deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-4229
Published: 2013-08-21
Description: Cross-site scripting (XSS) vulnerability in the Monster Menus module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated users with permissions to add pages to inject arbitrary web script or HTML via a title in the page settings.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupalcode.org/project/monster_menus.git/blobdiff/4841dcb4e36bdc74efe4ae[PII_REDACTED]df929940..4adcb6b:/mm_static.inc; http://secunia.com/advisories/54391; http://www.openwall.com/lists/oss-security/2013/08/10/1
CVE: CVE-2013-4230
Published: 2013-08-21
Description: The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrary submissions via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/54391; http://www.openwall.com/lists/oss-security/2013/08/10/1; http://www.securityfocus.com/bid/61711
CVE: CVE-2013-0526
Published: 2013-08-21
Description: ping.php in Global Console Manager 16 (GCM16) and Global Console Manager 32 (GCM32) before 1.20.0.22575 on the IBM Avocent 1754 KVM switch allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) count or (2) size parameter.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://www.bitcloud.es/2013/08/vulnerabilidad-en-kvms-gcm1632-de-ibm.html; http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093509; https://exchange.xforce.ibmcloud.com/vulnerabilities/85367
CVE: CVE-2013-3016
Published: 2013-08-21
Description: IBM WebSphere Portal 6.1, 7.0, and 8.0 allows remote attackers to access the user directory via a crafted request for a servlet, related to the serveServletsByClassnameEnabled setting.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21647344; https://exchange.xforce.ibmcloud.com/vulnerabilities/84350; http://www-01.ibm.com/support/docview.wss?uid=swg21647344
CVE: CVE-2013-4699
Published: 2013-08-21
Description: The Yahoo! Japan Yafuoku! application 4.3.0 and earlier for iOS and Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://jvn.jp/en/jp/JVN68156832/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000078; http://jvn.jp/en/jp/JVN68156832/index.html
CVE: CVE-2013-4700
Published: 2013-08-21
Description: The Yahoo! Japan Shopping application 1.4 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://jvn.jp/en/jp/JVN75084836/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000079; http://jvn.jp/en/jp/JVN75084836/index.html
CVE: CVE-2013-4701
Published: 2013-08-21
Description: Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN24713981/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000080; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html
CVE: CVE-2013-0597
Published: 2013-08-21
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0, when OAuth is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM85834; http://www-01.ibm.com/support/docview.wss?uid=swg1PM87131; http://www-01.ibm.com/support/docview.wss?uid=swg21644047
CVE: CVE-2013-2802
Published: 2013-08-21
Description: The universal protocol implementation in Sixnet UDR before 2.0 and RTU firmware before 4.8 allows remote attackers to execute arbitrary code; read, modify, or create files; or obtain file metadata via function opcodes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-231-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-231-01
CVE: CVE-2013-2967
Published: 2013-08-21
Description: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM78614; http://www-01.ibm.com/support/docview.wss?uid=swg21644047; https://exchange.xforce.ibmcloud.com/vulnerabilities/83871
CVE: CVE-2013-2976
Published: 2013-08-21
Description: The Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 does not properly perform caching, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM79992; http://www-01.ibm.com/support/docview.wss?uid=swg21644047; https://exchange.xforce.ibmcloud.com/vulnerabilities/83965
CVE: CVE-2013-3029
Published: 2013-08-21
Description: Cross-site request forgery (CSRF) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM88746; http://www-01.ibm.com/support/docview.wss?uid=swg21644047; https://exchange.xforce.ibmcloud.com/vulnerabilities/84591
CVE: CVE-2013-4004
Published: 2013-08-21
Description: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.7 and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM81571; http://www-01.ibm.com/support/docview.wss?uid=swg21644047; http://www.securityfocus.com/bid/61935
CVE: CVE-2013-4005
Published: 2013-08-21
Description: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified fields.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM88208; http://www-01.ibm.com/support/docview.wss?uid=swg21644047; http://www.securitytracker.com/id/1028932
CVE: CVE-2013-2299
Published: 2013-08-22
Description: Cross-site scripting (XSS) vulnerability in Advantech WebAccess (formerly BroadWin WebAccess) before 7.1 2013.05.30 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-225-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-225-01
CVE: CVE-2013-2789
Published: 2013-08-22
Description: The Kepware DNP Master Driver for the KEPServerEX Communications Platform before 5.12.140.0 allows remote attackers to cause a denial of service (master-station infinite loop) via crafted DNP3 packets to TCP port 20000 and allows physically proximate attackers to cause a denial of service (master-station infinite loop) via crafted input over a serial line.
CVSS Score: 7.8 (HIGH)
CWE: CWE-835
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-226-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-226-01
CVE: CVE-2013-2800
Published: 2013-08-22
Description: The OSIsoft PI Interface for IEEE C37.118 before 1.0.6.158 allows remote attackers to cause a denial of service (memory consumption or memory corruption, instance shutdown, and data-collection outage) via crafted C37.118 configuration packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-225-02; http://ics-cert.us-cert.gov/advisories/ICSA-13-225-02
CVE: CVE-2013-2801
Published: 2013-08-22
Description: The OSIsoft PI Interface for IEEE C37.118 before 1.0.6.158 allows remote attackers to cause a denial of service (instance shutdown and data-collection outage) via crafted C37.118 configuration packets that trigger an invalid read operation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-225-02; http://ics-cert.us-cert.gov/advisories/ICSA-13-225-02
CVE: CVE-2013-2979
Published: 2013-08-22
Description: Directory traversal vulnerability in IBM Optim Performance Manager 4.1.1 and IBM InfoSphere Optim Performance Manager 5.x before 5.2 allows remote authenticated users to read arbitrary files via a crafted URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21647415; https://exchange.xforce.ibmcloud.com/vulnerabilities/83972; http://www-01.ibm.com/support/docview.wss?uid=swg21647415
CVE: CVE-2013-3453
Published: 2013-08-22
Description: Memory leak in Cisco Unified Communications Manager IM and Presence Service before 8.6(5)SU1 and 9.x before 9.1(2), and Cisco Unified Presence, allows remote attackers to cause a denial of service (memory and CPU consumption) by making many TCP connections to port (1) 5060 or (2) 5061, aka Bug ID CSCud84959.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-cup; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130821-cup
CVE: CVE-2012-6583
Published: 2013-08-23
Description: Cross-site scripting (XSS) vulnerability in the Imagemenu module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "administer imagemenu" permission to inject arbitrary web script or HTML via an image file name.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://osvdb.org/85679; http://secunia.com/advisories/50683; http://www.securityfocus.com/bid/55610
CVE: CVE-2013-5569
Published: 2013-08-23
Description: SQL injection vulnerability in the Slideshare extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/90417; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-005/; https://exchange.xforce.ibmcloud.com/vulnerabilities/82219
CVE: CVE-2013-5570
Published: 2013-08-23
Description: Cross-site scripting (XSS) vulnerability in the Javascript and CSS Optimizer extension before 1.1.14 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/53253; http://typo3.org/extensions/repository/view/js_css_optimizer; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-002/
CVE: CVE-2011-4607
Published: 2013-08-23
Description: PuTTY 0.59 through 0.61 does not clear sensitive process memory when managing user replies that occur during keyboard-interactive authentication, which might allow local users to read login passwords by obtaining access to the process' memory.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://seclists.org/oss-sec/2011/q4/499; http://seclists.org/oss-sec/2011/q4/500; http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html
CVE: CVE-2012-4733
Published: 2013-08-23
Description: Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-255
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html; http://secunia.com/advisories/53522
CVE: CVE-2013-1434
Published: 2013-08-23
Description: Multiple SQL injection vulnerabilities in (1) api_poller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forums.cacti.net/viewtopic.php?f=21&t=50593; http://lists.opensuse.org/opensuse-updates/2013-08/msg00053.html; http://secunia.com/advisories/54181
CVE: CVE-2013-1435
Published: 2013-08-23
Description: (1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://forums.cacti.net/viewtopic.php?f=21&t=50593; http://lists.opensuse.org/opensuse-updates/2013-08/msg00053.html; http://secunia.com/advisories/54181
CVE: CVE-2013-1909
Published: 2013-08-23
Description: The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://qpid.apache.org/releases/qpid-0.22/release-notes.html; http://rhn.redhat.com/errata/RHSA-2013-1024.html; http://secunia.com/advisories/53968
CVE: CVE-2013-2194
Published: 2013-08-23
Description: Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
CVE: CVE-2013-2195
Published: 2013-08-23
Description: The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "pointer dereferences" involving unexpected calculations.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
CVE: CVE-2013-2196
Published: 2013-08-23
Description: Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "other problems" that are not CVE-2013-2194 or CVE-2013-2195.
CVSS Score: 6.9 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
CVE: CVE-2013-3368
Published: 2013-08-23
Description: bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
CVE: CVE-2013-3369
Published: 2013-08-23
Description: Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
CVE: CVE-2013-3370
Published: 2013-08-23
Description: Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
CVE: CVE-2013-3371
Published: 2013-08-23
Description: Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
CVE: CVE-2013-3372
Published: 2013-08-23
Description: Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
CVE: CVE-2013-3373
Published: 2013-08-23
Description: CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
CVE: CVE-2013-3374
Published: 2013-08-23
Description: Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use."
CVSS Score: 4.3 (MEDIUM)
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
CVE: CVE-2013-4172
Published: 2013-08-23
Description: The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://rhn.redhat.com/errata/RHSA-2013-1157.html; http://rhn.redhat.com/errata/RHSA-2013-1157.html
CVE: CVE-2013-5587
Published: 2013-08-23
Description: Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket.  NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html; http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html
CVE: CVE-2013-1662
Published: 2013-08-24
Description: vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsb_release binary in a directory in the PATH, related to use of the popen library function.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://blog.cmpxchg8b.com/2013/08/security-debianisms.html; http://www.vmware.com/security/advisories/VMSA-2013-0010.html; http://blog.cmpxchg8b.com/2013/08/security-debianisms.html
CVE: CVE-2010-5289
Published: 2013-08-25
Description: Buffer overflow in the Authenticate method in the INCREDISPOOLERLib.Pop ActiveX control in ImSpoolU.dll in IncrediMail 2.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in the first argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/12030/; http://www.exploit-db.com/exploits/12030/
CVE: CVE-2012-6584
Published: 2013-08-25
Description: Multiple SQL injection vulnerabilities in MYRE Realty Manager allow remote attackers to execute arbitrary SQL commands via the bathrooms1 parameter to (1) demo2/search.php or (2) search.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/22713/; http://www.exploit-db.com/exploits/22713/
CVE: CVE-2012-6585
Published: 2013-08-25
Description: Cross-site scripting (XSS) vulnerability in search.php in MYRE Realty Manager allows remote attackers to inject arbitrary web script or HTML via the cat_id1 parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/22713/; http://www.exploit-db.com/exploits/22713/
CVE: CVE-2012-6586
Published: 2013-08-25
Description: Multiple SQL injection vulnerabilities in MYRE Vacation Rental Software allow remote attackers to execute arbitrary SQL commands via the (1) garage1 or (2) bathrooms1 parameter to vacation/1_mobile/search.php, or (3) unspecified input to vacation/widgate/request_more_information.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/22712/; http://www.exploit-db.com/exploits/22712/
CVE: CVE-2012-6587
Published: 2013-08-25
Description: Cross-site scripting (XSS) vulnerability in vacation/1_mobile/alert_members.php in MYRE Vacation Rental Software allows remote attackers to inject arbitrary web script or HTML via the link_idd parameter in a login action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/22712/; http://www.exploit-db.com/exploits/22712/
CVE: CVE-2012-6588
Published: 2013-08-25
Description: SQL injection vulnerability in links.php in MYRE Business Directory allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/22711/; http://www.exploit-db.com/exploits/22711/
CVE: CVE-2012-6589
Published: 2013-08-25
Description: Cross-site scripting (XSS) vulnerability in search.php in MYRE Business Directory allows remote attackers to inject arbitrary web script or HTML via the look parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/22711/; http://www.exploit-db.com/exploits/22711/