CWE-16 Archives - CVE Vulnerability

CVE-2008-7253

Sun, 26 Feb 2023 09:11:56 +0000

The default configuration of the web server in IBM Lotus Domino Server, possibly 6.0 through 8.0, enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST) attack, a related issue to CVE-2004-2763 and CVE-2005-3398.

The post CVE-2008-7253 appeared first on CVE Vulnerability.

CVE-2008-6820

Sun, 26 Feb 2023 09:11:43 +0000

The db2fmp process in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 on Windows runs with “OS privilege,” which has unknown impact and attack vectors, a different vulnerability than CVE-2008-3856.

The post CVE-2008-6820 appeared first on CVE Vulnerability.

CVE-2008-6638

Sun, 26 Feb 2023 09:11:38 +0000

Insecure method vulnerability in the Versalsoft HTTP Image Uploader ActiveX control (UUploaderSvrD.dll 6.0.0.35) allows remote attackers to delete arbitrary files via the RemoveFileOrDir method.

The post CVE-2008-6638 appeared first on CVE Vulnerability.

CVE-2008-6171

Sun, 26 Feb 2023 09:11:23 +0000

includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for “IP-based virtual hosts,” allows remote attackers to include and execute arbitrary files via the HTTP Host header.

The post CVE-2008-6171 appeared first on CVE Vulnerability.

CVE-2008-5844

Sun, 26 Feb 2023 09:11:12 +0000

PHP 5.2.7 contains an incorrect change to the FILTER_UNSAFE_RAW functionality, and unintentionally disables magic_quotes_gpc regardless of the actual magic_quotes_gpc setting, which might make it easier for context-dependent attackers to conduct SQL injection attacks and unspecified other attacks.

The post CVE-2008-5844 appeared first on CVE Vulnerability.

CVE-2008-5827

Sun, 26 Feb 2023 09:11:12 +0000

The Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware automatically installs software upon completing the download of a JAR file, which makes it easier for remote attackers to execute arbitrary code via a crafted URI record in an NDEF tag.

The post CVE-2008-5827 appeared first on CVE Vulnerability.

CVE-2008-5710

Sun, 26 Feb 2023 09:11:08 +0000

Multiple unspecified vulnerabilities in the web management interface in Avaya Communication Manager (CM) 3.1.x, 4.0.3, and 5.x allow remote attackers to read (1) configuration files, (2) log files, (3) binary image files, and (4) help files via unknown vectors.

The post CVE-2008-5710 appeared first on CVE Vulnerability.

CVE-2008-5277

Sun, 26 Feb 2023 09:10:56 +0000

PowerDNS before 2.9.21.2 allows remote attackers to cause a denial of service (daemon crash) via a CH HINFO query.

The post CVE-2008-5277 appeared first on CVE Vulnerability.

CVE-2008-5109

Sun, 26 Feb 2023 09:10:52 +0000

The default configuration of Adobe Flash Media Server (FMS) 3.0 does not enable SWF Verification for (1) RTMPE and (2) RTMPTE sessions, which makes it easier for remote attackers to make copies of video content via stream-capture software.

The post CVE-2008-5109 appeared first on CVE Vulnerability.

CVE-2008-4609

Sun, 26 Feb 2023 09:10:37 +0000

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

The post CVE-2008-4609 appeared first on CVE Vulnerability.