deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1916
Published: 2008-04-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-rc1 module for Drupal allow remote attackers to inject arbitrary web script or HTML via text fields intended for the (1) address and (2) order information, which are later displayed on the order view page and unspecified other administrative pages, a different vulnerability than CVE-2008-1428.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/241944; http://www.vupen.com/english/advisories/2008/1083/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41624
CVE: CVE-2008-1917
Published: 2008-04-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in AMFPHP 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) class parameter to (a) methodTable.php, (b) code.php, and (c) details.php in browser/; and the (2) location parameter to browser/code.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28789; https://exchange.xforce.ibmcloud.com/vulnerabilities/41835; http://www.securityfocus.com/bid/28789
CVE: CVE-2008-1918
Published: 2008-04-23
Description: SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submit_info[] parameter in a link submission action.  NOTE: it was later reported that 7.00.2 is also affected.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/51052; http://secunia.com/advisories/29930; http://secunia.com/advisories/33295
CVE: CVE-2008-1919
Published: 2008-04-23
Description: SQL injection vulnerability in listtest.php in YourFreeWorld Apartment Search Script allows remote attackers to execute arbitrary SQL commands via the r parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29929; http://www.securityfocus.com/bid/28853; http://www.vupen.com/english/advisories/2008/1339/references
CVE: CVE-2008-1920
Published: 2008-04-23
Description: Heap-based buffer overflow in the boxelyRenderer module in the Personal Status Manager feature in ICQ 6.0 build 6043 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted personal status message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29821; http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-04-08; http://www.securityfocus.com/archive/1/490921/100/0/threaded
CVE: CVE-2008-1921
Published: 2008-04-23
Description: SQL injection vulnerability in store_pages/category_list.php in 5th Avenue Shopping Cart 1.2 trial edition allows remote attackers to execute arbitrary SQL commands via the category_ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forum.aria-security.com/showthread.php?p=76; http://forum.aria-security.net/showthread.php?p=2233; http://secunia.com/advisories/29887
CVE: CVE-2008-1897
Published: 2008-04-23
Description: The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake.  NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://bugs.digium.com/view.php?id=10078; http://downloads.digium.com/pub/security/AST-2008-006.html; http://secunia.com/advisories/29927
CVE: CVE-2008-1923
Published: 2008-04-23
Description: The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message.
CVSS Score: 7.1 (HIGH)
CWE: CWE-16
References: http://bugs.digium.com/view.php?id=10078; http://downloads.digium.com/pub/security/AST-2008-006.html; http://www.altsci.com/concepts/page.php?s=asteri&p=1
CVE: CVE-2008-1924
Published: 2008-04-23
Description: Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html; http://secunia.com/advisories/29944
CVE: CVE-2008-1925
Published: 2008-04-24
Description: Buffer overflow in InspIRCd before 1.1.18, when using the namesx and uhnames modules, allows remote attackers to cause a denial of service (daemon crash) via a large number of channel users with crafted nicknames, idents, and long hostnames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/29610; http://secunia.com/advisories/30163; http://security.gentoo.org/glsa/glsa-200805-08.xml
CVE: CVE-2008-1926
Published: 2008-04-24
Description: Argument injection vulnerability in login (login-utils/login.c) in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log injection."
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git%3Ba=blobdiff%3Bf=login-utils/login.c%3Bh=230121316d953c59e7842c1325f6e9f326a37608%3Bhp=aad27794327c60391b5148b367d2c79338fc6ee4%3Bhb=8ccf0b253ac0f4f58d64bc9674de18bff5a88782%3Bhpb=3a4a13b12a8065b0b5354686d2807cce421a9973; http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git%3Ba=commit%3Bh=8ccf0b253ac0f4f58d64bc9674de18bff5a88782; http://secunia.com/advisories/29982
CVE: CVE-2008-1927
Published: 2008-04-24
Description: Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters.  NOTE: this issue might only be present on certain operating systems.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454792; http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
CVE: CVE-2008-1928
Published: 2008-04-24
Description: Buffer overflow in Imager 0.42 through 0.63 allows attackers to cause a denial of service (crash) via an image based fill in which the number of input channels is different from the number of output channels.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://imager.perl.org/i/release064/Imager_0_64; http://rt.cpan.org/Public/Bug/Display.html?id=35324; http://secunia.com/advisories/30011
CVE: CVE-2008-1768
Published: 2008-04-25
Description: Multiple integer overflows in VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via the (1) MP4 demuxer, (2) Real demuxer, and (3) Cinepak codec, which triggers a buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/29503; http://secunia.com/advisories/29800; http://security.gentoo.org/glsa/glsa-200804-25.xml
CVE: CVE-2008-1769
Published: 2008-04-25
Description: VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via a crafted Cinepak file that triggers an out-of-bounds array access and memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://bugs.gentoo.org/show_bug.cgi?id=214627#c3; http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit%3Bh=cf489d7bff3c1b36b2d5501ecf21129c78104d98; http://secunia.com/advisories/29503
CVE: CVE-2008-1931
Published: 2008-04-25
Description: Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allow local users to create, write, and read registry keys via a crafted IOCTL request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/29953; http://www.securityfocus.com/archive/1/491249/100/0/threaded; http://www.securityfocus.com/bid/28909
CVE: CVE-2008-1932
Published: 2008-04-25
Description: Integer overflow in Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allows local users to execute arbitrary code via a crafted IOCTL request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/29953; http://www.securityfocus.com/archive/1/491249/100/0/threaded; http://www.securityfocus.com/bid/28909
CVE: CVE-2008-1933
Published: 2008-04-25
Description: Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to overwrite arbitrary files via the SaveToFile method.  NOTE: the victim must explicitly allow the code to run.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/491231/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/42028; https://www.exploit-db.com/exploits/5489
CVE: CVE-2008-1934
Published: 2008-04-25
Description: SQL injection vulnerability in commentaires.php in Crazy Goomba 1.2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28880; http://www.vupen.com/english/advisories/2008/1304/references; http://www.z0rlu.ownspace.org/index.php?/archives/58-Crazy-Goomba-1.2.1-SQL-inj.html
CVE: CVE-2008-1935
Published: 2008-04-25
Description: SQL injection vulnerability in the Filiale 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the idFiliale parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28900; http://www.vupen.com/english/advisories/2008/1346/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41980
CVE: CVE-2008-1936
Published: 2008-04-25
Description: SQL injection vulnerability in index.php in Classifieds Caffe allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in an add action.  NOTE: this issue might be site-specific.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/490985/100/0/threaded; http://www.securityfocus.com/bid/28800; http://www.vupen.com/english/advisories/2008/1240/references
CVE: CVE-2008-1937
Published: 2008-04-25
Description: The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://hg.moinmo.in/moin/1.6/rev/f405012e67af; http://moinmo.in/SecurityFixes; http://secunia.com/advisories/29894
CVE: CVE-2008-1938
Published: 2008-04-25
Description: Sony Mylo COM-2 Japanese model firmware before 1.002 does not properly verify web server SSL certificates, which allows remote attackers to obtain sensitive information and conduct spoofing attacks.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://esupport.sony.com/perl/news-item.pl?news_id=262&mdl=COM2; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://mylo.nccl.sony.co.jp/download/M-W002-001-02/index.html
CVE: CVE-2008-1939
Published: 2008-04-25
Description: Multiple SQL injection vulnerabilities in W1L3D4 Philboard 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) topic parameters to (a) philboard_reply.asp, and the (3) forumid parameter to (b) philboard_newtopic.asp, different vectors than CVE-2007-2641 and CVE-2007-0920.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28871; http://www.vupen.com/english/advisories/2008/1340/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41957
CVE: CVE-2008-1940
Published: 2008-04-25
Description: The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce user_transition_deny and user_transition_allow rules for the (1) sys_setfsuid and (2) sys_setfsgid calls, which allows local users to bypass restrictions for those calls.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/29899; http://www.grsecurity.org/news.php#grsec21113; http://www.securityfocus.com/bid/28889
CVE: CVE-2008-1941
Published: 2008-04-25
Description: Cross-site scripting (XSS) vulnerability in the profile update feature in Akiva WebBoard 8.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in the form field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/29091; http://www.securityfocus.com/bid/28895; https://exchange.xforce.ibmcloud.com/vulnerabilities/41969
CVE: CVE-2008-1942
Published: 2008-04-25
Description: Foxit Reader 2.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with (1) a malformed ExtGState resource containing a /Font resource, or (2) an XObject resource with a Rotate setting, which triggers memory corruption.  NOTE: this is probably a different vulnerability than CVE-2007-2186.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/29934; http://www.securityfocus.com/bid/28890; http://www.vallejo.cc/proyectos/foxitreader1.htm
CVE: CVE-2008-0712
Published: 2008-04-25
Description: Unspecified vulnerability in the HP HPeDiag (aka eSupportDiagnostics) ActiveX control in hpediag.dll in HP Software Update 4.000.009.002 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors.  NOTE: this might overlap CVE-2007-6513.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0901&w=2; http://secunia.com/advisories/29966; http://www.securityfocus.com/bid/28929
CVE: CVE-2008-1953
Published: 2008-04-25
Description: Cross-site scripting (XSS) vulnerability in the Sitedesigner before 1.1.5 search template in Magnolia Enterprise Edition allows remote attackers to inject arbitrary web script or HTML via the query parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jira.magnolia.info/browse/MGNLSD-175; http://secunia.com/advisories/29918; http://www.securityfocus.com/bid/28897
CVE: CVE-2008-1954
Published: 2008-04-25
Description: SQL injection vulnerability in one_day.php in Web Calendar Pro 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the user_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29933; http://www.securityfocus.com/bid/28921; http://www.vupen.com/english/advisories/2008/1343/references
CVE: CVE-2008-1955
Published: 2008-04-25
Description: Cross-site scripting (XSS) vulnerability in rep.php in Martin BOUCHER MyBoard 1.0.12 allows remote attackers to inject arbitrary web script or HTML via the id parameter. information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28823; http://www.z0rlu.ownspace.org/index.php?/archives/52-MyBoard-1.0.12-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/42024
CVE: CVE-2008-1956
Published: 2008-04-25
Description: Cross-site scripting (XSS) vulnerability in index.php in Wikepage Opus 13 2007.2 allows remote attackers to inject arbitrary web script or HTML via the wiki parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29699; http://sourceforge.net/tracker/index.php?func=detail&aid=1938445&group_id=128991&atid=713448; http://www.securityfocus.com/archive/1/491065/100/0/threaded
CVE: CVE-2008-1957
Published: 2008-04-25
Description: SQL injection vulnerability in news.php in Tr Script News 2.1 allows remote attackers to execute arbitrary SQL commands via the nb parameter in voir mode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29814; http://www.securityfocus.com/bid/28876; http://www.vupen.com/english/advisories/2008/1319/references
CVE: CVE-2008-1958
Published: 2008-04-25
Description: Unrestricted file upload vulnerability in the ajout_cat mode in admin/main.php in Tr Script News 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with a .php extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29814; https://exchange.xforce.ibmcloud.com/vulnerabilities/41953; https://www.exploit-db.com/exploits/5483
CVE: CVE-2008-1959
Published: 2008-04-25
Description: Stack-based buffer overflow in the get_remote_video_port_media function in call.cpp in SIPp 3.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SIP message.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29890; http://secunia.com/advisories/30193; http://sourceforge.net/project/shownotes.php?release_id=593806&group_id=104305
CVE: CVE-2008-1960
Published: 2008-04-25
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/contray/search.cgi in ContRay 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29888; http://www.securityfocus.com/bid/28883; https://exchange.xforce.ibmcloud.com/vulnerabilities/41937
CVE: CVE-2008-1961
Published: 2008-04-25
Description: SQL injection vulnerability in index.php in Voice Of Web AllMyGuests 0.4.1 allows remote attackers to execute arbitrary SQL commands via the AMG_id parameter in a comments action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28850; https://exchange.xforce.ibmcloud.com/vulnerabilities/41910; https://www.exploit-db.com/exploits/5469
CVE: CVE-2008-1962
Published: 2008-04-25
Description: Multiple directory traversal vulnerabilities in Aterr 0.9.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) class parameter to include/functions.inc.php and the (2) file parameter to include/common.inc.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28861; https://exchange.xforce.ibmcloud.com/vulnerabilities/41903; https://www.exploit-db.com/exploits/5474
CVE: CVE-2008-1963
Published: 2008-04-25
Description: PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attackers to execute arbitrary PHP code via a URL in the location parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28838; https://exchange.xforce.ibmcloud.com/vulnerabilities/41883; https://www.exploit-db.com/exploits/5463
CVE: CVE-2008-1964
Published: 2008-04-25
Description: Stack-based buffer overflow in the demux_nsf_send_headers function in src/demuxers/demux_nsf.c in xine-lib allows remote attackers to have an unknown impact via a long copyright field in an NSF header in an NES Sound file, a different issue than CVE-2008-1878.  NOTE: a third party claims that the copyright field always has a safe length
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/491248/100/0/threaded; http://www.securityfocus.com/archive/1/491274/100/0/threaded; http://www.securityfocus.com/bid/28908
CVE: CVE-2008-1965
Published: 2008-04-25
Description: Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Symphony and possibly other products, allows remote attackers to execute arbitrary code by injecting a -launcher option via a cai: URI, as demonstrated by a reference to a UNC share pathname.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0640.html; http://secunia.com/advisories/29958; http://thomas.pollet.googlepages.com/lotusexpeditorurihandlervulnerability
CVE: CVE-2008-1966
Published: 2008-04-27
Description: Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service (instance crash) via a call to the (1) RECOVERJAR or (2) REMOVE_JAR procedure with a crafted parameter, related to (a) sqlj.install_jar and (b) sqlj.replace_jar.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/46268; http://osvdb.org/46269; http://secunia.com/advisories/29022
CVE: CVE-2008-1967
Published: 2008-04-27
Description: Cross-site scripting (XSS) vulnerability in CFLogon/CFLogon.asp in Cezanne 6.5.1 and 7 allows remote attackers to inject arbitrary web script or HTML via the SleUserName parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3828; http://www.s21sec.com/avisos/s21sec-41-en.txt; http://www.securityfocus.com/archive/1/490842/100/0/threaded
CVE: CVE-2008-1968
Published: 2008-04-27
Description: Multiple SQL injection vulnerabilities in Cezanne 7 allow remote authenticated users to execute arbitrary SQL commands via the FUNID parameter to (1) CFLookup.asp and (2) CznCommon/CznCustomContainer.asp.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/3830; http://www.s21sec.com/avisos/s21sec-43-en.txt; http://www.securityfocus.com/archive/1/490843/100/0/threaded
CVE: CVE-2008-1969
Published: 2008-04-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary web script or HTML via the (1) LookUPId and (2) CbFun parameters to (a) CFLookUP.asp; (3) TitleParms, (4) WidgetsHeights, (5) WidgetsLinks, and (6) WidgetsTitles parameters to (b) CznCommon/CznCustomContainer.asp, (7) CFTARGET parameter to (c) home.asp, (8) PersonOid parameter to (d) PeopleWeb/Cards/CVCard.asp, (9) DESTLINKOID and PersonOID parameters to (e) PeopleWeb/Cards/PayrollCard.asp, and the (10) FolderTemplateId and (11) FolderTemplateName parameters to (f) PeopleWeb/CznDocFolder/CznDFStartProcess.asp.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://securityreason.com/securityalert/3829; http://www.s21sec.com/es/avisos/s21sec-042-en.txt; http://www.securityfocus.com/archive/1/490846/100/0/threaded
CVE: CVE-2008-1970
Published: 2008-04-27
Description: muCommander before 0.8.2 stores credentials.xml with insecure permissions, which allows local users to obtain credentials.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/29893; http://www.mucommander.com/changes.php; http://www.securityfocus.com/bid/28875
CVE: CVE-2008-1971
Published: 2008-04-27
Description: phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) phadmin cookie to admin.php, or (2) in 1.4 and earlier, the ssbadmin cookie to shoutadmin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/29892; http://www.securityfocus.com/bid/28856; https://exchange.xforce.ibmcloud.com/vulnerabilities/41901