deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-7235
Published: 2009-09-14
Description: Unspecified vulnerability in the Oracle Forms component in Oracle Application Server 10.1.2.2 and E-Business Suite 12.0.3 allows remote attackers to affect integrity via unknown vectors, aka AS04.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-7236
Published: 2009-09-14
Description: Unspecified vulnerability in the Oracle JDeveloper component in Oracle Application Server 10.1.2.2 and 10.1.3.1 allows remote attackers to affect integrity via unknown vectors, aka AS05.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-7237
Published: 2009-09-14
Description: Unspecified vulnerability in the Oracle Internet Directory component in Oracle Application Server 9.0.4.3 and 10.1.2.2 allows remote authenticated users to affect confidentiality via unknown vectors, aka AS06.
CVSS Score: 4.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-7238
Published: 2009-09-14
Description: Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.3 allow (1) local users to affect confidentiality and integrity via unknown vectors related to the Mobile Application Server component (APP01); (2) remote attackers to affect confidentiality via unknown vectors related to the Oracle Applications Framework (APP03); remote authenticated users to affect confidentiality and integrity via unknown vectors related to the (3) CRM Technical Foundation (APP05) and (4) Oracle Application Object Library (APP06); and remote authenticated users to affect integrity and availability via unknown vectors related to (5) Oracle Applications Technology Stack (APP07).
CVSS Score: 6.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2008-7239
Published: 2009-09-14
Description: Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 allow remote attackers to affect confidentiality via unknown vectors related to the (1) Oracle Application Object Library (APP02) and (2) Oracle Applications Manager (APP04).
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3005&w=2; http://secunia.com/advisories/28518; http://secunia.com/advisories/28556
CVE: CVE-2009-2803
Published: 2009-09-14
Description: CarbonCore in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a file with a crafted resource fork.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/57948; http://secunia.com/advisories/36701
CVE: CVE-2009-2804
Published: 2009-09-14
Description: Integer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5.8, and Safari before 4.0.4 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ColorSync profile embedded in an image, leading to a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/57949
CVE: CVE-2009-2805
Published: 2009-09-14
Description: Integer overflow in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JBIG2 stream in a PDF file, leading to a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/57950; http://secunia.com/advisories/36701
CVE: CVE-2009-2807
Published: 2009-09-14
Description: Heap-based buffer overflow in the USB backend in CUPS in Apple Mac OS X 10.5.8 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/57951; http://secunia.com/advisories/36701
CVE: CVE-2009-2809
Published: 2009-09-14
Description: ImageIO in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PixarFilm encoded TIFF image, related to "multiple memory corruption issues."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/57952; http://secunia.com/advisories/36701
CVE: CVE-2009-2811
Published: 2009-09-14
Description: Incomplete blacklist vulnerability in Launch Services in Apple Mac OS X 10.5.8 allows user-assisted remote attackers to execute arbitrary code via a .fileloc file, which does not trigger a "potentially unsafe" warning message in the Quarantine feature.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/57953; http://secunia.com/advisories/36701
CVE: CVE-2009-2812
Published: 2009-09-14
Description: Launch Services in Apple Mac OS X 10.5.8 does not properly recognize an unsafe Uniform Type Identifier (UTI) in an exported document type in a downloaded application, which allows remote attackers to trigger the automatic opening of a file, and execute arbitrary code, via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/57954; http://secunia.com/advisories/36701
CVE: CVE-2009-2813
Published: 2009-09-14
Description: Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3071&w=2
CVE: CVE-2009-2814
Published: 2009-09-14
Description: Cross-site scripting (XSS) vulnerability in the Wiki Server in Apple Mac OS X 10.5.8 allows remote attackers to inject arbitrary web script or HTML via a search request containing data that does not use UTF-8 encoding.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://osvdb.org/57956; http://secunia.com/advisories/36701
CVE: CVE-2009-2947
Published: 2009-09-14
Description: Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html; http://secunia.com/advisories/36674; http://secunia.com/advisories/36693
CVE: CVE-2009-3183
Published: 2009-09-14
Description: Heap-based buffer overflow in w in Sun Solaris 8 through 10, and OpenSolaris before snv_124, allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://osvdb.org/58110; http://sunsolve.sun.com/search/document.do?assetkey=1-21-113718-04-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-266348-1
CVE: CVE-2009-3184
Published: 2009-09-15
Description: Multiple SQL injection vulnerabilities in index.php in Pirates of The Caribbean in the E-Gold Game Series allow remote attackers to execute arbitrary SQL commands via the (1) x and (2) y parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0908-exploits/egoldgame-sql.txt; http://secunia.com/advisories/36488; http://www.vupen.com/english/advisories/2009/2442
CVE: CVE-2009-3185
Published: 2009-09-15
Description: SQL injection vulnerability in plugin.php in the Crazy Star plugin 2.0 for Discuz! allows remote authenticated users to execute arbitrary SQL commands via the fmid parameter in a view action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9529; http://www.vupen.com/english/advisories/2009/2432; http://www.exploit-db.com/exploits/9529
CVE: CVE-2009-3186
Published: 2009-09-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in VideoGirls BiZ allow remote attackers to inject arbitrary web script or HTML via the (1) t parameter to forum.php, (2) profile_name parameter to profile.php, and (3) p parameter to view.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/videogirls-xss.txt; http://secunia.com/advisories/36480; http://www.securityfocus.com/bid/36168
CVE: CVE-2009-3187
Published: 2009-09-15
Description: Cross-site scripting (XSS) vulnerability in gamelist.php in Stand Alone Arcade 1.1 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/saa-xss.txt; http://secunia.com/advisories/36481; http://www.vupen.com/english/advisories/2009/2438
CVE: CVE-2009-3188
Published: 2009-09-15
Description: PHP remote file inclusion vulnerability in save.php in phpSANE 0.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the file_save parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/36476; http://www.exploit-db.com/exploits/9533; http://www.vupen.com/english/advisories/2009/2436
CVE: CVE-2009-3189
Published: 2009-09-15
Description: Cross-site scripting (XSS) vulnerability in search.php in DigiOz Guestbook 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the search_term parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/digiozgb-xss.txt; http://secunia.com/advisories/36489; http://www.vupen.com/english/advisories/2009/2443
CVE: CVE-2009-3190
Published: 2009-09-15
Description: Multiple SQL injection vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to list.php and (2) cat parameter to rss.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9531; http://www.vupen.com/english/advisories/2009/2434; http://www.exploit-db.com/exploits/9531
CVE: CVE-2009-3191
Published: 2009-09-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to inject arbitrary web script or HTML via the cat parameter to (1) rss.php and (2) opml.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/9531; http://www.vupen.com/english/advisories/2009/2434; http://www.exploit-db.com/exploits/9531
CVE: CVE-2009-3192
Published: 2009-09-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in LinkorCMS 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the searchstr parameter in a search action; or the (2) nikname, (3) realname, (4) homepage, or (5) city parameter in a registration action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/linkorcms-xss.txt; http://secunia.com/advisories/36487; http://packetstormsecurity.org/0908-exploits/linkorcms-xss.txt
CVE: CVE-2009-3193
Published: 2009-09-15
Description: SQL injection vulnerability in the DigiFolio (com_digifolio) component 1.52 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a project action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9534; http://www.exploit-db.com/exploits/9534
CVE: CVE-2009-3194
Published: 2009-09-15
Description: Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech SearchFeed Script allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/searchfeed-xss.txt; http://secunia.com/advisories/36482; http://www.vupen.com/english/advisories/2009/2439
CVE: CVE-2009-3195
Published: 2009-09-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in JCE-Tech Auction RSS Content Script 3.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) rss.php and (2) search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/auctionrsscs-xss.txt; http://secunia.com/advisories/36490; http://www.vupen.com/english/advisories/2009/2444
CVE: CVE-2009-3196
Published: 2009-09-15
Description: Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech PHP Video Script allows remote attackers to inject arbitrary web script or HTML via the key parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/phpvideoyoutube-xss.txt; http://secunia.com/advisories/36483; http://www.vupen.com/english/advisories/2009/2440
CVE: CVE-2009-3197
Published: 2009-09-15
Description: Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech PHP Calendars Script allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/phpcalsearch-xss.txt; http://secunia.com/advisories/36484; http://www.vupen.com/english/advisories/2009/2441
CVE: CVE-2009-3198
Published: 2009-09-15
Description: Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech Affiliate Master Datafeed Parser Script 2.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/ams-xss.txt; http://secunia.com/advisories/36491; http://www.vupen.com/english/advisories/2009/2445
CVE: CVE-2009-3199
Published: 2009-09-15
Description: Uebimiau Webmail 3.2.0-2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database with usernames and password hashes via a direct request for system_admin/admin.ucf.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.exploit-db.com/exploits/9493; https://exchange.xforce.ibmcloud.com/vulnerabilities/52724; http://www.exploit-db.com/exploits/9493
CVE: CVE-2009-2201
Published: 2009-09-15
Description: The screensharing feature in the Admin application in Apple Xsan before 2.2 places a cleartext username and password in a URL within an error dialog, which allows physically proximate attackers to obtain credentials by reading this dialog.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00005.html; http://osvdb.org/58133; http://secunia.com/advisories/36673
CVE: CVE-2009-2629
Published: 2009-09-15
Description: Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://nginx.net/CHANGES; http://nginx.net/CHANGES-0.5; http://nginx.net/CHANGES-0.6
CVE: CVE-2009-2903
Published: 2009-09-15
Description: Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams.
CVSS Score: 7.1 (HIGH)
CWE: CWE-772
References: http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git%3Ba=commit%3Bh=ffcfb8db540ff879c2a85bf7e[PII_REDACTED]43414; http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html
CVE: CVE-2009-2945
Published: 2009-09-15
Description: weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/36640; http://webauth.stanford.edu/security/2009-09-10.html; http://secunia.com/advisories/36640
CVE: CVE-2009-3125
Published: 2009-09-15
Description: SQL injection vulnerability in the Bug.search WebService function in Bugzilla 3.3.2 through 3.4.1, and 3.5, allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36718; http://www.bugzilla.org/security/3.0.8/; http://www.securityfocus.com/bid/36371
CVE: CVE-2009-3165
Published: 2009-09-15
Description: SQL injection vulnerability in the Bug.create WebService function in Bugzilla 2.23.4 through 3.0.8, 3.1.1 through 3.2.4, and 3.3.1 through 3.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36718; http://www.bugzilla.org/security/3.0.8/; http://www.securityfocus.com/bid/36373
CVE: CVE-2009-3166
Published: 2009-09-15
Description: token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/36718; http://www.bugzilla.org/security/3.0.8/; http://www.securityfocus.com/bid/36372
CVE: CVE-2009-3201
Published: 2009-09-15
Description: Integer overflow in Media Player Classic 6.4.9 allows user-assisted remote attackers to cause a denial of service (application crash) via a MIDI file (.mid) with a malformed header, which triggers a buffer overflow, a different vulnerability than CVE-2007-4940.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://www.exploit-db.com/exploits/9620; http://www.securityfocus.com/bid/36333; http://www.exploit-db.com/exploits/9620
CVE: CVE-2009-3202
Published: 2009-09-16
Description: Cross-site scripting (XSS) vulnerability in search.php in ULoKI PHP Forum 2.1 allows remote attackers to inject arbitrary web script or HTML via the term parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57176; http://packetstormsecurity.org/0908-exploits/uloki-xss.txt; http://secunia.com/advisories/36407
CVE: CVE-2009-3203
Published: 2009-09-16
Description: SQL injection vulnerability in store.php in AJ Auction Pro OOPD 2.x allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/57159; http://packetstormsecurity.org/0908-exploits/ajauctionoopd2-sql.txt; http://secunia.com/advisories/36369
CVE: CVE-2009-3204
Published: 2009-09-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Stiva Forum 1.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) demo.php and (2) forum.php, and the PATH_INFO to (3) include_forum.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57177; http://osvdb.org/57178; http://packetstormsecurity.org/0908-exploits/stivaforum-xss.txt
CVE: CVE-2009-3205
Published: 2009-09-16
Description: SQL injection vulnerability in main.php in CBAuthority allows remote attackers to execute arbitrary SQL commands via the id parameter in a view_product action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/57161; http://packetstormsecurity.org/0908-exploits/cbauthority-sql.txt; http://secunia.com/advisories/36345
CVE: CVE-2009-3206
Published: 2009-09-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the ImageCache module 5.x before 5.x-2.5 and 6.x before 6.x-2.0-beta10, a module for Drupal, allow remote authenticated users, with "administer imagecache" permissions, to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/554084; http://secunia.com/advisories/36412; https://exchange.xforce.ibmcloud.com/vulnerabilities/52594
CVE: CVE-2009-3207
Published: 2009-09-16
Description: The ImageCache module 5.x before 5.x-2.5 and 6.x before 6.x-2.0-beta10, a module for Drupal, when the private file system is used, does not properly perform access control for derivative images, which allows remote attackers to view arbitrary images via a request that specifies an image's filename.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/505904; http://drupal.org/node/554084; http://drupal.org/node/554086
CVE: CVE-2009-3208
Published: 2009-09-16
Description: Multiple SQL injection vulnerabilities in phpfreeBB 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to permalink.php and (2) year parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0908-exploits/phpfreebb-sql.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/52550; http://packetstormsecurity.org/0908-exploits/phpfreebb-sql.txt
CVE: CVE-2009-3209
Published: 2009-09-16
Description: SQL injection vulnerability in remove.php in PHP eMail Manager 3.3.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/57171; http://packetstormsecurity.org/0908-exploits/phpem-sql.txt; http://secunia.com/advisories/36346
CVE: CVE-2009-3210
Published: 2009-09-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.8 and 6.x before 6.x-1.8, a module for Drupal, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/554326; http://drupal.org/node/554328; http://drupal.org/node/554448
CVE: CVE-2009-3211
Published: 2009-09-16
Description: Directory traversal vulnerability in VivaPrograms Infinity Script 2.x.x, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the options[style_dir] parameter to the default URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/0908-exploits/infinity-disclose.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/52555; http://packetstormsecurity.org/0908-exploits/infinity-disclose.txt
CVE: CVE-2009-3212
Published: 2009-09-16
Description: SQL injection vulnerability in VivaPrograms Infinity Script 2.x.x, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username field.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/0908-exploits/infinity-disclose.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/52559; http://packetstormsecurity.org/0908-exploits/infinity-disclose.txt