yahoo-inc/cve-impacts huggingface dataset:
CVE-2008-5003: SQL injection vulnerability in ndetail.php in Shahrood allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection, arbitrary sql commands
CVE-2008-5004: SQL injection vulnerability in genscode.php in myWebland Bloggie Lite 0.0.2 beta allows remote attackers to execute arbitrary SQL commands via a crafted cookie.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via a crafted cookie, sql injection, arbitrary sql commands
CVE-2008-5005: Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.
Key phrases: execute arbitrary code, gain privileges, gain privileges by specifying a long folder extension, stack-based buffer overflows, stack based buffer overflow
CVE-2008-5006: smtp.c in the c-client library in University of Washington IMAP Toolkit 2007b allows remote SMTP servers to cause a denial of service (NULL pointer dereference and application crash) by responding to the QUIT command with a close of the TCP connection instead of the expected 221 response code.
Key phrases: denial of service (NULL pointer dereference and application crash), cause a denial of service (NULL pointer, null pointer dereference
CVE-2008-5007: create_lazarus_export_tgz.sh in lazarus 0.9.24 allows local users to overwrite or delete arbitrary files via a symlink attack on a (1) /tmp/lazarus.tgz temporary file or a (2) /tmp/lazarus temporary directory.
Key phrases: delete arbitrary files, overwrite or delete arbitrary files via a symlink
CVE-2008-5008: Buffer overflow in src/src_sinc.c in Secret Rabbit Code (aka SRC or libsamplerate) before 0.1.4, when "extreme low conversion ratios" are used, allows user-assisted attackers to have an unknown impact via a crafted audio file.
Key phrases: have an unknown impact via a crafted audio, buffer overflow
CVE-2008-5009: Race condition in the s_xout kernel module in Sun Solstice X.25 9.2, when running on a multiple CPU machine, allows local users to cause a denial of service (panic) via vectors involving reading the /dev/xty file.
Key phrases: denial of service (panic), cause a denial of service (panic), race condition
CVE-2008-5010: in.dhcpd in the DHCP implementation in Sun Solaris 8 through 10, and OpenSolaris before snv_103, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unknown DHCP requests related to the "number of offers," aka Bug ID 6713805.
Key phrases: denial of service (assertion failure and daemon exit), cause a denial of service (assertion failure
CVE-2008-5011: Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to qpconfig_sample.xml, aka SPR CWIR7KMPVP and THES7F9NVR, a different vulnerability than CVE-2008-2163 and CVE-2008-3860.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2008-5012: Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker.  NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.
Key phrases: access arbitrary images, bypass the same origin policy, bypass the same origin policy and access arbitrary, bypass same origin policy
CVE-2008-5013: Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted SWF file, expired memory address
CVE-2008-5014: jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash)
CVE-2008-5015: Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrary JavaScript with chrome privileges via malicious code in a file that has already been saved on the local system.
Key phrases: execute arbitrary JavaScript, chrome privileges, file: uri
CVE-2008-5016: The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences.
Key phrases: denial of service (crash), cause a denial of service (crash), multiple vectors, assertion failure, other consequences
CVE-2008-5017: Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors.
Key phrases: denial of service (crash), cause a denial of service (crash), integer overflow, unknown vectors
CVE-2008-5018: The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via vectors related to "insufficient class checking" in the Date class.
Key phrases: denial of service (crash), cause a denial of service (crash), insufficient class checking
CVE-2008-5019: The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18 allows remote attackers to violate the same origin policy to conduct cross-site scripting (XSS) attacks and execute arbitrary JavaScript with chrome privileges via unknown vectors.
Key phrases: execute arbitrary JavaScript, violate the same origin policy to conduct cross, cross-site scripting (xss), unknown vectors
CVE-2008-5021: nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized, then using the blur method to access uninitialized memory.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), uninitialized memory
CVE-2008-5022: The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.
Key phrases: execute arbitrary script, bypass the same-origin policy, bypass the inner window check, bypass the same-origin policy and execute, multiple listeners, bypass same origin policy
CVE-2008-5023: Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding CSS property in a signed JAR file.
Key phrases: execute arbitrary script, bypass the protection, bypass the protection mechanism for codebase principals and
CVE-2008-5024: Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.
Key phrases: conduct XML injection attacks via the default namespace, xml injection
CVE-2008-5025: Stack-based buffer overflow in the hfs_cat_find_brec function in fs/hfs/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service (memory corruption or system crash) via an hfs filesystem image with an invalid catalog namelength field, a related issue to CVE-2008-4933.
Key phrases: denial of service (memory corruption or system crash), cause a denial of service (memory corruption, stack-based buffer overflow, stack based buffer overflow
CVE-2008-5026: Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML documents.
Key phrases: leverage same-origin relationships and conduct cross, cross-site scripting (xss)
CVE-2008-5027: The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon.
Key phrases: bypass authorization checks, custom form, browser addon
CVE-2008-5028: Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of arbitrary programs by this process, via unspecified HTTP requests.
Key phrases: send commands to the Nagios process, cross-site request forgery (csrf), execution of arbitrary programs, cross site request forgery, unspecified
CVE-2008-5029: The __scm_destroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service (panic) via vectors related to sending an SCM_RIGHTS message through a UNIX domain socket and closing file descriptors.
Key phrases: denial of service (panic), cause a denial of service (panic)
CVE-2008-5030: Heap-based buffer overflow in the cddb_read_disc_data function in cddb.c in libcdaudio 0.99.12p2 allows remote CDDB servers to execute arbitrary code via long CDDB data.
Key phrases: execute arbitrary code, execute arbitrary code via long CDDB data, heap-based buffer overflow, heap based buffer overflow
CVE-2008-5031: Multiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large integer value in the tabsize argument to the expandtabs method, as implemented by (1) the string_expandtabs function in Objects/stringobject.c and (2) the unicode_expandtabs function in Objects/unicodeobject.c.  NOTE: this vulnerability reportedly exists because of an incomplete fix for CVE-2008-2315.
Key phrases: have an unknown impact via a large integer, multiple integer overflows
CVE-2008-5032: Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c.  NOTE: this identifier originally included an issue related to RealText, but that issue has been assigned a separate identifier, CVE-2008-5036.
Key phrases: execute arbitrary code, execute arbitrary code via the header of an, stack-based buffer overflow, stack based buffer overflow
CVE-2008-5033: The chip_command function in drivers/media/video/tvaudio.c in the Linux kernel 2.6.25.x before 2.6.25.19, 2.6.26.x before 2.6.26.7, and 2.6.27.x before 2.6.27.3 allows attackers to cause a denial of service (NULL function pointer dereference and OOPS) via unknown vectors.
Key phrases: denial of service (NULL function pointer dereference and OOPS), cause a denial of service (NULL function, null function pointer dereference, oops, unknown vectors
CVE-2008-5034: master-filter in printfilters-ppd 2.13 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filter.debug temporary file.  NOTE: the vendor disputes this vulnerability, stating 'this package does not have " possibility of attack with the help of symlinks"'
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2008-5035: The Resource Monitoring and Control (RMC) daemon in IBM Hardware Management Console (HMC) 7 release 3.2.0 SP1 and 3.3.0 SP2 allows remote attackers to cause a denial of service (daemon crash or hang) via a packet with an invalid length.
Key phrases: denial of service (daemon crash or hang), cause a denial of service (daemon crash, packet with an invalid length
CVE-2008-5036: Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c.  NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.
Key phrases: execute arbitrary code, execute arbitrary code via an an invalid RealText, stack-based buffer overflow, stack based buffer overflow
CVE-2008-5037: SQL injection vulnerability in view.php in ElkaGroup Image Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the cid parameter, sql injection, arbitrary sql commands
CVE-2008-5038: Use-after-free vulnerability in the NetWare Core Protocol (NCP) feature in Novell eDirectory 8.7.3 SP10 before 8.7.3 SP10 FTF1 and 8.8 SP2 for Windows allows remote attackers to cause a denial of service and possibly execute arbitrary code via a sequence of "Get NCP Extension Information By Name" requests that cause one thread to operate on memory after it has been freed in another thread, which triggers memory corruption, aka Novell Bug 373852.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, use-after-free, memory corruption
CVE-2008-5039: Cross-site scripting (XSS) vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-5040: Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1) myforum_login and (2) myforum_pass cookies to 1.
Key phrases: bypass authentication, gain administrative access, bypass authentication and gain administrative access by setting
CVE-2008-5041: Sweex RO002 Router with firmware Ts03-072 has "rdc123" as its default password for the "rdc123" account, which makes it easier for remote attackers to obtain access.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: obtain access, default password
CVE-2008-5042: Zeeways PhotoVideoTube 1.1 and earlier allows remote attackers to bypass authentication and perform administrative tasks via a direct request to admin/home.php.
Key phrases: bypass authentication, bypass authentication and perform administrative tasks via a
CVE-2008-5043: Multiple cross-site scripting (XSS) vulnerabilities in the web-based interface in IBM Metrica Service Assurance Framework allow remote authenticated users to inject arbitrary web script or HTML via (1) the elementid parameter in a generatedreportresults action to the ReportTree program, (2) the jnlpname parameter to the Launch program, or (3) the :tasklabel parameter to the ReportRequest program, related to the name of a report.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2008-5044: Race condition in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (crash or hang) via a multi-threaded application that makes many calls to UnhookWindowsHookEx while certain other desktop activity is occurring.
Key phrases: denial of service (crash or hang), cause a denial of service (crash or, race condition
CVE-2008-5045: Heap-based buffer overflow in Network-Client FTP Now 2.6, and possibly other versions, allows remote FTP servers to cause a denial of service (crash) via a 200 server response that is exactly 1024 characters long.
Key phrases: denial of service (crash), cause a denial of service (crash), heap-based buffer overflow, heap based buffer overflow
CVE-2008-5046: SQL injection vulnerability in index.php in Mole Group Pizza Script allows remote attackers to execute arbitrary SQL commands via the manufacturers_id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the manufacturers_id parameter, sql injection
CVE-2008-5047: SQL injection vulnerability in admin/index.php in Mole Group Rental Script allows remote attackers to execute arbitrary SQL commands via the username parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the username parameter, sql injection
CVE-2008-5048: Buffer overflow in Atepmon.sys in ISecSoft Anti-Trojan Elite 4.2.1 and earlier, and possibly 4.2.2, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via long inputs to the 0x00222494 IOCTL.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2008-5049: Buffer overflow in AKEProtect.sys 3.3.3.0 in ISecSoft Anti-Keylogger Elite 3.3.0 and earlier, and possibly other versions including 3.3.3, allows local users to gain privileges via long inputs to the (1) 0x002224A4, (2) 0x002224C0, and (3) 0x002224CC IOCTL.
Key phrases: gain privileges, gain privileges via long inputs to the (, buffer overflow
CVE-2008-5050: Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before 0.94.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted VBA project file, which triggers a heap-based buffer overflow.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), heap-based buffer overflow, heap based buffer overflow
CVE-2008-5051: SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the PostID parameter to index.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the PostID parameter, sql injection, arbitrary sql commands
CVE-2008-5052: The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.
Key phrases: denial of service (crash), cause a denial of service (crash), unknown vectors, memory corruption
CVE-2008-5053: PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-5054: Multiple SQL injection vulnerabilities in Develop It Easy Membership System 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameters to customer_login.php and the (3) user_name and (4) user_pass parameters to admin/index.php. NOTE: some of these details are obtained from third party information.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands
CVE-2008-5055: SQL injection vulnerability in department_offline_context.php in ActiveCampaign TrioLive before 1.58.7 allows remote attackers to execute arbitrary SQL commands via the department_id parameter to index.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the department_id parameter, sql injection
CVE-2008-5056: Cross-site scripting (XSS) vulnerability in department_offline_context.php in ActiveCampaign TrioLive before 1.58.7 allows remote attackers to inject arbitrary web script or HTML via the department_id parameter to index.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-5057: SQL injection vulnerability in film.asp in Yigit Aybuga Dizi Portali allows remote attackers to execute arbitrary SQL commands via the film parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the film parameter, sql injection
CVE-2008-5058: SQL injection vulnerability in siteadmin/loginsucess.php in Pre Simple CMS allows remote attackers to execute arbitrary SQL commands via the user parameter, as reachable from siteadmin/adminlogin.php.  NOTE: some of these details are obtained from third party information.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the user parameter, sql injection
CVE-2008-5059: Cross-site scripting (XSS) vulnerability in index.php in ModernBill 4.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a Javascript event in the new_language parameter in a login action.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2008-5060: Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to (1) export_batch.inc.php, (2) run_auto_suspend.cron.php, and (3) send_email_cache.php in include/scripts/; (4) include/misc/mod_2checkout/2checkout_return.inc.php; and (5) include/html/nettools.popup.php, different vectors than CVE-2006-4034 and CVE-2005-1054.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-5061: Cross-site scripting (XSS) vulnerability in php/cal_default.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to inject arbitrary web script or HTML via the URL.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-5062: Directory traversal vulnerability in php/cal_pdf.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to read arbitrary files via directory traversal sequences in the thefile parameter.
Key phrases: read arbitrary files, read arbitrary files via directory traversal sequences in
CVE-2008-5063: PHP remote file inclusion vulnerability in Admin/ADM_Pagina.php in OTManager 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the Tipo parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-5064: SQL injection vulnerability in liga.php in H&H WebSoccer 2.80 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection, arbitrary sql commands
CVE-2008-5065: TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBook_login cookie to admin.
Key phrases: bypass authentication, gain administrative access, bypass authentication and gain administrative access by setting
CVE-2008-5066: PHP remote file inclusion vulnerability in upload/admin/frontpage_right.php in Agares Media ThemeSiteScript 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2008-5067: Cross-site scripting (XSS) vulnerability in search.php in Kmita Catalogue 2.x allows remote attackers to inject arbitrary web script or HTML via the q parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-5068: Multiple cross-site scripting (XSS) vulnerabilities in Kmita Gallery allow remote attackers to inject arbitrary web script or HTML via the (1) begin parameter to index.php and the (2) searchtext parameter to search.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-5069: SQL injection vulnerability in go.php in Panuwat PromoteWeb MySQL, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection, arbitrary sql commands
CVE-2008-5070: SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the gud parameter to (1) profiles/index.php and (2) profiles/admin.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the gud parameter, sql injection
CVE-2008-5071: Multiple eval injection vulnerabilities in itpm_estimate.php in Yoxel 1.23beta and earlier allow remote authenticated users to execute arbitrary PHP code via the proj_id parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the proj_id parameter, eval injection, arbitrary php code
CVE-2008-5072: vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash) via a malformed FLV file.
Key phrases: denial of service (application crash), cause a denial of service (application crash, malformed flv file
CVE-2008-5073: Heap-based buffer overflow in an ActiveX control in Novell ZENworks Desktop Management 6.5 allows remote attackers to execute arbitrary code via a long argument to the CanUninstall method.
Key phrases: execute arbitrary code, execute arbitrary code via a long argument to, heap-based buffer overflow, heap based buffer overflow
CVE-2008-5074: SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the linkid parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the linkid parameter, sql injection, arbitrary sql commands
CVE-2008-5075: Multiple SQL injection vulnerabilities in E-Uploader Pro 1.0 (aka Uploader PRO), when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) img.php, (b) file.php, (c) mail.php, (d) thumb.php, (e) zip.php, and (f) zipit.php, and (2) the view parameter to (g) browser.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands
CVE-2008-5076: htop 0.7 writes process names to a terminal without sanitizing non-printable characters, which might allow local users to hide processes, modify arbitrary files, or have unspecified other impact via a process name with "crazy control strings."
Key phrases: modify arbitrary files, hide processes, unspecified other impact, crazy control strings, unspecified impact
CVE-2008-5077: OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
Key phrases: bypass validation, bypass validation of the certificate chain via a
CVE-2008-5078: Multiple buffer overflows in the (1) recognize_eps_file function (src/psgen.c) and (2) tilde_subst function (src/util.c) in GNU enscript 1.6.1, and possibly earlier, might allow remote attackers to execute arbitrary code via an epsf escape sequence with a long filename.
Key phrases: execute arbitrary code, execute arbitrary code via an epsf escape sequence, buffer overflows
CVE-2008-5079: net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel infinite loop) by making two calls to svc_listen for the same socket, and then reading a /proc/net/atm/*vc file, related to corruption of the vcc table.
Key phrases: denial of service (kernel infinite loop), cause a denial of service (kernel infinite
CVE-2008-5080: awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter.  NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.
Key phrases: conduct cross-site scripting (XSS), cross-site scripting (xss)
CVE-2008-5081: The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 allows remote attackers to cause a denial of service (crash) via a crafted mDNS packet with a source port of 0, which triggers an assertion failure.
Key phrases: denial of service (crash), cause a denial of service (crash), assertion failure
CVE-2008-5082: The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.
Key phrases: bypass intended authentication, bypass intended authentication policies by performing enrollment with
CVE-2008-5083: In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON.
Key phrases: obtain unauthorized security information
CVE-2008-5086: Multiple methods in libvirt 0.3.2 through 0.5.1 do not check if a connection is read-only, which allows local users to bypass intended access restrictions and perform administrative actions.
Key phrases: bypass intended access restrictions, bypass intended access restrictions and perform administrative actions
CVE-2008-5087: SQL injection vulnerability in TYPO3 Another Backend Login (wrg_anotherbelogin) extension before 0.0.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2008-5088: Multiple SQL injection vulnerabilities in PHPKB Knowledge Base Software 1.5 Professional allow remote attackers to execute arbitrary SQL commands via the ID parameter to (1) email.php and (2) question.php, a different vector than CVE-2008-1909.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the ID parameter, sql injection
CVE-2008-5089: Multiple insecure method vulnerabilities in the DDActiveReportsViewer2.ARViewer2 ActiveX control (arview2.ocx) in Data Dynamics ActiveReports 2.5.0.1314 allow remote attackers to overwrite arbitrary files via a call to the (1) Pages.Save, (2) PrintReport, or (3) Canvas.Save method.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a call to the, insecure method
CVE-2008-5090: Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the preg_replace function with the eval switch.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via PHP code embedded
CVE-2008-5091: Buffer overflow in the LDAP Service in Novell eDirectory 8.7.3 before SP10a and 8.8 before SP3 allows attackers to cause a denial of service (application crash) via vectors involving an "invalid extensibleMatch filter."
Key phrases: denial of service (application crash), cause a denial of service (application crash, buffer overflow, invalid extensiblematch filter
CVE-2008-5092: Heap-based buffer overflows in Novell eDirectory HTTP protocol stack (HTTPSTK) before 8.8 SP3 have unknown impact and attack vectors related to the (1) HTTP language header and (2) HTTP content-length header.
Key phrases: heap-based buffer overflows, unknown impact, heap based buffer overflow
CVE-2008-5093: Cross-site scripting (XSS) vulnerability in the HTTP Protocol Stack (HTTPSTK) in Novell eDirectory before 8.8 SP3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unknown, cross-site scripting (xss), unknown vectors
CVE-2008-5094: Heap-based buffer overflow in the NDS Service in Novell eDirectory before 8.8 SP3 has unknown impact and attack vectors.
Key phrases: heap-based buffer overflow, unknown impact, heap based buffer overflow
CVE-2008-5095: Cross-site scripting (XSS) vulnerability in the Novell User Application 3.0.1, 3.5.0, and 3.5.1; and Identity Manager Roles Based Provisioning Module 3.6.0 and 3.6.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unknown, cross-site scripting (xss), unknown vectors
CVE-2008-5096: Unspecified vulnerability in the TYPO3 File List (file_list) extension 0.2.1 and earlier allows remote attackers to obtain sensitive information via unknown attack vectors.
Key phrases: obtain sensitive information, obtain sensitive information via unknown attack vectors, unspecified, unspecified vulnerability
CVE-2008-5097: SQL injection vulnerability in index.php in MyFWB 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the page parameter, sql injection
CVE-2008-5098: Cross-site scripting (XSS) vulnerability in Sun Java System Messaging Server 6.2 and 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2007-2904.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2008-5099: Sun Logical Domain Manager (aka LDoms Manager or ldm) 1.0 through 1.0.3 displays the value of the OpenBoot PROM (OBP) security-password variable in cleartext, which allows local users to bypass the SPARC firmware's password protection, and gain privileges or obtain data access, via the "ldm ls -l" command, a different vulnerability than CVE-2008-4992.
Key phrases: bypass the SPARC firmware's password protection, obtain data, gain privileges
CVE-2008-5100: The strong name (SN) implementation in Microsoft .NET Framework 2.0.50727 relies on the digital signature Public Key Token embedded in the pathname of a DLL file instead of the digital signature of this file itself, which makes it easier for attackers to bypass Global Assembly Cache (GAC) and Code Access Security (CAS) protection mechanisms, aka MSRC ticket MSRC8566gs.
Key phrases: bypass Global Assembly Cache (GAC) and Code Access Security
CVE-2008-5101: Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow."
Key phrases: execute arbitrary code, execute arbitrary code via a crafted BMP image, buffer overflow, array overflow
CVE-2008-5102: PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements.
Key phrases: denial of service (resource consumption or application halt), cause a denial of service (resource consumption
CVE-2008-5103: The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! argument, which configures the root account with a cleartext password of ! (exclamation point) and allows attackers to bypass intended login restrictions.
Key phrases: bypass intended login restrictions, cleartext password
CVE-2008-5104: Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm-builder or (2) ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.10, have ! (exclamation point) as the default root password, which allows attackers to bypass intended login restrictions.
Key phrases: bypass intended login restrictions
CVE-2008-5105: KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash or hang) via certain (1) APPE, (2) CWD, (3) DELE, (4) MKD, (5) RMD, (6) RETR, (7) RNFR, (8) RNTO, (9) SIZE, and (10) STOR commands.
Key phrases: denial of service (daemon crash or hang), cause a denial of service (daemon crash, appe, cwd, dele, mkd
CVE-2008-5106: Buffer overflow in KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long argument to an arbitrary command, which triggers the overflow when the SamyFtp.binlog log file is viewed in the management console.  NOTE: this may overlap CVE-2006-0441 and CVE-2006-2212.
Key phrases: execute arbitrary code, denial of service (daemon crash), cause a denial of service (daemon crash, buffer overflow, arbitrary commands
CVE-2008-5107: The installation process for Citrix Presentation Server 4.5 and Desktop Server 1.0, when MSI logging is enabled, stores database credentials in MSI log files, which allows local users to obtain these credentials by reading the log files.
Key phrases: obtain these credentials, obtain these credentials by reading the log files
CVE-2008-5108: Unspecified vulnerability in Adobe AIR 1.1 and earlier allows context-dependent attackers to execute untrusted JavaScript in an AIR application via unknown attack vectors.
Key phrases: execute untrusted JavaScript in an AIR application via, unspecified, unknown attack vectors, unspecified vulnerability
CVE-2008-5109: The default configuration of Adobe Flash Media Server (FMS) 3.0 does not enable SWF Verification for (1) RTMPE and (2) RTMPTE sessions, which makes it easier for remote attackers to make copies of video content via stream-capture software.
Key phrases: swf verification, rtmpe, copies of video content
CVE-2008-5110: syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.
Key phrases: escape the intended jail
CVE-2008-5111: Unspecified vulnerability in the socket function in Sun Solaris 10 and OpenSolaris snv_57 through snv_91, when InfiniBand hardware is not installed, allows local users to cause a denial of service (panic) via unknown vectors, related to the socksdpv_close function.
Key phrases: denial of service (panic), cause a denial of service (panic), unspecified, unknown vectors, unspecified vulnerability
CVE-2008-5112: The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt depending on whether the user account exists and is permitted to login, which allows remote attackers to enumerate valid usernames via a series of LDAP bind requests, as demonstrated by ldapuserenum.
Key phrases: enumerate valid usernames via a series of LDAP, failed bind attempt, series of ldap bind requests
CVE-2008-5113: WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access).  NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection.
Key phrases: denial of service (loss of application access), cookie injection, request superglobal array, independent, cross site request forgery
CVE-2008-5114: Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2008-5115: Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to hijack the authentication of administrators for requests that update the password via idm/admin/changeself.jsp.
Key phrases: hijack the authentication of administrators for requests that, cross-site request forgery (csrf), cross site request forgery
CVE-2008-5116: Directory traversal vulnerability in idm/includes/helpServer.jsp in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to read arbitrary files in the filesystem of the IDM server via directory traversal sequences in the ext parameter.
Key phrases: read arbitrary files, read arbitrary files in the filesystem of the, directory traversal, directory traversal sequences
CVE-2008-5117: Open redirect vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Key phrases: redirect users to arbitrary web sites and conduct, open redirect, phishing, unspecified vectors
CVE-2008-5118: Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via unspecified vectors, related to "frame injection."
Key phrases: inject frames from arbitrary web sites and conduct, frame injection, unspecified
CVE-2008-5119: Cross-site scripting (XSS) vulnerability in search.php in Scripts4Profit DXShopCart 4.30mc allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-5120: Stack-based buffer overflow in the Process Software MultiNet finger service (aka FINGERD) for HP OpenVMS 8.3 allows remote attackers to execute arbitrary code via a long request string.
Key phrases: execute arbitrary code, execute arbitrary code via a long request string, stack-based buffer overflow, stack based buffer overflow
CVE-2008-5121: dne2000.sys in Citrix Deterministic Network Enhancer (DNE) 2.21.7.233 through 3.21.7.17464, as used in (1) Cisco VPN Client, (2) Blue Coat WinProxy, and (3) SafeNet SoftRemote and HighAssurance Remote, allows local users to gain privileges via a crafted DNE_IOCTL DeviceIoControl request to the \\\\.\\DNE device interface.
Key phrases: gain privileges, gain privileges via a crafted DNE_IOCTL DeviceIoControl request
CVE-2008-5122: SQL injection vulnerability in WorkArea/ContentRatingGraph.aspx in Ektron CMS400.NET 7.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the res parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the res parameter, sql injection, arbitrary sql commands
CVE-2008-5123: SQL injection vulnerability in admin.php in CCleague Pro 1.2 allows remote attackers to execute arbitrary SQL commands via the u parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the u parameter, sql injection
CVE-2008-5124: JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key, which makes it easier for remote attackers to perform man-in-the-middle attacks.
Key phrases: man-in-the-middle, man in the middle
CVE-2008-5125: admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin.
Key phrases: bypass authentication, bypass authentication by setting the type cookie value
CVE-2008-5126: Cross-site scripting (XSS) vulnerability in search.php in BoutikOne CMS allows remote attackers to inject arbitrary web script or HTML via the search_query parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2008-5127: Ocean12 Contact Manager Pro 1.02 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12con.mdb.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, insufficient access control
CVE-2008-5128: Ocean12 Membership Manager Pro stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12member.mdb.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, insufficient access control
CVE-2008-5129: Ocean12 Poll Manager Pro 1.00 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12poll.mdb.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, insufficient access control
CVE-2008-5130: Ocean12 Calendar Manager Gold 2.04 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12cal.mdb.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, insufficient access control
CVE-2008-5131: Multiple SQL injection vulnerabilities in Develop It Easy News And Article System 1.4 allow remote attackers to execute arbitrary SQL commands via (1) the aid parameter to article_details.php, and the (2) username and (3) password to the admin panel (admin/index.php).
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via (1), sql injection
CVE-2008-5132: SQL injection vulnerability in inc/ajax/ajax_rating.php in MemHT Portal 4.0.1 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the X-, sql injection, arbitrary sql commands