yahoo-inc/cve-impacts huggingface dataset:
CVE-2008-0035: Unspecified vulnerability in Foundation, as used in Apple iPhone 1.0 through 1.1.2, iPod touch 1.1 through 1.1.2, and Mac OS X 10.5 through 10.5.1, allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted URL that triggers memory corruption in Safari.
Key phrases: execute arbitrary code, denial of service (application termination), cause a denial of service (application termination, unspecified vulnerability in foundation, memory corruption
CVE-2008-0036: Buffer overflow in Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a crafted compressed PICT image, which triggers the overflow during decoding.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted compressed PICT, buffer overflow
CVE-2008-0037: X11 in Apple Mac OS X 10.5 through 10.5.1 does not properly handle when the "Allow connections from network client" preference is disabled, which allows remote attackers to bypass intended access restrictions and connect to the X server.
Key phrases: bypass intended access restrictions, bypass intended access restrictions and connect to the
CVE-2008-0038: Launch Services in Apple Mac OS X 10.5 through 10.5.1 allows an uninstalled application to be launched if it is in a Time Machine backup, which might allow local users to bypass intended security restrictions or exploit vulnerabilities in the application.
Key phrases: bypass intended security restrictions, be launched if it is in a Time, bypass intended security restrictions or exploit vulnerabilities in
CVE-2008-0039: Unspecified vulnerability in Mail in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary commands via a crafted file:// URL.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted file:// URL, unspecified, unspecified vulnerability
CVE-2008-0040: Unspecified vulnerability in NFS in Apple Mac OS X 10.5 through 10.5.1 allows remote attackers to cause a denial of service (system shutdown) or execute arbitrary code via unknown vectors related to mbuf chains that trigger memory corruption.
Key phrases: execute arbitrary code, denial of service (system shutdown), cause a denial of service (system shutdown, unspecified, unknown vectors, memory corruption, unspecified vulnerability
CVE-2008-0041: Parental Controls in Apple Mac OS X 10.5 through 10.5.1 contacts www.apple.com "when a website is unblocked," which allows remote attackers to determine when a system is running Parental Controls.
Key phrases: determine when a system is running Parental Controls
CVE-2008-0042: Argument injection vulnerability in Terminal.app in Terminal in Apple Mac OS X 10.4.11 and 10.5 through 10.5.1 allows remote attackers to execute arbitrary code via unspecified URL schemes.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified URL schemes, argument injection
CVE-2008-0043: Format string vulnerability in Apple iPhoto before 7.1.2 allows remote attackers to execute arbitrary code via photocast subscriptions.
Key phrases: execute arbitrary code, execute arbitrary code via photocast subscriptions, format string
CVE-2008-0044: Multiple buffer overflows in AFP Client in Apple Mac OS X 10.4.11 and 10.5.2 allow remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted afp:// URL.
Key phrases: execute arbitrary code, denial of service (application termination), cause a denial of service (application termination, buffer overflows
CVE-2008-0045: Unspecified vulnerability in AFP Server in Apple Mac OS X 10.4.11 allows remote attackers to bypass cross-realm authentication via unknown manipulations of Kerberos principal realm names.
Key phrases: bypass cross-realm authentication, bypass cross-realm authentication via unknown manipulations, unspecified, unspecified vulnerability
CVE-2008-0046: The Application Firewall in Apple Mac OS X 10.5.2 has an incorrect German translation for the "Set access for specific services and applications" radio button that might cause the user to believe that the button is used to restrict access only to specific services and applications, which might allow attackers to bypass intended access restrictions.
Key phrases: bypass intended access restrictions
CVE-2008-0047: Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.
Key phrases: execute arbitrary code, execute arbitrary code via crafted search expressions, heap-based buffer overflow, heap based buffer overflow
CVE-2008-0048: Stack-based buffer overflow in AppKit in Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via the a long file name to the NSDocument API.
Key phrases: execute arbitrary code, execute arbitrary code via the a long file, stack-based buffer overflow, stack based buffer overflow
CVE-2008-0049: AppKit in Apple Mac OS X 10.4.11 inadvertently makes an NSApplication mach port available for inter-process communication instead of inter-thread communication, which allows local users to execute arbitrary code via crafted messages to privileged applications.
Key phrases: execute arbitrary code, execute arbitrary code via crafted messages to privileged
CVE-2008-0050: CFNetwork in Apple Mac OS X 10.4.11 allows remote HTTPS proxy servers to spoof secure websites via data in a 502 Bad Gateway error.
Key phrases: spoof secure websites via data in a 502, spoofing
CVE-2008-0051: Integer overflow in CoreFoundation in Apple Mac OS X 10.4.11 might allow local users to execute arbitrary code via crafted time zone data.
Key phrases: execute arbitrary code, execute arbitrary code via crafted time zone data, integer overflow
CVE-2008-0052: CoreServices in Apple Mac OS X 10.4.11 treats .ief as a safe file type, which allows remote attackers to force Safari users into opening an .ief file in AppleWorks, even when the "Open 'Safe' files" preference is set.
Key phrases: force Safari users into opening an .ief file
CVE-2008-0053: Multiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a crafted HP-GL/2 file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted HP-, buffer overflows
CVE-2008-0054: Foundation in Apple Mac OS X 10.4.11 might allow context-dependent attackers to execute arbitrary code via a malformed selector name to the NSSelectorFromString API, which causes an "unexpected selector" to be used.
Key phrases: execute arbitrary code, execute arbitrary code via a malformed selector name, unexpected selector
CVE-2008-0055: Foundation in Apple Mac OS X 10.4.11 creates world-writable directories while NSFileManager copies files recursively and only modifies the permissions afterward, which allows local users to modify copied files to cause a denial of service and possibly gain privileges.
Key phrases: gain privileges, modify copied files to cause a denial of, world-writable directories, denial of service
CVE-2008-0056: Stack-based buffer overflow in Foundation in Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a "long pathname with an unexpected structure" that triggers the overflow in NSFileManager.
Key phrases: execute arbitrary code, execute arbitrary code via a "long pathname, stack-based buffer overflow, stack based buffer overflow
CVE-2008-0057: Multiple integer overflows in a "legacy serialization format" parser in AppKit in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via a crafted serialized property list.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted serialized property, multiple integer overflows
CVE-2008-0058: Race condition in the NSURLConnection cache management functionality in Foundation for Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via unspecified manipulations that cause messages to be sent to a deallocated object.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified manipulations that cause, race condition, deallocated object
CVE-2008-0059: Race condition in NSXML in Foundation for Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a crafted XML file, related to "error handling logic."
Key phrases: execute arbitrary code, execute arbitrary code via a crafted XML file, race condition
CVE-2008-0060: Help Viewer in Apple Mac OS X 10.4.11 and 10.5.2 allows remote attackers to execute arbitrary Applescript via a help:topic_list URL that injects HTML or JavaScript into a topic list page, as demonstrated using a help:runscript link.
Key phrases: execute arbitrary Applescript, execute arbitrary Applescript via a help:topic_list
CVE-2008-0061: MaraDNS 1.0 before 1.0.41, 1.2 before 1.2.12.08, and 1.3 before 1.3.07.04 allows remote attackers to cause a denial of service via a crafted DNS packet that prevents an authoritative name (CNAME) record from resolving, aka "improper rotation of resource records."
Key phrases: cause a denial of service via a crafted, improper rotation of resource records
CVE-2008-0062: KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), null pointer dereference, double-free, double free
CVE-2008-0063: The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."
Key phrases: obtain sensitive information, uninitialized stack values
CVE-2008-0064: Stack-based buffer overflow in Pierre-emmanuel Gougelet (1) XnView 1.91 and 1.92, (2) NConvert 4.85, and (3) libgfl280.dll in GFL SDK 2.870 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted Radiance RGBE (.hdr) file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted Radiance RGBE, stack-based buffer overflow, stack based buffer overflow
CVE-2008-0065: Multiple stack-based buffer overflows in in_mp3.dll in Winamp 5.21, 5.5, and 5.51 allow remote attackers to execute arbitrary code via a long (1) artist or (2) name tag in Ultravox streaming metadata, related to construction of stream titles.
Key phrases: execute arbitrary code, execute arbitrary code via a long (1, stack-based buffer overflows, stack based buffer overflow
CVE-2008-0066: Multiple buffer overflows in htmsr.dll in the HTML speed reader in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes 7.0.2 and 7.0.3, allow remote attackers to execute arbitrary code via an HTML document with (1) "large chunks of data," or a long URL in the (2) BACKGROUND attribute of a BODY element or (3) SRC attribute of an IMG element.
Key phrases: execute arbitrary code, execute arbitrary code via an HTML document with, multiple buffer overflows, large chunks of data
CVE-2008-0067: Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) long string parameters to the OpenView5.exe CGI program; (2) a long string parameter to the OpenView5.exe CGI program, related to ov.dll; or a long string parameter to the (3) getcvdata.exe, (4) ovlaunch.exe, or (5) Toolbar.exe CGI program.
Key phrases: execute arbitrary code, execute arbitrary code via (1) long, stack-based buffer overflows, stack based buffer overflow
CVE-2008-0068: Directory traversal vulnerability in OpenView5.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to read arbitrary files via directory traversal sequences in the Action parameter.
Key phrases: read arbitrary files, read arbitrary files via directory traversal sequences in
CVE-2008-0069: Stack-based buffer overflow in XnView 1.92 and 1.92.1 allows user-assisted remote attackers to execute arbitrary code via a long FontName parameter in a slideshow (.sld) file, a different vector than CVE-2008-1461.
Key phrases: execute arbitrary code, execute arbitrary code via a long FontName parameter, stack-based buffer overflow, stack based buffer overflow
CVE-2008-0070: Integer overflow in Orb Networks Orb 2.00.1014 and Winamp Remote BETA allows remote attackers to execute arbitrary code via an RPC request that specifies a large number of array dimensions, which triggers a heap-based buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code via an RPC request that, integer overflow, heap-based buffer overflow, heap based buffer overflow
CVE-2008-0071: The Web UI interface in (1) BitTorrent before 6.0.3 build 8642 and (2) uTorrent before 1.8beta build 10524 allows remote attackers to cause a denial of service (application crash) via an HTTP request with a malformed Range header.
Key phrases: denial of service (application crash), cause a denial of service (application crash, malformed range header
CVE-2008-0072: Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted encrypted message, format string
CVE-2008-0073: Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a large streamid SDP, array index error
CVE-2008-0074: Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows local users to gain privileges via unknown vectors related to file change notifications in the TPRoot, NNTPFile\\Root, or WWWRoot folders.
Key phrases: gain privileges, gain privileges via unknown vectors related to file, unspecified, unspecified vulnerability
CVE-2008-0075: Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 through 6.0 allows remote attackers to execute arbitrary code via crafted inputs to ASP pages.
Key phrases: execute arbitrary code, execute arbitrary code via crafted inputs to ASP, unspecified, unspecified vulnerability
CVE-2008-0076: Unspecified vulnerability in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via crafted HTML layout combinations, aka "HTML Rendering Memory Corruption Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via crafted HTML layout combinations, unspecified, html rendering memory corruption, unspecified vulnerability
CVE-2008-0077: Use-after-free vulnerability in Microsoft Internet Explorer 6 SP1, 6 SP2, and and 7 allows remote attackers to execute arbitrary code by assigning malformed values to certain properties, as demonstrated using the by property of an animateMotion SVG element, aka "Property Memory Corruption Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code by assigning malformed values to, use-after-free, property memory corruption
CVE-2008-0078: Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via a crafted image, aka "Argument Handling Memory Corruption Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a crafted image, unspecified, argument handling memory corruption, unspecified vulnerability
CVE-2008-0080: Heap-based buffer overflow in the WebDAV Mini-Redirector in Microsoft Windows XP SP2, Server 2003 SP1 and SP2, and Vista allows remote attackers to execute arbitrary code via a crafted WebDAV response.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted WebDAV response, heap-based buffer overflow, heap based buffer overflow
CVE-2008-0081: Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted macros, aka "Macro Validation Vulnerability," a different vulnerability than CVE-2007-3490.
Key phrases: execute arbitrary code, execute arbitrary code via crafted macros, unspecified, macro validation, unspecified vulnerability
CVE-2008-0082: An ActiveX control (Messenger.UIAutomation.1) in Windows Messenger 4.7 and 5.1 is marked as safe-for-scripting, which allows remote attackers to control the Messenger application, and "change state," obtain contact information, and establish audio or video connections without notification via unknown vectors.
Key phrases: obtain contact, control the Messenger application, safe-for-scripting, unknown vectors
CVE-2008-0083: The (1) VBScript (VBScript.dll) and (2) JScript (JScript.dll) scripting engines 5.1 and 5.6, as used in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2, do not properly decode script, which allows remote attackers to execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors
CVE-2008-0084: Unspecified vulnerability in the TCP/IP support in Microsoft Windows Vista allows remote DHCP servers to cause a denial of service (hang and restart) via a crafted DHCP packet.
Key phrases: denial of service (hang and restart), cause a denial of service (hang and, unspecified, unspecified vulnerability
CVE-2008-0085: SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 does not initialize memory pages when reallocating memory, which allows database operators to obtain sensitive information (database contents) via unknown vectors related to memory page reuse.
Key phrases: obtain sensitive information, obtain sensitive information (database contents) via, unknown vectors, memory page reuse
CVE-2008-0086: Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to execute arbitrary code via a crafted SQL expression.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted SQL expression, buffer overflow
CVE-2008-0087: The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows remote attackers to spoof DNS responses.
Key phrases: spoof DNS responses, predictable dns transaction ids, spoofing
CVE-2008-0088: Unspecified vulnerability in Active Directory on Microsoft Windows 2000 and Windows Server 2003, and Active Directory Application Mode (ADAM) on XP and Server 2003, allows remote attackers to cause a denial of service (hang and restart) via a crafted LDAP request.
Key phrases: denial of service (hang and restart), cause a denial of service (hang and, unspecified, unspecified vulnerability
CVE-2008-0089: SQL injection vulnerability in uprofile.php in ClipShare allows remote attackers to execute arbitrary SQL commands via the UID parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the UID parameter, sql injection, arbitrary sql commands
CVE-2008-0090: A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long argument to the SetPassword method.
Key phrases: denial of service (Internet Explorer 7 crash), cause a denial of service (Internet Explorer, long argument
CVE-2008-0091: Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the file parameter.
Key phrases: delete arbitrary files, read and delete arbitrary files via a .., directory traversal
CVE-2008-0092: Cross-site scripting (XSS) vulnerability in index.php in the search module in Appalachian State University phpWebSite 1.4.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-0093: Multiple cross-site scripting (XSS) vulnerabilities in newticket.php in eTicket 1.5.5.2, and 1.5.6 RC2 and RC3, allow remote attackers to inject arbitrary web script or HTML via the (1) Name and (2) Subject parameters.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-0094: Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to (1) include and execute arbitrary local files via a .. (dot dot) in the as_language parameter to assets/snippets/AjaxSearch/AjaxSearch.php, reached through index-ajax.php; and (2) read arbitrary local files via a .. (dot dot) in the file parameter to assets/js/htcmime.php.
Key phrases: (1) include and execute arbitrary local, directory traversal, arbitrary local files
CVE-2008-0095: The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash, null pointer dereference
CVE-2008-0096: Multiple buffer overflows in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allow remote attackers to execute arbitrary code via a (1) a long username, which triggers an overflow in the log function; or (2) a long password.
Key phrases: execute arbitrary code, execute arbitrary code via a (1), buffer overflows
CVE-2008-0097: Format string vulnerability in the log function in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the username field, as demonstrated by a certain LoginPassword message.
Key phrases: execute arbitrary code, execute arbitrary code via format string specifiers in
CVE-2008-0098: Buffer overflow in RealPlayer 11 build 6.0.14.748 allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: As of 20080103, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, buffer overflow, disclosure
CVE-2008-0099: Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the searchtext parameter to search.php, and unspecified other vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the searchtext parameter, sql injection, unspecified other vectors
CVE-2008-0100: Stack-based buffer overflow in the Scene::errorf function in Scene.cpp in White_Dune 0.29 beta791 and earlier allows remote attackers to execute arbitrary code via a long string in a .WRL file.
Key phrases: execute arbitrary code, execute arbitrary code via a long string in, stack-based buffer overflow, stack based buffer overflow
CVE-2008-0101: Format string vulnerability in the swDebugf function in DuneApp.cpp in White_Dune 0.29 beta791 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a .WRL file.
Key phrases: execute arbitrary code, execute arbitrary code via format string specifiers in
CVE-2008-0102: Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file, related to invalid "memory values," aka "Publisher Invalid Memory Reference Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a crafted .pub file, unspecified, publisher invalid memory reference, unspecified vulnerability
CVE-2008-0103: Unspecified vulnerability in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Office document that contains a malformed object, related to a "memory handling error," aka "Microsoft Office Execution Jump Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via an Office document that, unspecified, memory handling error, microsoft office execution jump, unspecified vulnerability
CVE-2008-0104: Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file, aka "Publisher Memory Corruption Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a crafted .pub file, unspecified, publisher memory corruption, unspecified vulnerability
CVE-2008-0105: Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section header index table information, aka "Microsoft Works File Converter Index Table Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a .wps file with, microsoft works file converter index table
CVE-2008-0106: Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted insert statement, buffer overflow
CVE-2008-0107: Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 allows remote authenticated users to execute arbitrary code via a (1) SMB or (2) WebDAV pathname for an on-disk file (aka stored backup file) with a crafted record size value, which triggers a heap-based buffer overflow, aka "SQL Server Memory Corruption Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a (1), integer underflow, heap-based buffer overflow, sql server memory corruption, heap based buffer overflow
CVE-2008-0108: Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted field lengths, aka "Microsoft Works File Converter Field Length Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a .wps file with, stack-based buffer overflow, microsoft works file converter field length, stack based buffer overflow
CVE-2008-0109: Word in Microsoft Office 2000 SP3, XP SP3, Office 2003 SP2, and Office Word Viewer 2003 allows remote attackers to execute arbitrary code via crafted fields within the File Information Block (FIB) of a Word file, which triggers length calculation errors and memory corruption.
Key phrases: execute arbitrary code, execute arbitrary code via crafted fields within the, length calculation errors, memory corruption
CVE-2008-0110: Unspecified vulnerability in Microsoft Outlook in Office 2000 SP3, XP SP3, 2003 SP2 and Sp3, and Office System allows user-assisted remote attackers to execute arbitrary code via a crafted mailto URI.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted mailto URI, unspecified, unspecified vulnerability
CVE-2008-0111: Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted data validation records, aka "Excel Data Validation Record Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via crafted data validation records, unspecified, excel data validation record, unspecified vulnerability
CVE-2008-0112: Unspecified vulnerability in Microsoft Excel 2000 SP3, and Office for Mac 2004 and 2008 allows user-assisted remote attackers to execute arbitrary code via a crafted .SLK file that is not properly handled when importing the file, aka "Excel File Import Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a crafted .SLK file, unspecified, excel file import, unspecified vulnerability
CVE-2008-0113: Unspecified vulnerability in Microsoft Office Excel Viewer 2003 up to SP3 allows user-assisted remote attackers to execute arbitrary code via an Excel document with malformed cell comments that trigger memory corruption from an "allocation error," aka "Microsoft Office Cell Parsing Memory Corruption Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via an Excel document with, unspecified, memory corruption, allocation error, unspecified vulnerability
CVE-2008-0114: Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office for Mac 2004 allows user-assisted remote attackers to execute arbitrary code via crafted Style records that trigger memory corruption.
Key phrases: execute arbitrary code, execute arbitrary code via crafted Style records that, unspecified, memory corruption, unspecified vulnerability
CVE-2008-0115: Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office for Mac 2004 allows user-assisted remote attackers to execute arbitrary code via malformed formulas, aka "Excel Formula Parsing Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via malformed formulas, unspecified, excel formula parsing, unspecified vulnerability
CVE-2008-0116: Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka "Excel Rich Text Validation Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via malformed tags in rich, excel rich text validation
CVE-2008-0117: Unspecified vulnerability in Microsoft Excel 2000 SP3 and 2002 SP2, and Office 2004 and 2008 for Mac, allows user-assisted remote attackers to execute arbitrary code via crafted conditional formatting values, aka "Excel Conditional Formatting Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via crafted conditional formatting values, unspecified, excel conditional formatting, unspecified vulnerability
CVE-2008-0118: Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption from an "allocation error," aka "Microsoft Office Memory Corruption Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a crafted Office document, unspecified, memory corruption, allocation error, microsoft office memory corruption, unspecified vulnerability
CVE-2008-0119: Unspecified vulnerability in Microsoft Publisher in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 SP1 and earlier allows remote attackers to execute arbitrary code via a Publisher file with crafted object header data that triggers memory corruption, aka "Publisher Object Handler Validation Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a Publisher file with, unspecified, memory corruption, publisher object handler validation, unspecified vulnerability
CVE-2008-0120: Integer overflow in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file with a malformed picture index that triggers memory corruption, related to handling of CString objects, aka "Memory Allocation Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a PowerPoint file with, integer overflow, memory corruption, memory allocation
CVE-2008-0121: A "memory calculation error" in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file with an invalid picture index that triggers memory corruption, aka "Memory Calculation Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a PowerPoint file with, memory calculation error, memory corruption
CVE-2008-0122: Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), memory corruption
CVE-2008-0123: Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter.  NOTE: this issue only exists until the installation is complete.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-0124: Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1) the "Real name" field in Personal Settings, which is presented to readers of articles; or (2) a file upload, as demonstrated by a .htm, .html, or .js file.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss), file upload
CVE-2008-0125: Cross-site scripting (XSS) vulnerability in phpstats.php in Michael Wagner phpstats 0.1 alpha allows remote attackers to inject arbitrary web script or HTML via the baseDir parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-0127: The administration interface in McAfee E-Business Server 8.5.2 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long initial authentication packet.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), long initial authentication packet
CVE-2008-0128: The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVE-2008-0129: SQL injection vulnerability in starnet/addons/slideshow_full.php in Site@School 2.3.10 and earlier allows remote attackers to execute arbitrary SQL commands via the album_name parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the album_name parameter, sql injection
CVE-2008-0130: SQL injection vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Username parameter, a different vulnerability than CVE-2007-6671.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the Username parameter, sql injection
CVE-2008-0131: Cross-site scripting (XSS) vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different product than CVE-2006-6022.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-0132: Pragma FortressSSH 5.0 Build 4 Revision 293 and earlier handles long input to sshd.exe by creating an error-message window and waiting for the administrator to click in this window before terminating the sshd.exe process, which allows remote attackers to cause a denial of service (connection slot exhaustion) via a flood of SSH connections with long data objects, as demonstrated by (1) a long list of keys and (2) a long username.
Key phrases: denial of service (connection slot exhaustion), cause a denial of service (connection slot
CVE-2008-0133: Multiple SQL injection vulnerabilities in Tribisur 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to cat_main.php and the (2) cat parameter to forum.php in a liste action.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands
CVE-2008-0134: Cross-site scripting (XSS) vulnerability in Forums/setup.asp in Snitz Forums 2000 3.4.06 and earlier allows remote attackers to inject arbitrary web script or HTML via the MAIL parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-0135: Snitz Forums 2000 3.4.06 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for forum/snitz_forums_2000.mdb.
Key phrases: download a database via a direct request for, insufficient access control, sensitive information
CVE-2008-0136: Snitz Forums 2000 3.4.05 allows remote attackers to obtain sensitive information via a direct request to forum/whereami.asp, which reveals the database path.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, database path
CVE-2008-0137: PHP remote file inclusion vulnerability in config.inc.php in SNETWORKS PHP CLASSIFIEDS 5.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_escape parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-0138: PHP remote file inclusion vulnerability in xoopsgallery/init_basic.php in the mod_gallery module for XOOPS, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-0139: Eval injection vulnerability in loudblog/inc/parse_old.php in Loudblog 0.8.0 and earlier allows remote attackers to execute arbitrary PHP code via the template parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the template parameter, eval injection, arbitrary php code
CVE-2008-0140: Directory traversal vulnerability in error.php in Uebimiau Webmail 2.7.10 and 2.7.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the selected_theme parameter, a different vector than CVE-2007-3172.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2008-0141: actions.php in WebPortal CMS 0.6-beta generates predictable passwords containing only the time of day, which makes it easier for remote attackers to obtain access to any account via a lostpass action.
Key phrases: obtain access, lostpass action
CVE-2008-0142: Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL commands via the user_name parameter to actions.php, and unspecified other vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the user_name parameter, sql injection, arbitrary sql commands, unspecified other vectors
CVE-2008-0143: PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM Broadcaster, allows remote attackers to execute arbitrary PHP code via a URL in the commonpath parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-0144: PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.  NOTE: this can also be leveraged for local file inclusion using directory traversal sequences.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code, local file inclusion, directory traversal sequences
CVE-2008-0145: Unspecified vulnerability in glob in PHP before 4.4.8, when open_basedir is enabled, has unknown impact and attack vectors.  NOTE: this issue reportedly exists because of a regression related to CVE-2007-4663.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2008-0146: Cross-site scripting (XSS) vulnerability in the error page in W3-mSQL allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the top-level URI.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-0147: SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via (1) the user_email parameter and possibly (2) username parameter in a Members action.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via (1), sql injection
CVE-2008-0148: TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell commands via the cmd parameter in a direct request.
Key phrases: execute arbitrary shell commands, execute arbitrary shell commands via the cmd parameter
CVE-2008-0149: TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function.
Key phrases: read system information via a direct request to, tutos
CVE-2008-0150: Unspecified vulnerability in the LDAP authentication feature in Aruba Mobility Controller 2.3.6.15, 2.5.2.11, 2.5.4.25, 2.5.5.7, 3.1.1.3, and 2.4.8.11-FIPS or earlier allows remote attackers to bypass authentication mechanisms and obtain management or VPN interface access.
Key phrases: bypass authentication, obtain management or VPN interface access, bypass authentication mechanisms and obtain management or VPN, unspecified, unspecified vulnerability
CVE-2008-0151: Heap-based buffer overflow in Foxit WAC Server 2.1.0.910, 2.0 Build 3503, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Telnet request with long options.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), heap-based buffer overflow, heap based buffer overflow
CVE-2008-0152: SLnet.exe in SeattleLab SLNet RF Telnet Server 4.1.1.3758 and earlier allows user-assisted remote attackers to cause a denial of service (crash) via unspecified telnet options, which triggers a NULL pointer dereference.  NOTE: the crash is not user-assisted when the server is running in debug mode.
Key phrases: denial of service (crash), cause a denial of service (crash), null pointer dereference, unspecified
CVE-2008-0153: telnetd.exe in Pragma TelnetServer 7.0.4.589 allows remote attackers to cause a denial of service (process crash and resource exhaustion) via a crafted TELOPT PRAGMA LOGON telnet option, which triggers a NULL pointer dereference.
Key phrases: denial of service (process crash and resource exhaustion), cause a denial of service (process crash, null pointer dereference
CVE-2008-0154: SQL injection vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to execute arbitrary SQL commands the c parameter.
Key phrases: execute arbitrary SQL, execute arbitrary SQL commands the c parameter, sql injection, arbitrary sql commands
CVE-2008-0155: Cross-site scripting (XSS) vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to inject arbitrary web script or HTML via the c parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-0156: Absolute path traversal vulnerability in index.php in Million Dollar Script 2.0.14 allows remote attackers to read arbitrary files via encoded "/" (%2F) sequences in the link parameter.
Key phrases: read arbitrary files, read arbitrary files via encoded "/", absolute path traversal
CVE-2008-0157: SQL injection vulnerability in FlexBB 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb_temp_id parameter in a cookie.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the flexbb_temp_id parameter, sql injection, arbitrary sql commands
CVE-2008-0158: Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to read arbitrary files via a .. (dot dot) in the aux_page parameter.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2008-0159: SQL injection vulnerability in index.php in eggBlog 3.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the eggblogpassword parameter in a cookie.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the eggblogpassword parameter, sql injection, arbitrary sql commands
CVE-2008-0162: misc.c in splitvt 1.6.6 and earlier does not drop group privileges before executing xprop, which allows local users to gain privileges.
Key phrases: gain privileges
CVE-2008-0163: Linux kernel 2.6, when using vservers, allows local users to access resources of other vservers via a symlink attack in /proc.
Key phrases: access resources of other vservers via a symlink
CVE-2008-0164: Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.
Key phrases: add arbitrary accounts, (1) add arbitrary accounts via the, cross-site request forgery (csrf), cross site request forgery
CVE-2008-0165: Cross-site request forgery (CSRF) vulnerability in Ikiwiki before 2.42 allows remote attackers to modify user preferences, including passwords, via the (1) preferences and (2) edit forms.
Key phrases: modify user preferences, cross-site request forgery (csrf), cross site request forgery
CVE-2008-0166: OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
Key phrases: predictable numbers, brute force guessing
CVE-2008-0167: The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
Key phrases: bypass intended access restrictions, bypass intended access restrictions or have unspecified other, unspecified other impact, opportunistic circumstances, unspecified impact
CVE-2008-0169: Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.
Key phrases: bypass authentication, empty password