-4424
Published: 2008-10-03
Description: Cross-site scripting (XSS) vulnerability in index.php in Domain Group Network GooCMS 1.02 allows remote attackers to inject arbitrary web script or HTML via the s parameter in a comments action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/30635.html; http://secunia.com/advisories/31449; http://www.securityfocus.com/bid/30635
CVE: CVE-2008-4425
Published: 2008-10-03
Description: Directory traversal vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter within a delfile action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31424; http://securityreason.com/securityalert/4348; http://www.securityfocus.com/bid/30627
CVE: CVE-2008-4426
Published: 2008-10-03
Description: Cross-site scripting (XSS) vulnerability in events.php in Phlatline's Personal Information Manager (pPIM) 1.0 allows remote attackers to inject arbitrary web script or HTML via the date parameter in a new action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31424; http://securityreason.com/securityalert/4348; http://www.securityfocus.com/bid/30627
CVE: CVE-2008-4427
Published: 2008-10-03
Description: changepassword.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier does not require administrative authentication, which allows remote attackers to change arbitrary passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31424; http://securityreason.com/securityalert/4349; http://www.securityfocus.com/bid/30627
CVE: CVE-2008-4428
Published: 2008-10-03
Description: Unrestricted file upload vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the file in the top-level directory.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31424; http://securityreason.com/securityalert/4349; http://www.securityfocus.com/bid/30627
CVE: CVE-2008-4429
Published: 2008-10-03
Description: Unspecified vulnerability in SOURCENEXT Virus Security ZERO 9.5.0173 and earlier and Virus Security 9.5.0173 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via malformed compressed files.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
References: http://jvn.jp/en/jp/JVN66077895/; http://sec.sourcenext.info/support/bulletin.html; http://secunia.com/advisories/31452
CVE: CVE-2008-4430
Published: 2008-10-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-3699.  Reason: This candidate is a duplicate of CVE-2008-3699.  Notes: All CVE users should reference CVE-2008-3699 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-4431
Published: 2008-10-03
Description: SQL injection vulnerability in index.php in IceBB 1.0-rc9.3 and earlier allows remote attackers to execute arbitrary SQL commands via the skin parameter, probably related to an incorrect protection mechanism in the clean_string function in includes/functions.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forums.xaos-ia.com/?topic=765; http://secunia.com/advisories/31439; http://www.securityfocus.com/bid/30656
CVE: CVE-2008-4432
Published: 2008-10-03
Description: Cross-site scripting (XSS) vulnerability in search.php in the RMSOFT MiniShop module 1.0 for Xoops allows remote attackers to inject arbitrary web script or HTML via the itemsxpag parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2008/08/rmsoft-minishop-module-multiple.html; http://www.securityfocus.com/bid/30616; https://exchange.xforce.ibmcloud.com/vulnerabilities/44374
CVE: CVE-2008-4433
Published: 2008-10-03
Description: SQL injection vulnerability in search.php in the RMSOFT MiniShop module 1.0 for Xoops might allow remote attackers to execute arbitrary SQL commands via the itemsxpag parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lostmon.blogspot.com/2008/08/rmsoft-minishop-module-multiple.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/45714; http://lostmon.blogspot.com/2008/08/rmsoft-minishop-module-multiple.html
CVE: CVE-2008-4434
Published: 2008-10-03
Description: Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Created By field in a .torrent file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://forum.utorrent.com/viewtopic.php?id=44003; http://lists.immunitysec.com/pipermail/dailydave/attachments/20080811/35d6194b/attachment-0001.pdf; http://seclists.org/dailydave/2008/q3/0155.html
CVE: CVE-2008-4435
Published: 2008-10-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the RMSOFT Downloads Plus (rmdp) module 1.5 and 1.7 for Xoops allow remote attackers to inject arbitrary web script or HTML via the (1) key parameter to search.php and the (2) id parameter to down.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2008/08/rmsoft-downloads-plus-two-scripts-two.html; http://www.securityfocus.com/bid/30620; https://exchange.xforce.ibmcloud.com/vulnerabilities/44376
CVE: CVE-2008-4436
Published: 2008-10-03
Description: SQL injection vulnerability in bblog_plugins/builtin.help.php in bBlog 0.7.6 allows remote attackers to execute arbitrary SQL commands via the mod parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4351; http://www.securityfocus.com/bid/30658; https://exchange.xforce.ibmcloud.com/vulnerabilities/44406
CVE: CVE-2008-4437
Published: 2008-10-03
Description: Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attach_path is enabled, allows remote attackers to read arbitrary files via an XML file with a .. (dot dot) in the data element.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31444; http://secunia.com/advisories/34361; http://www.bugzilla.org/security/2.22.4/
CVE: CVE-2008-4438
Published: 2008-10-03
Description: Cross-site scripting (XSS) vulnerability in search.php in Datafeed Studio 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.datafeedstudio.com/datafeed-studio-v163-released; http://downloads.securityfocus.com/vulnerabilities/exploits/30660.html; http://secunia.com/advisories/31488
CVE: CVE-2008-4439
Published: 2008-10-03
Description: PHP remote file inclusion vulnerability in admin/bin/patch.php in MartinWood Datafeed Studio before 1.6.3 allows remote attackers to execute arbitrary PHP code via a URL in the INSTALL_FOLDER parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://blog.datafeedstudio.com/datafeed-studio-v163-released; http://www.securityfocus.com/bid/30659; http://www.securityfocus.com/bid/30659/exploit
CVE: CVE-2008-4440
Published: 2008-10-03
Description: The to-upgrade plugin in feta 1.4.16 allows local users to overwrite arbitrary files via a symlink on the (1) /tmp/feta.install.$USER and (2) /tmp/feta.avail.$USER temporary files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496397; http://dev.gentoo.org/~rbu/security/debiantemp/feta; http://secunia.com/advisories/32155
CVE: CVE-2008-3872
Published: 2008-10-06
Description: Adobe Flash Player 8.0.39.0 and earlier, and 9.x up to 9.0.115.0, allows remote attackers to bypass the allowScriptAccess parameter setting via a crafted SWF file with unspecified "Filter evasion" manipulations.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://taviso.decsystem.org/research.html; http://www.adobe.com/support/security/bulletins/apsb08-11.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/45713
CVE: CVE-2008-4278
Published: 2008-10-06
Description: VMware VirtualCenter 2.5 before Update 3 build 119838 on Windows displays a user's password in cleartext when the password contains unspecified special characters, which allows physically proximate attackers to steal the password.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3057&w=2; http://secunia.com/advisories/32179; http://secunia.com/advisories/32180
CVE: CVE-2008-4279
Published: 2008-10-06
Description: The CPU hardware emulation for 64-bit guest operating systems in VMware Workstation 6.0.x before 6.0.5 build 109488 and 5.x before 5.5.8 build 108000; Player 2.0.x before 2.0.5 build 109488 and 1.x before 1.0.8; Server 1.x before 1.0.7 build 108231; and ESX 2.5.4 through 3.5 allows authenticated guest OS users to gain additional guest OS privileges by triggering an exception that causes the virtual CPU to perform an indirect jump to a non-canonical address.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/064860.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3057&w=2; http://secunia.com/advisories/32157
CVE: CVE-2008-4445
Published: 2008-10-06
Description: The sctp_auth_ep_set_hmacs function in net/sctp/auth.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, does not verify that the identifier index is within the bounds established by SCTP_AUTH_HMAC_ID_MAX, which allows local users to obtain sensitive information via a crafted SCTP_HMAC_IDENT IOCTL request involving the sctp_getsockopt function, a different vulnerability than CVE-2008-4113.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git%3Ba=commit%3Bh=d97240552cd98c4b07322f30f66fd9c3ba4171de; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html; http://marc.info/?l=linux-sctp&m=[PII_REDACTED]9093&w=2
CVE: CVE-2008-4446
Published: 2008-10-06
Description: Cross-site scripting (XSS) vulnerability in Nucleus EUC-JP 3.31 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://japan.nucleuscms.org/bb/viewtopic.php?t=4131; http://japan.nucleuscms.org/item/47; http://jvn.jp/en/jp/JVN92651529/index.html
CVE: CVE-2008-4447
Published: 2008-10-06
Description: Cross-site scripting (XSS) vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to inject arbitrary web script or HTML via (1) the fn parameter during a dload action, (2) the mask parameter during a search action, and (3) the tab parameter during a sysinfo action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0810-exploits/webshell431-xssxsrf.txt; http://secunia.com/advisories/32086; http://www.securityfocus.com/bid/31524
CVE: CVE-2008-4448
Published: 2008-10-06
Description: Cross-site request forgery (CSRF) vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to perform unauthorized actions as an administrator, including file deletion and creation, via a link or IMG tag to the (1) overkill, (2) futils, or (3) edit actions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.org/0810-exploits/webshell431-xssxsrf.txt; http://secunia.com/advisories/32086; https://exchange.xforce.ibmcloud.com/vulnerabilities/45614
CVE: CVE-2008-4449
Published: 2008-10-06
Description: Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIVMSG message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32102; http://securityreason.com/securityalert/4352; http://www.securityfocus.com/bid/31552
CVE: CVE-2008-4450
Published: 2008-10-06
Description: Cross-site scripting (XSS) vulnerability in adodb.php in XAMPP for Windows 1.6.8 allows remote attackers to inject arbitrary web script or HTML via the (1) dbserver, (2) host, (3) user, (4) password, (5) database, and (6) table parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32134; http://www.securityfocus.com/bid/31472; https://exchange.xforce.ibmcloud.com/vulnerabilities/45522
CVE: CVE-2008-4451
Published: 2008-10-06
Description: The SysInspector AntiStealth driver (esiasdrv.sys) 3.0.65535.0 in ESET System Analyzer Tool 1.1.1.0 allows local users to execute arbitrary code via a certain METHOD_NEITHER IOCTL request to \Device\esiasdrv that overwrites a pointer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-264
References: http://securityreason.com/securityalert/4353; http://www.ntinternals.org/; http://www.securityfocus.com/bid/31521
CVE: CVE-2008-4452
Published: 2008-10-06
Description: Buffer overflow in Cambridge Computer Corporation vxFtpSrv 2.0.3 allows remote attackers to cause a denial of service (crash and hang) and possibly execute arbitrary code via a long CWD request.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4356; http://www.securityfocus.com/bid/31532; https://exchange.xforce.ibmcloud.com/vulnerabilities/45620
CVE: CVE-2008-4453
Published: 2008-10-06
Description: The GdPicture (1) Light Imaging Toolkit 4.7.1 GdPicture4S.Imaging ActiveX control (gdpicture4s.ocx) 4.7.0.1 and (2) Pro Imaging SDK 5.7.1 GdPicturePro5S.Imaging ActiveX control (gdpicturepro5s.ocx) 5.7.0.1 allows remote attackers to create, overwrite, and modify arbitrary files via the SaveAsPDF method.  NOTE: this issue might only be exploitable in limited environments or non-default browser settings.  NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31898; http://secunia.com/advisories/31966; http://securityreason.com/securityalert/4355
CVE: CVE-2008-4454
Published: 2008-10-06
Description: Directory traversal vulnerability in EKINdesigns MySQL Quick Admin 1.5.5 allows remote attackers to read and execute arbitrary files via a .. (dot dot) in the lang parameter to actions.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31820; http://secunia.com/advisories/31820
CVE: CVE-2008-4455
Published: 2008-10-06
Description: Directory traversal vulnerability in index.php in EKINdesigns MySQL Quick Admin 1.5.5 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to read and execute arbitrary files via a .. (dot dot) in the language cookie.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31820; http://www.securityfocus.com/bid/31517; https://exchange.xforce.ibmcloud.com/vulnerabilities/45606