rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-0132 
Pragma FortressSSH 5.0 Build 4 Revision 293 and earlier handles long input to sshd.exe by creating an error-message window and waiting for the administrator to click in this window before terminating the sshd.exe process, which allows remote attackers to cause a denial of service (connection slot exhaustion) via a flood of SSH connections with long data objects, as demonstrated by (1) a long list of keys and (2) a long username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T11:00:00.000Z
CVE-2008-0133 
Multiple SQL injection vulnerabilities in Tribisur 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to cat_main.php and the (2) cat parameter to forum.php in a liste action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0134 
Cross-site scripting (XSS) vulnerability in Forums/setup.asp in Snitz Forums 2000 3.4.06 and earlier allows remote attackers to inject arbitrary web script or HTML via the MAIL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0135 
Snitz Forums 2000 3.4.06 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for forum/snitz_forums_2000.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0136 
Snitz Forums 2000 3.4.05 allows remote attackers to obtain sensitive information via a direct request to forum/whereami.asp, which reveals the database path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0137 
PHP remote file inclusion vulnerability in config.inc.php in SNETWORKS PHP CLASSIFIEDS 5.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_escape parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0138 
PHP remote file inclusion vulnerability in xoopsgallery/init_basic.php in the mod_gallery module for XOOPS, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0139 
Eval injection vulnerability in loudblog/inc/parse_old.php in Loudblog 0.8.0 and earlier allows remote attackers to execute arbitrary PHP code via the template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0140 
Directory traversal vulnerability in error.php in Uebimiau Webmail 2.7.10 and 2.7.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the selected_theme parameter, a different vector than CVE-2007-3172.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0141 
actions.php in WebPortal CMS 0.6-beta generates predictable passwords containing only the time of day, which makes it easier for remote attackers to obtain access to any account via a lostpass action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0142 
Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL commands via the user_name parameter to actions.php, and unspecified other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0143 
PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM Broadcaster, allows remote attackers to execute arbitrary PHP code via a URL in the commonpath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0144 
PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.  NOTE: this can also be leveraged for local file inclusion using directory traversal sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0145 
Unspecified vulnerability in glob in PHP before 4.4.8, when open_basedir is enabled, has unknown impact and attack vectors.  NOTE: this issue reportedly exists because of a regression related to CVE-2007-4663.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0146 
Cross-site scripting (XSS) vulnerability in the error page in W3-mSQL allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the top-level URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2008-0147 
SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via (1) the user_email parameter and possibly (2) username parameter in a Members action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0148 
TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell commands via the cmd parameter in a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0149 
TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0150 
Unspecified vulnerability in the LDAP authentication feature in Aruba Mobility Controller 2.3.6.15, 2.5.2.11, 2.5.4.25, 2.5.5.7, 3.1.1.3, and 2.4.8.11-FIPS or earlier allows remote attackers to bypass authentication mechanisms and obtain management or VPN interface access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0151 
Heap-based buffer overflow in Foxit WAC Server 2.1.0.910, 2.0 Build 3503, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Telnet request with long options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0152 
SLnet.exe in SeattleLab SLNet RF Telnet Server 4.1.1.3758 and earlier allows user-assisted remote attackers to cause a denial of service (crash) via unspecified telnet options, which triggers a NULL pointer dereference.  NOTE: the crash is not user-assisted when the server is running in debug mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0153 
telnetd.exe in Pragma TelnetServer 7.0.4.589 allows remote attackers to cause a denial of service (process crash and resource exhaustion) via a crafted TELOPT PRAGMA LOGON telnet option, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0154 
SQL injection vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to execute arbitrary SQL commands the c parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0155 
Cross-site scripting (XSS) vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to inject arbitrary web script or HTML via the c parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0156 
Absolute path traversal vulnerability in index.php in Million Dollar Script 2.0.14 allows remote attackers to read arbitrary files via encoded "/" (%2F) sequences in the link parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0157 
SQL injection vulnerability in FlexBB 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb_temp_id parameter in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0158 
Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to read arbitrary files via a .. (dot dot) in the aux_page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0159 
SQL injection vulnerability in index.php in eggBlog 3.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the eggblogpassword parameter in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2008-0162 
misc.c in splitvt 1.6.6 and earlier does not drop group privileges before executing xprop, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-22T21:00:00.000Z
CVE-2008-0163 
Linux kernel 2.6, when using vservers, allows local users to access resources of other vservers via a symlink attack in /proc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-12T20:00:00.000Z
CVE-2008-0164 
Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T00:00:00.000Z
CVE-2008-0165 
Cross-site request forgery (CSRF) vulnerability in Ikiwiki before 2.42 allows remote attackers to modify user preferences, including passwords, via the (1) preferences and (2) edit forms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-20T18:00:00.000Z
CVE-2008-0166 
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-13T17:00:00.000Z
CVE-2008-0167 
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-18T14:00:00.000Z
CVE-2008-0169 
Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-03T15:00:00.000Z
CVE-2008-0171 
regex/v4/perl_matcher_non_recursive.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (failed assertion and crash) via an invalid regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T22:00:00.000Z
CVE-2008-0172 
The get_repeat_type function in basic_regex_creator.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (NULL dereference and crash) via an invalid regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T22:00:00.000Z
CVE-2008-0173 
SQL injection vulnerability in Gforge 4.6.99 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified parameters, related to RSS exports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-15T19:00:00.000Z
CVE-2008-0174 
GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the passwords and gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-29T01:00:00.000Z
CVE-2008-0175 
Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-29T01:00:00.000Z
CVE-2008-0176 
Heap-based buffer overflow in w32rtr.exe in GE Fanuc CIMPLICITY HMI SCADA system 7.0 before 7.0 SIM 9, and earlier versions before 6.1 SP6 Hot fix - 010708_162517_6106, allow remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-29T01:00:00.000Z
CVE-2008-0177 
The ipcomp6_input function in sys/netinet6/ipcomp_input.c in the KAME project before 20071201 does not properly check the return value of the m_pulldown function, which allows remote attackers to cause a denial of service (system crash) via an IPv6 packet with an IPComp header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-07T21:00:00.000Z
CVE-2008-0178 
Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-04T23:00:00.000Z
CVE-2008-0179 
Cross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-04T23:00:00.000Z
CVE-2008-0180 
Cross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Greeting field in a User Profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-04T23:00:00.000Z
CVE-2008-0181 
Cross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Shutdown message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-04T23:00:00.000Z
CVE-2008-0182 
Cross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified actions as unspecified other authenticated users via the Shutdown message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-04T23:00:00.000Z
CVE-2008-0184 
Absolute path traversal vulnerability in index.php in Sys-Hotel on Line System allows remote attackers to read arbitrary files via an encoded "/" ("%2F") in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T22:00:00.000Z
CVE-2008-0185 
SQL injection vulnerability in index.php in NetRisk 1.9.7 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via the pid parameter in a profile page (possibly profile.php).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T22:00:00.000Z
CVE-2008-0186 
Cross-site scripting (XSS) vulnerability in index.php in NetRisk 1.9.7 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter, possibly related to CVE-2008-0144.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T22:00:00.000Z
CVE-2008-0187 
SQL injection vulnerability in songinfo.php in SAM Broadcaster samPHPweb, possibly 4.2.2 and earlier, allows remote attackers to execute arbitrary SQL commands via the songid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T22:00:00.000Z
CVE-2008-0190 
Multiple cross-site scripting (XSS) vulnerabilities in templates/example_template.php in AwesomeTemplateEngine allow remote attackers to inject arbitrary web script or HTML via the (1) data[title], (2) data[message], (3) data[table][1][item], (4) data[table][1][url], or (5) data[poweredby] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0191 
WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and the SQL database structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0192 
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the popuptitle parameter to (1) wp-admin/post.php or (2) wp-admin/page-new.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0193 
Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0194 
Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete arbitrary files, and cause a denial of service via a .. (dot dot) in the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.  NOTE: this might be the same as CVE-2006-5705.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0195 
WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0196 
Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the \..\..\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0197 
Multiple cross-site scripting (XSS) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wpcf_email, (2) wpcf_subject, (3) wpcf_question, (4) wpcf_answer, (5) wpcf_success_msg, (6) wpcf_error_msg, or (7) wpcf_msg parameter to wp-admin/admin.php, or (8) the SRC attribute of an IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0198 
Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0199 
PRO-Search 0.17 and earlier allows remote attackers to cause a denial of service via certain values of the show_page and time parameters to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0200 
Multiple cross-site scripting (XSS) vulnerabilities in account/index.html in RotaBanner Local 3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) drop parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0201 
Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0202 
CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0203 
Multiple cross-site scripting (XSS) vulnerabilities in cryptographp/admin.php in the Cryptographp 1.2 and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cryptwidth, (2) cryptheight, (3) bgimg, (4) charR, (5) charG, (6) charB, (7) charclear, (8) tfont, (9) charel, (10) charelc, (11) charelv, (12) charnbmin, (13) charnbmax, (14) charspace, (15) charsizemin, (16) charsizemax, (17) charanglemax, (18) noisepxmin, (19) noisepxmax, (20) noiselinemin, (21) noiselinemax, (22) nbcirclemin, (23) nbcirclemax, or (24) brushsize parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0204 
Multiple cross-site scripting (XSS) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) mcsp_opt_msg_no_answer or (2) mcsp_opt_msg_wrong_answer parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2008-0205 
Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) mcsp_opt_msg_no_answer or (2) mcsp_opt_msg_wrong_answer parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z