Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-2138 State: PUBLISHED Published: 2009-06-19T19:00:00 Last Updated: 2024-08-07T05:36:21.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the returnto parameter to login.php or (2) the returnto parameter in a delete action to news.php. NOTE: this can be leveraged for cross-site scripting (XSS) by redirecting to a data: URI. Additional Analyst Notes: - CVE Program Container: References: - http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html - https://
- http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html - https://www.exploit-db.com/exploits/8942
CVE ID: CVE-2009-2139 State: PUBLISHED Published: 2009-09-08T23:00:00 Last Updated: 2024-08-07T05:36:21.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in svtools/source/filter.vcl/wmf/enhwmf.cxx in Go-oo 2.x and 3.x before 3.0.1, previously named ooo-build and related to OpenOffice.org (OOo), allows remote attackers to execute arbitrary code via a crafted EMF file, a similar issue to CVE-2008-2238. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2010:105 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:091 - http://cgit.freedesktop.org/ooo-build/ooo-build/commit/?i
p://www.mandriva.com/security/advisories?name=MDVSA-2010:091 - http://cgit.freedesktop.org/ooo-build/ooo-build/commit/?id=49b4e38571912a7d28c4044e5b2bd57e51c77d55 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:035 - http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html - http://www.debian.org/security/2009/dsa-1880 - http://marc.info/?l=oss-security&m=125363445702917&w=2 - http://marc.info/?l=oss-security&m=125258116800739&w=2 - http://www.openwall.com/lists/oss-security/2009/10/26/2 - http://marc.info/?l=oss-security&m=125265261125765&w=2 - http://www.securityfocus.com/bid/36291 - http://secunia.com/advisories/36613
CVE ID: CVE-2009-2140 State: PUBLISHED Published: 2009-09-21T19:00:00 Last Updated: 2024-08-07T05:36:21.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple heap-based buffer overflows in cppcanvas/source/mtfrenderer/emfplus.cxx in Go-oo 2.x and 3.x before 3.0.1, previously named ooo-build and related to OpenOffice.org (OOo), allow remote attackers to execute arbitrary code via a crafted EMF+ file, a similar issue to CVE-2008-2238. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2010:105 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:091 - http://cgit.freedesktop.org/ooo-build/ooo-build
:105 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:091 - http://cgit.freedesktop.org/ooo-build/ooo-build/commit/?id=49b4e38571912a7d28c4044e5b2bd57e51c77d55 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:035 - http://marc.info/?l=oss-security&m=125363445702917&w=2 - http://marc.info/?l=oss-security&m=125258116800739&w=2 - http://marc.info/?l=oss-security&m=125265261125765&w=2
CVE ID: CVE-2009-2141 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:36:21.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to inject arbitrary web script or HTML via (1) the returnto parameter to makepoll.php, (2) the returnto parameter in a delete action to polls.php, or the (3) Info or (4) Avatar field to my.php. Additional Analyst Notes: - CVE Program Container: References: - http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html - http://secunia.com/advisories/35378 - https://www.exploit-db.com/ex
n0t-tbdev-01-01-2008-multiple-vulnerabilities.html - http://secunia.com/advisories/35378 - https://www.exploit-db.com/exploits/8942
CVE ID: CVE-2009-2142 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:36:21.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in admin/index.asp in Zip Store Chat 4.0 and 5.0 allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) senha parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1581 - http://secunia.com/advisories/35417 - https://www.exploit-db.com/exploits/8935
CVE ID: CVE-2009-2143 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:36:21.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter. Additional Analyst Notes: - CVE Program Container: References: - http://firestats.cc/wiki/ChangeLog#a1.6.2-stable13062009 - http://secunia.com/advisories/35400 - https://www.exploit-db.com/exploits/8945
CVE ID: CVE-2009-2144 State: PUBLISHED Published: 2009-06-22T14:00:00Z Last Updated: 2024-09-16T22:02:08.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://firestats.cc/wiki/ChangeLog#a1.6.2-stable13062009 - http://secunia.com/advisories/35400
CVE ID: CVE-2009-2145 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:36:21.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in transLucid 1.75 allow remote attackers to inject arbitrary web script or HTML via the (a) NodeID and (b) action parameters to the default URI, and the (c) NodeID parameter to the default URI for the admin section; and allow remote authenticated users to inject arbitrary web script or HTML via the (d) Title (aka page name) and (e) Url fields in a (1) new or (2) modified page. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploit
r (2) modified page. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/8943 - http://secunia.com/advisories/35389 - http://forum.intern0t.net/intern0t-advisories/1122-intern0t-translucid-1-75-multiple-vulnerabilities.html
CVE ID: CVE-2009-2146 State: PUBLISHED Published: 2009-06-22T14:00:00Z Last Updated: 2024-09-17T04:25:46.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the file via a direct request to a modified filename under cache/modules/Emails/, as demonstrated using .php as the entire original name. Additional Analyst Notes: - CVE Program Container: References: - http://www.sugarforge.org/frs/download.php/5598/Sugar_
Additional Analyst Notes: - CVE Program Container: References: - http://www.sugarforge.org/frs/download.php/5598/Sugar_CommunityEdition_ReleaseNotes_5.2f.pdf - http://secunia.com/advisories/35445 - http://www.ush.it/team/ush/hack-sugarcrm_520e/adv.txt - http://www.securityfocus.com/bid/35361
CVE ID: CVE-2009-2147 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:36:21.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in fdown.php in phpWebThings 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35396 - https://www.exploit-db.com/exploits/8939 - http://www.securityfocus.com/bid/35336 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51094
CVE ID: CVE-2009-2148 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:36:21.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1583 - https://www.exploit-db.com/exploits/8937
CVE ID: CVE-2009-2149 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:36:20.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web script or HTML via the (1) courseid parameter to enrolments/step1.php, or the (2) search or (3) siteid parameter to files/shared_list.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1583 - https://www.exploit-db.com/exploits/8937
CVE ID: CVE-2009-2150 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:36:20.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack the authentication of arbitrary users for requests that terminate a session via login/logout.php, and might allow remote attackers to hijack the authentication of certain users via a (2) ADD or (3) DELETE action to enrolments/step2.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/8937
CVE ID: CVE-2009-2151 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:36:20.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in index.php in AdaptWeb 0.9.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the newlang parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/8954
CVE ID: CVE-2009-2152 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:44:54.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in a_index.php in AdaptWeb 0.9.2 allows remote attackers to execute arbitrary SQL commands via the CodigoDisciplina parameter in a TopicosCadastro1 action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/8954
CVE ID: CVE-2009-2153 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:44:54.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in Impleo Music Collection 2.0 allows remote attackers to inject arbitrary web script or HTML via the sort parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/8947
CVE ID: CVE-2009-2154 State: PUBLISHED Published: 2009-06-22T14:00:00 Last Updated: 2024-08-07T05:44:54.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/8947
CVE ID: CVE-2009-2155 State: PUBLISHED Published: 2009-06-22T19:00:00 Last Updated: 2024-08-07T05:44:54.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in report/ReportViewAction.do in WebNMS Free Edition 5 allows remote attackers to inject arbitrary web script or HTML via the type parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35495 - http://osvdb.org/55188 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51250
CVE ID: CVE-2009-2156 State: PUBLISHED Published: 2009-06-22T19:00:00 Last Updated: 2024-08-07T05:44:54.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Title field to requests.php, related to viewrequests.php; and (2) the Torrent Name field to torrents-upload.php, related to the logging of torrent uploads; and allow remote attackers to inject arbitrary web script or HTML via (3) the ttversion parameter to themes/default/footer.php, the (4) SITENAME and (5) CURUSER[username] parameters to themes/default/header.php
rameter to themes/default/footer.php, the (4) SITENAME and (5) CURUSER[username] parameters to themes/default/header.php, (6) the todayactive parameter to visitorstoday.php, (7) the activepeople parameter to visitorsnow.php, (8) the faq_categ[999][title] parameter to faq.php, and (9) the keepget parameter to torrents-details.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51145 - http://secunia.com/advisories/35456 - http://www.securityfocus.com/bid/35369 - https://www.exploit-db.com/exploits/8958 - http://www.securityfocus.com/archive/1/504294/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/5114
http://www.securityfocus.com/archive/1/504294/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/51144 - http://www.waraxe.us/advisory-74.html
CVE ID: CVE-2009-2157 State: PUBLISHED Published: 2009-06-22T19:00:00 Last Updated: 2024-08-07T05:44:54.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitrary SQL commands via (1) the origmsg parameter to account-inbox.php; the categ parameter to (2) delreq.php and (3) admin-delreq.php; (4) the choice parameter to index.php; (5) the id parameter to modrules.php in an edited (aka edit) action; the (6) user, (7) torrent, (8) forumid, and (9) forumpost parameters to report.php; (10) the delmp parameter to take-deletepm.php; (11) the delreport parameter to takedelre
mpost parameters to report.php; (10) the delmp parameter to take-deletepm.php; (11) the delreport parameter to takedelreport.php; (12) the delreq parameter to takedelreq.php; (13) the clases parameter to takestaffmess.php; and (14) the warndisable parameter to takewarndisable.php; and allow remote attackers to execute arbitrary SQL commands via (15) the wherecatin parameter to browse.php, (16) the limit parameter to today.php, and (17) the where parameter to torrents-details.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51142 - http://secunia.com/advisories/35456 - https://exchange.xforce.ibmcloud.com/vulnerabilitie
ud.com/vulnerabilities/51142 - http://secunia.com/advisories/35456 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51181 - http://www.securityfocus.com/bid/35369 - https://www.exploit-db.com/exploits/8958 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51179 - http://www.securityfocus.com/archive/1/504294/100/0/threaded - http://www.waraxe.us/advisory-74.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/51178 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51180 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51143
CVE ID: CVE-2009-2158 State: PUBLISHED Published: 2009-06-22T19:00:00 Last Updated: 2024-08-07T05:44:54.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: account-recover.php in TorrentTrader Classic 1.09 chooses random passwords from an insufficiently large set, which makes it easier for remote attackers to obtain a password via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51150 - http://www.securityfocus.com/bid/35369 - https://www.exploit-db.com/exploits/8958 - http://www.securityfocus.com/archive/1/504294/100/0/threaded - http://www.waraxe.us/advisory-74.html
CVE ID: CVE-2009-2159 State: PUBLISHED Published: 2009-06-22T19:00:00 Last Updated: 2024-08-07T05:44:55.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote attackers to create and download a backup database by making a direct request and then retrieving a .gz file from backups/. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35456 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51147 - http://www.securityfocus.com/bid/35369 - https://www.exploit-db.com/exploits/8958 - http://www.securityfocus.com/archive/1/504
/www.securityfocus.com/bid/35369 - https://www.exploit-db.com/exploits/8958 - http://www.securityfocus.com/archive/1/504294/100/0/threaded - http://www.waraxe.us/advisory-74.html
CVE ID: CVE-2009-2160 State: PUBLISHED Published: 2009-06-22T19:00:00 Last Updated: 2024-08-07T05:44:54.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function; and allows remote attackers to (2) obtain other potentially sensitive information via a direct request to check.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35456 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51148 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51149 - http://www.securityfocus.com
ud.com/vulnerabilities/51148 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51149 - http://www.securityfocus.com/bid/35369 - https://www.exploit-db.com/exploits/8958 - http://www.securityfocus.com/archive/1/504294/100/0/threaded - http://www.waraxe.us/advisory-74.html
CVE ID: CVE-2009-2161 State: PUBLISHED Published: 2009-06-22T19:00:00 Last Updated: 2024-08-07T05:44:54.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter, in conjunction with a modified component name. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35456 - http://www.securityfocus.com/bid/35369 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51146 - https://www.exploit-db.com/ex
securityfocus.com/bid/35369 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51146 - https://www.exploit-db.com/exploits/8958 - http://www.securityfocus.com/archive/1/504294/100/0/threaded - http://www.waraxe.us/advisory-74.html
CVE ID: CVE-2009-2162 State: PUBLISHED Published: 2009-06-22T19:00:00 Last Updated: 2024-08-07T05:44:54.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the XOOPS MANIAC PukiWikiMod module 1.6.6.2 and earlier for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN12244807/index.html - http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000041.html - http://xoops.hypweb.net/wiki/6005.html - http://secunia.com/advisories/35504 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51260 - http://osvdb.org/55189
CVE ID: CVE-2009-2163 State: PUBLISHED Published: 2009-06-22T20:00:00 Last Updated: 2024-08-07T05:44:55.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the sc_error parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/504093/100/0/threaded - http://www.securityfocus.com/archive/1/504132/100/0/threaded - http://secunia.com/advisories/35353 - http://forum.intern0t.net/intern0t-advisories/1082-intern0t-sitecore-net-6-0-0-cross-site-scripting-vuln
isories/35353 - http://forum.intern0t.net/intern0t-advisories/1082-intern0t-sitecore-net-6-0-0-cross-site-scripting-vulnerability.html
CVE ID: CVE-2009-2164 State: PUBLISHED Published: 2009-06-22T20:00:00 Last Updated: 2024-08-07T05:44:55.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the code parameter to activate.php or (2) the dest parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/8884 - https://www.exploit-db.com/exploits/8885 - http://www.securityfocus.com/archive/1/504136/100/0/threaded
CVE ID: CVE-2009-2165 State: PUBLISHED Published: 2009-06-22T20:00:00Z Last Updated: 2024-09-17T01:00:42.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: SerendipityNZ (aka SimpleBoxes) Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35335 - http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000035.html - http://www.securityfocus.com/bid/35254 - http://jvn.jp/en/jp/JVN20689557/index.html - http://serenebach.net/log/sb221R.html
CVE ID: CVE-2009-2166 State: PUBLISHED Published: 2009-06-22T20:00:00 Last Updated: 2024-08-07T05:44:55.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/8868 - http://www.securityfocus.com/archive/1/504047/100/0/threaded - http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_directory_traversal.shtml - https://exchange.xforce.ibmcloud.com/vulnerabilities/50946
CVE ID: CVE-2009-2167 State: PUBLISHED Published: 2009-06-22T20:00:00 Last Updated: 2024-08-07T05:44:54.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/8865 - http://www.vupen.com/english/advisories/2009/1491 - https://exchange.xforce.ibmcloud.com/vulnerabilities/50935
CVE ID: CVE-2009-2168 State: PUBLISHED Published: 2009-06-22T20:00:00 Last Updated: 2025-01-21T15:28:45.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied credentials are incorrect, which allows remote attackers to bypass authentication by providing arbitrary username and password parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/8865