deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3247
Published: 2008-07-24
Description: The LDT implementation in the Linux kernel 2.6.25.x before 2.6.25.11 on x86_64 platforms uses an incorrect size for ldt_desc, which allows local users to cause a denial of service (system crash) or possibly gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=74454a6a286bfce4bb23d89bd465f856fa6a6e19; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00009.html
CVE: CVE-2008-3264
Published: 2008-07-24
Description: The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (traffic amplification) via an IAX2 FWDOWNL request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://downloads.digium.com/pub/security/AST-2008-011.html; http://secunia.com/advisories/31178; http://secunia.com/advisories/31194
CVE: CVE-2008-3265
Published: 2008-07-24
Description: SQL injection vulnerability in the DT Register (com_dtregister) 2.2.3 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the eventId parameter in a pay_options action to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/47061; http://secunia.com/advisories/31126; http://securityreason.com/securityalert/4023
CVE: CVE-2008-3266
Published: 2008-07-24
Description: SQL injection vulnerability in picture_pic_bv.asp in SoftAcid Hotel Reservation System (HRS) Multi allows remote attackers to execute arbitrary SQL commands via the key parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31170; http://securityreason.com/securityalert/4028; http://www.securityfocus.com/bid/30316
CVE: CVE-2008-3267
Published: 2008-07-24
Description: SQL injection vulnerability in mojoJobs.cgi in MojoJobs allows remote attackers to execute arbitrary SQL commands via the cat_a parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31164; http://securityreason.com/securityalert/4029; http://www.vupen.com/english/advisories/2008/2158/references
CVE: CVE-2008-3268
Published: 2008-07-24
Description: Unspecified vulnerability in phpScheduleIt 1.2.0 through 1.2.9, when useLogonName is enabled, allows remote attackers with administrator email address knowledge to bypass restrictions and gain privileges via unspecified vectors related to login names.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/31147; http://sourceforge.net/project/shownotes.php?release_id=614202; http://www.securityfocus.com/bid/30300
CVE: CVE-2008-3269
Published: 2008-07-24
Description: WRPCServer.exe in WinSoftMagic WinRemotePC (WRPC) Lite 2008 and Full 2008 allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet to TCP port 4321.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/31102; http://securityreason.com/securityalert/4030; http://www.securityfocus.com/bid/30236
CVE: CVE-2008-3285
Published: 2008-07-24
Description: The Filesys::SmbClientParser module 2.7 and earlier for Perl allows remote SMB servers to execute arbitrary code via a folder name containing shell metacharacters.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/31175; http://securityreason.com/securityalert/4027; http://www.securityfocus.com/archive/1/494536/100/0/threaded
CVE: CVE-2008-3286
Published: 2008-07-24
Description: SWAT 4 1.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via a (1) VERIFYCONTENT or (2) GAMECONFIG command sent to the server before user session initialization, which triggers a NULL pointer dereference; or (3) a GAMESPYRESPONSE command followed by a long RS string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/swat4x-adv.txt; http://aluigi.org/fakep/unrealfp.zip; http://secunia.com/advisories/31158
CVE: CVE-2008-3287
Published: 2008-07-24
Description: retroclient.exe in EMC Dantz Retrospect Backup Client 7.5.116 allows remote attackers to cause a denial of service (daemon crash) via malformed packets to TCP port 497, which trigger a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://kb.dantz.com/display/2/articleDirect/index.asp?aid=9692&r=0.5160639; http://secunia.com/advisories/31186; http://securityreason.com/securityalert/4031
CVE: CVE-2008-3288
Published: 2008-07-24
Description: The Server Authentication Module in EMC Dantz Retrospect Backup Server 7.5.508 uses a "weak hash algorithm," which makes it easier for context-dependent attackers to recover passwords.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://kb.dantz.com/display/2/articleDirect/index.asp?aid=9692&r=0.5160639; http://secunia.com/advisories/31186; http://securityreason.com/securityalert/4026
CVE: CVE-2008-3289
Published: 2008-07-24
Description: EMC Dantz Retrospect Backup Client 7.5.116 sends the password hash in cleartext at an unspecified point, which allows remote attackers to obtain sensitive information via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://kb.dantz.com/display/2/articleDirect/index.asp?aid=9692&r=0.5160639; http://secunia.com/advisories/31186; http://securityreason.com/securityalert/4025
CVE: CVE-2008-3290
Published: 2008-07-24
Description: retroclient.exe in EMC Dantz Retrospect Backup Client 7.5.116 allows remote attackers to cause a denial of service (daemon crash) via a series of long packets containing 0x00 characters to TCP port 497 that trigger memory corruption, probably involving an English product version on a Chinese OS version.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://kb.dantz.com/display/2/articleDirect/index.asp?aid=9692&r=0.5160639; http://secunia.com/advisories/31186; http://securityreason.com/securityalert/4024
CVE: CVE-2008-3291
Published: 2008-07-24
Description: SQL injection vulnerability in index.php in AproxEngine (aka Aprox CMS Engine) 5.1.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4032; http://www.aprox.de/index.php?id=001; http://www.securityfocus.com/bid/30295
CVE: CVE-2008-3292
Published: 2008-07-24
Description: constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the photoalbumadmin cookie, as demonstrated via addpage.php.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://securityreason.com/securityalert/4033; http://www.securityfocus.com/bid/30343; https://exchange.xforce.ibmcloud.com/vulnerabilities/43938
CVE: CVE-2008-3293
Published: 2008-07-24
Description: Directory traversal vulnerability in download.php in EZWebAlbum allows remote attackers to read arbitrary files via the dlfilename parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4034; http://www.securityfocus.com/archive/1/494573/100/0/threaded; http://www.securityfocus.com/bid/30311
CVE: CVE-2008-3294
Published: 2008-07-24
Description: src/configure.in in Vim 5.0 through 7.1, when used for a build with Python support, does not ensure that the Makefile-conf temporary file has the intended ownership and permissions, which allows local users to execute arbitrary code by modifying this file during a time window, or by creating it ahead of time with permissions that prevent its modification by configure.
CVSS Score: 3.7 (LOW)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://seclists.org/fulldisclosure/2008/Jul/0312.html; http://secunia.com/advisories/31159
CVE: CVE-2008-3295
Published: 2008-07-25
Description: Cross-site scripting (XSS) vulnerability in modules/system/admin.php in XOOPS 2.0.18.1 allows remote attackers to inject arbitrary web script or HTML via the fct parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/30330; https://exchange.xforce.ibmcloud.com/vulnerabilities/43965; http://www.securityfocus.com/bid/30330
CVE: CVE-2008-3296
Published: 2008-07-25
Description: Directory traversal vulnerability in modules/system/admin.php in XOOPS 2.0.18 1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the fct parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/30330; https://exchange.xforce.ibmcloud.com/vulnerabilities/43966; http://www.securityfocus.com/bid/30330
CVE: CVE-2008-3297
Published: 2008-07-25
Description: Multiple SQL injection vulnerabilities in SocialEngine (SE) before 2.83 allow remote attackers to execute arbitrary SQL commands via (1) an se_user cookie to include/class_user.php or (2) an se_admin cookie to include/class_admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31203; http://securityreason.com/securityalert/4035; http://www.securityfocus.com/archive/1/494638/100/0/threaded
CVE: CVE-2008-3298
Published: 2008-07-25
Description: SocialEngine (SE) before 2.83 grants certain write privileges for templates, which allows remote authenticated administrators to execute arbitrary PHP code.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/31203; http://securityreason.com/securityalert/4035; http://www.securityfocus.com/archive/1/494638/100/0/threaded
CVE: CVE-2008-3299
Published: 2008-07-25
Description: eSyndiCat 1.6 allows remote attackers to bypass authentication and gain administrative access by setting the admin_lng cookie value to 1. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/30332; https://exchange.xforce.ibmcloud.com/vulnerabilities/43972; http://www.securityfocus.com/bid/30332
CVE: CVE-2008-3300
Published: 2008-07-25
Description: AlphAdmin CMS 1.0.5/03 allows remote attackers to bypass authentication and gain administrative access by setting the aa_login cookie value to 1.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/30333; https://exchange.xforce.ibmcloud.com/vulnerabilities/43970; http://www.securityfocus.com/bid/30333
CVE: CVE-2008-3301
Published: 2008-07-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in BilboBlog 0.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) content parameter to admin/update.php, related to conflicting code in widget.php; and allow remote attackers to inject arbitrary web script or HTML via the (2) titleId parameter to head.php, reachable through index.php; the (3) t_lang[lang_copyright] parameter to footer.php; the (4) content parameter to the default URI under admin/; the (5) url, (6) t_lang[lang_admin_help], (7) t_lang[lang_admin_clear_cache], (8) t_lang[lang_admin_home], and (9) t_lang[lang_admin_logout] parameters to admin/homelink.php; and the (10) t_lang[lang_admin_new_post] parameter to admin/post.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/31054; http://www.securityfocus.com/bid/30228; https://exchange.xforce.ibmcloud.com/vulnerabilities/43764
CVE: CVE-2008-3302
Published: 2008-07-25
Description: SQL injection vulnerability in admin/delete.php in BilboBlog 0.2.1, when magic_quotes_gpc is disabled, allows remote authenticated administrators to execute arbitrary SQL commands via the num parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31054; http://securityreason.com/securityalert/4036; https://exchange.xforce.ibmcloud.com/vulnerabilities/43765
CVE: CVE-2008-3303
Published: 2008-07-25
Description: admin/login.php in BilboBlog 0.2.1, when register_globals is enabled, allows remote attackers to bypass authentication and obtain administrative access via a direct request that sets the login, admin_login, password, and admin_passwd parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/31054; http://securityreason.com/securityalert/4036; http://www.securityfocus.com/bid/30225
CVE: CVE-2008-3304
Published: 2008-07-25
Description: BilboBlog 0.2.1 allows remote attackers to obtain sensitive information via (1) an enable_cache=false query string to footer.php or (2) a direct request to pagination.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/43766; https://www.exploit-db.com/exploits/6073; https://exchange.xforce.ibmcloud.com/vulnerabilities/43766
CVE: CVE-2008-3305
Published: 2008-07-25
Description: Cross-site scripting (XSS) vulnerability in mensaje.php in C. Desseno YouTube Blog (ytb) 0.1 allows remote attackers to inject arbitrary web script or HTML via the m parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31161; http://securityreason.com/securityalert/4037; http://www.securityfocus.com/bid/30345
CVE: CVE-2008-3306
Published: 2008-07-25
Description: SQL injection vulnerability in info.php in C. Desseno YouTube Blog (ytb) 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-3307.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31161; https://exchange.xforce.ibmcloud.com/vulnerabilities/44151; http://secunia.com/advisories/31161
CVE: CVE-2008-3307
Published: 2008-07-25
Description: SQL injection vulnerability in todos.php in C. Desseno YouTube Blog (ytb) 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-3306.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31161; http://securityreason.com/securityalert/4037; http://www.securityfocus.com/bid/30345
CVE: CVE-2008-3308
Published: 2008-07-25
Description: PHP remote file inclusion vulnerability in cuenta/cuerpo.php in C. Desseno YouTube Blog (ytb) 0.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the base_archivo parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/31161; http://securityreason.com/securityalert/4037; http://www.securityfocus.com/bid/30345
CVE: CVE-2008-3309
Published: 2008-07-25
Description: SQL injection vulnerability in info_book.asp in DigiLeave 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the book_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4038; http://www.securityfocus.com/bid/30314; http://www.vupen.com/english/advisories/2008/2153/references
CVE: CVE-2008-3310
Published: 2008-07-25
Description: SQL injection vulnerability in default.asp in Pre Survey Poll allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31187; http://securityreason.com/securityalert/4039; https://exchange.xforce.ibmcloud.com/vulnerabilities/43956
CVE: CVE-2008-3311
Published: 2008-07-25
Description: PHP remote file inclusion vulnerability in config.php in Adam Scheinberg Flip 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the incpath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4040; http://www.securityfocus.com/archive/1/494585/100/0/threaded; http://www.securityfocus.com/bid/30312
CVE: CVE-2008-3312
Published: 2008-07-25
Description: Directory traversal vulnerability in lemon_includes/FCKeditor/editor/filemanager/browser/browser.php in Lemon CMS 1.10 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the dir parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this might be an issue in FCKeditor.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/30285; http://www.securityfocus.com/bid/30285/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/43907
CVE: CVE-2008-3313
Published: 2008-07-25
Description: Multiple PHP remote file inclusion vulnerabilities in CreaCMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) cfg[document_uri] parameter to _administration/edition_article/edition_article.php and the (2) cfg[base_uri_admin] parameter to _administration/fonctions/get_liste_langue.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/30284; https://exchange.xforce.ibmcloud.com/vulnerabilities/43906; http://www.securityfocus.com/bid/30284
CVE: CVE-2008-3314
Published: 2008-07-25
Description: ZDaemon 1.08.07 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted type 6 command, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/zdaemonull-adv.txt; http://aluigi.org/poc/zdaemonull.zip; http://secunia.com/advisories/31185
CVE: CVE-2008-3315
Published: 2008-07-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the (1) query string to (a) announcements/messages.php; (b) lostPassword.php and (c) profile.php in auth/; (d) calendar/myagenda.php; (e) group/group.php; (f) learningPath.php, (g) learningPathList.php, and (h) module.php in learnPath/; (i) phpbb/index.php; (j) courseLog.php, (k) course_access_details.php, (l) delete_course_stats.php, (m) userLog.php, and (n) user_access_details.php in tracking/; (o) user/user.php; and (p) user/userInfo.php; the (2) view parameter to (q) tracking/courseLog.php; and the (3) toolId parameter to (r) tracking/toolaccess_details.php.  NOTE: this may overlap CVE-2006-3257 and CVE-2005-1374.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31201; http://securityreason.com/securityalert/4041; http://sourceforge.net/project/shownotes.php?release_id=615030
CVE: CVE-2008-3316
Published: 2008-07-25
Description: Cross-site scripting (XSS) vulnerability in the search feature in the Forum plugin before 2.7.1 for Geeklog allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably related to (1) public_html/index.php, (2) config.php, and (3) functions.inc.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN60419863/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000045.html; http://secunia.com/advisories/31188
CVE: CVE-2008-3317
Published: 2008-07-25
Description: admin/index.php in Maian Search 1.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary search_cookie cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31075; http://securityreason.com/securityalert/4042; http://www.maianscriptworld.co.uk/free-php-scripts/maian-search/development/index.html
CVE: CVE-2008-3318
Published: 2008-07-25
Description: admin/index.php in Maian Weblog 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary weblog_cookie cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/30943; http://www.maianscriptworld.co.uk/free-php-scripts/maian-weblog/development/index.html; http://www.maianscriptworld.co.uk/news.html
CVE: CVE-2008-3319
Published: 2008-07-25
Description: admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary links_cookie cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31068; http://www.maianscriptworld.co.uk/free-php-scripts/maian-links/development/index.html; http://www.maianscriptworld.co.uk/news.html
CVE: CVE-2008-3320
Published: 2008-07-25
Description: admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbook_cookie cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31070; http://www.maianscriptworld.co.uk/free-php-scripts/maian-guestbook/development/index.html; http://www.securityfocus.com/bid/30203
CVE: CVE-2008-3321
Published: 2008-07-25
Description: admin/index.php in Maian Uploader 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary uploader_cookie cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31045; http://www.maianscriptworld.co.uk/free-php-scripts/maian-uploader/development/index.html; http://www.maianscriptworld.co.uk/news.html
CVE: CVE-2008-3322
Published: 2008-07-25
Description: admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary recipe_cookie cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31071; http://www.maianscriptworld.co.uk/news.html; http://www.securityfocus.com/bid/30208
CVE: CVE-2008-3325
Published: 2008-07-25
Description: Cross-site request forgery (CSRF) vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00001.html; http://moodle.org/mod/forum/discuss.php?d=101405; http://secunia.com/advisories/31196
CVE: CVE-2008-3326
Published: 2008-07-25
Description: Cross-site scripting (XSS) vulnerability in blog/edit.php in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the etitle parameter (blog entry title).
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00001.html; http://moodle.org/mod/forum/discuss.php?d=101401; http://secunia.com/advisories/31196
CVE: CVE-2008-3327
Published: 2008-07-25
Description: Moodle 1.6.5, when display_errors is enabled, allows remote attackers to obtain sensitive information via a direct request to (1) blog/blogpage.php and (2) course/report/stats/report.php, which reveals the installation path in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://moodle.org/mod/forum/discuss.php?d=101403; http://www.procheckup.com/Vulnerability_PR08-15.php; http://www.securityfocus.com/archive/1/494657/100/0/threaded
CVE: CVE-2008-2951
Published: 2008-07-27
Description: Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://holisticinfosec.org/content/view/72/45/; http://secunia.com/advisories/31314; http://trac.edgewall.org/wiki/ChangeLog