Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2010-5034 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:38.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in viewhistorydetail.php in iScripts EasyBiller 1.1 allows remote attackers to execute arbitrary SQL commands via the planid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/13741/ - http://packetstormsecurity.org/1006-exploits/iscriptseasybiller-sql.txt - http://securityreason.com/securityalert/8521 - http://secunia.com/advisories/40088 - http://www.vupen.com/english/advisories/2010/1359 - https://exchange.xforce.ibmcloud.com/vulnerabili
/advisories/40088 - http://www.vupen.com/english/advisories/2010/1359 - https://exchange.xforce.ibmcloud.com/vulnerabilities/59150
CVE ID: CVE-2010-5035 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:38.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in search.php in iScripts eSwap 2.0 allows remote attackers to inject arbitrary web script or HTML via the txtHomeSearch parameter (aka the search field). NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/59148 - http://packetstormsecurity.org/1006-exploits/iscriptsewap-sqlxss.txt - http://www.vupen.com/english/advisories/2010/1360 - http://securityr
ecurity.org/1006-exploits/iscriptsewap-sqlxss.txt - http://www.vupen.com/english/advisories/2010/1360 - http://securityreason.com/securityalert/8522 - http://www.securityfocus.com/bid/40597 - http://secunia.com/advisories/40087 - http://www.exploit-db.com/exploits/13740/
CVE ID: CVE-2010-5036 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:39.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/1006-exploits/iscriptsewap-sqlxss.txt - http://www.vupen.com/english/advisories/2010/1360 - http://securityreason.com/securityalert/8522 - https://exchange.xforce.ibmcloud.com/vulnerabilities/59147 - http://www.securityfocus.com/bid/40597 - http://www.exploit-db.com/exploits/13740/
CVE ID: CVE-2010-5037 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:38.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in article.php in SenseSites CommonSense CMS allows remote attackers to execute arbitrary SQL commands via the article_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/8526 - http://packetstormsecurity.org/1006-exploits/commonsensecms-sql.txt - http://www.exploit-db.com/exploits/13762/ - http://www.securityfocus.com/bid/40621 - http://www.vupen.com/english/advisories/2010/1375
CVE ID: CVE-2010-5038 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:38.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in contact/contact.php in Groone's Simple Contact Form allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/1291 - http://securityreason.com/securityalert/8523 - http://www.securityfocus.com/archive/1/511551/100/0/threaded - http://packetstormsecurity.org/1005-exploits/groonescf-rfi.txt
CVE ID: CVE-2010-5039 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:38.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in control/admin_login.php in ScriptsFeed Recipes Listing Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter (aka the UserName field). NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/39929 - http://www.exploit-db.com/exploits/12703/ - http://www.osvdb.org/64841 - https://exchange.xforce.ibmcloud.com/vulnerabilities/58803 - http://www.securi
its/12703/ - http://www.osvdb.org/64841 - https://exchange.xforce.ibmcloud.com/vulnerabilities/58803 - http://www.securityfocus.com/bid/40352
CVE ID: CVE-2010-5040 State: PUBLISHED Published: 2011-11-02T21:00:00Z Last Updated: 2024-09-17T00:20:51.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in nucleus/plugins/NP_gallery.php in the NP_Gallery plugin 0.94 for Nucleus allows remote attackers to execute arbitrary PHP code via a URL in the DIR_NUCLEUS parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/1285 - http://www.exploit-db.com/exploits/12787/ - http://secunia.com/advisories/40022 - http://www.securityfocus.com/bid/40448 - http://www
ploit-db.com/exploits/12787/ - http://secunia.com/advisories/40022 - http://www.securityfocus.com/bid/40448 - http://www.osvdb.org/65004
CVE ID: CVE-2010-5041 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:38.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in the NP_Gallery plugin 0.94 for Nucleus allows remote attackers to execute arbitrary SQL commands via the id parameter in a plugin action. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/1285 - http://www.exploit-db.com/exploits/12787/ - http://secunia.com/advisories/40022 - http://www.securityfocus.com/bid/40448 - http://www.osvdb.org/65005 - https://exchange.xforce.ibmcloud.com/vulnerabilities/58997
CVE ID: CVE-2010-5042 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:38.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the DJ-ArtGallery (com_djartgallery) component 0.9.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the cid[] parameter in an editItem action to administrator/index.php. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/13737/ - http://www.securityfocus.com/bid/40580 - http://secunia.com/advisories/40073 - https://exchange.xforce.ibm
oits/13737/ - http://www.securityfocus.com/bid/40580 - http://secunia.com/advisories/40073 - https://exchange.xforce.ibmcloud.com/vulnerabilities/59143 - http://www.vupen.com/english/advisories/2010/1374 - http://osvdb.org/65188
CVE ID: CVE-2010-5043 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:39.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the DJ-ArtGallery (com_djartgallery) component 0.9.1 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the cid[] parameter in an editItem action to administrator/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/13737/ - http://www.securityfocus.com/bid/40580 - http://secunia.com/advisories/40073 - http://osvdb.org/65187 - https://exchange.xforce.ibmcloud.com/vulnerabilities/59142
CVE ID: CVE-2010-5044 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:38.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in models/log.php in the Search Log (com_searchlog) component 3.1.0 for Joomla! allows remote authenticated users, with Public Back-end privileges, to execute arbitrary SQL commands via the search parameter in a log action to administrator/index.php. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/59152 - http://www.vupen.com/english/advisories/2010/1363 - http
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59152 - http://www.vupen.com/english/advisories/2010/1363 - http://osvdb.org/65185 - http://www.securityfocus.com/bid/40588 - http://secunia.com/advisories/40055 - http://www.exploit-db.com/exploits/13746/
CVE ID: CVE-2010-5045 State: PUBLISHED Published: 2011-11-02T21:00:00 Last Updated: 2024-08-07T04:09:38.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in poll/default.asp in Smart ASP Survey allows remote attackers to inject arbitrary web script or HTML via the catid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36028 - http://www.exploit-db.com/exploits/13880 - https://exchange.xforce.ibmcloud.com/vulnerabilities/59473 - http://www.securityfocus.com/bid/40870
CVE ID: CVE-2010-5046 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin.php in ecoCMS allows remote attackers to inject arbitrary web script or HTML via the p parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/511117/100/0/threaded - http://packetstormsecurity.org/1005-exploits/ecocms-xss.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/58335 - http://osvdb.org/64308 - http://secunia.com/advisories/39678 - http://www.securityfocus.com/bid/39901 - http://www.htbridge.ch/adviso
org/64308 - http://secunia.com/advisories/39678 - http://www.securityfocus.com/bid/39901 - http://www.htbridge.ch/advisory/xss_in_ecocms.html
CVE ID: CVE-2010-5047 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in page.php in V-EVA Press Release Script allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/39826 - http://www.securityfocus.com/bid/40172 - http://www.exploit-db.com/exploits/12597 - https://exchange.xforce.ibmcloud.com/vulnerabilities/58603 - http://osvdb.org/64636 - http://packetstormsecurity.org/1005-exploits/pressrelease-sql.txt
CVE ID: CVE-2010-5048 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin.jcomments.php in the JoomlaTune JComments (com_jcomments) component 2.1.0.0 for Joomla! allows remote authenticated users to inject arbitrary web script or HTML via the name parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/39842 - http://packetstormsecurity.org/1005-exploits/joomlajcomments-xss.txt - http://www.joomlatune.com/jcomments-v.2.2-release-notes.html - http://www.htbridge.ch/advisory/xss_vulnerabili
xss.txt - http://www.joomlatune.com/jcomments-v.2.2-release-notes.html - http://www.htbridge.ch/advisory/xss_vulnerability_in_jcomments_joomla.html - http://www.securityfocus.com/bid/40230 - http://www.securityfocus.com/archive/1/511320/100/0/threaded
CVE ID: CVE-2010-5049 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/511454/100/0/threaded - http://www.vupen.com/english/advisories/2010/1240 - http://www.securityfocus.com/bid/39752 - http://secunia.com/advisories/39119 - http://packetstormsecurity.org/1004-exploits/zabbix181-sql.txt
CVE ID: CVE-2010-5050 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary web script or HTML via the computerName parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/64857 - http://www.securityfocus.com/bid/40355 - http://secunia.com/advisories/39901 - https://exchange.xforce.ibmcloud.com/vu
- http://www.securityfocus.com/bid/40355 - http://secunia.com/advisories/39901 - https://exchange.xforce.ibmcloud.com/vulnerabilities/58860
CVE ID: CVE-2010-5051 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web script or HTML via the content parameter in an edit action to admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/39961 - http://www.htbridge.ch/advisory/xss_vulnerability_in_razorcms.html - http://www.securityfocus.com/archive/1/511457/100/0/threaded - http://www.securityfocus.com/bid/40373
CVE ID: CVE-2010-5052 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/components.php in GetSimple CMS 2.01 allows remote attackers to inject arbitrary web script or HTML via the val[] parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/511458/100/0/threaded - http://www.htbridge.ch/advisory/xss_vulnerability_in_getsimple_cms.html - http://www.securityfocus.com/bid/40374
CVE ID: CVE-2010-5053 State: PUBLISHED Published: 2011-11-23T01:00:00Z Last Updated: 2024-09-17T03:43:23.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the XOBBIX (com_xobbix) component 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the prodid parameter in a prod_desc action to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/39312 - http://www.exploit-db.com/exploits/12097 - http://packetstormsecurity.org/1004-exploits/joomlaxobbix-sql.txt - http://www.securityfocus.com/bid/39259
CVE ID: CVE-2010-5054 State: PUBLISHED Published: 2011-11-23T01:00:00Z Last Updated: 2024-09-16T22:41:18.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Special:Login in JAMWiki before 0.8.4 allows remote attackers to inject arbitrary web script or HTML via the message parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/39225 - http://jamwiki.svn.sourceforge.net/viewvc/jamwiki/wiki/branches/0.8.x/jamwiki-war/src/main/webapp/CHANGELOG.txt?view=markup&revision=2995 - http://secunia.com/advisories/39335
CVE ID: CVE-2010-5055 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/57869 - http://secunia.com/advisories/39452 - http://packetstormsecurity.org/1004-exploits/almnrzm-sql.txt - http://osvdb.org/63843 - http://www.securityfocus.com/bid/39487 - http://www.exploit-db.com/exploits/12220
CVE ID: CVE-2010-5056 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the GBU Facebook (com_gbufacebook) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the face_id parameter in a show_face action to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/39576 - https://exchange.xforce.ibmcloud.com/vulnerabilities/57946 - http://www.vupen.com/english/advisories/2010/0944 - http://packetstormsecurity.org/1004-exploits/joomlagbufacebook-sql.txt - http://www.exploit-db.com/
visories/2010/0944 - http://packetstormsecurity.org/1004-exploits/joomlagbufacebook-sql.txt - http://www.exploit-db.com/exploits/12299 - http://secunia.com/advisories/39487
CVE ID: CVE-2010-5057 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the tipodoc_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/57944 - http://www.securityfocus.com/bid/39589 - http://www.vupen.com/english/advisories/2010/0943 - http://secunia.com/advisories/39486 - http://www.exploit-db.com/exploits/12301 - http://packetstormsecurity.org/1004-exploits/cmsariadna-sql.txt
CVE ID: CVE-2010-5058 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the res_id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/39486 - https://exchange.xforce.ibmcloud.com/vulnerabilities/57945
CVE ID: CVE-2010-5059 State: PUBLISHED Published: 2011-11-23T01:00:00Z Last Updated: 2024-09-16T17:53:39.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in CMScout 2.0.8 allows remote attackers to execute arbitrary SQL commands via the album parameter in a photos action. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/1004-exploits/cmscout-sql.txt - http://www.exploit-db.com/exploits/12407 - http://www.securityfocus.com/bid/39707 - http://www.vupen.com/english/advisories/2010/0998 - http://secunia.com/advisories/39602
CVE ID: CVE-2010-5060 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Nus.php in NUs Newssystem 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/11674 - http://www.securityfocus.com/bid/38620 - https://exchange.xforce.ibmcloud.com/vulnerabilities/56775 - http://packetstormsecurity.org/1003-exploits/nusnewssystem-sql.txt - http://secunia.com/advisories/38890
CVE ID: CVE-2010-5061 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in RSStatic allows remote attackers to execute arbitrary SQL commands via the maxarticles parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/38623 - http://packetstormsecurity.org/1003-exploits/rsstatic-sql.txt - http://www.exploit-db.com/exploits/11665 - https://exchange.xforce.ibmcloud.com/vulnerabilities/56781
CVE ID: CVE-2010-5062 State: PUBLISHED Published: 2011-11-23T01:00:00 Last Updated: 2024-08-07T04:09:38.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in search.php in MH Products kleinanzeigenmarkt allows remote attackers to execute arbitrary SQL commands via the c parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/56777 - http://www.exploit-db.com/exploits/11671 - http://www.securityfocus.com/bid/38622 - http://www.osvdb.org/62841 - http://secunia.com/advisories/38897 - http://packetstormsecurity.org/1003-exploits/mhproducts-sql.txt
CVE ID: CVE-2010-5063 State: PUBLISHED Published: 2012-10-08T10:00:00Z Last Updated: 2024-09-16T22:29:45.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via the ratearticleselect parameter. Additional Analyst Notes: - CVE Program Container: References: - http://dmcdonald.net/vwar.txt - http://www.securityfocus.com/bid/29001 - http://seclists.org/fulldisclosure/2010/Aug/235
CVE ID: CVE-2010-5064 State: PUBLISHED Published: 2012-10-08T10:00:00Z Last Updated: 2024-09-16T17:19:08.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Virtual War (aka VWar) 1.6.1 R2 allow remote attackers to inject arbitrary web script or HTML via (1) the Additional Information field to challenge.php, the (2) Additional Information or (3) Contact information field to joinus.php, (4) the War Report field to admin/admin.php in a finishwar action, or (5) the Nick field to profile.php. Additional Analyst Notes: - CVE Program Container: References: - http://dmcdonald.net/vwar.txt - http://seclists.org/fulldisclosure/2010/Au
Notes: - CVE Program Container: References: - http://dmcdonald.net/vwar.txt - http://seclists.org/fulldisclosure/2010/Aug/235
CVE ID: CVE-2010-5065 State: PUBLISHED Published: 2012-10-08T10:00:00Z Last Updated: 2024-09-16T16:57:39.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: popup.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to bypass intended member restrictions and read news posts via a modified newsid parameter in a printnews action. Additional Analyst Notes: - CVE Program Container: References: - http://dmcdonald.net/vwar.txt - http://seclists.org/fulldisclosure/2010/Aug/235
CVE ID: CVE-2010-5066 State: PUBLISHED Published: 2012-10-08T10:00:00Z Last Updated: 2024-09-16T16:52:37.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: The createRandomPassword function in includes/functions_common.php in Virtual War (aka VWar) 1.6.1 R2 uses a small range of values to select the seed argument for the PHP mt_srand function, which makes it easier for remote attackers to determine randomly generated passwords via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - http://dmcdonald.net/vwar.txt - http://seclists.org/fulldisclosure/2010/Aug/235
CVE ID: CVE-2010-5067 State: PUBLISHED Published: 2012-10-08T10:00:00Z Last Updated: 2024-09-16T20:48:08.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: Virtual War (aka VWar) 1.6.1 R2 uses static session cookies that depend only on a user's password, which makes it easier for remote attackers to bypass timeout and logout actions, and retain access for a long period of time, by leveraging knowledge of a session cookie. Additional Analyst Notes: - CVE Program Container: References: - http://dmcdonald.net/vwar.txt - http://seclists.org/fulldisclosure/2010/Aug/235