deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3328
Published: 2008-07-27
Description: Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31231; http://secunia.com/advisories/31314; http://trac.edgewall.org/wiki/ChangeLog
CVE: CVE-2008-3329
Published: 2008-07-27
Description: Unspecified vulnerability in Links before 2.1, when "only proxies" is enabled, has unknown impact and attack vectors related to providing "URLs to external programs."
CVSS Score: 9.3 (HIGH)
CWE: CWE-59
References: http://links.twibright.com/download/ChangeLog; http://www.securityfocus.com/bid/30422; https://exchange.xforce.ibmcloud.com/vulnerabilities/44035
CVE: CVE-2008-3330
Published: 2008-07-27
Description: Cross-site scripting (XSS) vulnerability in services/obrowser/index.php in Horde 3.2 and Turba 2.2 allows remote attackers to inject arbitrary web script or HTML via the contact name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492578; http://secunia.com/advisories/34609; http://www.securityfocus.com/bid/29745
CVE: CVE-2008-3331
Published: 2008-07-27
Description: Cross-site scripting (XSS) vulnerability in return_dynamic_filters.php in Mantis before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the filter_target parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7956&w=4; http://secunia.com/advisories/30270; http://secunia.com/advisories/31972
CVE: CVE-2008-3332
Published: 2008-07-27
Description: Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7956&w=4; http://secunia.com/advisories/30270; http://secunia.com/advisories/31972
CVE: CVE-2008-3333
Published: 2008-07-27
Description: Directory traversal vulnerability in core/lang_api.php in Mantis before 1.1.2 allows remote attackers to include and execute arbitrary files via the language parameter to the user preferences page (account_prefs_update.php).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30270; http://secunia.com/advisories/31972; http://www.gentoo.org/security/en/glsa/glsa-200809-10.xml
CVE: CVE-2008-3334
Published: 2008-07-27
Description: Cross-site scripting (XSS) vulnerability in MyBB 1.2.x before 1.2.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.mybboard.net/thread-33865.html; http://secunia.com/advisories/31216; http://www.securityfocus.com/bid/30401
CVE: CVE-2008-3335
Published: 2008-07-27
Description: Unspecified vulnerability in PunBB before 1.2.19 allows remote attackers to inject arbitrary SMTP commands via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://punbb.informer.com/; http://punbb.informer.com/download/changelogs/1.2.17_to_1.2.19.txt; http://punbb.informer.com/forums/topic/19539/punbb-1219/
CVE: CVE-2008-3336
Published: 2008-07-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in PunBB before 1.2.19 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1) include/parser.php and (2) moderate.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://punbb.informer.com/; http://punbb.informer.com/download/changelogs/1.2.17_to_1.2.19.txt; http://punbb.informer.com/forums/topic/19539/punbb-1219/
CVE: CVE-2008-3339
Published: 2008-07-28
Description: search_result.cfm in Jobbex JobSite allows remote attackers to obtain sensitive information via unspecified vectors that reveal the installation path in an error message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://holisticinfosec.org/content/view/78/45/; http://secunia.com/advisories/31089; http://support.avidwebtech.com/index.php?_m=news&_a=viewnews&newsid=4
CVE: CVE-2008-3340
Published: 2008-07-28
Description: Cross-site scripting (XSS) vulnerability in search_result.cfm in Jobbex JobSite allows remote attackers to inject arbitrary web script or HTML via the searchFor variable (possibly the opt parameter.)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/78/45/; http://secunia.com/advisories/31089; http://support.avidwebtech.com/index.php?_m=news&_a=viewnews&newsid=4
CVE: CVE-2008-3341
Published: 2008-07-28
Description: Multiple SQL injection vulnerabilities in search_result.cfm in Jobbex JobSite allow remote attackers to execute arbitrary SQL commands via the (1) jobcountryid and (2) jobstateid parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://holisticinfosec.org/content/view/78/45/; http://secunia.com/advisories/31089; http://support.avidwebtech.com/index.php?_m=news&_a=viewnews&newsid=4
CVE: CVE-2008-3342
Published: 2008-07-28
Description: Cross-site scripting (XSS) vulnerability in staticpages/easypublish/index.php in MyioSoft EasyPublish 3.0tr allows remote attackers to inject arbitrary web script or HTML via the read parameter in an edp_News action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31193; http://securityreason.com/securityalert/4050; http://www.securityfocus.com/archive/1/494556/100/0/threaded
CVE: CVE-2008-3343
Published: 2008-07-28
Description: SQL injection vulnerability in staticpages/easypublish/index.php in MyioSoft EasyPublish 3.0tr (trial edition) allows remote attackers to execute arbitrary SQL commands via the read parameter in a search action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31193; http://securityreason.com/securityalert/4050; http://www.securityfocus.com/archive/1/494556/100/0/threaded
CVE: CVE-2008-3344
Published: 2008-07-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in staticpages/easyecards/index.php in MyioSoft EasyE-Cards 3.5 trial edition (tr) and 3.10a allow remote attackers to inject arbitrary web script or HTML via the (1) ResultHtml, (2) dir, (3) SenderName, (4) RecipientName, (5) SenderMail, and (6) RecipientMail parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4071&w=2; http://secunia.com/advisories/31192; http://securityreason.com/securityalert/4049
CVE: CVE-2008-3345
Published: 2008-07-28
Description: SQL injection vulnerability in staticpages/easyecards/index.php in MyioSoft EasyE-Cards 3.5 trial edition (tr) and 3.10a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sid parameter in a pickup action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4071&w=2; http://secunia.com/advisories/31192; http://securityreason.com/securityalert/4049
CVE: CVE-2008-3346
Published: 2008-07-28
Description: SQL injection vulnerability in product_detail.php in ShopCart DX allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31156; http://securityreason.com/securityalert/4045; http://www.securityfocus.com/bid/30337
CVE: CVE-2008-3347
Published: 2008-07-28
Description: SQL injection vulnerability in staticpages/easycalendar/index.php in MyioSoft EasyDynamicPages 3.0 trial edition (tr) allows remote attackers to execute arbitrary SQL commands via the read parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31189; http://securityreason.com/securityalert/4046; http://www.securityfocus.com/archive/1/494551/100/0/threaded
CVE: CVE-2008-3348
Published: 2008-07-28
Description: Cross-site scripting (XSS) vulnerability in staticpages/easycalendar/index.php in MyioSoft EasyDynamicPages 3.0 trial edition (tr) allows remote attackers to inject arbitrary web script or HTML via the year parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31189; http://securityreason.com/securityalert/4046; http://www.securityfocus.com/archive/1/494551/100/0/threaded
CVE: CVE-2007-5400
Published: 2008-07-28
Description: Heap-based buffer overflow in the Shockwave Flash (SWF) frame handling in RealNetworks RealPlayer 10.5 Build 6.0.12.1483 might allow remote attackers to execute arbitrary code via a crafted SWF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html; http://secunia.com/advisories/27620; http://secunia.com/advisories/31321
CVE: CVE-2008-1946
Published: 2008-07-28
Description: The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a (1) locked or (2) expired account by entering the account name on the command line, related to improper use of the pam_succeed_if.so module.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2008-0780.html; http://secunia.com/advisories/31225; http://securitytracker.com/id?1020552
CVE: CVE-2008-3064
Published: 2008-07-28
Description: Unspecified vulnerability in RealNetworks RealPlayer Enterprise, RealPlayer 10, and RealPlayer 10.5 before build 6.0.12.1675 has unknown impact and attack vectors, probably related to accessing local files, aka a "Local resource reference vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://service.real.com/realplayer/security/07252008_player/en/; http://www.securityfocus.com/archive/1/494934/100/0/threaded; http://www.securityfocus.com/bid/30378
CVE: CVE-2008-3066
Published: 2008-07-28
Description: Stack-based buffer overflow in a certain ActiveX control in rjbdll.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, and RealPlayer 10.5 before build 6.0.12.1675 allows remote attackers to execute arbitrary code by importing a file into a media library and then deleting this file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securitytracker.com/id?1020565; http://service.real.com/realplayer/security/07252008_player/en/; http://www.kb.cert.org/vuls/id/461187
CVE: CVE-2008-3323
Published: 2008-07-28
Description: setup.exe before 2.573.2.3 in Cygwin does not properly verify the authenticity of packages, which allows remote Cygwin mirror servers or man-in-the-middle attackers to execute arbitrary code via a package list containing the MD5 checksum of a Trojan horse package.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://cygwin.com/ml/cygwin-announce/2008-08/msg00001.html; http://secunia.com/advisories/31271; http://securityreason.com/securityalert/4051
CVE: CVE-2008-3349
Published: 2008-07-28
Description: Multiple unspecified vulnerabilities in NetApp Data ONTAP, as used on NetApp and IBM eServer platforms, allow remote attackers to execute arbitrary commands, cause a denial of service (system crash), or obtain sensitive information, probably related to insufficient access control for HTTP requests.  NOTE: this may overlap CVE-2008-3160.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://now.netapp.com/NOW/products/cpc/cpc0807-01.shtml; http://now.netapp.com/NOW/products/cpc/cpc0807-02.shtml; http://now.netapp.com/NOW/products/cpc/cpc0807-03.shtml
CVE: CVE-2008-3350
Published: 2008-07-28
Description: dnsmasq 2.43 allows remote attackers to cause a denial of service (daemon crash) by (1) sending a DHCPINFORM while lacking a DHCP lease, or (2) attempting to renew a nonexistent DHCP lease for an invalid subnet as an "unknown client," a different vulnerability than CVE-2008-3214.
CVSS Score: 5.0 (MEDIUM)
References: http://article.gmane.org/gmane.network.dns.dnsmasq.general/2189; http://secunia.com/advisories/31197; http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
CVE: CVE-2008-3351
Published: 2008-07-28
Description: SQL injection vulnerability in atomPhotoBlog.php in Atom PhotoBlog 1.0.9.1 and 1.1.5b1 allows remote attackers to execute arbitrary SQL commands via the photoId parameter in a show action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31205; http://securityreason.com/securityalert/4053; https://exchange.xforce.ibmcloud.com/vulnerabilities/43982
CVE: CVE-2008-3352
Published: 2008-07-28
Description: SQL injection vulnerability in index.php in Live Music Plus 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a Singer action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31214; http://securityreason.com/securityalert/4052; https://exchange.xforce.ibmcloud.com/vulnerabilities/43989
CVE: CVE-2008-3353
Published: 2008-07-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pure Software Lore before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the (1) article comments feature and the (2) search log feature.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://puresw.com/kb/idx.php/8/025/article/Changelog.html; http://secunia.com/advisories/31217; http://www.securityfocus.com/bid/30367
CVE: CVE-2008-3354
Published: 2008-07-28
Description: Multiple PHP remote file inclusion vulnerabilities in the Newbb Plus (newbb_plus) module 0.93 in RunCMS 1.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) bbPath[path] parameter to votepolls.php and the (2) bbPath[root_theme] parameter to config.php, different vectors than CVE-2006-0659.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/30331; http://www.securityfocus.com/bid/30331/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/43969
CVE: CVE-2008-3355
Published: 2008-07-28
Description: SQL injection vulnerability in sitemap.xml.php in Camera Life 2.6.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a photos action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31234; http://securityreason.com/securityalert/4047; http://www.securityfocus.com/bid/30368
CVE: CVE-2008-1667
Published: 2008-07-29
Description: The Probe Builder Service (aka PBOVISServer.exe) in European Performance Systems (EPS) Probe Builder 2.2 before A.02.20.901, as used in HP OpenView Internet Services (OVIS) on Windows, allows remote attackers to kill arbitrary processes via a process ID number in an unspecified opcode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=728; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9585&w=2; http://secunia.com/advisories/31278
CVE: CVE-2008-3100
Published: 2008-07-29
Description: Cross-site scripting (XSS) vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter in a getpasswd action to register.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31264; http://securityreason.com/securityalert/4057; http://www.datensalat.eu/~fabian/cve/CVE-2008-3100-Owl.html
CVE: CVE-2008-3359
Published: 2008-07-29
Description: SQL injection vulnerability in register.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.vupen.com/english/advisories/2008/2213; https://exchange.xforce.ibmcloud.com/vulnerabilities/44143; http://www.vupen.com/english/advisories/2008/2213
CVE: CVE-2008-3360
Published: 2008-07-29
Description: Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code via a long URL in the HREF attribute of an A element, a different vulnerability than CVE-2006-2494.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4058; http://www.securityfocus.com/bid/30317; http://www.securitytracker.com/id?1020521
CVE: CVE-2008-3361
Published: 2008-07-29
Description: Stack-based buffer overflow in IntelliTamper 2.07 allows remote web sites to execute arbitrary code via a long HTTP Server header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4059; http://www.securityfocus.com/bid/30356; https://exchange.xforce.ibmcloud.com/vulnerabilities/44147
CVE: CVE-2008-3362
Published: 2008-07-30
Description: Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct request to the file in wp-content/plugins/downloads-manager/upload/.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4060; http://www.securityfocus.com/bid/30365; https://exchange.xforce.ibmcloud.com/vulnerabilities/43987
CVE: CVE-2008-3363
Published: 2008-07-30
Description: Directory traversal vulnerability in user_portal.php in the Dokeos E-Learning System 1.8.5 on Windows allows remote attackers to include and execute arbitrary local files via a ..\ (dot dot backslash) in the include parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30987; http://securityreason.com/securityalert/4056; http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8.5
CVE: CVE-2008-3364
Published: 2008-07-30
Description: Buffer overflow in the ObjRemoveCtrl Class ActiveX control in OfficeScanRemoveCtrl.dll 7.3.0.1020 in Trend Micro OfficeScan Corp Edition (OSCE) Web-Deployment 7.0, 7.3 build 1343 Patch 4 and other builds, and 8.0; Client Server Messaging Security (CSM) 3.5 and 3.6; and Worry-Free Business Security (WFBS) 5.0 allows remote attackers to execute arbitrary code via a long string in the Server property, and possibly other properties.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1037899&id=EN-1037899; http://secunia.com/advisories/31277; http://secunia.com/advisories/31440
CVE: CVE-2008-3365
Published: 2008-07-30
Description: Directory traversal vulnerability in index.php in Pixelpost 1.7.1 on Windows, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language_full parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31239; http://securityreason.com/securityalert/4062; http://www.pixelpost.org/blog/2008/07/27/pixelpost-171-security-patch
CVE: CVE-2008-3366
Published: 2008-07-30
Description: SQL injection vulnerability in story.php in Pligg CMS Beta 9.9.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: this might overlap CVE-2008-1774.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4063; http://www.vupen.com/english/advisories/2008/2214/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/44021
CVE: CVE-2008-3367
Published: 2008-07-30
Description: Cross-site scripting (XSS) vulnerability in RTE_popup_link.asp in Web Wiz Rich Text Editor (RTE) 3.x and 4.x before 4.03 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://depo2.nm.ru/WebWiz_Rich_Text_Editor_v4.02_XSS.txt; http://secunia.com/advisories/31272; http://securityreason.com/securityalert/4055
CVE: CVE-2008-3368
Published: 2008-07-30
Description: PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via a URL in the type parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/31274; http://securityreason.com/securityalert/4064; http://www.securityfocus.com/bid/30412
CVE: CVE-2008-3369
Published: 2008-07-30
Description: SQL injection vulnerability in products_rss.php in ViArt Shop 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31275; http://securityreason.com/securityalert/4065; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8
CVE: CVE-2008-3370
Published: 2008-07-30
Description: SQL injection vulnerability in the CUA Login Module in EMC Centera Universal Access (CUA) 4.0_4735.p4 allows remote attackers to execute arbitrary SQL commands via the user (user name) field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6717&w=2; http://secunia.com/advisories/31215; http://securityreason.com/securityalert/4066
CVE: CVE-2008-3371
Published: 2008-07-30
Description: Directory traversal vulnerability in install/help.php in TalkBack 2.3.5, and other versions before 2.3.6.2, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4067; http://www.packetstormsecurity.org/0907-exploits/talkback-lfiexec.txt; http://www.scripts.oldguy.us/talkback/release-notes.html
CVE: CVE-2008-3372
Published: 2008-07-30
Description: SQL injection vulnerability in search_form.php in Getacoder Clone allows remote attackers to execute arbitrary SQL commands via the sb_protype parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4068; http://www.securityfocus.com/bid/30388; http://www.vupen.com/english/advisories/2008/2217/references
CVE: CVE-2008-3373
Published: 2008-07-30
Description: The files parsing engine in Grisoft AVG Anti-Virus before 8.0.156 allows remote attackers to cause a denial of service (engine crash) via a crafted UPX compressed file, which triggers a divide-by-zero error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/31290; http://www.grisoft.com/ww.94247; http://www.nruns.com/advisories/%5Bn.runs-SA-2008%20004%5D%20-%20AVG%20Antivirus%20UPX%20parsing%20Divide%20by%20Zero%20Advisory.txt
CVE: CVE-2008-3374
Published: 2008-07-30
Description: SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the rsargs array parameter in an __exp__getFeedContent action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31260; http://svn.gregarius.net/trac/changeset/1788/trunk/gregarius/ajax.php; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8
CVE: CVE-2008-3375
Published: 2008-07-30
Description: The jrCookie function in includes/jamroom-misc.inc.php in JamRoom before 3.4.0 allows remote attackers to bypass authentication and gain administrative access via a boolean value within serialized data in a JMU_Cookie cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31249; http://securityreason.com/securityalert/4069; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8
CVE: CVE-2008-3376
Published: 2008-07-30
Description: Multiple unspecified vulnerabilities in JamRoom before 3.4.0 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31249; http://www.jamroom.net/index.php?m=td_tracker&o=view&id=1177; http://www.jamroom.net/phpBB2/viewtopic.php?t=24454