deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0899
Published: 2008-02-22
Description: Cross-site scripting (XSS) vulnerability in the Administration Console in BEA WebLogic Server and Express 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via URLs that are not properly handled by the Unexpected Exception Page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev2dev.bea.com/pub/advisory/269; http://secunia.com/advisories/29041; http://www.securitytracker.com/id?1019448
CVE: CVE-2008-0900
Published: 2008-02-22
Description: Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://dev2dev.bea.com/pub/advisory/270; http://secunia.com/advisories/29041; http://www.securitytracker.com/id?1019439
CVE: CVE-2008-0901
Published: 2008-02-22
Description: BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been activated, via crafted URLs that indicate whether a guessed password is successful or not.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200, CWE-255
References: http://dev2dev.bea.com/pub/advisory/271; http://secunia.com/advisories/29041; http://www.s21sec.com/avisos/s21sec-040-en.txt
CVE: CVE-2008-0902
Published: 2008-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 6.1 through 10.0 MP1 allow remote attackers to inject arbitrary web script or HTML via unspecified samples.  NOTE: this might be the same issue as CVE-2007-2694.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev2dev.bea.com/pub/advisory/273; http://secunia.com/advisories/29041; http://www.vupen.com/english/advisories/2008/0612/references
CVE: CVE-2008-0903
Published: 2008-02-22
Description: Unspecified vulnerability in the BEA WebLogic Server and Express proxy plugin, as distributed before November 2007 and before 9.2 MP3 and 10.0 MP2, allows remote attackers to cause a denial of service (web server crash) via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/275; http://secunia.com/advisories/29041; http://www.securitytracker.com/id?1019450
CVE: CVE-2008-0904
Published: 2008-02-22
Description: Unspecified vulnerability in the download servlet in BEA Plumtree Collaboration 4.1 through SP2 and AquaLogic Interaction 4.2 through MP1 allows remote attackers to read arbitrary files via a crafted URL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://dev2dev.bea.com/pub/advisory/276; http://osvdb.org/41881; http://secunia.com/advisories/28991
CVE: CVE-2008-0905
Published: 2008-02-22
Description: Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29047; http://www.securityfocus.com/bid/27910; https://www.exploit-db.com/exploits/5162
CVE: CVE-2008-0906
Published: 2008-02-22
Description: SQL injection vulnerability in the Docum module in PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27912; https://exchange.xforce.ibmcloud.com/vulnerabilities/40720; https://www.exploit-db.com/exploits/5161
CVE: CVE-2008-0907
Published: 2008-02-22
Description: SQL injection vulnerability in the Inhalt module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27886; https://www.exploit-db.com/exploits/5163; http://www.securityfocus.com/bid/27886
CVE: CVE-2008-0908
Published: 2008-02-22
Description: SQL injection vulnerability in browse.asp in Schoolwires Academic Portal allows remote attackers to execute arbitrary SQL commands via the c parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29034; http://www.securityfocus.com/bid/27903; https://exchange.xforce.ibmcloud.com/vulnerabilities/40687
CVE: CVE-2008-0909
Published: 2008-02-22
Description: Cross-site scripting (XSS) vulnerability in browse.asp in Schoolwires Academic Portal allows remote attackers to inject arbitrary web script or HTML via the c parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29034; http://www.securityfocus.com/bid/27903; http://secunia.com/advisories/29034
CVE: CVE-2008-0910
Published: 2008-02-22
Description: Multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, F-Secure Protection Service, and others, allow remote attackers to bypass malware detection via a crafted RAR archive.  NOTE: this might be related to CVE-2008-0792.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/28919; http://www.f-secure.com/security/fsc-2008-1.shtml; http://www.securitytracker.com/id?1019405
CVE: CVE-2008-0911
Published: 2008-02-22
Description: SQL injection vulnerability in productdetails.php in iScripts MultiCart 2.0 allows remote authenticated users to execute arbitrary SQL commands via the productid parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29018; http://www.securityfocus.com/bid/27916; https://www.exploit-db.com/exploits/5166
CVE: CVE-2008-0912
Published: 2008-02-22
Description: Multiple heap-based buffer overflows in mlsrv10.exe in Sybase MobiLink 10.0.1.3629 and earlier, as used by SQL Anywhere Developer Edition 10.0.1.3415 and probably other products, allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a long (1) username, (2) version, or (3) remote ID.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/mobilinkhof-adv.txt; http://secunia.com/advisories/29045; http://securityreason.com/securityalert/3691
CVE: CVE-2008-0913
Published: 2008-02-22
Description: Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB or IP.Board) 2.3.4 allows remote attackers to inject arbitrary web script or HTML via crafted BBCodes in an unspecified context.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forums.invisionpower.com/index.php?showtopic=269961; http://secunia.com/advisories/29055; http://forums.invisionpower.com/index.php?showtopic=269961
CVE: CVE-2008-0914
Published: 2008-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Mediation server in IPdiva SSL VPN Server 2.2 before 2.2.8.84 and 2.3 before 2.3.2.14 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060315.html; http://secunia.com/advisories/28963; http://securityreason.com/securityalert/3690
CVE: CVE-2008-0915
Published: 2008-02-22
Description: The Mediation server in IPdiva SSL VPN Server 2.2 before 2.2.8.84 and 2.3 before 2.3.2.14 stores the number of remaining allowed login attempts in a cookie, which makes it easier for remote attackers to conduct brute force attacks by manipulating this cookie's value.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060314.html; http://secunia.com/advisories/28963; http://securityreason.com/securityalert/3692
CVE: CVE-2008-0916
Published: 2008-02-22
Description: SQL injection vulnerability in the Highwood Design hwdVideoShare (com_hwdvideoshare) 1.1.3 Alpha component for Joomla!  allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a viewcategory action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29044; http://www.securityfocus.com/bid/27907; https://exchange.xforce.ibmcloud.com/vulnerabilities/40711
CVE: CVE-2008-0917
Published: 2008-02-22
Description: Cross-site scripting (XSS) vulnerability in Tor World Tor Search 1.1 and earlier, I-Navigator 4.0, Mobile Frontier 2.1 and earlier, Diary.cgi (aka Quotes of the Day) 1.5 and earlier, Tor News 1.21 and earlier, Simple BBS 1.3 and earlier, Interactive BBS 1.3 and earlier, Tor Board 1.1 and earlier, Simple Vote 1.1 and earlier, and Com Vote 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://download.torworld.com/bug/20080221.html; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/29039
CVE: CVE-2008-0918
Published: 2008-02-22
Description: SQL injection vulnerability in includes/count_dl_or_link.inc.php in the astatsPRO (com_astatspro) 1.0.1 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to getfile.php, a different vector than CVE-2008-0839. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29008; https://exchange.xforce.ibmcloud.com/vulnerabilities/40852; http://secunia.com/advisories/29008
CVE: CVE-2008-0919
Published: 2008-02-22
Description: Cross-site scripting (XSS) vulnerability in session/login.php in Open Source Security Information Management (OSSIM) 0.9.9 rc5 and earlier allows remote attackers to inject arbitrary web script or HTML via the dest parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/42006; http://secunia.com/advisories/29046; http://securityreason.com/securityalert/3689
CVE: CVE-2008-0920
Published: 2008-02-22
Description: SQL injection vulnerability in port/modifyportform.php in Open Source Security Information Management (OSSIM) 0.9.9 rc5 allows remote authenticated users to execute arbitrary SQL commands via the portname parameter, which is not properly handled by a validation regular expression.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29046; http://securityreason.com/securityalert/3689; http://www.securityfocus.com/archive/1/488450/100/0/threaded
CVE: CVE-2008-0921
Published: 2008-02-22
Description: SQL injection vulnerability in news.php in beContent 0.3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29061; http://www.securityfocus.com/bid/27928; https://www.exploit-db.com/exploits/5170
CVE: CVE-2008-0922
Published: 2008-02-22
Description: SQL injection vulnerability in the Manuales 0.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cid parameter in a viewdownload action to modules.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27933; https://www.exploit-db.com/exploits/5168; http://www.securityfocus.com/bid/27933
CVE: CVE-2008-0933
Published: 2008-02-25
Description: Multiple race conditions in the CPU Performance Counters (cpc) subsystem in the kernel in Sun Solaris 10 allow local users to cause a denial of service (panic) via unspecified vectors related to kcpc_unbind and kcpc_restore.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/29052; http://sunsolve.sun.com/search/document.do?assetkey=1-26-231466-1; http://www.securityfocus.com/bid/27941
CVE: CVE-2008-0934
Published: 2008-02-25
Description: SQL injection vulnerability in modules.php in the NukeC 2.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id_catg parameter in a ViewCatg action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27937; https://www.exploit-db.com/exploits/5172; http://www.securityfocus.com/bid/27937
CVE: CVE-2008-0935
Published: 2008-02-25
Description: Stack-based buffer overflow in the Novell iPrint Control ActiveX control in ienipp.ocx in Novell iPrint Client before 4.34 allows remote attackers to execute arbitrary code via a long argument to the ExecuteRequest method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=prBBH4JpImA~; http://secunia.com/advisories/27994; http://www.securityfocus.com/bid/27939
CVE: CVE-2008-0936
Published: 2008-02-25
Description: SQL injection vulnerability in index.php in the Prayer List (prayerlist) 1.04 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in a view action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9492&w=2; http://secunia.com/advisories/29063; http://www.securityfocus.com/bid/27934
CVE: CVE-2008-0937
Published: 2008-02-25
Description: SQL injection vulnerability in index.php in the Tiny Event (tinyevent) 1.01 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action, a different vector than CVE-2007-1811.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7815&w=2; http://secunia.com/advisories/29073; http://www.securityfocus.com/bid/27931
CVE: CVE-2008-0938
Published: 2008-02-25
Description: Unspecified vulnerability in the dynamic tracing framework (DTrace) in Sun Solaris 10 allows local users with PRIV_DTRACE_USER or PRIV_DTRACE_PROC privileges to obtain sensitive kernel information via unspecified vectors, a different vulnerability than CVE-2007-4126.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/29037; http://sunsolve.sun.com/search/document.do?assetkey=1-26-231803-1; http://www.securityfocus.com/bid/27942
CVE: CVE-2008-0939
Published: 2008-02-25
Description: Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the photo parameter to index.php, used by the wppa_photo_name function; or (2) the album parameter to index.php, used by the wppa_album_name function.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://me.mywebsight.ws/web/wppa/; http://secunia.com/advisories/28988; http://securityreason.com/securityalert/3693
CVE: CVE-2008-0940
Published: 2008-02-25
Description: Cross-site scripting (XSS) vulnerability in Plain Black WebGUI before 7.4.24 allows remote attackers to inject arbitrary web script or HTML when creating a username, a different vulnerability than CVE-2007-0407.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28967; http://www.plainblack.com/getwebgui/advisories/webgui-7_4_24-stable-released; http://www.securityfocus.com/bid/27869
CVE: CVE-2008-0932
Published: 2008-02-25
Description: diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466449; http://secunia.com/advisories/25400; http://secunia.com/advisories/29012
CVE: CVE-2008-0941
Published: 2008-02-25
Description: Cross-site scripting (XSS) vulnerability in Eagle Software Aeries Browser Interface (ABI) 3.8.2.8 allows remote authenticated users to inject arbitrary web script or HTML via an event.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29053; http://securityreason.com/securityalert/3694; http://www.securityfocus.com/archive/1/488430/100/0/threaded
CVE: CVE-2008-0942
Published: 2008-02-25
Description: SQL injection vulnerability in GradebookStuScores.asp in Eagle Software Aeries Browser Interface (ABI) 3.8.2.8 allows remote attackers to execute arbitrary SQL commands via the GrdBk parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3695; http://www.securityfocus.com/archive/1/488456/100/0/threaded; http://www.securityfocus.com/bid/27924
CVE: CVE-2008-0943
Published: 2008-02-25
Description: Multiple SQL injection vulnerabilities in Eagle Software Aeries Browser Interface (ABI) 3.7.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) FC parameter to Comments.asp, or the Term parameter to (2) Labels.asp or (3) ClassList.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29053; http://securityreason.com/securityalert/3696; http://www.securityfocus.com/archive/1/488428/100/0/threaded
CVE: CVE-2008-0944
Published: 2008-02-25
Description: Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote attackers to cause a denial of service (NULL dereference and application crash) via a version field containing zero.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/ipsimene-adv.txt; http://secunia.com/advisories/28824; http://securityreason.com/securityalert/3697
CVE: CVE-2008-0945
Published: 2008-02-25
Description: Format string vulnerability in the logging function in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in an IP address field.
CVSS Score: 3.5 (LOW)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/ipsimene-adv.txt; http://aluigi.org/poc/ipsimene.zip; http://secunia.com/advisories/28824
CVE: CVE-2008-0946
Published: 2008-02-25
Description: Directory traversal vulnerability in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to create arbitrary empty files via a .. (dot dot) in the recipient field.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/ipsimene-adv.txt; http://aluigi.org/poc/ipsimene.zip; http://securityreason.com/securityalert/3697
CVE: CVE-2008-0929
Published: 2008-02-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2008-0973
Published: 2008-02-25
Description: Buffer overflow in Double-Take (aka HP StorageWorks Storage Mirroring) 4.5.0.1629, and other 4.5.0.x versions, allows remote attackers to have an unknown impact via a packet with a long string in the username field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/doubletakedown-adv.txt; http://aluigi.org/poc/doubletakedown.zip; http://secunia.com/advisories/29075
CVE: CVE-2008-0974
Published: 2008-02-25
Description: Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service (daemon termination) via (1) a large vector<T> value, which raises a "vector<T> too long" exception; or (2) a certain packet that raises an ospace/time/src\date.cpp exception.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/doubletakedown-adv.txt; http://aluigi.org/poc/doubletakedown.zip; http://secunia.com/advisories/29075
CVE: CVE-2008-0975
Published: 2008-02-25
Description: Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service (CPU consumption) via a -1 value in the field that specifies the size of the vector<T> value.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/doubletakedown-adv.txt; http://aluigi.org/poc/doubletakedown.zip; http://secunia.com/advisories/29075
CVE: CVE-2008-0976
Published: 2008-02-25
Description: Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed packet, as demonstrated by a packet of type (1) 0x2722 or (2) 0x272a.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/doubletakedown-adv.txt; http://aluigi.org/poc/doubletakedown.zip; http://secunia.com/advisories/29075
CVE: CVE-2008-0977
Published: 2008-02-25
Description: Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service (daemon crash) via a certain long packet that triggers an attempt to allocate a large amount of memory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/doubletakedown-adv.txt; http://aluigi.org/poc/doubletakedown.zip; http://secunia.com/advisories/29075
CVE: CVE-2008-0978
Published: 2008-02-25
Description: Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to obtain sensitive information via a packet of type (1) 0x2728, which provides operating system and path information; (2) 0x274e, which lists Ethernet adapters; (3) 0x2726, which provides filesystem information; (4) 0x274f, which specifies the printer driver; or (5) 0x2757, which provides recent log entries.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://aluigi.altervista.org/adv/doubletakedown-adv.txt; http://aluigi.org/poc/doubletakedown.zip; http://secunia.com/advisories/29075
CVE: CVE-2008-0979
Published: 2008-02-25
Description: Stack consumption vulnerability in Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service (daemon crash) via a certain packet that triggers the recursive calling of a function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/doubletakedown-adv.txt; http://aluigi.org/poc/doubletakedown.zip; http://secunia.com/advisories/29075
CVE: CVE-2008-0980
Published: 2008-02-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Spyce - Python Server Pages (PSP) 2.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the url or type parameter to docs/examples/redirect.spy; (2) the x parameter to docs/examples/handlervalidate.spy; (3) the name parameter to spyce/examples/request.spy; (4) the Name parameter to spyce/examples/getpost.spy; (5) the mytextarea parameter, the mypass parameter, or an empty parameter to spyce/examples/formtag.spy; (6) the newline parameter to the default URI under demos/chat/; (7) the text1 parameter to docs/examples/formintro.spy; or (8) the mytext or mydate parameter to docs/examples/formtag.spy.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3699; http://www.procheckup.com/Vulnerability_PR08-01.php; http://www.securityfocus.com/archive/1/488336/100/0/threaded
CVE: CVE-2008-0981
Published: 2008-02-25
Description: Open redirect vulnerability in spyce/examples/redirect.spy in Spyce - Python Server Pages (PSP) 2.1.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/3699; http://www.procheckup.com/Vulnerability_PR08-01.php; http://www.securityfocus.com/archive/1/488336/100/0/threaded
CVE: CVE-2008-0982
Published: 2008-02-25
Description: Spyce - Python Server Pages (PSP) 2.1.3 allows remote attackers to obtain sensitive information via a direct request for spyce/examples/automaton.spy, which reveals the path in an error message.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/3699; http://www.procheckup.com/Vulnerability_PR08-01.php; http://www.securityfocus.com/archive/1/488336/100/0/threaded