morpheuslord/cve-llm-training huggingface dataset:
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1902.

assistant: The GUI for aptlinex before 0.91 does not sufficiently warn the user of potentially dangerous actions, which allows remote attackers to remove or modify packages via an apt:// URL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1903.

assistant: PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the newsoffice_directory parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1904.

assistant: Cicoandcico CcMail 1.0.1 and earlier does not verify that the this_cookie cookie corresponds to an authenticated session, which allows remote attackers to obtain access to the "admin area" via a modified this_cookie cookie.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1905.

assistant: NMMediaServer.exe in Nero MediaHome 3.3.3.0 and earlier, as used in Nero 8.3.2.1 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a long HTTP request to TCP port 54444, a different vector than CVE-2007-2322.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1906.

assistant: Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a view.year action.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1907.

assistant: Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_product, (2) id_manufacturer, and (3) id_category parameters to unspecified components.  NOTE: this probably overlaps CVE-2007-2959 and CVE-2007-2890.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1908.

assistant: Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the language parameter in a language action to the default URI, which is not properly handled in actions/language.act.php, or (2) the action parameter to category.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1909.

assistant: SQL injection vulnerability in comment.php in PHP Knowledge Base (PHPKB) 1.5 and 2.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1910.

assistant: Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 SP2 allows remote attackers to execute arbitrary code via a malformed opcode 0x52 request to TCP port 3050. NOTE: this might overlap CVE-2007-5243 or CVE-2007-5244.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1911.

assistant: SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a cookpass cookie.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1912.

assistant: Stack-based buffer overflow in DivX Player 6.7 build 6.7.0.22 and earlier allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long subtitle in a .SRT file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1913.

assistant: SQL injection vulnerability in index.php in Lasernet CMS 1.5 and 1.11, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the new parameter in a new action.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1914.

assistant: Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows remote attackers to execute arbitrary code via a long URI in a request to TCP port 6080. NOTE: some of these details are obtained from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1915.

assistant: SQL injection vulnerability in view.asp in DevWorx BlogWorx 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1916.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-rc1 module for Drupal allow remote attackers to inject arbitrary web script or HTML via text fields intended for the (1) address and (2) order information, which are later displayed on the order view page and unspecified other administrative pages, a different vulnerability than CVE-2008-1428.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1917.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in AMFPHP 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) class parameter to (a) methodTable.php, (b) code.php, and (c) details.php in browser/; and the (2) location parameter to browser/code.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1918.

assistant: SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submit_info[] parameter in a link submission action.  NOTE: it was later reported that 7.00.2 is also affected.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1919.

assistant: SQL injection vulnerability in listtest.php in YourFreeWorld Apartment Search Script allows remote attackers to execute arbitrary SQL commands via the r parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1920.

assistant: Heap-based buffer overflow in the boxelyRenderer module in the Personal Status Manager feature in ICQ 6.0 build 6043 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted personal status message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1921.

assistant: SQL injection vulnerability in store_pages/category_list.php in 5th Avenue Shopping Cart 1.2 trial edition allows remote attackers to execute arbitrary SQL commands via the category_ID parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1922.

assistant: Multiple stack-based buffer overflows in Sarg might allow attackers to execute arbitrary code via unknown vectors, probably a crafted Squid log file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1923.

assistant: The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1924.

assistant: Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1925.

assistant: Buffer overflow in InspIRCd before 1.1.18, when using the namesx and uhnames modules, allows remote attackers to cause a denial of service (daemon crash) via a large number of channel users with crafted nicknames, idents, and long hostnames.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1926.

assistant: Argument injection vulnerability in login (login-utils/login.c) in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log injection."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1927.

assistant: Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters.  NOTE: this issue might only be present on certain operating systems.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1928.

assistant: Buffer overflow in Imager 0.42 through 0.63 allows attackers to cause a denial of service (crash) via an image based fill in which the number of input channels is different from the number of output channels.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1930.

assistant: The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allows remote attackers to forge cookies by registering a username that results in the same concatenated string, as demonstrated by registering usernames beginning with "admin" to obtain administrator privileges, aka a "cryptographic splicing" issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-6013.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1931.

assistant: Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allow local users to create, write, and read registry keys via a crafted IOCTL request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1932.

assistant: Integer overflow in Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allows local users to execute arbitrary code via a crafted IOCTL request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1933.

assistant: Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to overwrite arbitrary files via the SaveToFile method.  NOTE: the victim must explicitly allow the code to run.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1934.

assistant: SQL injection vulnerability in commentaires.php in Crazy Goomba 1.2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1935.

assistant: SQL injection vulnerability in the Filiale 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the idFiliale parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1936.

assistant: SQL injection vulnerability in index.php in Classifieds Caffe allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in an add action.  NOTE: this issue might be site-specific.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1937.

assistant: The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1938.

assistant: Sony Mylo COM-2 Japanese model firmware before 1.002 does not properly verify web server SSL certificates, which allows remote attackers to obtain sensitive information and conduct spoofing attacks.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1939.

assistant: Multiple SQL injection vulnerabilities in W1L3D4 Philboard 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) topic parameters to (a) philboard_reply.asp, and the (3) forumid parameter to (b) philboard_newtopic.asp, different vectors than CVE-2007-2641 and CVE-2007-0920.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1940.

assistant: The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce user_transition_deny and user_transition_allow rules for the (1) sys_setfsuid and (2) sys_setfsgid calls, which allows local users to bypass restrictions for those calls.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1941.

assistant: Cross-site scripting (XSS) vulnerability in the profile update feature in Akiva WebBoard 8.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in the form field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1942.

assistant: Foxit Reader 2.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with (1) a malformed ExtGState resource containing a /Font resource, or (2) an XObject resource with a Rotate setting, which triggers memory corruption.  NOTE: this is probably a different vulnerability than CVE-2007-2186.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1943.

assistant: Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1944.

assistant: Buffer overflow in the backend framebuffer of XenSource Xen Para-Virtualized Framebuffer (PVFB) Message 3.0 through 3.0.3 allows local users to cause a denial of service (SDL crash) and possibly execute arbitrary code via "bogus screen updates," related to missing validation of the "format of messages."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1945.

assistant: QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1946.

assistant: The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a (1) locked or (2) expired account by entering the account name on the command line, related to improper use of the pam_succeed_if.so module.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1947.

assistant: Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1948.

assistant: The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the pack_security_parameters function, aka GNUTLS-SA-2008-1-1.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1949.

assistant: The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service (NULL dereference and crash) via a TLS message containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1950.

assistant: Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1951.

assistant: Untrusted search path vulnerability in a certain Red Hat build script for Standards Based Linux Instrumentation for Manageability (sblim) libraries before 1-13a.el4_6.1 in Red Hat Enterprise Linux (RHEL) 4, and before 1-31.el5_2.1 in RHEL 5, allows local users to gain privileges via a malicious library in a certain subdirectory of /var/tmp, related to an incorrect RPATH setting, as demonstrated by a malicious libc.so library for tog-pegasus.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1952.

assistant: The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1953.

assistant: Cross-site scripting (XSS) vulnerability in the Sitedesigner before 1.1.5 search template in Magnolia Enterprise Edition allows remote attackers to inject arbitrary web script or HTML via the query parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1954.

assistant: SQL injection vulnerability in one_day.php in Web Calendar Pro 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the user_id parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1955.

assistant: Cross-site scripting (XSS) vulnerability in rep.php in Martin BOUCHER MyBoard 1.0.12 allows remote attackers to inject arbitrary web script or HTML via the id parameter. information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1956.

assistant: Cross-site scripting (XSS) vulnerability in index.php in Wikepage Opus 13 2007.2 allows remote attackers to inject arbitrary web script or HTML via the wiki parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1957.

assistant: SQL injection vulnerability in news.php in Tr Script News 2.1 allows remote attackers to execute arbitrary SQL commands via the nb parameter in voir mode.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1958.

assistant: Unrestricted file upload vulnerability in the ajout_cat mode in admin/main.php in Tr Script News 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with a .php extension.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1959.

assistant: Stack-based buffer overflow in the get_remote_video_port_media function in call.cpp in SIPp 3.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SIP message.  NOTE: some of these details are obtained from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1960.

assistant: Cross-site scripting (XSS) vulnerability in cgi-bin/contray/search.cgi in ContRay 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1961.

assistant: SQL injection vulnerability in index.php in Voice Of Web AllMyGuests 0.4.1 allows remote attackers to execute arbitrary SQL commands via the AMG_id parameter in a comments action.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1962.

assistant: Multiple directory traversal vulnerabilities in Aterr 0.9.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) class parameter to include/functions.inc.php and the (2) file parameter to include/common.inc.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1963.

assistant: PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attackers to execute arbitrary PHP code via a URL in the location parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1964.

assistant: Stack-based buffer overflow in the demux_nsf_send_headers function in src/demuxers/demux_nsf.c in xine-lib allows remote attackers to have an unknown impact via a long copyright field in an NSF header in an NES Sound file, a different issue than CVE-2008-1878.  NOTE: a third party claims that the copyright field always has a safe length
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1965.

assistant: Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Symphony and possibly other products, allows remote attackers to execute arbitrary code by injecting a -launcher option via a cai: URI, as demonstrated by a reference to a UNC share pathname.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1966.

assistant: Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service (instance crash) via a call to the (1) RECOVERJAR or (2) REMOVE_JAR procedure with a crafted parameter, related to (a) sqlj.install_jar and (b) sqlj.replace_jar.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1967.

assistant: Cross-site scripting (XSS) vulnerability in CFLogon/CFLogon.asp in Cezanne 6.5.1 and 7 allows remote attackers to inject arbitrary web script or HTML via the SleUserName parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1968.

assistant: Multiple SQL injection vulnerabilities in Cezanne 7 allow remote authenticated users to execute arbitrary SQL commands via the FUNID parameter to (1) CFLookup.asp and (2) CznCommon/CznCustomContainer.asp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1969.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary web script or HTML via the (1) LookUPId and (2) CbFun parameters to (a) CFLookUP.asp; (3) TitleParms, (4) WidgetsHeights, (5) WidgetsLinks, and (6) WidgetsTitles parameters to (b) CznCommon/CznCustomContainer.asp, (7) CFTARGET parameter to (c) home.asp, (8) PersonOid parameter to (d) PeopleWeb/Cards/CVCard.asp, (9) DESTLINKOID and PersonOID parameters to (e) PeopleWeb/Cards/PayrollCard.asp, and the (10) FolderTemplateId and (11) FolderTemplateName parameters to (f) PeopleWeb/CznDocFolder/CznDFStartProcess.asp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1970.

assistant: muCommander before 0.8.2 stores credentials.xml with insecure permissions, which allows local users to obtain credentials.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1971.

assistant: phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) phadmin cookie to admin.php, or (2) in 1.4 and earlier, the ssbadmin cookie to shoutadmin.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1972.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in the user account creation feature in Exponent CMS 0.96.6-GA20071003 and earlier, when the Allow Registration? configuration option is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) firstname, (3) lastname, and (4) e-mail address fields.  NOTE: some of these details are obtained from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1973.

assistant: Heap-based buffer overflow in SubEdit Player build 4056 and 4066 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long subtitle file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1974.

assistant: Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1975.

assistant: SQL injection vulnerability in index.php in E-RESERV 2.1 allows remote attackers to execute arbitrary SQL commands via the ID_loc parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1976.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in the Drupal modules (1) Internationalization (i18n) 5.x before 5.x-2.3 and 5.x-1.1 and 6.x before 6.x-1.0 beta 1; and (2) Localizer 5.x before 5.x-3.4, 5.x-2.1, and 5.x-1.11; allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1977.

assistant: Cross-site request forgery (CSRF) vulnerability in the Internationalization (i18n) Drupal module 5.x before 5.x-2.3 and 5.x-1.1, and 6.x before 6.x-1.0 beta 1, allows remote attackers to change node translation relationships via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1978.

assistant: Cross-site scripting (XSS) vulnerability in the Ubercart 5.x before 5.x-1.0 rc3 module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via node titles related to unspecified product features, a different vector than CVE-2008-1428.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1979.

assistant: The Discovery Service (casdscvc) in CA ARCserve Backup 12.0.5454.0 and earlier allows remote attackers to cause a denial of service (crash) via a packet with a large integer value used in an increment to TCP port 41523, which triggers a buffer over-read.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1980.

assistant: Cross-site scripting (XSS) vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1981.

assistant: Cross-site request forgery (CSRF) vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attackers to perform unauthorized actions as other users via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1982.

assistant: SQL injection vulnerability in ss_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1983.

assistant: Cross-site scripting (XSS) vulnerability in Advanced Electron Forum (AEF) 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the beg parameter in a members action to index.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1984.

assistant: The eTrust Common Services (Transport) Daemon (eCSqdmn) in CA Secure Content Manager 8.0.28000.511 and earlier allows remote attackers to cause a denial of service (crash or CPU consumption) via a malformed packet to TCP port 1882.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1985.

assistant: Cross-site scripting (XSS) vulnerability in base.php in DigitalHive 2.0 RC2 allows remote attackers to inject arbitrary web script or HTML via the mt parameter, possibly related to membres.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1986.

assistant: Cross-site scripting (XSS) vulnerability in liste_article.php in Blog Pixel Motion (aka PixelMotion) allows remote attackers to inject arbitrary web script or HTML via the jours parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1987.

assistant: Cross-site scripting (XSS) vulnerability in search.php in EncapsGallery 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1988.

assistant: Unrestricted file upload vulnerability in the file_upload function in core/misc.class.php in EncapsGallery 2.0.2 allows remote authenticated administrators to upload and execute arbitrary PHP files by uploading a file with an executable extension, then accessing it via a direct request to the file in the rwx_gallery directory.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1989.

assistant: PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the e107path parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1990.

assistant: Multiple SQL injection vulnerabilities in Acidcat CMS 3.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) cID parameter to default.asp and the (2) username parameter to main_login2.asp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1991.

assistant: Cross-site scripting (XSS) vulnerability in admin_colors_swatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the field parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1992.

assistant: Acidcat CMS 3.4.1 does not properly restrict access to (1) default_mail_aspemail.asp, (2) default_mail_cdosys.asp or (3) default_mail_jmail.asp, which allows remote attackers to bypass restrictions and relay email messages with modified From, FromName, and To fields.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1993.

assistant: Acidcat CMS 3.4.1 does not restrict access to the FCKEditor component, which allows remote attackers to upload arbitrary files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1994.

assistant: Multiple stack-based buffer overflows in (a) acon.c, (b) menu.c, and (c) child.c in Acon 1.0.5-5 through 1.0.5-7 allow local users to execute arbitrary code via (1) a long HOME environment variable or (2) a large number of terminal columns.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1995.

assistant: Sun Java System Directory Proxy Server 6.0, 6.1, and 6.2 classifies a connection using the "bind-dn" criteria, which can cause an incorrect application of policy and allows remote attackers to bypass intended access restrictions for the server.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1996.

assistant: licq before 1.3.6 allows remote attackers to cause a denial of service (file-descriptor exhaustion and application crash) via a large number of connections.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1997.

assistant: Unspecified vulnerability in the ADMIN_SP_C2 procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the ADMIN_SP_C issue is already covered by CVE-2008-0699.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1998.

assistant: The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2008-1999.

assistant: Apple Safari 3.1.1 allows remote attackers to spoof the address bar by placing many "invisible" characters in the userinfo subcomponent of the authority component of the URL (aka the user field), as demonstrated by %E3%80%80 sequences.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0001.

assistant: Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted RTSP URL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0002.

assistant: Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a QTVR movie file with crafted THKD atoms.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0003.

assistant: Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via an AVI movie file with an invalid nBlockAlign value in the _WAVEFORMATEX structure.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0004.

assistant: Buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted MP3 audio file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0005.

assistant: Unspecified vulnerability in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted H.263 encoded movie file that triggers memory corruption.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0006.

assistant: Integer signedness error in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a Cinepak encoded movie file with a crafted MDAT atom that triggers a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0007.

assistant: Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a QuickTime movie file containing invalid image width data in JPEG atoms within STSD atoms.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0008.

assistant: Unspecified vulnerability in Apple QuickTime MPEG-2 Playback Component before 7.60.92.0 on Windows allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted MPEG-2 movie.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0009.

assistant: Unspecified vulnerability in the Pixlet codec in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted movie file that triggers memory corruption.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0010.

assistant: Integer underflow in QuickDraw Manager in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7, and Apple QuickTime before 7.6.2, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a crafted 0x77 Poly tag and a crafted length field, which triggers a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0011.

assistant: Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure file operation" on a temporary file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0012.

assistant: Heap-based buffer overflow in CoreText in Apple Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via a crafted Unicode string.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0013.

assistant: dscl in DS Tools in Apple Mac OS X 10.4.11 and 10.5.6 requires that passwords must be provided as command line arguments, which allows local users to gain privileges by listing process information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0014.

assistant: Folder Manager in Apple Mac OS X 10.5.6 uses insecure default permissions when recreating a Downloads folder after it has been deleted, which allows local users to bypass intended access restrictions and read the Downloads folder.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0015.

assistant: Unspecified vulnerability in fseventsd in the FSEvents framework in Apple Mac OS X 10.5.6 allows local users to obtain sensitive information (filesystem activities and directory names) via unknown vectors related to "credential management."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0016.

assistant: Apple iTunes before 8.1 on Windows allows remote attackers to cause a denial of service (infinite loop) via a Digital Audio Access Protocol (DAAP) message with a crafted Content-Length header.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0017.

assistant: csregprinter in the Printing component in Apple Mac OS X 10.4.11 and 10.5.6 does not properly handle error conditions, which allows local users to execute arbitrary code via unknown vectors that trigger a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0018.

assistant: The Remote Apple Events server in Apple Mac OS X 10.4.11 and 10.5.6 does not properly initialize a buffer, which allows remote attackers to read portions of memory.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0019.

assistant: Remote Apple Events in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) or obtain sensitive information via unspecified vectors that trigger an out-of-bounds memory access.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0020.

assistant: Unspecified vulnerability in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted resource fork that triggers memory corruption.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0021.

assistant: NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0022.

assistant: Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a blank share name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0023.

assistant: The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0024.

assistant: The sys_remap_file_pages function in mm/fremap.c in the Linux kernel before 2.6.24.1 allows local users to cause a denial of service or gain privileges via unspecified vectors, related to the vm_file structure member, and the mmap_region and do_munmap functions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0025.

assistant: BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0026.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0027.

assistant: The request handler in JBossWS in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read arbitrary XML files via a crafted request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0028.

assistant: The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0029.

assistant: The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service (crash) or possibly gain privileges via a crafted system call.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0030.

assistant: A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0031.

assistant: Memory leak in the keyctl_join_session_keyring function (security/keys/keyctl.c) in Linux kernel 2.6.29-rc2 and earlier allows local users to cause a denial of service (kernel memory consumption) via unknown vectors related to a "missing kfree."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0032.

assistant: CUPS on Mandriva Linux 2008.0, 2008.1, 2009.0, Corporate Server (CS) 3.0 and 4.0, and Multi Network Firewall (MNF) 2.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pdf.log temporary file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0033.

assistant: Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2009-0034.

assistant: parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.