deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3049
Published: 2008-07-07
Description: The PDF Generator 2 (pdf_generator2) extension 0.5.0 and earlier for TYPO3 allows attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30057; https://exchange.xforce.ibmcloud.com/vulnerabilities/43486
CVE: CVE-2008-3050
Published: 2008-07-07
Description: Unspecified vulnerability in the PDF Generator 2 (pdf_generator2) extension 0.5.0 and earlier for TYPO3 allows attackers to cause a denial of service via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30057; https://exchange.xforce.ibmcloud.com/vulnerabilities/43488
CVE: CVE-2008-3051
Published: 2008-07-07
Description: SQL injection vulnerability in the Pinboard extension 0.0.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; https://exchange.xforce.ibmcloud.com/vulnerabilities/43489; http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/
CVE: CVE-2008-3052
Published: 2008-07-07
Description: Unspecified vulnerability in the SQL Frontend (mh_omsqlio) extension 1.0.11 and earlier for TYPO3 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/30885; http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30051
CVE: CVE-2008-3053
Published: 2008-07-07
Description: SQL injection vulnerability in the SQL Frontend (mh_omsqlio) extension 1.0.11 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30885; http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30051
CVE: CVE-2008-3054
Published: 2008-07-07
Description: SQL injection vulnerability in the Branchenbuch (aka Yellow Pages o (mh_branchenbuch) extension 0.8.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30885; http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; https://exchange.xforce.ibmcloud.com/vulnerabilities/43482
CVE: CVE-2008-3055
Published: 2008-07-07
Description: SQL injection vulnerability in the Support view (ext_tbl) extension 0.0.102 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30041; https://exchange.xforce.ibmcloud.com/vulnerabilities/43479
CVE: CVE-2008-3056
Published: 2008-07-07
Description: SQL injection vulnerability in the Codeon Petition (cd_petition) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30040; https://exchange.xforce.ibmcloud.com/vulnerabilities/43475
CVE: CVE-2008-1676
Published: 2008-07-07
Description: Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://rhn.redhat.com/errata/RHSA-2008-0500.html; http://rhn.redhat.com/errata/RHSA-2008-0577.html; http://secunia.com/advisories/30929
CVE: CVE-2008-2371
Published: 2008-07-07
Description: Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://bugs.gentoo.org/show_bug.cgi?id=228091; http://ftp.gnome.org/pub/GNOME/sources/glib/2.16/glib-2.16.4.changes; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
CVE: CVE-2008-2374
Published: 2008-07-07
Description: src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1284, CWE-1284
References: http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html; http://secunia.com/advisories/30957; http://secunia.com/advisories/31057
CVE: CVE-2008-2430
Published: 2008-07-07
Description: Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/30601; http://secunia.com/advisories/31317; http://secunia.com/secunia_research/2008-29/advisory/
CVE: CVE-2008-2463
Published: 2008-07-07
Description: The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6986&w=2; http://secunia.com/advisories/30883; http://www.exploit-db.com/exploits/6124
CVE: CVE-2008-2667
Published: 2008-07-07
Description: SQL injection vulnerability in the Courier Authentication Library (aka courier-authlib) before 0.60.6 on SUSE openSUSE 10.3 and 11.0, and other platforms, when MySQL and a non-Latin character set are used, allows remote attackers to execute arbitrary SQL commands via the username and unspecified other vectors.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89
References: http://bugs.gentoo.org/show_bug.cgi?id=225407; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html; http://secunia.com/advisories/30591
CVE: CVE-2008-2798
Published: 2008-07-07
Description: Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown vectors related to the layout engine.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2799
Published: 2008-07-07
Description: Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2800
Published: 2008-07-07
Description: Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors involving (1) an event handler attached to an outer window, (2) a SCRIPT element in an unloaded document, or (3) the onreadystatechange handler in conjunction with an XMLHttpRequest.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2801
Published: 2008-07-07
Description: Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly implement JAR signing, which allows remote attackers to execute arbitrary code via (1) injection of JavaScript into documents within a JAR archive or (2) a JAR archive that uses relative URLs to JavaScript files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2802
Published: 2008-07-07
Description: Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allow remote attackers to execute arbitrary code via an XUL document that includes a script from a chrome: URI that points to a fastload file, related to this file's "privilege level."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2803
Published: 2008-07-07
Description: The mozIJSSubScriptLoader.LoadScript function in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 does not apply XPCNativeWrappers to scripts loaded from (1) file: URIs, (2) data: URIs, or (3) certain non-canonical chrome: URIs, which allows remote attackers to execute arbitrary code via vectors involving third-party add-ons.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2805
Published: 2008-07-07
Description: Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 allow remote attackers to force the upload of arbitrary local files from a client computer via vectors involving originalTarget and DOM Range.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2806
Published: 2008-07-07
Description: Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 on Mac OS X allow remote attackers to bypass the Same Origin Policy and create arbitrary socket connections via a crafted Java applet, related to the Java Embedding Plugin (JEP) and Java LiveConnect.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://secunia.com/advisories/30898; http://secunia.com/advisories/30911
CVE: CVE-2008-2807
Published: 2008-07-07
Description: Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly handle an invalid .properties file for an add-on, which allows remote attackers to read uninitialized memory, as demonstrated by use of ISO 8859 encoding instead of UTF-8 encoding in a French .properties file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2808
Published: 2008-07-07
Description: Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly escape HTML in file:// URLs in directory listings, which allows remote attackers to conduct cross-site scripting (XSS) attacks or have unspecified other impact via a crafted filename.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2810
Published: 2008-07-07
Description: Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly identify the context of Windows shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site for which the user has previously saved a shortcut.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2811
Published: 2008-07-07
Description: The block reflow implementation in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image whose display requires more pixels than nscoord_MAX, related to nsBlockFrame::DrainOverflowLines.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://rhn.redhat.com/errata/RHSA-2008-0616.html; http://secunia.com/advisories/30878
CVE: CVE-2008-2927
Published: 2008-07-07
Description: Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin before 2.4.3 and Adium before 1.3 allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, a different vulnerability than CVE-2008-2955.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b[PII_REDACTED]86ee79e4a08fd8/libpurple/protocols/msn/slplink.c; http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b[PII_REDACTED]86ee79e4a08fd8/libpurple/protocols/msnp9/slplink.c; http://secunia.com/advisories/30971
CVE: CVE-2008-2950
Published: 2008-07-07
Description: The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html; http://secunia.com/advisories/30963; http://secunia.com/advisories/31002
CVE: CVE-2008-3067
Published: 2008-07-07
Description: sudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which might allow local users to obtain a password by reading stdin from the parent process after a sudo child process exits.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/43618; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
CVE: CVE-2008-3068
Published: 2008-07-07
Description: Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/3978; http://www.securityfocus.com/archive/1/493947/100/0/threaded; http://www.securityfocus.com/archive/1/494101/100/0/threaded
CVE: CVE-2008-3069
Published: 2008-07-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in MyBB before 1.2.13 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) portal.php and (2) inc/functions_post.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.mybboard.net/attachment.php?aid=9272; http://community.mybboard.net/showthread.php?tid=31666; http://secunia.com/advisories/31013
CVE: CVE-2008-3070
Published: 2008-07-08
Description: Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user['language'] variable, probably related to SQL injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://community.mybboard.net/attachment.php?aid=9272; http://community.mybboard.net/showthread.php?tid=31666; http://secunia.com/advisories/31013
CVE: CVE-2008-3071
Published: 2008-07-08
Description: Directory traversal vulnerability in inc/class_language.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $language variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://community.mybboard.net/attachment.php?aid=9272; http://community.mybboard.net/showthread.php?tid=31666; http://secunia.com/advisories/31013
CVE: CVE-2008-3072
Published: 2008-07-08
Description: Simple Machines Forum (SMF) 1.1.x before 1.1.5 and 1.0.x before 1.0.13, when running in PHP before 4.2.0, does not properly seed the random number generator, which has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/30955; http://www.simplemachines.org/community/index.php?P=c3696c2022b54fa50c5f341bf5710aa3&topic=236816.0; http://secunia.com/advisories/30955
CVE: CVE-2008-3073
Published: 2008-07-08
Description: Unspecified vulnerability in Simple Machines Forum (SMF) 1.1.x before 1.1.5 and 1.0.x before 1.0.13 has unknown impact and attack vectors, probably cross-site scripting (XSS), related to "use of the html-tag."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/30955; http://www.securityfocus.com/bid/30108; http://www.simplemachines.org/community/index.php?P=c3696c2022b54fa50c5f341bf5710aa3&topic=236816.0
CVE: CVE-2008-0085
Published: 2008-07-08
Description: SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 does not initialize memory pages when reallocating memory, which allows database operators to obtain sensitive information (database contents) via unknown vectors related to memory page reuse.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/30970; http://www.securityfocus.com/archive/1/516397/100/0/threaded; http://www.securitytracker.com/id?1020441
CVE: CVE-2008-0086
Published: 2008-07-08
Description: Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to execute arbitrary code via a crafted SQL expression.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30970; http://www.securityfocus.com/archive/1/494082/100/0/threaded; http://www.securityfocus.com/archive/1/516397/100/0/threaded
CVE: CVE-2008-0106
Published: 2008-07-08
Description: Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30970; http://www.securityfocus.com/archive/1/494082/100/0/threaded; http://www.securityfocus.com/archive/1/516397/100/0/threaded
CVE: CVE-2008-0107
Published: 2008-07-08
Description: Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 allows remote authenticated users to execute arbitrary code via a (1) SMB or (2) WebDAV pathname for an on-disk file (aka stored backup file) with a crafted record size value, which triggers a heap-based buffer overflow, aka "SQL Server Memory Corruption Vulnerability."
CVSS Score: 9.0 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=723; http://secunia.com/advisories/30970; http://www.insomniasec.com/advisories/ISVA-080709.1.htm
CVE: CVE-2008-1435
Published: 2008-07-08
Description: Windows Explorer in Microsoft Windows Vista up to SP1, and Server 2008, allows user-assisted remote attackers to execute arbitrary code via crafted saved-search (.search-ms) files that are not properly handled when saving, aka "Windows Saved Search Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30953; http://www.securityfocus.com/bid/30109; http://www.securitytracker.com/id?1020436
CVE: CVE-2008-1447
Published: 2008-07-08
Description: The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-331
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-009.txt.asc; http://blog.invisibledenizen.org/2008/07/kaminskys-dns-issue-accidentally-leaked.html; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401
CVE: CVE-2008-1454
Published: 2008-07-08
Description: Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct cache poisoning attacks via unknown vectors related to accepting "records from a response that is outside the remote server's authority," aka "DNS Cache Poisoning Vulnerability," a different vulnerability than CVE-2008-1447.
CVSS Score: 9.4 (HIGH)
References: http://secunia.com/advisories/30925; http://www.securityfocus.com/bid/30132; http://www.securitytracker.com/id?1020437
CVE: CVE-2008-2247
Published: 2008-07-08
Description: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified e-mail fields, a different vulnerability than CVE-2008-2248.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30964; http://www.securityfocus.com/bid/30130; http://www.securitytracker.com/id?1020439
CVE: CVE-2008-2248
Published: 2008-07-08
Description: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30964; http://www.securityfocus.com/bid/30078; http://www.securitytracker.com/id?1020439