deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1151
Published: 2009-03-26
Description: Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html; http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301
CVE: CVE-2009-1152
Published: 2009-03-26
Description: Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a denial of service (device restart and loss of configuration) by connecting to TCP port 53, then closing the connection.
CVSS Score: 7.3 (HIGH)
References: http://helith.net/txt/siemens_gigaset_se461_wimax_router_remote_dos.txt; http://www.securityfocus.com/bid/34220; https://exchange.xforce.ibmcloud.com/vulnerabilities/49365
CVE: CVE-2008-6529
Published: 2009-03-26
Description: Cross-site scripting (XSS) vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inject arbitrary web script or HTML via the r parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/32761; https://exchange.xforce.ibmcloud.com/vulnerabilities/47214; https://www.exploit-db.com/exploits/7408
CVE: CVE-2008-6530
Published: 2009-03-26
Description: Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/32760; https://exchange.xforce.ibmcloud.com/vulnerabilities/47215; https://www.exploit-db.com/exploits/7408
CVE: CVE-2008-6531
Published: 2009-03-26
Description: The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-12-09; http://secunia.com/advisories/33084; http://www.osvdb.org/52707
CVE: CVE-2008-6532
Published: 2009-03-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modify the database.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/345441; http://secunia.com/advisories/33112; http://secunia.com/advisories/33147
CVE: CVE-2008-6533
Published: 2009-03-26
Description: Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/345441; http://secunia.com/advisories/33112; http://secunia.com/advisories/33147
CVE: CVE-2008-6534
Published: 2009-03-26
Description: Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands via a custom SITE command containing shell metacharacters such as "&" (ampersand) in the middle of an argument.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/32999; http://vuln.sg/nullftpserver1107-en.html; http://www.osvdb.org/50486
CVE: CVE-2008-6535
Published: 2009-03-26
Description: admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the administrative password via a direct request with a modified NewAdmin parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/50682; http://secunia.com/advisories/33036; https://exchange.xforce.ibmcloud.com/vulnerabilities/47203
CVE: CVE-2009-1169
Published: 2009-03-27
Description: The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XML file with a crafted XSLT transform.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blogs.zdnet.com/security/?p=3013; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html
CVE: CVE-2009-0631
Published: 2009-03-27
Description: Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when configured with (1) IP Service Level Agreements (SLAs) Responder, (2) Session Initiation Protocol (SIP), (3) H.323 Annex E Call Signaling Transport, or (4) Media Gateway Control Protocol (MGCP) allows remote attackers to cause a denial of service (blocked input queue on the inbound interface) via a crafted UDP packet.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90426.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml; http://www.securityfocus.com/bid/34245
CVE: CVE-2009-0590
Published: 2009-03-27
Description: The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-008.txt.asc; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
CVE: CVE-2009-0591
Published: 2009-03-27
Description: The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.
CVSS Score: 2.6 (LOW)
CWE: CWE-287
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-008.txt.asc; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
CVE: CVE-2009-0626
Published: 2009-03-27
Description: The SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (device reload or hang) via a crafted HTTPS packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/34438; http://securitytracker.com/id?1021896; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90424.shtml
CVE: CVE-2009-0628
Published: 2009-03-27
Description: Memory leak in the SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (memory consumption and device crash) by disconnecting an SSL session in an abnormal manner, leading to a Transmission Control Block (TCB) leak.
CVSS Score: 9.0 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/34438; http://securitytracker.com/id?1021896; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90424.shtml
CVE: CVE-2009-0629
Published: 2009-03-27
Description: The (1) Airline Product Set (aka ALPS), (2) Serial Tunnel Code (aka STUN), (3) Block Serial Tunnel Code (aka BSTUN), (4) Native Client Interface Architecture (NCIA) support, (5) Data-link switching (aka DLSw), (6) Remote Source-Route Bridging (RSRB), (7) Point to Point Tunneling Protocol (PPTP), (8) X.25 for Record Boundary Preservation (RBP), (9) X.25 over TCP (XOT), and (10) X.25 Routing features in Cisco IOS 12.2 and 12.4 allows remote attackers to cause a denial of service (device reload) via a series of crafted TCP packets.
CVSS Score: 5.4 (MEDIUM)
References: http://secunia.com/advisories/34438; http://securitytracker.com/id?1021903; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml
CVE: CVE-2009-0630
Published: 2009-03-27
Description: The (1) Cisco Unified Communications Manager Express; (2) SIP Gateway Signaling Support Over Transport Layer Security (TLS) Transport; (3) Secure Signaling and Media Encryption; (4) Blocks Extensible Exchange Protocol (BEEP); (5) Network Admission Control HTTP Authentication Proxy; (6) Per-user URL Redirect for EAPoUDP, Dot1x, and MAC Authentication Bypass; (7) Distributed Director with HTTP Redirects; and (8) TCP DNS features in Cisco IOS 12.0 through 12.4 do not properly handle IP sockets, which allows remote attackers to cause a denial of service (outage or resource consumption) via a series of crafted TCP packets.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/34438; http://securitytracker.com/id?1021897; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml
CVE: CVE-2009-0633
Published: 2009-03-27
Description: Multiple unspecified vulnerabilities in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interface outage) via MIPv6 packets, aka Bug ID CSCsm97220.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/34438; http://securitytracker.com/id?1021898; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a9042f.shtml
CVE: CVE-2009-0634
Published: 2009-03-27
Description: Multiple unspecified vulnerabilities in the home agent (HA) implementation in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interface outage) via an ICMP packet, aka Bug ID CSCso05337.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/34438; http://securitytracker.com/id?1021898; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a9042f.shtml
CVE: CVE-2009-0635
Published: 2009-03-27
Description: Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/34438; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90459.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml
CVE: CVE-2009-0636
Published: 2009-03-27
Description: Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when SIP voice services are enabled, allows remote attackers to cause a denial of service (device crash) via a valid SIP message.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/34438; http://securitytracker.com/id?1021902; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml
CVE: CVE-2009-0637
Published: 2009-03-27
Description: The SCP server in Cisco IOS 12.2 through 12.4, when Role-Based CLI Access is enabled, does not enforce the CLI view configuration for file transfers, which allows remote authenticated users with an attached CLI view to (1) read or (2) overwrite arbitrary files via an SCP command.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/34438; http://securitytracker.com/id?1021899; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml
CVE: CVE-2009-0789
Published: 2009-03-27
Description: OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure, which allows remote attackers to cause a denial of service (invalid memory access and application crash) by placing this structure in the public key of a certificate, as demonstrated by an RSA public key.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-008.txt.asc; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
CVE: CVE-2009-0845
Published: 2009-03-27
Description: The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=6402; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/34347
CVE: CVE-2008-4312
Published: 2009-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2007-6721
Published: 2009-03-30
Description: The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
CVSS Score: 10.0 (HIGH)
References: http://freshmeat.net/projects/bouncycastlecryptoapi/releases/265580; http://www.bouncycastle.org/csharp/; http://www.bouncycastle.org/devmailarchive/msg08195.html
CVE: CVE-2008-6536
Published: 2009-03-30
Description: Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats (c10).
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/43649; http://secunia.com/advisories/29434; http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html
CVE: CVE-2008-6537
Published: 2009-03-30
Description: LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the administrator password via the setup "do" action to LightNEasy.php, which is cleared from $_GET but later accessed using $_REQUEST.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/44397; http://secunia.com/advisories/29757; https://exchange.xforce.ibmcloud.com/vulnerabilities/41768
CVE: CVE-2008-6538
Published: 2009-03-30
Description: DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/28426; https://exchange.xforce.ibmcloud.com/vulnerabilities/41384; https://www.exploit-db.com/exploits/5298
CVE: CVE-2008-6539
Published: 2009-03-30
Description: Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitrary administrators and inject arbitrary Python code into destar_cfg.py via a crafted pin parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://www.exploit-db.com/exploits/5305; https://www.exploit-db.com/exploits/5305
CVE: CVE-2008-6540
Published: 2009-03-30
Description: DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/43720; http://secunia.com/advisories/29488; http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno12/tabid/1148/Default.aspx
CVE: CVE-2008-6541
Published: 2009-03-30
Description: Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/43719; http://secunia.com/advisories/29488; http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno11/tabid/1147/Default.aspx
CVE: CVE-2008-6542
Published: 2009-03-30
Description: Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/43721; http://secunia.com/advisories/29488; http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno13/tabid/1149/Default.aspx
CVE: CVE-2008-6543
Published: 2009-03-30
Description: Multiple PHP remote file inclusion vulnerabilities in ComScripts TEAM Quick Classifieds 1.0 via the DOCUMENT_ROOT parameter to (1) index.php3, (2) locate.php3, (3) search_results.php3, (4) classifieds/index.php3, and (5) classifieds/view.php3; (6) index.php3, (7) manager.php3, (8) pass.php3, (9) remember.php3 (10) sign-up.php3, (11) update.php3, (12) userSet.php3, and (13) verify.php3 in controlcenter/; (14) alterCats.php3, (15) alterFeatured.php3, (16) alterHomepage.php3, (17) alterNews.php3, (18) alterTheme.php3, (19) color_help.php3, (20) createdb.php3, (21) createFeatured.php3, (22) createHomepage.php3, (23) createL.php3, (24) createM.php3, (25) createNews.php3, (26) createP.php3, (27) createS.php3, (28) createT.php3, (29) index.php3, (30) mailadmin.php3, and (31) setUp.php3 in controlpannel/; (32) include/sendit.php3 and (33) include/sendit2.php3; and possibly (34) include/adminHead.inc, (35) include/usersHead.inc, and (36) style/default.scheme.inc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28417; http://www.securityfocus.com/bid/28417/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/42469
CVE: CVE-2008-6544
Published: 2009-03-30
Description: Multiple PHP remote file inclusion vulnerabilities in Simple Machines Forum (SMF) 1.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) settings[default_theme_dir] parameter to Sources/Subs-Graphics.php and (2) settings[default_theme_dir] parameter to Sources/Themes.php.  NOTE: CVE and multiple third parties dispute this issue because the files contain a protection mechanism against direct request
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-03/0425.html; http://archives.neohapsis.com/archives/bugtraq/2008-03/0426.html; http://archives.neohapsis.com/archives/bugtraq/2008-03/0431.html
CVE: CVE-2008-6545
Published: 2009-03-30
Description: PHP remote file inclusion vulnerability in news/include/createdb.php in Web Server Creator Web Portal 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the langfile parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.osvdb.org/53093; http://www.securityfocus.com/bid/28631; https://exchange.xforce.ibmcloud.com/vulnerabilities/43555
CVE: CVE-2008-6546
Published: 2009-03-30
Description: Unspecified vulnerability in phpns before 2.1.3 has unknown impact and attack vectors related to "activation permissions."
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/48867; http://phpns.alecwh.com/news.php?a=2; http://osvdb.org/48867
CVE: CVE-2008-6547
Published: 2009-03-30
Description: schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/47082; http://secunia.com/advisories/31081; http://secunia.com/advisories/31163
CVE: CVE-2008-6548
Published: 2009-03-30
Description: The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862
References: http://hg.moinmo.in/moin/1.6/rev/35ff7a9b1546; http://moinmo.in/SecurityFixes; http://osvdb.org/48877
CVE: CVE-2008-6549
Published: 2009-03-30
Description: The password_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are not thread-safe, which allows remote attackers to cause a denial of service (segmentation fault and crash) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://hg.moinmo.in/moin/1.6/rev/35ff7a9b1546; http://moinmo.in/SecurityFixes; http://osvdb.org/48876
CVE: CVE-2008-6550
Published: 2009-03-30
Description: Cross-site scripting (XSS) vulnerability in glossaire.php in Glossaire 2.0 allows remote attackers to inject arbitrary web script or HTML via the letter parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/28609.html; http://www.securityfocus.com/bid/28609; https://exchange.xforce.ibmcloud.com/vulnerabilities/49772
CVE: CVE-2008-6551
Published: 2009-03-30
Description: Multiple directory traversal vulnerabilities in e-Vision CMS 2.0.2 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) an adminlang cookie to admin/ind_ex.php; or the module parameter to (2) 3rdparty/adminpart/add3rdparty.php, (3) polling/adminpart/addpolling.php, (4) contact/adminpart/addcontact.php, (5) brandnews/adminpart/addbrandnews.php, (6) newsletter/adminpart/addnewsletter.php, (7) game/adminpart/addgame.php, (8) tour/adminpart/addtour.php, (9) articles/adminpart/addarticles.php, (10) product/adminpart/addproduct.php, or (11) plain/adminpart/addplain.php in modules/.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/32180; https://exchange.xforce.ibmcloud.com/vulnerabilities/46457; https://www.exploit-db.com/exploits/7031
CVE: CVE-2008-6552
Published: 2009-03-30
Description: Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://osvdb.org/50299; http://osvdb.org/50300; http://osvdb.org/50301
CVE: CVE-2008-6553
Published: 2009-03-30
Description: microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows remote attackers to (1) create administrative accounts via an add_admin action, (2) remove administrative accounts via a delete_admin action, and (3) modify administrative passwords via a change_password action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://downloads.securityfocus.com/vulnerabilities/exploits/32063.pl; http://www.securityfocus.com/bid/32063; https://exchange.xforce.ibmcloud.com/vulnerabilities/46294