yahoo-inc/cve-impacts huggingface dataset:
CVE-2008-1766: Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."
Key phrases: multiple unspecified, unknown impact, minor security-related bugs, unspecified vulnerability
CVE-2008-1767: Buffer overflow in pattern.c in libxslt before 1.1.24 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XSL style sheet file with a long XSLT "transformation match" condition that triggers a large number of steps.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2008-1768: Multiple integer overflows in VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via the (1) MP4 demuxer, (2) Real demuxer, and (3) Cinepak codec, which triggers a buffer overflow.
Key phrases: denial of service (crash), cause a denial of service (crash), integer overflows, buffer overflow
CVE-2008-1769: VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via a crafted Cinepak file that triggers an out-of-bounds array access and memory corruption.
Key phrases: denial of service (crash), cause a denial of service (crash), out-of-bounds array access, memory corruption
CVE-2008-1770: CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6 allows remote attackers to force the download and execution of arbitrary files via a URL parameter containing an encoded LF followed by a malicious target line.
Key phrases: force the download and execution of arbitrary files, crlf injection
CVE-2008-1771: Integer overflow in the ws_getpostvars function in Firefly Media Server (formerly mt-daapd) 0.2.4.1 (0.9~r1696-1.2 on Debian) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a large Content-Length.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), integer overflow
CVE-2008-1772: iScripts SocialWare stores passwords in cleartext in a database, which allows context-dependent attackers to obtain sensitive information.
Key phrases: obtain sensitive information, cleartext
CVE-2008-1773: PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-1774: SQL injection vulnerability in editlink.php in Pligg 9.9.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection, arbitrary sql commands
CVE-2008-1775: Cross-site scripting (XSS) vulnerability in mindex.do in ManageEngine Firewall Analyzer 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the displayName parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1776: PHP remote file inclusion vulnerability in modules/basicfog/basicfogfactory.class.php in PhpBlock A8.4 allows remote attackers to execute arbitrary PHP code via a URL in the PATH_TO_CODE parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-1777: The eDirectory Host Environment service (dhost.exe) in Novell eDirectory 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via a long HTTP HEAD request to TCP port 8028.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption
CVE-2008-1778: Unspecified vulnerability in the floating point context switch implementation in Sun Solaris 9 and 10 on x86 platforms might allow local users to cause a denial of service (application exit), corrupt data, or trigger incorrect calculations via unknown vectors.
Key phrases: denial of service (application exit), cause a denial of service (application exit, unspecified, corrupt data, incorrect calculations, unknown vectors, unspecified vulnerability
CVE-2008-1779: Sun Solaris 8, 9, and 10 allows "remote privileged" users to cause a denial of service (panic) via unknown vectors related to self encapsulated IP packets.
Key phrases: denial of service (panic), cause a denial of service (panic), unknown vectors, self encapsulated ip packets
CVE-2008-1780: Unspecified vulnerability in the labeled networking functionality in Solaris 10 Trusted Extensions allows applications in separate labeling zones to bypass labeling restrictions via unknown vectors.
Key phrases: bypass labeling restrictions, bypass labeling restrictions via unknown vectors, unspecified, unspecified vulnerability
CVE-2008-1782: phpdemo/viewsource.php in Advanced Software Engineering ChartDirector 4.1 allows remote attackers to read sensitive files via the file parameter.
Key phrases: read sensitive files via the file parameter
CVE-2008-1783: Prozilla Reviews 1.0 allows remote attackers to delete arbitrary users via a modified UserID parameter in a direct request to siteadmin/DeleteUser.php.
Key phrases: delete arbitrary users, delete arbitrary users via a modified UserID parameter, modified userid parameter
CVE-2008-1784: Prozilla Topsites 1.0 allows remote attackers to perform administrative actions via a direct request to (1) addu.php, (2) editu.php, and (3) uidx.php in siteadmin/.
Key phrases: perform administrative actions via a direct request to
CVE-2008-1785: delete.php in Prozilla Top 100 1.2 allows remote authenticated users to delete statistics and accounts of arbitrary users via a modified s parameter.
Key phrases: delete statistics and accounts of arbitrary users via, modified s parameter
CVE-2008-1786: The DSM gui_cm_ctrls ActiveX control (gui_cm_ctrls.ocx), as used in multiple CA products including BrightStor ARCServe Backup for Laptops and Desktops r11.5, Desktop Management Suite r11.1 through r11.2 C2; Unicenter r11.1 through r11.2 C2; and Desktop and Server Management r11.1 through r11.2 C2 allows remote attackers to execute arbitrary code via crafted function arguments.
Key phrases: execute arbitrary code, execute arbitrary code via crafted function arguments
CVE-2008-1787: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Poplar Gedcom Viewer 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) text and (2) ul parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1788: SQL injection vulnerability in directory.php in Prozilla Entertainers 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter.  NOTE: some of these details are obtained from third party information.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the cat parameter, sql injection
CVE-2008-1789: SQL injection vulnerability in forum.php in Prozilla Forum allows remote attackers to execute arbitrary SQL commands via the forum parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the forum parameter, sql injection
CVE-2008-1790: Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated administrators to upload arbitrary files via a crafted logo file in the "Manage Settings" functionality.  NOTE: remote exploitation is facilitated by a separate SQL injection vulnerability.
Key phrases: upload arbitrary files, upload arbitrary files via a crafted logo file, unrestricted file upload, sql injection
CVE-2008-1791: SQL injection vulnerability in ladder.php in My Gaming Ladder 7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the ladderid parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the ladderid parameter, sql injection
CVE-2008-1792: Cross-site scripting (XSS) vulnerability in the insertion filter in the Flickr Drupal module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-alpha allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2008-1793: Multiple cross-site scripting (XSS) vulnerabilities in view.cgi in Smart Classified ADS Professional, Smart Photo ADS, and Smart Photo ADS Gold allow remote attackers to inject arbitrary web script or HTML via the (1) AdNum and (2) Department parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1794: Multiple cross-site scripting (XSS) vulnerabilities in the Webform Drupal module 5.x before 5.x-1.10, 5.x-2.x before 5.x-2.0-beta3, and 6.x before 6.x-1.0-beta3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2008-1795: Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Academic Suite 7.x and earlier, and possibly some 8.0 versions, allow remote attackers to inject arbitrary web script or HTML via (1) the searchText parameter in a Course action to webapps/blackboard/execute/viewCatalog or (2) the data__announcements___pk1_pk2__subject parameter in an ADD action to bin/common/announcement.pl.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2008-1796: Comix 3.6.4 creates temporary directories with predictable names, which allows local users to cause an unspecified denial of service.
Key phrases: cause an unspecified denial of service, predictable names
CVE-2008-1797: Unspecified vulnerability in Secure Computing Webwasher 5.30 before build 3159 and 6.3.0 before build 3150 allows remote attackers to cause a denial of service (freeze) via a crafted URL.
Key phrases: denial of service (freeze), cause a denial of service (freeze), unspecified, unspecified vulnerability
CVE-2008-1798: Directory traversal vulnerability in forum/kietu/libs/calendrier.php in Dragoon 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cal[lng] parameter.
Key phrases: include and execute arbitrary local files via a, directory traversal
CVE-2008-1799: Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2008-1800: Multiple cross-site scripting (XSS) vulnerabilities in index.php in DivXDB 2002 0.94b allow remote attackers to inject arbitrary web script or HTML via the (1) choice, (2) _page_, (3) zone_admin, (4) general_search, and (5) import parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1801: Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Remote Desktop Protocol (RDP) request with a small length field.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), integer underflow
CVE-2008-1802: Buffer overflow in the process_redirect_pdu (rdp.c) function in rdesktop 1.5.0 allows remote attackers to execute arbitrary code via a Remote Desktop Protocol (RDP) redirect request with modified length fields.
Key phrases: execute arbitrary code, execute arbitrary code via a Remote Desktop Protocol, buffer overflow
CVE-2008-1803: Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow.  NOTE: the role of the channel_process function was not specified by the original researcher.
Key phrases: execute arbitrary code, execute arbitrary code via unknown parameters that trigger, heap-based overflow, heap based overflow
CVE-2008-1804: preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment.
Key phrases: bypass detection rules, bypass detection rules by using a different TTL
CVE-2008-1805: Incomplete blacklist vulnerability in Skype 3.6.0.248, and other versions before 3.8.0.139, allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI that ends in an executable extension that is not covered by the blacklist.
Key phrases: execute arbitrary code, bypass warning dialogs and possibly execute arbitrary code, incomplete blacklist
CVE-2008-1806: Integer overflow in FreeType2 before 2.3.6 allows context-dependent attackers to execute arbitrary code via a crafted set of 16-bit length values within the Private dictionary table in a Printer Font Binary (PFB) file, which triggers a heap-based buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted set of, integer overflow, heap-based buffer overflow, heap based buffer overflow
CVE-2008-1807: FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.
Key phrases: execute arbitrary code, execute arbitrary code via an invalid "number, memory corruption
CVE-2008-1808: Multiple off-by-one errors in FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via (1) a crafted table in a Printer Font Binary (PFB) file or (2) a crafted SHC instruction in a TrueType Font (TTF) file, which triggers a heap-based buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code via (1) a, heap-based buffer overflow, heap based buffer overflow
CVE-2008-1809: Heap-based buffer overflow in Novell eDirectory 8.7.3 before 8.7.3.10b, and 8.8 before 8.8.2 FTF2, allows remote attackers to execute arbitrary code via an LDAP search request containing "NULL search parameters."
Key phrases: execute arbitrary code, execute arbitrary code via an LDAP search request, heap-based buffer overflow, heap based buffer overflow
CVE-2008-1810: Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable.
Key phrases: gain privileges, gain privileges via a modified PATH environment variable, untrusted search path
CVE-2008-1811: Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows_030000.wwv_execute_immediate, aka APEX01.  NOTE: the previous information was obtained from the April 2008 CPU.  Oracle has not commented on reliable researcher claims that APEX01 is for insufficient authorization checks for SQL commands in the run_ddl function in flows_030000.wwv_execute_immediate, allowing privilege escalation by certain non-DBA remote authenticated users.
Key phrases: privilege escalation by certain non-DBA remote, unspecified vulnerability in oracle application express, unspecified impact
CVE-2008-1812: Unspecified vulnerability in the Oracle Enterprise Manager component in Oracle Database 9.0.1.5 FIPS+; Application Server 1.0.2.2; and Enterprise Manager for AS 1.0.2.2 and Database 9.0.1.5 has unknown impact and local attack vectors, aka EM01.
Key phrases: unspecified, unknown impact, local attack vectors, unspecified vulnerability
CVE-2008-1813: Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 have unknown impact and remote unauthenticated or authenticated attack vectors related to (1) SYS.DBMS_AQ in the Advanced Queuing component, aka DB01; (2) Core RDBMS, aka DB03; (3) SDO_GEOM in Oracle Spatial, aka DB06; (4) Export, aka DB12; and (5) DBMS_STATS in Query Optimizer, aka DB13.  NOTE: the previous information was obtained from the Oracle CPU.  Oracle has not commented on reliable researcher claims that DB06 is SQL injection, and DB13 occurs when the OUTLN account is reset to use a hard-coded password.
Key phrases: unknown impact, remote unauthenticated or authenticated attack vectors, sys.dbms_aq, sdo_geom, dbms_stats, unspecified, unspecified vulnerability, hard coded password
CVE-2008-1814: Unspecified vulnerability in the Oracle Secure Enterprise Search or Ultrasearch component in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3 and 10.1.2.2; and Oracle Collaboration Suite 10.1.2; has unknown impact and remote attack vectors, aka DB04.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2008-1815: Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.3, and 11.1.0.6 has unknown impact and remote authenticated attack vectors related to DBMS_CDC_UTILITY, aka DB02.  NOTE: the previous information was obtained from the April 2008 CPU.  Oracle has not commented on reliable researcher claims that DB02 is for SQL injection in LOCK_CHANGE_SET.
Key phrases: unspecified, unknown impact, sql injection, unspecified vulnerability
CVE-2008-1816: Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.3 have unknown impact and remote authenticated attack vectors related to (1) SDO_UTIL in the Oracle Spatial component, aka DB05; or (2) fine grained auditing in the Audit component, aka DB14.  NOTE: the previous information was obtained from the Oracle CPU.  Oracle has not commented on reliable researcher claims that DB05 is SQL injection.
Key phrases: unspecified, unknown impact, sdo_util, sql injection, unspecified vulnerability
CVE-2008-1817: Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 have unknown impact and remote attack vectors related to (1) SDO_IDX in the Spatial component, aka DB07; and (2) Core RDBMS, aka DB10.  NOTE: the previous information was obtained from the Oracle CPU.  Oracle has not commented on reliable researcher claims that DB07 is SQL injection.
Key phrases: unknown impact, sdo_idx, sql injection, unspecified, unspecified vulnerability
CVE-2008-1818: Unspecified vulnerability in the Authentication component in Oracle Database 11.1.0.6 has unknown impact and remote attack vectors, aka DB08.
Key phrases: unspecified, unknown impact, remote attack vectors, unspecified vulnerability
CVE-2008-1819: Unspecified vulnerability in the Oracle Net Services component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and local attack vectors, aka DB09.
Key phrases: unspecified, unknown impact, local attack vectors, unspecified vulnerability
CVE-2008-1820: Unspecified vulnerability in the Data Pump component in Oracle Database 9.2.0.8, 10.1.0.5, 10.2.0.3, and 11.1.0.6 has unknown impact and remote attack vectors related to KUPF$FILE_INT, aka DB11.  NOTE: the previous information was obtained from the April 2008 CPU.  Oracle has not commented on reliable researcher claims that DB11 is for a buffer overflow in the SYS.KUPF$FILE_INT.GET_FULL_FILENAME procedure.
Key phrases: unspecified, unknown impact, buffer overflow, unspecified vulnerability
CVE-2008-1821: Unspecified vulnerability in the Advanced Queuing component in Oracle Database 9.0.1.5 FIPS+, and 10.1.0.5 has unknown impact and remote attack vectors related to SYS.DBMS_AQJMS_INTERNAL, aka DB15.  NOTE: the previous information was obtained from the April 2008 CPU.  Oracle has not commented on reliable researcher claims that DB15 is for multiple buffer overflows in the (1) AQ$_REGISTER and (2) AQ$_UNREGISTER procedures.
Key phrases: unspecified, unknown impact, remote attack vectors, buffer overflows, unspecified vulnerability
CVE-2008-1822: Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express 3.0.1 has unknown impact and remote attack vectors, aka APEX02.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2008-1823: Unspecified vulnerability in the Oracle Jinitiator component in Oracle Application Server 1.3.1.14 has unknown impact and remote attack vectors, aka AS01.
Key phrases: unspecified, unknown impact, remote attack vectors, unspecified vulnerability
CVE-2008-1824: Unspecified vulnerability in the Oracle Dynamic Monitoring Service component in Oracle Application Server 9.0.4.3, 10.1.2.2, and 10.1.3.3 has unknown impact and remote attack vectors, aka AS02.
Key phrases: unspecified, unknown impact, remote attack vectors, unspecified vulnerability
CVE-2008-1825: Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3 has unknown impact and remote attack vectors, aka AS03.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2008-1826: Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 have unknown impact and attack vectors related to (a) Advanced Pricing, aka (1) APP01 and (2) APP10; and (b) Applications Framework, aka (3) APP05.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2008-1827: Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 and 12.0.4 have unknown impact and attack vectors related to (a) Advanced Pricing component, aka (1) APP02, (2) APP03, and (3) APP09; (b) Application Object Library component, aka (4) APP04, (5) APP07, and (6) APP11; (c) Applications Manager component, aka (7) APP06; (d) and Applications Technology Stack component, aka (8) APP08.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2008-1828: Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.22.19, 8.48.16, and 8.49.09 has unknown impact and remote authenticated attack vectors, aka PSE01.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2008-1829: Unspecified vulnerability in the PeopleSoft HCM Recruiting component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.8 SP1 has unknown impact and remote attack vectors, aka PSE02.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2008-1830: Unspecified vulnerability in the PeopleSoft HCM ePerformance component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9 and 9.0 has unknown impact and remote attack vectors, aka PSE03.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2008-1831: Multiple unspecified vulnerabilities in the Siebel SimBuilder component in Oracle Siebel Enterprise 7.8.2 and 7.8.5 have unknown impact and remote or local attack vectors, aka (1) SEBL01, (2) SEBL02, (3) SEBL03, (4) SEBL04, (5) SEBL05, and (6) SEBL06.
Key phrases: multiple unspecified, unknown impact, local attack vectors, unspecified vulnerability
CVE-2008-1832: lib/prefs.tcl in Cecilia 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the csvers temporary file.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2008-1833: Heap-based buffer overflow in pe.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted WWPack compressed PE binary.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted WWPack compressed, heap-based buffer overflow, heap based buffer overflow
CVE-2008-1834: swfdec_load_object.c in Swfdec before 0.6.4 does not properly restrict local file access from untrusted sandboxes, which allows remote attackers to read arbitrary files via a crafted Flash file.
Key phrases: read arbitrary files, read arbitrary files via a crafted Flash file, local file access, untrusted sandboxes
CVE-2008-1835: ClamAV before 0.93 allows remote attackers to bypass the scanning enging via a RAR file with an invalid version number, which cannot be parsed by ClamAV but can be extracted by Winrar.
Key phrases: bypass the scanning enging via a RAR file, invalid version number
CVE-2008-1836: The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via a crafted message that produces a string that is not null terminated, which triggers a buffer over-read.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer over-read, buffer over read
CVE-2008-1837: libclamunrar in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via crafted RAR files that trigger "memory problems," as demonstrated by the PROTOS GENOME test suite for Archive Formats.
Key phrases: denial of service (crash), cause a denial of service (crash), memory problems
CVE-2008-1838: SQL injection vulnerability in BosClassifieds Classified Ads System 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the cat parameter, sql injection
CVE-2008-1839: Multgiple cross-site scripting (XSS) vulnerabilities in module/main.php in WORK system e-commerce 4.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) day, (2) month, and (3) year parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1840: SQL injection vulnerability in upload.php in Coppermine Photo Gallery (CPG) 1.4.16 and earlier allows remote authenticated users or user-assisted remote HTTP servers to execute arbitrary SQL commands via the Content-Type HTTP response header provided by the HTTP server that is used for an upload.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the Content-, sql injection
CVE-2008-1841: SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery (CPG) 1.4.17 and earlier allows remote attackers to execute arbitrary SQL commands via an input field associated with the session_id variable, as exploited in the wild in April 2008.  NOTE: the fix for CVE-2008-1840 was intended to address this vulnerability, but is actually inapplicable.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via an input field, sql injection, inapplicable
CVE-2008-1842: Integer signedness error in ovspmd.exe in HP OpenView Network Node Manager (OV NNM) 8.01, and 7.53 and earlier, allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a long request to TCP port 8886 that begins with a certain negative integer, which passes a signed comparison and triggers a heap-based buffer overflow.
Key phrases: execute arbitrary code, denial of service (daemon crash), cause a denial of service (daemon crash, integer signedness error, heap-based buffer overflow, heap based buffer overflow
CVE-2008-1843: SQL injection vulnerability in browse.php in W2B DatingClub (aka Dating Club) allows remote attackers to execute arbitrary SQL commands via the age_to parameter in a browsebyCat action.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the age_to parameter, sql injection
CVE-2008-1844: SQL injection vulnerability in cat.php in W2B phpHotResources allows remote attackers to execute arbitrary SQL commands via the kind parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the kind parameter, sql injection, arbitrary sql commands
CVE-2008-1845: The Korn shell (aka mksh) before R33d on MirOS (aka MirBSD) does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a different user who launches mksh and specifies that terminal with the -T option.
Key phrases: gain privileges, gain privileges by opening a virtual terminal and
CVE-2008-1846: The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
Key phrases: conduct cross-site scripting (XSS), cross-site scripting (xss)
CVE-2008-1847: SQL injection vulnerability in view.php in CoronaMatrix phpAddressBook 2.11 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection
CVE-2008-1848: Cross-site scripting (XSS) vulnerability in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter in a show_error action to index.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1849: Directory traversal vulnerability in index.php in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter in a show_error action.
Key phrases: list arbitrary directories, list arbitrary directories via a .. (dot, directory traversal
CVE-2008-1850: Multiple cross-site scripting (XSS) vulnerabilities in login.php in Omnistar Interactive OSI Affiliate allow remote attackers to inject arbitrary web script or HTML via the (1) login, (2) profile, (3) profile2, and (4) ref parameters.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1851: ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (hang) via certain requests that do not provide all required arguments.
Key phrases: denial of service (hang), cause a denial of service (hang), ovalarmsrv
CVE-2008-1852: ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (crash) via certain requests that specify a large number of sub-arguments, which triggers a NULL pointer dereference due to memory allocation failure.
Key phrases: denial of service (crash), cause a denial of service (crash), null pointer dereference, memory allocation failure
CVE-2008-1853: The ovtopmd service in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (exit) by sending a 0x36 packet (exit request).
Key phrases: denial of service (exit), cause a denial of service (exit)
CVE-2008-1854: Unspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows remote attackers to cause a denial of service (service termination) via a long HTTP (1) GET, (2) HEAD, (3) PUT, (4) POST, or (5) TRACE request.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: denial of service (service termination), cause a denial of service (service termination, unspecified, unspecified vulnerability
CVE-2008-1855: FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid method in requests for the /spin//AVClient//AVClient.csp URI, a different vulnerability than CVE-2006-5274.
Key phrases: denial of service (CMA Framework service crash), corrupt memory and cause a denial of service
CVE-2008-1856: plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication for a settings action that modifies the configuration file, which allows remote attackers to conduct directory traversal attacks and execute arbitrary local files by placing directory traversal sequences into the maps_type configuration setting, and then sending a request to maps_view.php, which causes plugins/maps/map.main.class.php to use the modified configuration.
Key phrases: conduct directory traversal attacks and execute arbitrary local, arbitrary local files, directory traversal sequences
CVE-2008-1857: Multiple directory traversal vulnerabilities in viewsource.php in Make our Life Easy (Mole) 2.1.0 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) dirn and (2) fname parameters.
Key phrases: read arbitrary files, read arbitrary files via directory traversal sequences in
CVE-2008-1858: SQL injection vulnerability in index.php in 724Networks 724CMS 4.01 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the ID parameter, sql injection, arbitrary sql commands
CVE-2008-1859: SQL injection vulnerability in events.php in iScripts SocialWare allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection
CVE-2008-1860: Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrary PHP code into includes/Config.php via the default parameter.
Key phrases: inject arbitrary PHP code, inject arbitrary PHP code into includes/Config.php, static code injection
CVE-2008-1861: Directory traversal vulnerability in modules/threadstop/threadstop.php in ExBB Italia 0.22 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the exbb[default_lang] parameter.
Key phrases: include and execute arbitrary local files via a, directory traversal
CVE-2008-1862: ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which allows remote attackers to bypass this check via (1) POST or (2) COOKIE variables, a different vector than CVE-2006-4488.  NOTE: this can be leveraged to conduct PHP remote file inclusion attacks via a URL in the (a) new_exbb[home_path] or (b) exbb[home_path] parameter to modules/threadstop/threadstop.php.
Key phrases: bypass this check, bypass this check via (1) POST, php remote file inclusion
CVE-2008-1863: SQL injection vulnerability in view_reviews.php in Prozilla Cheat Script (aka Cheats) 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection
CVE-2008-1864: SQL injection vulnerability in project.php in Prozilla Freelancers allows remote attackers to execute arbitrary SQL commands via the project parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the project parameter, sql injection, arbitrary sql commands
CVE-2008-1865: Stack-based buffer overflow in the msx_readnode function in libmosix.c in openmosix-tools (aka userspace-tools) in openMosix might allow local users to cause a denial of service (application crash) via a third-party program that calls this function with a long item argument.  NOTE: the vendor does not provide any program that is capable of causing this overflow.
Key phrases: denial of service (application crash), cause a denial of service (application crash, stack-based buffer overflow, stack based buffer overflow
CVE-2008-1866: admin/modif_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically extracted under templates/ for execution via a direct request.
Key phrases: upload arbitrary PHP scripts, upload arbitrary PHP scripts in a ZIP archive
CVE-2008-1867: SQL injection vulnerability in Blog Pixel Motion (aka Blog PixelMotion) allows remote attackers to execute arbitrary SQL commands via the categorie parameter to index.php, possibly related to include/requetesIndex.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the categorie parameter, sql injection
CVE-2008-1868: admin/sauvBase.php in Blog Pixel Motion (aka Blog PixelMotion) does not require authentication, which allows remote attackers to trigger a database backup dump, and obtain the resulting blogPM.sql file that contains sensitive information.
Key phrases: obtain the resulting blogPM.sql file that contains sensitive information, trigger a database backup dump
CVE-2008-1869: SQL injection vulnerability in Site Sift Listings allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.  NOTE: this issue might be site-specific.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection, site-specific
CVE-2008-1870: SQL injection vulnerability in getdata.php in PIGMy-SQL 1.4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection, arbitrary sql commands
CVE-2008-1871: SQL injection vulnerability in links.php in Scriptsagent.com Links Directory 1.1 allows remote authenticated users to execute arbitrary SQL commands via the cat_id parameter in a list action.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the cat_id parameter, sql injection
CVE-2008-1872: SQL injection vulnerability in home.news.php in Comdev News Publisher 4.1.2 allows remote attackers to execute arbitrary SQL commands via the arcmonth parameter.  NOTE: some of these details are obtained from third party information.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the arcmonth parameter, sql injection
CVE-2008-1873: Cross-site scripting (XSS) vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje parameter.  NOTE: some of these details are obtained from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2008-1874: SQL injection vulnerability in account/user/mail.html in Xpoze Pro 3.05 and earlier allows remote authenticated users to execute arbitrary SQL commands via the reed parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the reed parameter, sql injection
CVE-2008-1875: SQL injection vulnerability in index.php in Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 allows remote attackers to execute arbitrary SQL commands via the photo_id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the photo_id parameter, sql injection
CVE-2008-1876: PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the _CONFIG[files][functions_page] parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-1877: tss 0.8.1 allows local users to read arbitrary files via the -a parameter, which is processed while tss is running with privileges.
Key phrases: read arbitrary files, read arbitrary files via the -a parameter
CVE-2008-1878: Stack-based buffer overflow in the demux_nsf_send_chunk function in src/demuxers/demux_nsf.c in xine-lib 1.1.12 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long NSF title.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), stack-based buffer overflow, stack based buffer overflow
CVE-2008-1880: The default configuration of Firebird before 2.0.3.12981.0-r6 on Gentoo Linux sets the ISC_PASSWORD environment variable before starting Firebird, which allows remote attackers to bypass SYSDBA authentication and obtain sensitive database information via an empty password.
Key phrases: bypass SYSDBA authentication, obtain sensitive database, bypass SYSDBA authentication and obtain sensitive database information, empty password
CVE-2008-1881: Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary code via a long subtitle in an SSA file.  NOTE: this issue is due to an incomplete fix for CVE-2007-6681.
Key phrases: execute arbitrary code, execute arbitrary code via a long subtitle in, stack-based buffer overflow, stack based buffer overflow
CVE-2008-1883: The server in Blackboard Academic Suite 7.x stores MD5 password hashes that are provided directly by clients, which makes it easier for remote attackers to access accounts via a modified client that skips the javascript/md5.js hash calculation, and instead sends an arbitrary MD5 string.
Key phrases: modified client, arbitrary string
CVE-2008-1884: Directory traversal vulnerability in index.php in Wikepage Opus 13 2007.2 allows remote attackers to read arbitrary files via directory traversal sequences in the wiki parameter, a different vector than CVE-2006-4418.
Key phrases: read arbitrary files, read arbitrary files via directory traversal sequences in
CVE-2008-1885: Directory traversal vulnerability in the NeffyLauncher 1.0.5 ActiveX control (NeffyLauncher.dll) in CDNetworks Nefficient Download allows remote attackers to download arbitrary code onto a client system via a .. (dot dot) in the SkinPath parameter and a .zip URL in the HttpSkin parameter.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
Key phrases: download arbitrary code, download arbitrary code onto a client system via, directory traversal, code execution
CVE-2008-1886: The NeffyLauncher 1.0.5 ActiveX control (NeffyLauncher.dll) in CDNetworks Nefficient Download uses weak cryptography for a KeyCode that blocks unauthorized use of the control, which allows remote attackers to bypass this protection mechanism by calculating the required KeyCode.  NOTE: this can be used by arbitrary web sites to host exploit code that targets this control.
Key phrases: bypass this protection, bypass this protection mechanism by calculating the required, weak cryptography, exploit code
CVE-2008-1887: Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString_FromStringAndSize function, which allocates less memory than expected when assert() is disabled and triggers a buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code via multiple vectors that cause, buffer overflow
CVE-2008-1888: Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML via the Picture Source (aka picture object source) field in the Rich Text Editor.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1889: SQL injection vulnerability in viewcat.php in XplodPHP AutoTutorials 2.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection, arbitrary sql commands
CVE-2008-1890: SQL injection vulnerability in the Jom Comment 2.0 build 345 component for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2008-1891: Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option.
Key phrases: read arbitrary CGI files, read arbitrary CGI files via a trailing (, directory traversal
CVE-2008-1892: Cross-site scripting (XSS) vulnerability in bs_auth.php in Blogator-script 0.95 and 1.01 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1893: PHP remote file inclusion vulnerability in index.php in W2B Online Banking allows remote attackers to execute arbitrary PHP code via a URL in the ilang parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-1894: Cross-site scripting (XSS) vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1895: Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands, unspecified
CVE-2008-1896: Multiple cross-site scripting (XSS) vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Redirect parameter to login.asp and the (2) OrderBy parameter to member_send.asp.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-1897: The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake.  NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.
Key phrases: denial of service (traffic amplification), a NEW message, cause a denial of service (traffic amplification, unauthenticated calls, spoofing