deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5732
Published: 2008-12-26
Description: Unrestricted file upload vulnerability in lib/image_upload.php in KafooeyBlog 1.55b allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/50876; http://secunia.com/advisories/33223; http://securityreason.com/securityalert/4812
CVE: CVE-2008-5733
Published: 2008-12-26
Description: SQL injection vulnerability in blog.php in the Team Impact TI Blog System mod for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51017; http://securityreason.com/securityalert/4814; http://www.securityfocus.com/archive/1/499583/100/0/threaded
CVE: CVE-2008-5734
Published: 2008-12-26
Description: Cross-site scripting (XSS) vulnerability in WebMail Pro in IceWarp Software Merak Mail Server 9.3.2 allows remote attackers to inject arbitrary web script or HTML via an IMG element in an HTML e-mail message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.vijatov.com/index.php?itemid=11; http://osvdb.org/50885; http://secunia.com/advisories/32770
CVE: CVE-2008-5735
Published: 2008-12-26
Description: Stack-based buffer overflow in skin.c in CoolPlayer 2.17 through 2.19 allows remote attackers to execute arbitrary code via a large PlaylistSkin value in a skin file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4813; http://www.bmgsec.com.au/advisory/43/; http://www.securityfocus.com/archive/1/499480/100/0/threaded
CVE: CVE-2008-5736
Published: 2008-12-26
Description: Multiple unspecified vulnerabilities in FreeBSD 6 before 6.4-STABLE, 6.3 before 6.3-RELEASE-p7, 6.4 before 6.4-RELEASE-p1, 7.0 before 7.0-RELEASE-p7, 7.1 before 7.1-RC2, and 7 before 7.1-PRERELEASE allow local users to gain privileges via unknown attack vectors related to function pointers that are "not properly initialized" for (1) netgraph sockets and (2) bluetooth sockets.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/50936; http://secunia.com/advisories/33209; http://security.freebsd.org/advisories/FreeBSD-SA-08:13.protosw.asc
CVE: CVE-2008-5737
Published: 2008-12-26
Description: SQL injection vulnerability in index.php in Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50892; http://secunia.com/advisories/33266; http://securityreason.com/securityalert/4815
CVE: CVE-2008-5738
Published: 2008-12-26
Description: Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the nodstrumCalendarV2 cookie to 1.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/50827; http://secunia.com/advisories/33214; http://securityreason.com/securityalert/4816
CVE: CVE-2008-5739
Published: 2008-12-26
Description: SQL injection vulnerability in evb/check_url.php in Pligg CMS 9.9.5 Beta allows remote attackers to execute arbitrary SQL commands via the url parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50913; http://securityreason.com/securityalert/4817; http://www.securityfocus.com/bid/32970
CVE: CVE-2008-5498
Published: 2008-12-26
Description: Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the bgd_color or clrBack argument) for an indexed image.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1360&r2=1.2027.2.547.2.1361&diff_format=u; http://downloads.securityfocus.com/vulnerabilities/exploits/33002-2.php; http://downloads.securityfocus.com/vulnerabilities/exploits/33002.php
CVE: CVE-2008-5742
Published: 2008-12-26
Description: Multiple open redirect vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the redirect parameter in a logoff action to modules/auth/index.php or (2) the url parameter to modules/linkmanager/redirect.php.  NOTE: this was reported within an "HTTP Response Splitting" section in the original disclosure.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-59
References: http://securityreason.com/securityalert/4819; http://www.securityfocus.com/bid/32992; https://www.exploit-db.com/exploits/7560
CVE: CVE-2008-5743
Published: 2008-12-26
Description: pdfjam creates the (1) pdf90, (2) pdfjoin, and (3) pdfnup files with a predictable name, which allows local users to overwrite arbitrary files via a symlink attack.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://secunia.com/advisories/33278; http://secunia.com/advisories/34312; http://www.openwall.com/lists/oss-security/2008/12/19/3
CVE: CVE-2008-5744
Published: 2008-12-26
Description: Array index error in the dahdi/tor2.c driver in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to an incorrect tor2 patch for CVE-2008-5396 that uses the wrong variable in a range check against the value of lc->sync.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://bugs.digium.com/view.php?id=13954#96700; http://secunia.com/advisories/32960; http://svn.digium.com/view/dahdi?view=rev&revision=5590
CVE: CVE-2008-4539
Published: 2008-12-29
Description: Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow.  NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://git.kernel.dk/?p=qemu.git%3Ba=commitdiff%3Bh=65d35a09979e63541afc5bfc595b9f1b1b4ae069; http://groups.google.com/group/linux.debian.changes.devel/msg/9e0dc008572f2867?dmode=source; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html
CVE: CVE-2008-5745
Published: 2008-12-29
Description: Integer overflow in quartz.dll in the DirectShow framework in Microsoft Windows Media Player (WMP) 9, 10, and 11, including 11.0.5721.5260, allows remote attackers to cause a denial of service (application crash) via a crafted (1) WAV, (2) SND, or (3) MID file. NOTE: this has been incorrectly reported as a code-execution vulnerability. NOTE: it is not clear whether this issue is related to CVE-2008-4927.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://securityreason.com/securityalert/4823; http://www.securityfocus.com/archive/1/499579/100/0/threaded; http://www.securityfocus.com/bid/33018
CVE: CVE-2008-5746
Published: 2008-12-29
Description: Sun SNMP Management Agent (SUNWmasf) 1.4u2 through 1.5.4 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on temporary files.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://osvdb.org/50987; http://secunia.com/advisories/33328; http://sunsolve.sun.com/search/document.do?assetkey=1-26-248646-1
CVE: CVE-2008-5747
Published: 2008-12-29
Description: F-Prot 4.6.8 for GNU/Linux allows remote attackers to bypass anti-virus protection via a crafted ELF program with a "corrupted" header that still allows the program to be executed.  NOTE: due to an error in the initial disclosure, F-secure was incorrectly stated as the vendor.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/34700; http://security.gentoo.org/glsa/glsa-200904-14.xml; http://securityreason.com/securityalert/4822
CVE: CVE-2008-5748
Published: 2008-12-29
Description: Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to read arbitrary files via the (1) lang, (2) theme, and (3) module parameters.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: http://osvdb.org/51006; http://secunia.com/advisories/33135; http://securityreason.com/securityalert/4820
CVE: CVE-2008-5749
Published: 2008-12-29
Description: Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attackers to execute arbitrary commands via the --renderer-path option in a chromehtml: URI.  NOTE: a third party disputes this issue, stating that Chrome "will ask for user permission" and "cannot launch the applet even [if] you have given out the permission.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://retrogod.altervista.org/9sg_chrome.html; http://securityreason.com/securityalert/4821; http://www.securityfocus.com/archive/1/499570/100/0/threaded
CVE: CVE-2008-5750
Published: 2008-12-29
Description: Argument injection vulnerability in Microsoft Internet Explorer 8 beta 2 on Windows XP SP3 allows remote attackers to execute arbitrary commands via the --renderer-path option in a chromehtml: URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://retrogod.altervista.org/9sg_chrome.html; http://securityreason.com/securityalert/4821; http://www.securityfocus.com/archive/1/499570/100/0/threaded
CVE: CVE-2008-5751
Published: 2008-12-30
Description: SQL injection vulnerability in index.php in AlstraSoft Web Email Script Enterprise (ESE) allows remote attackers to execute arbitrary SQL commands via the id parameter in a directory action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4824; http://www.securityfocus.com/bid/33033; https://www.exploit-db.com/exploits/7596
CVE: CVE-2008-5752
Published: 2008-12-30
Description: Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/50902; http://secunia.com/advisories/33274; http://securityreason.com/securityalert/4836
CVE: CVE-2008-5753
Published: 2008-12-30
Description: Stack-based buffer overflow in BulletProof FTP Client 2.63 and 2010 allows user-assisted attackers to execute arbitrary code via a bookmark file entry with a long host name, which appears as a host parameter within the quick-connect bar.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/50968; http://packetstormsecurity.com/files/131965/BulletProof-FTP-Client-2010-Buffer-Overflow.html; http://secunia.com/advisories/33322
CVE: CVE-2008-5754
Published: 2008-12-30
Description: Stack-based buffer overflow in BulletProof FTP Client allows user-assisted attackers to execute arbitrary code via a .bps file (aka Session-File) with a long second line, possibly a related issue to CVE-2008-5753.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/33024; https://www.exploit-db.com/exploits/7589; https://www.exploit-db.com/exploits/8420
CVE: CVE-2008-5755
Published: 2008-12-30
Description: Stack-based buffer overflow in IntelliTamper 2.07 and 2.08 allows remote attackers to execute arbitrary code via a MAP file containing a long URL, possibly a related issue to CVE-2006-2494.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4839; http://www.securityfocus.com/bid/33022; https://exchange.xforce.ibmcloud.com/vulnerabilities/47741
CVE: CVE-2008-5756
Published: 2008-12-30
Description: Buffer overflow in BreakPoint Software Hex Workshop 5.1.4 allows user-assisted attackers to cause a denial of service and possibly execute arbitrary code via a long mapping reference in a Color Mapping (.cmap) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33327; http://securityreason.com/securityalert/4838; http://www.securityfocus.com/bid/33023
CVE: CVE-2008-4270
Published: 2008-12-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-5416.  Reason: This candidate is a duplicate of CVE-2008-5416.  Notes: All CVE users should reference CVE-2008-5416 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-5757
Published: 2008-12-30
Description: Cross-site scripting (XSS) vulnerability in textarea/index.php in Textpattern (aka Txp CMS) 4.0.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Body parameter in an article action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/28793; http://www.securityfocus.com/archive/1/487483/100/200/threaded; http://www.securityfocus.com/bid/27606
CVE: CVE-2008-5758
Published: 2008-12-30
Description: Cross-site request forgery (CSRF) vulnerability in PHParanoid before 0.5 allows remote attackers to perform unspecified actions as authenticated users via unknown vectors related to private messages.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/28847; http://sourceforge.net/project/shownotes.php?release_id=575374; https://exchange.xforce.ibmcloud.com/vulnerabilities/47749
CVE: CVE-2008-5759
Published: 2008-12-30
Description: Cross-site scripting (XSS) vulnerability in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allows remote attackers to inject arbitrary web script or HTML via the name parameter in an updaterecord action to index.php in the 08_Files module.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33175; https://exchange.xforce.ibmcloud.com/vulnerabilities/47367; http://secunia.com/advisories/33175
CVE: CVE-2008-5760
Published: 2008-12-30
Description: Cross-site scripting (XSS) vulnerability in error413.php in Kerio MailServer before 6.6.2 allows remote attackers to inject arbitrary web script or HTML via the sent parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32955; http://www.kerio.com/kms_history.html; http://www.kerio.com/security_advisory.html
CVE: CVE-2008-5761
Published: 2008-12-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allow remote attackers to inject arbitrary web script or HTML via (1) the mod parameter to the default URI; (2) the foto parameter to photo.php in the 05_Foto module; or (3) the name parameter in an insertrecord action to index.php in the 08_Files module, as demonstrated by injection within a SRC attribute of an IFRAME element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33175; http://securityreason.com/securityalert/4825; http://www.securityfocus.com/bid/32826
CVE: CVE-2008-5762
Published: 2008-12-30
Description: Simple Text-File Login Script (SiTeFiLo) 1.0.6 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a direct request for slog_users.txt.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/50712; http://secunia.com/advisories/33110; http://securityreason.com/securityalert/4847
CVE: CVE-2008-5763
Published: 2008-12-30
Description: PHP remote file inclusion vulnerability in slogin_lib.inc.php in Simple Text-File Login Script (SiTeFiLo) 1.0.6 allows remote attackers to execute arbitrary PHP code via a URL in the slogin_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/50711; http://secunia.com/advisories/33110; http://www.securityfocus.com/bid/32811
CVE: CVE-2008-5764
Published: 2008-12-30
Description: PHP remote file inclusion vulnerability in calendar.php in WorkSimple 1.2.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/50726; http://secunia.com/advisories/33163; http://securityreason.com/securityalert/4831
CVE: CVE-2008-5765
Published: 2008-12-30
Description: WorkSimple 1.2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing usernames and passwords via a direct request for data/usr.txt.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/50725; http://secunia.com/advisories/33163; http://www.securityfocus.com/bid/32849
CVE: CVE-2008-5766
Published: 2008-12-30
Description: SQL injection vulnerability in download.php in Farsi Script Faupload allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4830; http://www.securityfocus.com/bid/32858; https://exchange.xforce.ibmcloud.com/vulnerabilities/47394
CVE: CVE-2008-5767
Published: 2008-12-30
Description: SQL injection vulnerability in authors.asp in gNews Publisher allows remote attackers to execute arbitrary SQL commands via the authorID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33118; http://securityreason.com/securityalert/4829; http://www.securityfocus.com/bid/32883
CVE: CVE-2008-5768
Published: 2008-12-30
Description: SQL injection vulnerability in print.php in the AM Events (aka Amevents) module 0.22 for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4854; http://www.securityfocus.com/bid/32848; https://exchange.xforce.ibmcloud.com/vulnerabilities/47360
CVE: CVE-2008-5769
Published: 2008-12-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Kerio MailServer before 6.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) folder parameter to mailCompose.php or the (2) daytime parameter to calendarEdit.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32955; http://www.kerio.com/kms_history.html; http://www.kerio.com/security_advisory.html
CVE: CVE-2008-5770
Published: 2008-12-30
Description: Cross-site scripting (XSS) vulnerability in config/make_config.php in PHP Weather 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33098; http://securityreason.com/securityalert/4826; http://www.securityfocus.com/bid/32820
CVE: CVE-2008-5771
Published: 2008-12-30
Description: Directory traversal vulnerability in test.php in PHP Weather 2.2.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/33098; http://securityreason.com/securityalert/4826; http://www.securityfocus.com/bid/32820
CVE: CVE-2008-5772
Published: 2008-12-30
Description: Multiple SQL injection vulnerabilities in ASPSiteWare RealtyListings 1.0 and 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) iType parameter to type.asp and the (2) iPro parameter to detail.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50707; http://osvdb.org/50708; http://secunia.com/advisories/33167
CVE: CVE-2008-5773
Published: 2008-12-30
Description: Nukedit 4.9.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing usernames and passwords via a direct request for database/dbsite.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33165; http://securityreason.com/securityalert/4840; https://www.exploit-db.com/exploits/7491
CVE: CVE-2008-5774
Published: 2008-12-30
Description: Multiple SQL injection vulnerabilities in ASPSiteWare HomeBuilder 1.0 and 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) iType parameter to (a) type.asp and (b) type2.asp and the (2) iPro parameter to (c) detail.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33172; http://www.securityfocus.com/bid/32812; https://exchange.xforce.ibmcloud.com/vulnerabilities/47319
CVE: CVE-2008-5775
Published: 2008-12-30
Description: SQL injection vulnerability in categories.php in Aperto Blog 0.1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4844; http://www.securityfocus.com/bid/32853; https://exchange.xforce.ibmcloud.com/vulnerabilities/47346
CVE: CVE-2008-5776
Published: 2008-12-30
Description: Multiple directory traversal vulnerabilities in Aperto Blog 0.1.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) action parameter to admin.php and the (2) get parameter to index.php.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/32850; https://www.exploit-db.com/exploits/7482; http://www.securityfocus.com/bid/32850
CVE: CVE-2008-5777
Published: 2008-12-30
Description: SQL injection vulnerability in index.php in CadeNix allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4832; http://www.securityfocus.com/bid/32846; https://exchange.xforce.ibmcloud.com/vulnerabilities/47344
CVE: CVE-2008-5778
Published: 2008-12-30
Description: SQL injection vulnerability in report.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute arbitrary SQL commands via the linkid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50724; http://secunia.com/advisories/33075; http://securityreason.com/securityalert/4852
CVE: CVE-2008-5779
Published: 2008-12-30
Description: SQL injection vulnerability in lpro.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50723; http://secunia.com/advisories/33075; http://securityreason.com/securityalert/4849
CVE: CVE-2008-5780
Published: 2008-12-30
Description: Forest Blog 1.3.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing passwords via a direct request for blog.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://securityreason.com/securityalert/4842; https://exchange.xforce.ibmcloud.com/vulnerabilities/47359; https://www.exploit-db.com/exploits/7466
CVE: CVE-2008-5781
Published: 2008-12-30
Description: SQL injection vulnerability in right.php in Cant Find A Gaming CMS (CFAGCMS) 1.0 Beta 1 allows remote attackers to execute arbitrary SQL commands via the title parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4850; http://www.securityfocus.com/bid/32851; https://exchange.xforce.ibmcloud.com/vulnerabilities/47358
CVE: CVE-2008-5782
Published: 2008-12-31
Description: SQL injection vulnerability in bannerclick.php in ZeeMatri 3.0 allows remote attackers to execute arbitrary SQL commands via the adid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4845; http://www.securityfocus.com/bid/32221; http://www.vupen.com/english/advisories/2008/3063