deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0505
Published: 2009-02-25
Description: The CICS listener in IBM TXSeries for Multiplatforms 6.2 GA waits for a forcepurge acknowledgement from the CICS Application Server (CICSAS) after an eci response timeout, which might allow remote authenticated users to cause a denial of service (forcepurge handling delay), or have unspecified other impact, via vectors involving slow or nonexistent acknowledgement.
CVSS Score: 9.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg24019725; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ22391; http://www.securityfocus.com/bid/33883
CVE: CVE-2009-0506
Published: 2009-02-25
Description: Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1 and 6.0.2 before 6.0.2.33 on z/OS, when CSIv2 Identity Assertion is enabled and Enterprise JavaBeans (EJB) interaction occurs between a WAS 6.1 instance and a WAS pre-6.1 instance, allows local users to have an unknown impact via vectors related to (1) use of the wrong subject and (2) multiple CBIND checks.
CVSS Score: 6.2 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg27006876; http://www-1.ibm.com/support/docview.wss?uid=swg1PK71143; http://www.securityfocus.com/bid/33884
CVE: CVE-2009-0540
Published: 2009-02-25
Description: Cross-site scripting (XSS) vulnerability in Libero 5.3 SP5, and possibly other versions before 5.5 SP1, allows remote attackers to inject arbitrary web script or HTML via the search term field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0243.html; http://osvdb.org/52263; http://www.securityfocus.com/bid/33856
CVE: CVE-2009-0541
Published: 2009-02-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Magento 1.2.0 and 1.2.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the username field in an admin/ request to index.php, possibly related to the login[username] parameter and the app/code/core/Mage/Admin/Model/Session.php login function; (2) the email address field in an admin/index/forgotpassword/ request to index.php, possibly related to the email parameter and the app/code/core/Mage/Adminhtml/controllers/IndexController.php forgotpasswordAction function; or (3) the return parameter to the default URI under downloader/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0257.html; http://secunia.com/advisories/34000; http://securitytracker.com/id?1021746
CVE: CVE-2009-0734
Published: 2009-02-25
Description: Heap-based buffer overflow in MultimediaPlayer.exe 6.86.240.7 in Nokia PC Suite 6.86.9.3 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/51739; http://secunia.com/advisories/33796; http://www.securityfocus.com/archive/1/500627/100/0/threaded
CVE: CVE-2009-0735
Published: 2009-02-25
Description: Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the pfadhier parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33911; http://www.securityfocus.com/bid/33718; https://www.exploit-db.com/exploits/8030
CVE: CVE-2009-0736
Published: 2009-02-25
Description: Cross-site scripting (XSS) vulnerability in Pebble before 2.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33888; http://sourceforge.net/forum/forum.php?forum_id=917656; http://sourceforge.net/project/shownotes.php?release_id=660130
CVE: CVE-2009-0737
Published: 2009-02-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12 before 1.12.4, and 1.13 before 1.13.4, when the installer is in active use, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-February/000083.html; http://secunia.com/advisories/33881; http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_4/phase3/RELEASE-NOTES
CVE: CVE-2009-0738
Published: 2009-02-25
Description: SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33908; http://www.securityfocus.com/bid/33723; https://www.exploit-db.com/exploits/8033
CVE: CVE-2009-0739
Published: 2009-02-25
Description: SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33728; https://www.exploit-db.com/exploits/8034; http://www.securityfocus.com/bid/33728
CVE: CVE-2009-0740
Published: 2009-02-25
Description: SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33725; https://www.exploit-db.com/exploits/8035; http://www.securityfocus.com/bid/33725
CVE: CVE-2009-0741
Published: 2009-02-25
Description: SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginName parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lists.grok.org.uk/pipermail/full-disclosure/2009-February/067879.html; http://secunia.com/advisories/33907; http://www.securityfocus.com/archive/1/500824/100/0/threaded
CVE: CVE-2008-6274
Published: 2009-02-25
Description: Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the logmbr parameter (aka login field) or (2) the mdpmbr parameter (aka pass or "Mot de passe" field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/50314; http://secunia.com/advisories/32900; http://www.securityfocus.com/bid/32501
CVE: CVE-2008-6275
Published: 2009-02-25
Description: Cross-site scripting (XSS) vulnerability in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/339553; http://osvdb.org/50208; http://secunia.com/advisories/32904
CVE: CVE-2008-6276
Published: 2009-02-25
Description: Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticated administrators to execute arbitrary SQL commands via (1) a content type or (2) a voting API value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://drupal.org/node/339553; http://osvdb.org/50207; http://secunia.com/advisories/32904
CVE: CVE-2008-6277
Published: 2009-02-25
Description: SQL injection vulnerability in product.php in RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to execute arbitrary SQL commands via the subcategory_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/0811-exploits/rakhi-sqlxssfpd.txt; http://secunia.com/advisories/32897; http://www.osvdb.org/50313
CVE: CVE-2008-6278
Published: 2009-02-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in product.php in RakhiSoftware Price Comparison Script (aka Shopping Cart) allow remote attackers to inject arbitrary web script or HTML via the (1) category_id and (2) subcategory_id parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/50326; http://packetstormsecurity.com/0811-exploits/rakhi-sqlxssfpd.txt; http://secunia.com/advisories/32950
CVE: CVE-2008-6279
Published: 2009-02-25
Description: RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to obtain sensitive information via an invalid PHPSESSID cookie, which reveals the installation path in an error message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://osvdb.org/50325; http://packetstormsecurity.com/0811-exploits/rakhi-sqlxssfpd.txt; http://secunia.com/advisories/32950
CVE: CVE-2008-6280
Published: 2009-02-25
Description: Cross-site scripting (XSS) vulnerability in apply.cgi on the Linksys WRT160N allows remote attackers to inject arbitrary web script or HTML via the action parameter in a DHCP_Static operation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0811-exploits/linksys-xss.txt; http://secunia.com/advisories/32877; http://www.securityfocus.com/bid/32496
CVE: CVE-2008-6281
Published: 2009-02-25
Description: SQL injection vulnerability in index.php in Bluo CMS 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32932; http://www.securityfocus.com/bid/32522; https://www.exploit-db.com/exploits/7268
CVE: CVE-2008-6282
Published: 2009-02-25
Description: SQL injection vulnerability in engine/users/users_edit_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the city parameter in a users_edit_pub action to index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://ortus.nirn.ru/index.php?ortupg=16; http://osvdb.org/50312; http://secunia.com/advisories/32899
CVE: CVE-2008-6283
Published: 2009-02-25
Description: Cross-site scripting (XSS) vulnerability in Subtext 2.0 allows remote attackers to inject arbitrary web script or HTML via a comment, related to "the feature which converts URLs to anchor tags."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://haacked.com/archive/2008/11/27/subtext-2.1-security-update.aspx; http://osvdb.org/50235; http://secunia.com/advisories/32914
CVE: CVE-2008-6284
Published: 2009-02-25
Description: SQL injection vulnerability in edit.php in Z1Exchange 1.0 allows remote attackers to execute arbitrary SQL commands via the site parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32556; https://exchange.xforce.ibmcloud.com/vulnerabilities/46938; https://www.exploit-db.com/exploits/7311
CVE: CVE-2008-6285
Published: 2009-02-25
Description: SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the mid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32925; http://www.securityfocus.com/bid/32532; http://www.vupen.com/english/advisories/2008/3307
CVE: CVE-2008-6286
Published: 2009-02-25
Description: Multiple SQL injection vulnerabilities in SubscriberStart.asp in Active Newsletter 4.3 allow remote attackers to execute arbitrary SQL commands via (1) the email parameter (aka username or E-mail field), or (2) the password parameter (aka password field), to (a) Subscriber.asp or (b) start.asp.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32908; https://exchange.xforce.ibmcloud.com/vulnerabilities/46916; https://www.exploit-db.com/exploits/7280
CVE: CVE-2008-6287
Published: 2009-02-25
Description: Multiple PHP remote file inclusion vulnerabilities in Broadcast Machine 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the baseDir parameter to (1) MySQLController.php, (2) SQLController.php, (3) SetupController.php, (4) VideoController.php, and (5) ViewController.php in controllers/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/32554; http://www.vupen.com/english/advisories/2008/3289; https://exchange.xforce.ibmcloud.com/vulnerabilities/46939
CVE: CVE-2008-6288
Published: 2009-02-25
Description: Directory traversal vulnerability in download.php in Interface Medien ibase 2.03 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31210; http://www.securityfocus.com/bid/30362; https://exchange.xforce.ibmcloud.com/vulnerabilities/43983
CVE: CVE-2008-5263
Published: 2009-02-26
Description: Multiple stack-based buffer overflows in the mt_codec::getHdrHead function in kernel/kls_hdr/fmt_codec_hdr.cpp in ksquirrel-libs 0.8.0 allow context-dependent attackers to execute arbitrary code via a crafted Radiance RGBE image (aka .hdr file).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/33469; http://secunia.com/secunia_research/2008-63/; http://www.securityfocus.com/archive/1/501228/100/0/threaded
CVE: CVE-2008-6289
Published: 2009-02-26
Description: SQL injection vulnerability in cityview.php in Tours Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the cityid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32503; http://www.securityfocus.com/bid/32110; https://exchange.xforce.ibmcloud.com/vulnerabilities/46337
CVE: CVE-2008-6290
Published: 2009-02-26
Description: Directory traversal vulnerability in includefile.php in nicLOR Sito, when register_globals is enabled or magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the page_file parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32556; http://www.securityfocus.com/bid/32111; https://exchange.xforce.ibmcloud.com/vulnerabilities/46338
CVE: CVE-2008-6291
Published: 2009-02-26
Description: Acc PHP eMail 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the NEWSLETTERLOGIN cookie to "admin".
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32507; http://www.securityfocus.com/bid/32074; https://exchange.xforce.ibmcloud.com/vulnerabilities/46289
CVE: CVE-2008-6292
Published: 2009-02-26
Description: Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) username_cookie to "admin," (2) right_cookie to "1," and (3) id_cookie to "1."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32517; http://www.securityfocus.com/bid/32083; https://exchange.xforce.ibmcloud.com/vulnerabilities/46287
CVE: CVE-2008-6293
Published: 2009-02-26
Description: admin/Index.php in Acc Real Estate 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the username_cookie to "admin."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32517; http://www.securityfocus.com/bid/32078; https://exchange.xforce.ibmcloud.com/vulnerabilities/46290
CVE: CVE-2008-6294
Published: 2009-02-26
Description: admin/Index.php in Acc Statistics 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the username_cookie cookie to "admin."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32517; http://www.securityfocus.com/bid/32078; https://exchange.xforce.ibmcloud.com/vulnerabilities/46292
CVE: CVE-2008-6295
Published: 2009-02-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Camera Life 2.6.2b8 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.php and (2) rss.php; the query string after the image name in (3) photos/photo; the path parameter to (4) folder.php; page parameter and REQUEST_URI to (5) login.php; ver parameter to (6) media.php; theme parameter to (7) modules/iconset/iconset-debug.php; and the REQUEST_URI to (8) index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31234; http://www.digitrustgroup.com/advisories/web-application-security-camera-life2.html; http://www.securityfocus.com/bid/32019
CVE: CVE-2008-6296
Published: 2009-02-26
Description: admin.php in Maran PHP Shop allows remote attackers to bypass authentication and gain administrative access by setting the user cookie to "demo."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/32048; https://exchange.xforce.ibmcloud.com/vulnerabilities/46306; https://www.exploit-db.com/exploits/6954
CVE: CVE-2008-6297
Published: 2009-02-26
Description: Cross-site scripting (XSS) vulnerability in order.php in DHCart allows remote attackers to inject arbitrary web script or HTML via the (1) domain and (2) d1 parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2008/11/dhcart-multiple-variable-xss-and-stored.html; http://secunia.com/advisories/32555; http://www.securityfocus.com/bid/32117
CVE: CVE-2008-6298
Published: 2009-02-26
Description: Unspecified vulnerability in sISAPILocation before 1.0.2.2 allows remote attackers to bypass intended access restrictions for character encoding and the cookie secure flag via unknown vectors related to the "HTTP header rewrite function."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN67060882/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000076.html; http://rocketeer.dip.jp/sanaki/free/free100.htm
CVE: CVE-2008-6299
Published: 2009-02-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5.7 and earlier allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) the title and description parameters to the com_weblinks module and (2) unspecified vectors in the com_content module related to "article submission."
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-comcontent-xss-vulnerability.html; http://developer.joomla.org/security/news/[PII_REDACTED]2-core-comweblinks-xss-vulnerability.html; http://secunia.com/advisories/32622
CVE: CVE-2008-6300
Published: 2009-02-26
Description: Galatolo WebManager 1.3a allows remote attackers to bypass authentication and gain administrative access by setting the (1) gwm_user and (2) gwm_pass cookies to admin.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/30247; http://www.securityfocus.com/bid/30247/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/46678
CVE: CVE-2008-6301
Published: 2009-02-26
Description: SQL injection vulnerability in shoutbox_view.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32565; http://www.securityfocus.com/bid/32123; https://exchange.xforce.ibmcloud.com/vulnerabilities/46389
CVE: CVE-2009-0114
Published: 2009-02-26
Description: Unspecified vulnerability in the Settings Manager in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87, and possibly other versions, allows remote attackers to trick a user into visiting an arbitrary URL via unknown vectors, related to "a potential Clickjacking issue variant."
CVSS Score: 5.8 (MEDIUM)
References: http://isc.sans.org/diary.html?storyid=5929; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/34226
CVE: CVE-2009-0187
Published: 2009-02-26
Description: Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3, and possibly other versions before 2.8.5, allows remote attackers to execute arbitrary code via a crafted HTTP URL with a long host name, which is not properly handled when constructing a "Connecting" log message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/52294; http://secunia.com/advisories/33843; http://secunia.com/secunia_research/2009-9/
CVE: CVE-2009-0507
Published: 2009-02-26
Description: IBM WebSphere Process Server (WPS) 6.1.2 before 6.1.2.3 and 6.2 before 6.2.0.1 does not properly restrict configuration data during an export of the cluster configuration file from the administrative console, which allows remote authenticated users to obtain the (1) JMSAPI, (2) ESCALATION, and (3) MAILSESSION (aka mail session) cleartext passwords via vectors involving access to a cluster member.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-16
References: http://secunia.com/advisories/34249; http://www-01.ibm.com/support/docview.wss?uid=swg27015580; http://www-1.ibm.com/support/docview.wss?uid=swg1JR30088
CVE: CVE-2009-0519
Published: 2009-02-26
Description: Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockwave Flash (aka .swf) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://isc.sans.org/diary.html?storyid=5929; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://rhn.redhat.com/errata/RHSA-2009-0332.html
CVE: CVE-2009-0520
Published: 2009-02-26
Description: Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a "buffer overflow issue."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://isc.sans.org/diary.html?storyid=5929; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=773; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
CVE: CVE-2009-0521
Published: 2009-02-26
Description: Untrusted search path vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Linux allows local users to obtain sensitive information or gain privileges via a crafted library in a directory contained in the RPATH.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://isc.sans.org/diary.html?storyid=5929; http://rhn.redhat.com/errata/RHSA-2009-0332.html; http://secunia.com/advisories/34012
CVE: CVE-2009-0522
Published: 2009-02-26
Description: Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Windows allows remote attackers to trick a user into visiting an arbitrary URL via an unspecified manipulation of the "mouse pointer display," related to a "Clickjacking attack."
CVSS Score: 4.3 (MEDIUM)
References: http://isc.sans.org/diary.html?storyid=5929; http://secunia.com/advisories/34012; http://securitytracker.com/id?1021752
CVE: CVE-2009-0523
Published: 2009-02-26
Description: Cross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled when displaying the Help Errors log.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34048; http://securitytracker.com/id?1021755; http://www.adobe.com/support/security/bulletins/apsb09-02.html
CVE: CVE-2009-0524
Published: 2009-02-26
Description: Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 6 and 7, and RoboHelp Server 6 and 7, allows remote attackers to inject arbitrary web script or HTML via vectors involving files produced by RoboHelp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34032; http://secunia.com/advisories/34048; http://securitytracker.com/id?1021755