CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2008-2951
https://notcve.org/view.php?id=CVE-2008-2951
Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function. Una vulnerabilidad de Redireccionamiento Abierto en el script de búsqueda en Trac anterior a versión 0.10.5, permite a los atacantes remotos redireccionar a los usuarios a sitios web arbitrarios y conducir ataques de phishing por medio de una URL en el parámetro q, posiblemente relacionada con la función quickjump. • http://holisticinfosec.org/content/view/72/45 http://secunia.com/advisories/31314 http://trac.edgewall.org/wiki/ChangeLog http://www.osvdb.org/46513 http://www.securityfocus.com/bid/30402 https://exchange.xforce.ibmcloud.com/vulnerabilities/44043 https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01261.html https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01270.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 10.0EPSS: 29%CPEs: 4EXPL: 0CVE-2008-3252
https://notcve.org/view.php?id=CVE-2008-3252
Stack-based buffer overflow in the read_article function in getarticle.c in newsx 1.6 allows remote attackers to execute arbitrary code via a news article containing a large number of lines starting with a period. Desbordamiento de búfer basado en pila en la función read_article en getarticle.c en newsx 1.6, permite a atacantes remotos ejecutar código de su elección a través de un artículo de noticias que contiene un gran número de líneas que empiezan con un período. • http://secunia.com/advisories/31080 http://secunia.com/advisories/31307 http://www.debian.org/security/2008/dsa-1622 http://www.securityfocus.com/bid/30231 https://bugzilla.redhat.com/show_bug.cgi?id=454483 https://exchange.xforce.ibmcloud.com/vulnerabilities/43844 https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00485.html https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00565.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2008-3223
https://notcve.org/view.php?id=CVE-2008-3223
SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields." Vulnerabilidad de inyección SQL en el Schema API de versiones de Drupal 6.x anteriores a 6.3 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores relacionados con un "inadeacuado marcador de posición para campos 'numéricos'" • http://drupal.org/node/280571 http://secunia.com/advisories/31079 http://www.openwall.com/lists/oss-security/2008/07/10/3 http://www.securityfocus.com/bid/30168 https://bugzilla.redhat.com/show_bug.cgi?id=454849 https://exchange.xforce.ibmcloud.com/vulnerabilities/43705 https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html https://www.redhat.com/archives/fedora-package-announce& • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2008-3218
https://notcve.org/view.php?id=CVE-2008-3218
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values. Múltiples vulnerabilidades de cross-site scripting (XSS) en versiones de Drupal 6.x anteriores a 6.3 permiten a atacantes remotos inyectar scripts web o HTML arbitrario a través de vectores relacionados con (1) un etiquetado libre de términos de taxonomía, que no son manejados correctamente en el módulo de vista previa, y con (2) valores OpenID sin especificar. • http://drupal.org/node/280571 http://secunia.com/advisories/31079 http://www.openwall.com/lists/oss-security/2008/07/10/3 http://www.securityfocus.com/bid/30168 https://bugzilla.redhat.com/show_bug.cgi?id=454849 https://exchange.xforce.ibmcloud.com/vulnerabilities/43704 https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html https://www.redhat.com/archives/fedora-package-announce& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2008-3219
https://notcve.org/view.php?id=CVE-2008-3219
The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism. La función filter_xss_admin en versiones de Drupal 5.X anteriores a la 5.8 y 6.X anteriores a la 6.3 no "impide la utilización del objeto etiqueta HTML en la entrada de administrador" lo cual tiene un impacto desconocido y vectores de ataque, probablemente relacionados con un mecanismo de protección insuficiente de cross-site scripting (XSS). • http://drupal.org/node/280571 http://secunia.com/advisories/31079 http://www.openwall.com/lists/oss-security/2008/07/10/3 http://www.securityfocus.com/bid/30168 https://bugzilla.redhat.com/show_bug.cgi?id=454849 https://exchange.xforce.ibmcloud.com/vulnerabilities/43701 https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html https://www.redhat.com/archives/fedora-package-announce& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •