rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-5099 
Sun Logical Domain Manager (aka LDoms Manager or ldm) 1.0 through 1.0.3 displays the value of the OpenBoot PROM (OBP) security-password variable in cleartext, which allows local users to bypass the SPARC firmware's password protection, and gain privileges or obtain data access, via the "ldm ls -l" command, a different vulnerability than CVE-2008-4992.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-5100 
The strong name (SN) implementation in Microsoft .NET Framework 2.0.50727 relies on the digital signature Public Key Token embedded in the pathname of a DLL file instead of the digital signature of this file itself, which makes it easier for attackers to bypass Global Assembly Cache (GAC) and Code Access Security (CAS) protection mechanisms, aka MSRC ticket MSRC8566gs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-5101 
Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-5102 
PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-5103 
The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! argument, which configures the root account with a cleartext password of ! (exclamation point) and allows attackers to bypass intended login restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-5104 
Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm-builder or (2) ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.10, have ! (exclamation point) as the default root password, which allows attackers to bypass intended login restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-5105 
KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash or hang) via certain (1) APPE, (2) CWD, (3) DELE, (4) MKD, (5) RMD, (6) RETR, (7) RNFR, (8) RNTO, (9) SIZE, and (10) STOR commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-5106 
Buffer overflow in KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long argument to an arbitrary command, which triggers the overflow when the SamyFtp.binlog log file is viewed in the management console.  NOTE: this may overlap CVE-2006-0441 and CVE-2006-2212.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-5107 
The installation process for Citrix Presentation Server 4.5 and Desktop Server 1.0, when MSI logging is enabled, stores database credentials in MSI log files, which allows local users to obtain these credentials by reading the log files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-5108 
Unspecified vulnerability in Adobe AIR 1.1 and earlier allows context-dependent attackers to execute untrusted JavaScript in an AIR application via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T22:00:00.000Z
CVE-2008-5109 
The default configuration of Adobe Flash Media Server (FMS) 3.0 does not enable SWF Verification for (1) RTMPE and (2) RTMPTE sessions, which makes it easier for remote attackers to make copies of video content via stream-capture software.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-5110 
syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T22:00:00.000Z
CVE-2008-5111 
Unspecified vulnerability in the socket function in Sun Solaris 10 and OpenSolaris snv_57 through snv_91, when InfiniBand hardware is not installed, allows local users to cause a denial of service (panic) via unknown vectors, related to the socksdpv_close function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T23:00:00.000Z
CVE-2008-5112 
The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt depending on whether the user account exists and is permitted to login, which allows remote attackers to enumerate valid usernames via a series of LDAP bind requests, as demonstrated by ldapuserenum.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T23:00:00.000Z
CVE-2008-5113 
WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access).  NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T23:00:00.000Z
CVE-2008-5114 
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5115 
Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to hijack the authentication of administrators for requests that update the password via idm/admin/changeself.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5116 
Directory traversal vulnerability in idm/includes/helpServer.jsp in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to read arbitrary files in the filesystem of the IDM server via directory traversal sequences in the ext parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5117 
Open redirect vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5118 
Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via unspecified vectors, related to "frame injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5119 
Cross-site scripting (XSS) vulnerability in search.php in Scripts4Profit DXShopCart 4.30mc allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5120 
Stack-based buffer overflow in the Process Software MultiNet finger service (aka FINGERD) for HP OpenVMS 8.3 allows remote attackers to execute arbitrary code via a long request string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5121 
dne2000.sys in Citrix Deterministic Network Enhancer (DNE) 2.21.7.233 through 3.21.7.17464, as used in (1) Cisco VPN Client, (2) Blue Coat WinProxy, and (3) SafeNet SoftRemote and HighAssurance Remote, allows local users to gain privileges via a crafted DNE_IOCTL DeviceIoControl request to the \\.\DNE device interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5122 
SQL injection vulnerability in WorkArea/ContentRatingGraph.aspx in Ektron CMS400.NET 7.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the res parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5123 
SQL injection vulnerability in admin.php in CCleague Pro 1.2 allows remote attackers to execute arbitrary SQL commands via the u parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5124 
JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key, which makes it easier for remote attackers to perform man-in-the-middle attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5125 
admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T00:00:00.000Z
CVE-2008-5126 
Cross-site scripting (XSS) vulnerability in search.php in BoutikOne CMS allows remote attackers to inject arbitrary web script or HTML via the search_query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T02:00:00.000Z
CVE-2008-5127 
Ocean12 Contact Manager Pro 1.02 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12con.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T11:00:00.000Z
CVE-2008-5128 
Ocean12 Membership Manager Pro stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12member.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T11:00:00.000Z
CVE-2008-5129 
Ocean12 Poll Manager Pro 1.00 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12poll.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T11:00:00.000Z
CVE-2008-5130 
Ocean12 Calendar Manager Gold 2.04 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12cal.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T11:00:00.000Z
CVE-2008-5131 
Multiple SQL injection vulnerabilities in Develop It Easy News And Article System 1.4 allow remote attackers to execute arbitrary SQL commands via (1) the aid parameter to article_details.php, and the (2) username and (3) password to the admin panel (admin/index.php).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T11:00:00.000Z
CVE-2008-5132 
SQL injection vulnerability in inc/ajax/ajax_rating.php in MemHT Portal 4.0.1 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T11:00:00.000Z
CVE-2008-5133 
ipnat in IP Filter in Sun Solaris 10 and OpenSolaris before snv_96, when running on a DNS server with Network Address Translation (NAT) configured, improperly changes the source port of a packet when the destination port is the DNS port, which allows remote attackers to bypass an intended CVE-2008-1447 protection mechanism and spoof the responses to DNS queries sent by named.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5134 
Buffer overflow in the lbs_process_bss function in drivers/net/wireless/libertas/scan.c in the libertas subsystem in the Linux kernel before 2.6.27.5 allows remote attackers to have an unknown impact via an "invalid beacon/probe response."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5135 
os-prober in os-prober 1.17 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/mounted-map or (2) /tmp/raided-map temporary file.  NOTE: the vendor disputes this issue, stating "the insecure code path should only ever run inside a d-i environment, which has no non-root users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5136 
tkusr in tkusr 0.82 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/tkusr.pgm temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5137 
tkman in tkman 2.2 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/tkman##### or (2) /tmp/ll temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5138 
passwdehd in libpam-mount 0.43 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/passwdehd.##### temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5139 
updatejail in jailer 0.4 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/#####.updatejail temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5140 
trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/opr.ini.##### or (2) /tmp/lpt*.zip temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5141 
flamethrower in flamethrower 0.1.8 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/multicast.tar.##### temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5142 
sendbug in freebsd-sendpr 3.113+5.3 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on a /tmp/pr.##### temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5143 
mgt-helper in multi-gnome-terminal 1.6.2 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/*.debug or (2) /tmp/*.env temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5144 
nvidia-cg-toolkit-installer in nvidia-cg-toolkit 2.0.0015 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/nvidia-cg-toolkit-manifest temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5145 
ltpmenu in ltp 20060918 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/runltp.mainmenu.##### temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5146 
add-accession-numbers in ctn 3.0.6 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/accession temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5147 
test-pipe-to-pyodconverter.org.sh in docvert 2.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/outer.odt temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5148 
sch2eaglepos.sh in geda-gnetlist 1.4.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/##### temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5149 
fwd_check.sh in libncbi6 6.1.20080302 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/##### temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5150 
sample.sh in maildirsync 1.1 allows local users to append data to arbitrary files via a symlink attack on a /tmp/maildirsync-*.#####.log temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5151 
test_parser.py in mayavi 1.5 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/err.log temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5152 
inmail-show in mh-book 200605 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/inmail#####.log or (2) /tmp/inmail#####.stdin temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5153 
spell-check-logic.cgi in Moodle 1.8.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/spell-check-debug.log, (2) /tmp/spell-check-before, or (3) /tmp/spell-check-after temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5154 
bluetooth.rc in p3nfs 5.19 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/blue.log temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5155 
mail2sms.sh in smsclient 2.0.8z allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/header.##### or (2) /tmp/body.##### temporary file, or append data to arbitrary files via a symlink attack on the (3) /tmp/sms.log temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5156 
si_mkbootserver in systemimager-server 3.6.3 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/*.inetd.conf or (2) /tmp/pxe.conf.*.tmp temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5157 
tau 2.16.4 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/makefile.tau.*.##### or (2) /tmp/makefile.tau*.##### temporary file, related to the (a) tau_cxx, (b) tau_f90, and (c) tau_cc scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T15:00:00.000Z
CVE-2008-5158 
Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to bypass authentication and perform administrative actions via vectors involving "simply skipping the auth stage."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T21:00:00.000Z
CVE-2008-5159 
Integer overflow in the remote administration protocol processing in Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to cause a denial of service (crash) via a large string length argument, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T21:00:00.000Z
CVE-2008-5160 
Unspecified vulnerability in MyServer 0.8.11 allows remote attackers to cause a denial of service (daemon crash) via multiple invalid requests with the HTTP GET, DELETE, OPTIONS, and possibly other methods, related to a "204 No Content error."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-18T21:00:00.000Z
CVE-2008-5161 
Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-19T17:00:00.000Z
CVE-2008-5162 
The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM framework and various network protocols, related to the Yarrow random number generator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T23:00:00.000Z
CVE-2008-5163 
Multiple SQL injection vulnerabilities in The Rat CMS Pre-Alpha 2 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewarticle.php and (2) viewarticle2.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-19T18:00:00.000Z
CVE-2008-5164 
Multiple cross-site scripting (XSS) vulnerabilities in The Rat CMS Pre-Alpha 2 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) viewarticle.php and (b) viewarticle2.php and the (2) PATH_INFO to viewarticle.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-19T18:00:00.000Z
CVE-2008-5165 
Multiple SQL injection vulnerabilities in eTicket 1.5.7 allow remote attackers to execute arbitrary SQL commands via the pri parameter to (1) index.php, (2) open.php, (3) open_raw.php, and (4) newticket.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-19T18:00:00.000Z
CVE-2008-5166 
SQL injection vulnerability in riddle.php in Riddles Website 1.2.1 allows remote attackers to execute arbitrary SQL commands via the riddleid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-19T18:00:00.000Z
CVE-2008-5167 
PHP remote file inclusion vulnerability in layout/default/params.php in Boonex Orca 2.0 and 2.0.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the gConf[dir][layouts] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-19T18:00:00.000Z