deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-7009
Published: 2009-08-19
Description: Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security Suite 7.0.483.000 and 8.0.020.000 allows local users to execute arbitrary code via a file or directory with a long path.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/48097; http://secunia.com/advisories/31832; http://www.securityfocus.com/archive/1/496226/100/0/threaded
CVE: CVE-2008-7010
Published: 2009-08-19
Description: Skalfa Software SkaLinks Exchange Script 1.5 allows remote attackers to add new administrators and gain privileges via a direct request to admin/register.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.org/0809-exploits/skalinks-editor.txt; http://www.securityfocus.com/bid/31158; https://exchange.xforce.ibmcloud.com/vulnerabilities/45116
CVE: CVE-2008-7011
Published: 2009-08-19
Description: The Unreal engine, as used in Unreal Tournament 3 1.3, Unreal Tournament 2003 and 2004, Dead Man's Hand, Pariah, WarPath, Postal2, and Shadow Ops, allows remote authenticated users to cause a denial of service (server exit) via multiple file downloads from the server, which triggers an assertion failure when the Closing flag in UnChan.cpp is set.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0321.html; http://osvdb.org/48293; http://www.securityfocus.com/archive/1/496399/100/0/threaded
CVE: CVE-2008-7012
Published: 2009-08-19
Description: courier/1000@/api_error_email.html (aka "error reporting page") in Accellion File Transfer Appliance FTA_7_0_178, and possibly other versions before FTA_7_0_189, allows remote attackers to send spam e-mail via modified description and client_email parameters.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/48242; http://secunia.com/advisories/31848; http://www.securityfocus.com/bid/31178
CVE: CVE-2008-7013
Published: 2009-08-19
Description: NetService.dll in Baidu Hi IM allows remote servers to cause a denial of service (client crash) via a crafted login response that triggers a divide-by-zero error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://osvdb.org/51697; http://www.securityfocus.com/archive/1/496353/100/0/threaded; http://osvdb.org/51697
CVE: CVE-2008-7014
Published: 2009-08-19
Description: fhttpd 0.4.2 allows remote attackers to cause a denial of service (crash) via an Authorization HTTP header with an invalid character after the Basic value.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/31265; https://exchange.xforce.ibmcloud.com/vulnerabilities/45278; https://www.exploit-db.com/exploits/6493
CVE: CVE-2008-7015
Published: 2009-08-19
Description: Unreal engine 3, as used in Unreal Tournament 3 1.3, Frontlines: Fuel of War 1.1.1, and other products, allows remote attackers to cause a denial of service (server exit) via a packet with a large length value that triggers a memory allocation failure.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0189.html; http://osvdb.org/48292; http://www.securityfocus.com/archive/1/496280/100/0/threaded
CVE: CVE-2009-0682
Published: 2009-08-19
Description: vetmonnt.sys in CA Internet Security Suite r3, vetmonnt.sys before 9.0.0.184 in Internet Security Suite r4, and vetmonnt.sys before 10.0.0.217 in Internet Security Suite r5 do not properly verify IOCTL calls, which allows local users to cause a denial of service (system crash) via a crafted call.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://en.securitylab.ru/lab/PT-2009-05; http://osvdb.org/57228; http://www.securityfocus.com/archive/1/505880/100/0/threaded
CVE: CVE-2009-1884
Published: 2009-08-19
Description: Off-by-one error in the bzinflate function in Bzip2.xs in the Compress-Raw-Bzip2 module before 2.018 for Perl allows context-dependent attackers to cause a denial of service (application hang or crash) via a crafted bzip2 compressed stream that triggers a buffer overflow, a related issue to CVE-2009-1391.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/36386; http://secunia.com/advisories/36415; http://security.gentoo.org/glsa/glsa-200908-07.xml
CVE: CVE-2009-2055
Published: 2009-08-19
Description: Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://mailman.nanog.org/pipermail/nanog/2009-August/012719.html; http://securitytracker.com/id?1022739; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af150f.shtml
CVE: CVE-2009-2627
Published: 2009-08-19
Description: Insecure method vulnerability in the Acer LunchApp (aka AcerCtrls.APlunch) ActiveX control in acerctrl.ocx allows remote attackers to execute arbitrary commands via the Run method, a different vulnerability than CVE-2006-6121.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/57201; http://secunia.com/advisories/36343; http://www.kb.cert.org/vuls/id/485961
CVE: CVE-2009-2740
Published: 2009-08-19
Description: kmxIds.sys before 7.3.1.18 in CA Host-Based Intrusion Prevention System (HIPS) 8.1 allows remote attackers to cause a denial of service (system crash) via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/archive/1/505881/100/0/threaded; https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=214665; http://www.securityfocus.com/archive/1/505881/100/0/threaded
CVE: CVE-2009-2857
Published: 2009-08-19
Description: The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virtual-memory implementations, which allows local users to cause a denial of service (deadlock and system halt) via vectors involving mmap and write operations on the same file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: http://secunia.com/advisories/36319; http://sunsolve.sun.com/search/document.do?assetkey=1-21-127721-02-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-257848-1
CVE: CVE-2009-2858
Published: 2009-08-19
Description: Memory leak in the Security component in IBM DB2 8.1 before FP18 on Unix platforms allows attackers to cause a denial of service (memory consumption) via unspecified vectors, related to private memory within the DB2 memory structure.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT; http://secunia.com/advisories/36313; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ35635
CVE: CVE-2009-2859
Published: 2009-08-19
Description: IBM DB2 8.1 before FP18 allows attackers to obtain unspecified access via a das command.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT; http://secunia.com/advisories/36313; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ34149
CVE: CVE-2009-2860
Published: 2009-08-19
Description: Unspecified vulnerability in db2jds in IBM DB2 8.1 before FP18 allows remote attackers to cause a denial of service (service crash) via "malicious packets."
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT; http://secunia.com/advisories/36313; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ52433
CVE: CVE-2009-2881
Published: 2009-08-20
Description: Multiple SQL injection vulnerabilities in Basilic 1.5.13 allow remote attackers to execute arbitrary SQL commands via the idAuthor parameter to (1) index.php and possibly (2) allpubs.php in publications/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9246; http://www.vupen.com/english/advisories/2009/2005; https://exchange.xforce.ibmcloud.com/vulnerabilities/51992
CVE: CVE-2009-2882
Published: 2009-08-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in PG MatchMaking allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) browse_ladies.php and (2) browse_men.php, the (3) gender parameter to search.php, and the (4) id parameter to services.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/pgmatchmaking-xss.txt; http://secunia.com/advisories/36004; http://www.securityfocus.com/bid/35808
CVE: CVE-2009-2883
Published: 2009-08-20
Description: SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cp_username parameter, related to an error in the CleanVar function in includes/functions.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9248; http://www.securityfocus.com/bid/35795; https://exchange.xforce.ibmcloud.com/vulnerabilities/51983
CVE: CVE-2009-2884
Published: 2009-08-20
Description: Cross-site scripting (XSS) vulnerability in bios.php in PHP Scripts Now World's Tallest Buildings allows remote attackers to inject arbitrary web script or HTML via the rank parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/tallestbuildings-sql.txt; http://secunia.com/advisories/35935; http://www.osvdb.org/56122
CVE: CVE-2009-2885
Published: 2009-08-20
Description: SQL injection vulnerability in bios.php in PHP Scripts Now World's Tallest Buildings allows remote attackers to execute arbitrary SQL commands via the rank parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/tallestbuildings-sql.txt; http://secunia.com/advisories/35935; http://www.osvdb.org/56121
CVE: CVE-2009-2886
Published: 2009-08-20
Description: SQL injection vulnerability in bios.php in PHP Scripts Now President Bios allows remote attackers to execute arbitrary SQL commands via the rank parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/presidentbios-sqlxss.txt; http://secunia.com/advisories/35935; https://exchange.xforce.ibmcloud.com/vulnerabilities/51870
CVE: CVE-2009-2887
Published: 2009-08-20
Description: Cross-site scripting (XSS) vulnerability in bios.php in PHP Scripts Now President Bios allows remote attackers to inject arbitrary web script or HTML via the rank parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/presidentbios-sqlxss.txt; http://secunia.com/advisories/35935; https://exchange.xforce.ibmcloud.com/vulnerabilities/51871
CVE: CVE-2009-2888
Published: 2009-08-20
Description: SQL injection vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to execute arbitrary SQL commands via the n parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/tophangman-sqlxss.txt; http://secunia.com/advisories/35888; http://www.osvdb.org/56075
CVE: CVE-2009-2889
Published: 2009-08-20
Description: Cross-site scripting (XSS) vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to inject arbitrary web script or HTML via the letters parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/tophangman-sqlxss.txt; http://secunia.com/advisories/35888; http://www.osvdb.org/56074
CVE: CVE-2009-2890
Published: 2009-08-20
Description: Cross-site scripting (XSS) vulnerability in results.php in PHP Scripts Now Riddles allows remote attackers to inject arbitrary web script or HTML via the searchquery parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/riddledepot-sqlxss.txt; http://secunia.com/advisories/35932; http://www.osvdb.org/56124
CVE: CVE-2009-2891
Published: 2009-08-20
Description: SQL injection vulnerability in list.php in PHP Scripts Now Riddles allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/riddledepot-sqlxss.txt; http://secunia.com/advisories/35932; http://www.osvdb.org/56123
CVE: CVE-2009-2892
Published: 2009-08-20
Description: Multiple SQL injection vulnerabilities in header.php in Scripteen Free Image Hosting Script 2.3 allow remote attackers to execute arbitrary SQL commands via a (1) cookid or (2) cookgid cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35976; http://www.exploit-db.com/exploits/9252; http://www.scripteen.com/forum/bug-reports-f15-my-image-hosting-site-got-hacked-t764.html
CVE: CVE-2009-2893
Published: 2009-08-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in XZero Community Classifieds 4.97.8 allow remote attackers to inject arbitrary web script or HTML via (1) the postevent parameter in a post action or (2) the _xzcal_y parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/xzero-xss.txt; http://secunia.com/advisories/35996; http://www.securityfocus.com/bid/35809
CVE: CVE-2009-2894
Published: 2009-08-20
Description: Multiple SQL injection vulnerabilities in Ebay Clone 2009 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to product_desc.php, and the cid parameter to (2) showcategory.php and (3) gallery.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/56265; http://osvdb.org/56266; http://osvdb.org/56268
CVE: CVE-2009-2895
Published: 2009-08-20
Description: SQL injection vulnerability in rss.php in Ultimate Regnow Affiliate (URA) 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9263; http://www.exploit-db.com/exploits/9263
CVE: CVE-2009-2896
Published: 2009-08-20
Description: Buffer overflow in KMplayer 2.9.4.1433 and earlier allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long string in a subtitle (.srt) playlist file. NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9220; http://www.securityfocus.com/bid/35745; http://www.vupen.com/english/advisories/2009/1959
CVE: CVE-2009-0638
Published: 2009-08-21
Description: The Cisco Firewall Services Module (FWSM) 2.x, 3.1 before 3.1(16), 3.2 before 3.2(13), and 4.0 before 4.0(6) for Cisco Catalyst 6500 switches and Cisco 7600 routers allows remote attackers to cause a denial of service (traffic-handling outage) via a series of malformed ICMP messages.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/36373; http://securitytracker.com/id?1022747; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af0d1d.shtml
CVE: CVE-2009-2694
Published: 2009-08-21
Description: The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://developer.pidgin.im/viewmtn/revision/info/6f7343166c673bf0496ecb1afec9b633c1d54a0e; http://developer.pidgin.im/wiki/ChangeLog; http://secunia.com/advisories/36384
CVE: CVE-2009-2732
Published: 2009-08-21
Description: The checkHTTPpassword function in http.c in ntop 3.3.10 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an Authorization HTTP header that lacks a : (colon) character in the base64-decoded string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/36403; http://www.mandriva.com/security/advisories?name=MDVSA-2010:181; http://www.securityfocus.com/archive/1/505862/100/0/threaded
CVE: CVE-2009-2912
Published: 2009-08-21
Description: The (1) sendfile and (2) sendfilev functions in Sun Solaris 8 through 10, and OpenSolaris before snv_110, allow local users to cause a denial of service (panic) via vectors related to vnode function calls.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/36400; http://sunsolve.sun.com/search/document.do?assetkey=1-21-127721-02-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-258588-1
CVE: CVE-2009-2913
Published: 2009-08-21
Description: Cross-site scripting (XSS) vulnerability in index.php in XZero Community Classifieds 4.97.8 allows remote attackers to inject arbitrary web script or HTML via the URI.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35996; http://secunia.com/advisories/35996
CVE: CVE-2009-2914
Published: 2009-08-21
Description: Cross-site scripting (XSS) vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.vupen.com/english/advisories/2009/2010; http://www.vupen.com/english/advisories/2009/2010
CVE: CVE-2009-2962
Published: 2009-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-2692.  Reason: This candidate is a duplicate of CVE-2009-2692.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2009-2692 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-2915
Published: 2009-08-21
Description: SQL injection vulnerability in 2fly_gift.php in 2FLY Gift Delivery System 6.0 allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a content action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0908-exploits/discuz60-sql.txt; http://secunia.com/advisories/36294; http://packetstormsecurity.org/0908-exploits/discuz60-sql.txt
CVE: CVE-2009-2916
Published: 2009-08-21
Description: Format string vulnerability in the CNS_AddTxt function in logs.dll in 2K Games Vietcong 2 1.10 and earlier might allow remote attackers to execute arbitrary code via format string specifiers in the nickname.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/vietcong2fs-adv.txt; http://osvdb.org/57002; http://secunia.com/advisories/36301
CVE: CVE-2009-2917
Published: 2009-08-21
Description: Stack-based buffer overflow in ImTOO MPEG Encoder 3.1.53 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted string in a (1) .cue or (2) .m3u playlist file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9382; https://exchange.xforce.ibmcloud.com/vulnerabilities/52857; http://www.exploit-db.com/exploits/9382
CVE: CVE-2009-2918
Published: 2009-08-21
Description: The tgbvpn.sys driver in TheGreenBow IPSec VPN Client 4.61.003 allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted request to the 0x80000034 IOCTL, probably involving an input or output buffer size of 0.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://secunia.com/advisories/36332; http://www.securityfocus.com/archive/1/505816/100/0/threaded; http://www.vupen.com/english/advisories/2009/2294
CVE: CVE-2009-2919
Published: 2009-08-21
Description: Cross-site scripting (XSS) vulnerability in Boonex Orca 2.0 and 2.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the topic title field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://securityreason.com/exploitalert/5644; http://www.securityfocus.com/bid/33545; https://exchange.xforce.ibmcloud.com/vulnerabilities/48434
CVE: CVE-2009-2920
Published: 2009-08-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Elvin 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) component and (2) priority parameters to buglist.php; and the (3) Username (4) E-mail, (5) Pass, and (6) Confirm pass fields to createaccount.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/9342; https://exchange.xforce.ibmcloud.com/vulnerabilities/51671; http://www.exploit-db.com/exploits/9342
CVE: CVE-2009-2921
Published: 2009-08-21
Description: Multiple SQL injection vulnerabilities in login.php in MOC Designs PHP News 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) newsuser parameter (User field) and (2) newspassword parameter (Password field).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9353; http://www.vupen.com/english/advisories/2009/2161; https://exchange.xforce.ibmcloud.com/vulnerabilities/52231
CVE: CVE-2009-2922
Published: 2009-08-21
Description: Absolute path traversal vulnerability in pixaria.image.php in Pixaria Gallery 2.0.0 through 2.3.5 allows remote attackers to read arbitrary files via a base64-encoded file parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9257; http://www.pixaria.com/news/article/234; http://www.securityfocus.com/bid/35802
CVE: CVE-2009-2923
Published: 2009-08-21
Description: Multiple directory traversal vulnerabilities in BitmixSoft PHP-Lance 1.52 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to show.php and (2) in parameter to advanced_search.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/57246; http://osvdb.org/57247; http://www.exploit-db.com/exploits/9444
CVE: CVE-2009-2924
Published: 2009-08-21
Description: Multiple SQL injection vulnerabilities in Videos Broadcast Yourself 2 allow remote attackers to execute arbitrary SQL commands via the (1) UploadID parameter to videoint.php, and possibly the (2) cat_id parameter to catvideo.php and (3) uid parameter to cviewchannels.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9453; http://www.exploit-db.com/exploits/9453
CVE: CVE-2009-2925
Published: 2009-08-21
Description: Directory traversal vulnerability in DJcalendar.cgi in DJCalendar allows remote attackers to read arbitrary files via a .. (dot dot) in the TEMPLATE parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9140; https://exchange.xforce.ibmcloud.com/vulnerabilities/52463; http://www.exploit-db.com/exploits/9140
CVE: CVE-2008-7016
Published: 2009-08-21
Description: tnftpd before 20080929 splits large command strings into multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unknown vectors, probably involving a crafted ftp:// link to a tnftpd server.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://freshmeat.net/projects/tnftpd/?branch_id=14355&release_id=285654#; http://osvdb.org/48637; http://secunia.com/advisories/31958
CVE: CVE-2008-7017
Published: 2009-08-21
Description: Cross-site scripting (XSS) vulnerability in analyse.php in CAcert 20080921, and possibly other versions before 20080928, allows remote attackers to inject arbitrary web script or HTML via the CN (CommonName) field in the subject of an X.509 certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.cynops.de/advisories/AKLINK-SA-2008-007.txt; http://www.securityfocus.com/bid/31481; https://exchange.xforce.ibmcloud.com/vulnerabilities/45515