deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5528
Published: 2008-12-12
Description: Aladdin eSafe 7.0.17.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5529
Published: 2008-12-12
Description: CA eTrust Antivirus 31.6.6086, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5530
Published: 2008-12-12
Description: Ewido Security Suite 4.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5531
Published: 2008-12-12
Description: Fortinet Antivirus 3.113.0.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5532
Published: 2008-12-12
Description: Ikarus Virus Utilities T3.1.1.45.0 and possibly T3.1.1.34.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5533
Published: 2008-12-12
Description: K7AntiVirus 7.10.541 and possibly 7.10.454, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5534
Published: 2008-12-12
Description: ESET NOD32 Antivirus 3662 and possibly 3440, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5535
Published: 2008-12-12
Description: Norman Antivirus 5.80.02, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5536
Published: 2008-12-12
Description: Panda Antivirus 9.0.0.4, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5537
Published: 2008-12-12
Description: PC Tools AntiVirus 4.4.2.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5538
Published: 2008-12-12
Description: Prevx Prevx1 2, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5539
Published: 2008-12-12
Description: RISING Antivirus 21.06.31.00 and possibly 20.61.42.00, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5540
Published: 2008-12-12
Description: Secure Computing Secure Web Gateway (aka Webwasher), when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5541
Published: 2008-12-12
Description: Sophos Anti-Virus 4.33.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5542
Published: 2008-12-12
Description: Sunbelt VIPRE 3.1.1832.2 and possibly 3.1.1633.1, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5543
Published: 2008-12-12
Description: Symantec AntiVirus (SAV) 10, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5544
Published: 2008-12-12
Description: Hacksoft The Hacker 6.3.1.2.174 and possibly 6.3.0.9.081, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5545
Published: 2008-12-12
Description: Trend Micro VSAPI 8.700.0.1004 in Trend Micro AntiVirus, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5546
Published: 2008-12-12
Description: VirusBlokAda VBA32 3.12.8.5, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5547
Published: 2008-12-12
Description: HAURI ViRobot 2008.12.4.1499 and possibly 2008.9.12.1375, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5548
Published: 2008-12-12
Description: VirusBuster 4.5.11.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4723; http://www.securityfocus.com/archive/1/498995/100/0/threaded; http://www.securityfocus.com/archive/1/499043/100/0/threaded
CVE: CVE-2008-5549
Published: 2008-12-12
Description: Unspecified vulnerability in the Sun Java Web Console components in Sun Java System Portal Server 7.1 and 7.2 allows remote attackers to access local files and read the product's configuration information via unknown vectors related to "access to secure files by ThemeServlet."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33120; http://securitytracker.com/id?1021380; http://sunsolve.sun.com/search/document.do?assetkey=1-21-124301-12-1
CVE: CVE-2008-5550
Published: 2008-12-12
Description: Open redirect vulnerability in console/faces/jsp/login/BeginLogin.jsp in Sun Java Web Console 3.0.2 through 3.0.5 and Solaris 10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the redirect_url parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-125950-18-1; http://sunsolve.sun.com/search/document.do?assetkey=1-21-125952-18-1; http://sunsolve.sun.com/search/document.do?assetkey=1-21-136987-02-1
CVE: CVE-2008-5551
Published: 2008-12-12
Description: The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting data at two different positions within an HTML document, related to STYLE elements and the CSS expression property, aka a "double injection."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4724; http://www.securityfocus.com/archive/1/499124/100/0/threaded; http://www.securityfocus.com/bid/32780
CVE: CVE-2008-5552
Published: 2008-12-12
Description: The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks via a CRLF sequence in conjunction with a crafted Content-Type header, as demonstrated by a header with a utf-7 charset value.  NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/499124/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/47277; https://exchange.xforce.ibmcloud.com/vulnerabilities/47441
CVE: CVE-2008-5553
Published: 2008-12-12
Description: The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 disables itself upon encountering a certain X-XSS-Protection HTTP header, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting this header after a CRLF sequence. NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/499124/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/47277; https://exchange.xforce.ibmcloud.com/vulnerabilities/47442
CVE: CVE-2008-5554
Published: 2008-12-12
Description: The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers that appear after a CRLF sequence in a URI, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS or redirection attacks, as demonstrated by the (1) Location and (2) Set-Cookie HTTP headers.  NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/499124/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/47277; https://exchange.xforce.ibmcloud.com/vulnerabilities/47443
CVE: CVE-2008-5555
Published: 2008-12-12
Description: Microsoft Internet Explorer 8.0 Beta 2 relies on the XDomainRequestAllowed HTTP header to authorize data exchange between domains, which allows remote attackers to bypass the product's XSS Filter protection mechanism, and conduct XSS and cross-domain attacks, by injecting this header after a CRLF sequence, related to "XDomainRequest Allowed Injection (XAI)." NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/499124/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/47277; https://exchange.xforce.ibmcloud.com/vulnerabilities/47444
CVE: CVE-2008-5556
Published: 2008-12-12
Description: The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not recognize attack patterns designed to operate against web pages that are encoded with utf-7, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting crafted utf-7 content.  NOTE: the vendor reportedly disputes this issue, stating "Behaviour is by design.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/499124/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/47277; http://www.securityfocus.com/archive/1/499124/100/0/threaded
CVE: CVE-2008-5430
Published: 2008-12-13
Description: Mozilla Thunderbird 2.0.14 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many "Content-type: message/rfc822;" headers, which might allow remote attackers to cause a denial of service (stack consumption or other resource consumption) via a large e-mail message, a related issue to CVE-2006-1173.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://mime.recurity.com/cgi-bin/twiki/view/Main/AttackIntro; http://www.securityfocus.com/archive/1/499038/100/0/threaded; http://www.securityfocus.com/archive/1/499045/100/0/threaded
CVE: CVE-2008-5559
Published: 2008-12-15
Description: SQL injection vulnerability in sendcard.cfm in PostEcards allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33067; http://securityreason.com/securityalert/4725; http://www.securityfocus.com/bid/32719
CVE: CVE-2008-5560
Published: 2008-12-15
Description: PostEcards stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for postcards.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/50629; http://secunia.com/advisories/33067; http://securityreason.com/securityalert/4725
CVE: CVE-2008-5561
Published: 2008-12-15
Description: SQL injection vulnerability in Netref 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) fiche_product.php and (2) presentation.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4726; http://www.securityfocus.com/bid/32725; https://exchange.xforce.ibmcloud.com/vulnerabilities/47191
CVE: CVE-2008-5562
Published: 2008-12-15
Description: ASPPortal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for xportal.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://securityreason.com/securityalert/4727; https://www.exploit-db.com/exploits/7361; http://securityreason.com/securityalert/4727
CVE: CVE-2008-5563
Published: 2008-12-15
Description: Aruba Mobility Controller 2.4.8.x-FIPS, 2.5.x, 3.1.x, 3.2.x, 3.3.1.x, and 3.3.2.x allows remote attackers to cause a denial of service (device crash) via a malformed Extensible Authentication Protocol (EAP) frame.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/33057; http://securityreason.com/securityalert/4728; http://www.arubanetworks.com/support/alerts/aid-12808.asc
CVE: CVE-2008-5564
Published: 2008-12-15
Description: Unspecified vulnerability in the media server in Orb Networks Orb before 2.01.0025 allows remote attackers to cause a denial of service (daemon crash) via a malformed HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/33017; http://securityreason.com/securityalert/4729; http://www.securityfocus.com/archive/1/498904/100/0/threaded
CVE: CVE-2008-5565
Published: 2008-12-15
Description: Cross-site request forgery (CSRF) vulnerability in admin/settings.php in DL PayCart 1.34 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the NewAdmin, NewPass1, and NewPass2 parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/33038; http://securityreason.com/securityalert/4730; https://www.exploit-db.com/exploits/7365
CVE: CVE-2008-5566
Published: 2008-12-15
Description: Cross-site scripting (XSS) vulnerability in index.php in Triangle Solutions PHP Multiple Newsletters 2.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/50659; http://secunia.com/advisories/33065; http://securityreason.com/securityalert/4751
CVE: CVE-2008-5567
Published: 2008-12-15
Description: Cross-site request forgery (CSRF) vulnerability in admin/ad_settings.php in Bonza Cart 1.10 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the NewAdmin, NewPass1, and NewPass2 parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/33037; http://securityreason.com/securityalert/4731; https://www.exploit-db.com/exploits/7366
CVE: CVE-2008-5568
Published: 2008-12-15
Description: Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the admin_id, newpass_1, and newpass_2 parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/33039; http://securityreason.com/securityalert/4735; https://www.exploit-db.com/exploits/7364
CVE: CVE-2008-5569
Published: 2008-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHPepperShop 1.4 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php or (2) shop/kontakt.php, or (3) shop_kunden_mgmt.php or (4) SHOP_KONFIGURATION.php in shop/Admin/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/50568; http://osvdb.org/50569; http://osvdb.org/50570