deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1016
Published: 2010-03-19
Description: SQL injection vulnerability in the SAV Filter Selectors (sav_filter_selectors) extension before 1.0.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/sav_filter_selectors/1.0.5/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38804
CVE: CVE-2010-1017
Published: 2010-03-19
Description: SQL injection vulnerability in the SAV Filter Months (sav_filter_months) extension before 1.0.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63035; http://secunia.com/advisories/38994; http://typo3.org/extensions/repository/view/sav_filter_months/1.0.5/
CVE: CVE-2010-1018
Published: 2010-03-19
Description: SQL injection vulnerability in the Book Reviews (sk_bookreview) extension 0.0.12 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38803; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1019
Published: 2010-03-19
Description: SQL injection vulnerability in the Simple Gallery (sk_simplegallery) extension 0.0.9 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38796; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1020
Published: 2010-03-19
Description: Cross-site scripting (XSS) vulnerability in the Simple Gallery (sk_simplegallery) extension 0.0.9 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38796; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1021
Published: 2010-03-19
Description: Cross-site scripting (XSS) vulnerability in the Typo3 Quixplorer (t3quixplorer) extension before 1.7.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/63036; http://secunia.com/advisories/38993; http://typo3.org/extensions/repository/view/t3quixplorer/1.7.1/
CVE: CVE-2010-1022
Published: 2010-03-19
Description: The TYPO3 Security - Salted user password hashes (t3sec_saltedpw) extension before 0.2.13 for TYPO3 allows remote attackers to bypass authentication via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/38992; http://typo3.org/extensions/repository/view/t3sec_saltedpw/0.2.13/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1023
Published: 2010-03-19
Description: Cross-site scripting (XSS) vulnerability in the UserTask Center, Recent (taskcenter_recent) extension 0.1.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/63037; http://secunia.com/advisories/38985; http://typo3.org/extensions/repository/view/taskcenter_recent/0.2.0/
CVE: CVE-2010-1024
Published: 2010-03-19
Description: SQL injection vulnerability in the TGM-Newsletter (tgm_newsletter) extension 0.0.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/tgm_newsletter/0.0.3/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38805
CVE: CVE-2010-1025
Published: 2010-03-19
Description: Cross-site scripting (XSS) vulnerability in the TGM-Newsletter (tgm_newsletter) extension 0.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/extensions/repository/view/tgm_newsletter/0.0.3/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38805
CVE: CVE-2010-1026
Published: 2010-03-19
Description: SQL injection vulnerability in the CleanDB - DBAL (tmsw_cleandb) extension 2.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38800; https://exchange.xforce.ibmcloud.com/vulnerabilities/56979
CVE: CVE-2010-1027
Published: 2010-03-19
Description: SQL injection vulnerability in the Meet Travelmates (travelmate) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38802; https://exchange.xforce.ibmcloud.com/vulnerabilities/56980
CVE: CVE-2009-4271
Published: 2010-03-19
Description: The Linux kernel 2.6.9 through 2.6.17 on the x86_64 and amd64 platforms allows local users to cause a denial of service (panic) via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object (VDSO) page and then triggers a segmentation fault.
CVSS Score: 4.7 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2010/03/17/1; https://bugzilla.redhat.com/show_bug.cgi?id=548876; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10248
CVE: CVE-2010-0008
Published: 2010-03-19
Description: The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ece25dfa0991f65c4e1d26beb1c3c45bda4239b8; http://secunia.com/advisories/39295; http://secunia.com/advisories/43315
CVE: CVE-2010-0465
Published: 2010-03-19
Description: Cross-site scripting (XSS) vulnerability in the online Documents functionality in SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a allows remote authenticated users to inject arbitrary web script or HTML via the Document Name field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38962; http://www.securityfocus.com/archive/1/510116/100/0/threaded; http://www.securityfocus.com/bid/38772
CVE: CVE-2010-0732
Published: 2010-03-19
Description: gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://ftp.gnome.org/pub/gnome/sources/gtk+/2.18/gtk+-2.18.5.news; http://git.gnome.org/browse/gnome-screensaver/commit/?h=gnome-2-28&id=98f8a22412cf388217fd5b88915eadd274d68520; http://git.gnome.org/browse/gnome-screensaver/commit/?id=ab08cc93f2dc6223c8c00bfa1ca4f2d89069dbe0
CVE: CVE-2010-0733
Published: 2010-03-19
Description: Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size calculations.
CVSS Score: 3.5 (LOW)
CWE: CWE-189
References: http://archives.postgresql.org/pgsql-bugs/2009-10/msg00277.php; http://archives.postgresql.org/pgsql-bugs/2009-10/msg00287.php; http://archives.postgresql.org/pgsql-bugs/2009-10/msg00289.php
CVE: CVE-2010-0734
Published: 2010-03-19
Description: content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://curl.haxx.se/docs/adv_20100209.html; http://curl.haxx.se/docs/security.html#20100209; http://curl.haxx.se/libcurl-contentencoding.patch
CVE: CVE-2010-0736
Published: 2010-03-19
Description: Cross-site scripting (XSS) vulnerability in the view_queryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via "user-provided input."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2313&r2=2342&pathrev=HEAD; http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2326; http://www.openwall.com/lists/oss-security/2010/03/10/8
CVE: CVE-2010-0688
Published: 2010-03-19
Description: Stack-based buffer overflow in Orbital Viewer 1.04 allows user-assisted remote attackers to execute arbitrary code via a crafted (1) .orb or (2) .ov file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/38720; http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-011-orbital-viewer-orb-buffer-overflow/; http://www.exploit-db.com/exploits/13940
CVE: CVE-2010-1003
Published: 2010-03-19
Description: Directory traversal vulnerability in www/editor/tiny_mce/langs/language.php in eFront 3.5.x through 3.5.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langname parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://forum.efrontlearning.net/viewtopic.php?f=15&t=1945; http://osvdb.org/63028; http://www.coresecurity.com/content/efront-php-file-inclusion
CVE: CVE-2010-1028
Published: 2010-03-19
Description: Integer overflow in the decompression functionality in the Web Open Fonts Format (WOFF) decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow, as demonstrated by the vd_ff module in VulnDisco 9.0.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://blog.mozilla.com/security/2010/02/22/secunia-advisory-sa38608/; http://blog.mozilla.com/security/2010/03/18/update-on-secunia-advisory-sa38608/; http://blog.psi2.de/en/2010/02/20/going-commercial-with-firefox-vulnerabilities/
CVE: CVE-2010-1029
Published: 2010-03-19
Description: Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Safari 4.0.4, Apple Safari on iPhone OS and iPhone OS for iPod touch, and Google Chrome 4.0.249, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a STYLE element composed of a large number of *> sequences.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/43068; http://www.exploit-db.com/exploits/11567
CVE: CVE-2009-3385
Published: 2010-03-23
Description: The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content, which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message, as demonstrated by a Flash object that sends arbitrary local files during a reply or forward operation.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://secunia.com/advisories/39001; http://www.mozilla.org/security/announce/2010/mfsa2010-06.html
CVE: CVE-2010-0161
Published: 2010-03-23
Description: The nsAuthSSPI::Unwrap function in extensions/auth/nsAuthSSPI.cpp in Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 on Windows Vista, Windows Server 2008 R2, and Windows 7 allows remote SMTP, IMAP, and POP servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via crafted data in a session that uses SSPI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://secunia.com/advisories/39001; http://www.mozilla.org/security/announce/2010/mfsa2010-07.html
CVE: CVE-2010-0163
Published: 2010-03-23
Description: Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted message, related to message indexing.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://secunia.com/advisories/38977; http://secunia.com/advisories/39001
CVE: CVE-2010-1041
Published: 2010-03-23
Description: Unspecified vulnerability in the single sign-on functionality in the Web Services implementation in IBM DB2 Content Manager (CM) Toolkit 8.3 before FP13 on z/OS and DB2 Information Integrator for Content 8.3 before FP13 has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/39025; http://securitytracker.com/id?1023726; http://www-01.ibm.com/support/docview.wss?uid=isg1PM03804
CVE: CVE-2010-1042
Published: 2010-03-23
Description: Microsoft Windows Media Player 11 does not properly perform colorspace conversion, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .AVI file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/38790; https://exchange.xforce.ibmcloud.com/vulnerabilities/57205; http://www.securityfocus.com/bid/38790
CVE: CVE-2010-1043
Published: 2010-03-23
Description: Directory traversal vulnerability in index.php in jaxCMS 1.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/62161; http://secunia.com/advisories/38524; http://www.exploit-db.com/exploits/11359
CVE: CVE-2010-1044
Published: 2010-03-23
Description: SQL injection vulnerability in Login.do in ManageEngine OpUtils 5.0 allows remote attackers to execute arbitrary SQL commands via the isHttpPort parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/oputils_5-sql.txt; http://www.exploit-db.com/exploits/11330; http://www.securityfocus.com/bid/38082
CVE: CVE-2010-1045
Published: 2010-03-23
Description: SQL injection vulnerability in the Productbook (com_productbook) component 1.0.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/38466; http://www.exploit-db.com/exploits/11352; http://www.vupen.com/english/advisories/2010/0322
CVE: CVE-2010-1046
Published: 2010-03-23
Description: Multiple SQL injection vulnerabilities in index.php in Rostermain 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) userid (username) and (2) password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62162; http://secunia.com/advisories/38440; http://www.exploit-db.com/exploits/11356
CVE: CVE-2010-1047
Published: 2010-03-23
Description: SQL injection vulnerability in index.php in MASA2EL Music City 1.0 and 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in a singer action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62133; http://packetstormsecurity.org/1002-exploits/masa2elmc-sql.txt; http://secunia.com/advisories/38469
CVE: CVE-2010-1048
Published: 2010-03-23
Description: Cross-site scripting (XSS) vulnerability in blog/index.php in Uiga Business Portal allows remote attackers to inject arbitrary web script or HTML via the textcomment parameter (aka the Comment Box) in a noentryid action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38430; http://www.exploit-db.com/exploits/11357; http://www.vupen.com/english/advisories/2010/0317
CVE: CVE-2010-1049
Published: 2010-03-23
Description: Multiple SQL injection vulnerabilities in Uiga Business Portal allow remote attackers to execute arbitrary SQL commands via the (1) noentryid parameter to blog/index.php and the (2) p parameter to index2.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/38430; http://www.exploit-db.com/exploits/11357; http://www.vupen.com/english/advisories/2010/0317
CVE: CVE-2010-1050
Published: 2010-03-23
Description: SQL injection vulnerability in index.php in AudiStat 1.3 allows remote attackers to execute arbitrary SQL commands via the mday parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/audistats-sql.txt; http://secunia.com/advisories/38494; http://www.exploit-db.com/exploits/11334
CVE: CVE-2010-1051
Published: 2010-03-23
Description: Multiple SQL injection vulnerabilities in index.php in AudiStat 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) year and (2) month parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/38494; http://secunia.com/advisories/38494
CVE: CVE-2010-1052
Published: 2010-03-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in AudiStat 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) year and (2) mday parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38494; http://secunia.com/advisories/38494
CVE: CVE-2010-1053
Published: 2010-03-23
Description: Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to (a) userlogin.php and (b) managerlogin.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/38471; http://www.exploit-db.com/exploits/11345; https://exchange.xforce.ibmcloud.com/vulnerabilities/56146
CVE: CVE-2010-1054
Published: 2010-03-23
Description: Multiple SQL injection vulnerabilities in ParsCMS allow remote attackers to execute arbitrary SQL commands via the RP parameter to (1) fa_default.asp and (2) en_default.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62999; http://osvdb.org/63000; http://packetstormsecurity.org/1003-exploits/parscms-sql.txt
CVE: CVE-2010-1055
Published: 2010-03-23
Description: Multiple PHP remote file inclusion vulnerabilities in osDate 2.1.9 and 2.5.4, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the config[forum_installed] parameter to (1) forum/adminLogin.php and (2) forum/userLogin.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://evilc0de.blogspot.com/2010/03/osdate-rfi-vuln.html; http://osvdb.org/63005; http://osvdb.org/63006
CVE: CVE-2010-1056
Published: 2010-03-23
Description: Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/62972; http://packetstormsecurity.org/1003-exploits/joomlarokdownloads-lfi.txt; http://secunia.com/advisories/38982
CVE: CVE-2010-1057
Published: 2010-03-23
Description: Multiple directory traversal vulnerabilities in Phpkobo AdFreely (aka Ad Board Script) 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a ..// (dot dot slash slash) in the LANG_CODE parameter to common.inc.php in (1) codelib/cfg/, (2) codelib/sys/, (3) staff/, and (4) staff/app/; and (5) staff/file.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/62926; http://secunia.com/advisories/38947; http://www.exploit-db.com/exploits/11722
CVE: CVE-2010-1058
Published: 2010-03-23
Description: Directory traversal vulnerability in codelib/cfg/common.inc.php in Phpkobo Address Book Script 1.09, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG_CODE parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63003; http://packetstormsecurity.org/1003-exploits/addressbookscript-lfi.txt; http://secunia.com/advisories/38938
CVE: CVE-2010-1059
Published: 2010-03-23
Description: Directory traversal vulnerability in staff/app/common.inc.php in Phpkobo Address Book Script 1.09, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the LANG_CODE parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63004; http://secunia.com/advisories/38938; http://www.securityfocus.com/bid/38731
CVE: CVE-2010-1060
Published: 2010-03-23
Description: Directory traversal vulnerability in staff/app/common.inc.php in Phpkobo Short URL 1.01, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG_CODE parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1003-exploits/shorturl-lfi.txt; http://secunia.com/advisories/38968; http://www.exploit-db.com/exploits/11775
CVE: CVE-2010-1061
Published: 2010-03-23
Description: Multiple directory traversal vulnerabilities in Phpkobo Short URL 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the LANG_CODE parameter to (1) url/app/common.inc.php and (2) codelib/cfg/common.inc.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/38968; http://www.securityfocus.com/bid/38731; http://secunia.com/advisories/38968