deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6499
Published: 2009-03-20
Description: security/xamppsecurity.php in XAMPP 1.6.8 performs an extract operation on the SERVER superglobal array, which allows remote attackers to spoof critical variables, as demonstrated by setting the REMOTE_ADDR variable to 127.0.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/47202; https://www.exploit-db.com/exploits/7384; https://exchange.xforce.ibmcloud.com/vulnerabilities/47202
CVE: CVE-2009-1022
Published: 2009-03-20
Description: Heap-based buffer overflow in the Preview/ Set Segment function in Gretech GOMlab GOM Encoder 1.0.0.11 and earlier allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a long text field in a subtitle (.srt) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/52677; http://secunia.com/advisories/34314; http://security.bkis.vn/?p=352
CVE: CVE-2009-1023
Published: 2009-03-20
Description: SQL injection vulnerability in index.php in phpComasy 0.9.1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52817; http://www.securityfocus.com/bid/34131; http://www.vupen.com/english/advisories/2009/0734
CVE: CVE-2009-1024
Published: 2009-03-20
Description: Multiple SQL injection vulnerabilities in Beerwin PHPLinkAdmin 1.0 allow remote attackers to execute arbitrary SQL commands via the linkid parameter to edlink.php, and unspecified other vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52778; http://secunia.com/advisories/34323; http://www.securityfocus.com/bid/34129
CVE: CVE-2009-1025
Published: 2009-03-20
Description: PHP remote file inclusion vulnerability in linkadmin.php in Beerwin PHPLinkAdmin 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/52779; http://secunia.com/advisories/34323; http://www.securityfocus.com/bid/34129
CVE: CVE-2009-1026
Published: 2009-03-20
Description: Multiple SQL injection vulnerabilities in login.php in Kim Websites 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/34116; http://www.vupen.com/english/advisories/2009/0732; https://exchange.xforce.ibmcloud.com/vulnerabilities/49259
CVE: CVE-2009-1027
Published: 2009-03-20
Description: SQL injection vulnerability in OpenCart 1.1.8 allows remote attackers to execute arbitrary SQL commands via the order parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34313; http://www.ngenuity.org/wordpress/2009/03/10/ngenuity-2009-005-opencart-order-by-blind-sql-injection/; http://www.securityfocus.com/archive/1/501843/100/0/threaded
CVE: CVE-2009-1028
Published: 2009-03-20
Description: Stack-based buffer overflow in ediSys eZip Wizard 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/39169; http://securityreason.com/securityalert/8217; http://www.securityfocus.com/bid/34044
CVE: CVE-2009-1029
Published: 2009-03-20
Description: Stack-based buffer overflow in POP Peeper 3.4.0.0 and earlier allows remote POP3 servers to execute arbitrary code via a long Date header, related to Imap.dll.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34077; http://www.krakowlabs.com/res/adv/KL0309ADV-poppeeper_date-bof.txt; http://www.securityfocus.com/archive/1/501701/100/0/threaded
CVE: CVE-2009-1030
Published: 2009-03-20
Description: Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4732&w=2; http://www.securityfocus.com/archive/1/501667/100/0/threaded; http://www.securityfocus.com/bid/34075
CVE: CVE-2009-1031
Published: 2009-03-20
Description: Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows remote attackers to create arbitrary directories via a \.. (backslash dot dot) in an MKD request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://osvdb.org/52773; http://secunia.com/advisories/34329; http://www.securityfocus.com/bid/34125
CVE: CVE-2008-6500
Published: 2009-03-20
Description: Cross-site scripting (XSS) vulnerability in CodeToad ASP Shopping Cart Script allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0812-exploits/aspshoppingcart-xss.txt; http://www.securityfocus.com/bid/32568; https://exchange.xforce.ibmcloud.com/vulnerabilities/47003
CVE: CVE-2008-6501
Published: 2009-03-20
Description: Cross-site scripting (XSS) vulnerability in profiles/index.php in Pro Chat Rooms 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the gud parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/50696; http://secunia.com/advisories/33088; http://www.securityfocus.com/bid/32758
CVE: CVE-2008-6502
Published: 2009-03-20
Description: Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local PHP script as an avatar via a .. (dot dot) in the avatar parameter, and cause other users to execute this script by using sendData.php to send a message to (1) an individual user or (2) a room, leading to cross-site request forgery (CSRF), cross-site scripting (XSS), or other impacts.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/50697; http://secunia.com/advisories/33088; https://exchange.xforce.ibmcloud.com/vulnerabilities/47242
CVE: CVE-2008-6503
Published: 2009-03-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in PrestaShop 1.1.0.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin/login.php and (2) order.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/498994/100/100/threaded; http://www.securityfocus.com/bid/32689; https://exchange.xforce.ibmcloud.com/vulnerabilities/47158
CVE: CVE-2009-1032
Published: 2009-03-20
Description: SQL injection vulnerability in gallery_list.php in YABSoft Advanced Image Hosting (AIH) Script 2.3 allows remote attackers to execute arbitrary SQL commands via the gal parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52813; http://secunia.com/advisories/34366; http://www.securityfocus.com/bid/34176
CVE: CVE-2009-1033
Published: 2009-03-20
Description: SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the qorder parameter, a different vector than CVE-2005-2989 and CVE-2006-2503.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52788; http://secunia.com/advisories/34365; http://www.securityfocus.com/bid/34174
CVE: CVE-2009-1034
Published: 2009-03-20
Description: SQL injection vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via values in the URI.
CVSS Score: 10.0 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/406316; http://secunia.com/advisories/34376; http://www.osvdb.org/52781
CVE: CVE-2009-1035
Published: 2009-03-20
Description: Cross-site scripting (XSS) vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via Cascading Style Sheets (CSS).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/406316; http://osvdb.org/52782; http://secunia.com/advisories/34376
CVE: CVE-2009-1036
Published: 2009-03-20
Description: Cross-site request forgery (CSRF) vulnerability in the Plus 1 module before 6.x-2.6, a module for Drupal, allows remote attackers to cast votes for content via unspecified aspects of the URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/405672; http://drupal.org/node/406314; http://osvdb.org/52786
CVE: CVE-2009-1037
Published: 2009-03-20
Description: Unspecified vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to send unlimited spam messages via unknown vectors related to the flood control API.
CVSS Score: 5.0 (MEDIUM)
References: http://drupal.org/node/406516; http://osvdb.org/52785; http://secunia.com/advisories/34374
CVE: CVE-2009-1038
Published: 2009-03-20
Description: Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) image_id parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the (2) user parameter in a modif action to admin/index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/52761; http://osvdb.org/52762; http://www.securityfocus.com/bid/34274
CVE: CVE-2009-1039
Published: 2009-03-20
Description: Buffer overflow in CDex 1.70b2 allows remote attackers to execute arbitrary code via a crafted Info header in an Ogg Vorbis (.ogg) file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/52812; http://retrogod.altervista.org/9sg_cdex_ogg.html; http://www.securityfocus.com/archive/1/501928/100/0/threaded
CVE: CVE-2009-1040
Published: 2009-03-20
Description: Buffer overflow in WinAsm Studio 5.1.5.0 allows user-assisted remote attackers to execute arbitrary code via a crafted project (.wap) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/52776; http://secunia.com/advisories/34309; http://www.securityfocus.com/bid/34132
CVE: CVE-2008-6504
Published: 2009-03-23
Description: ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://fisheye6.atlassian.com/cru/CR-9/; http://issues.apache.org/struts/browse/WW-2692; http://jira.opensymphony.com/browse/XW-641
CVE: CVE-2008-6505
Published: 2009-03-23
Description: Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://issues.apache.org/struts/browse/WW-2779; http://osvdb.org/49733; http://osvdb.org/49734
CVE: CVE-2009-0581
Published: 2009-03-23
Description: Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://scary.beasts.org/security/CESA-2009-003.html; http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html
CVE: CVE-2009-0723
Published: 2009-03-23
Description: Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://scary.beasts.org/security/CESA-2009-003.html; http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html
CVE: CVE-2009-0733
Published: 2009-03-23
Description: Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUT_A2B and ReadLUT_B2A functions.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://scary.beasts.org/security/CESA-2009-003.html; http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html
CVE: CVE-2009-1042
Published: 2009-03-23
Description: Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
CVSS Score: 9.3 (HIGH)
References: http://blogs.zdnet.com/security/?p=2934; http://cansecwest.com/index.html; http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009
CVE: CVE-2009-1043
Published: 2009-03-23
Description: Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
CVSS Score: 10.0 (HIGH)
References: http://blogs.zdnet.com/security/?p=2934; http://cansecwest.com/index.html; http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009
CVE: CVE-2009-1044
Published: 2009-03-23
Description: Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blogs.zdnet.com/security/?p=2934; http://blogs.zdnet.com/security/?p=2941; http://cansecwest.com/index.html
CVE: CVE-2008-6506
Published: 2009-03-23
Description: Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33166; http://www.openwall.com/lists/oss-security/2009/02/06/2; http://www.osvdb.org/50806
CVE: CVE-2008-6507
Published: 2009-03-23
Description: Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts for a private message that quotes a post in a password-protected forum.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/33166; http://www.openwall.com/lists/oss-security/2009/02/06/2; http://www.osvdb.org/50806
CVE: CVE-2009-1045
Published: 2009-03-23
Description: requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via a long input argument in an in_play action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=262708; http://www.openwall.com/lists/oss-security/2009/03/17/4; http://www.securityfocus.com/bid/34126
CVE: CVE-2009-1046
Published: 2009-03-23
Description: The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://lists.openwall.net/linux-kernel/2009/01/30/333; http://lists.openwall.net/linux-kernel/2009/02/02/364; http://secunia.com/advisories/34917
CVE: CVE-2008-6508
Published: 2009-03-23
Description: Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/49663; http://secunia.com/advisories/32478; http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
CVE: CVE-2008-6509
Published: 2009-03-23
Description: SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-log-summary.jsp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51912; http://secunia.com/advisories/32478; http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
CVE: CVE-2008-6510
Published: 2009-03-23
Description: Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt; http://www.igniterealtime.org/issues/browse/JM-629; http://www.securityfocus.com/archive/1/498162/100/0/threaded
CVE: CVE-2008-6511
Published: 2009-03-23
Description: Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt; http://www.securityfocus.com/archive/1/498162/100/0/threaded; https://www.exploit-db.com/exploits/7075
CVE: CVE-2009-0583
Published: 2009-03-23
Description: Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=261087; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://secunia.com/advisories/34266
CVE: CVE-2009-0584
Published: 2009-03-23
Description: icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=261087; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://osvdb.org/52988
CVE: CVE-2009-1047
Published: 2009-03-23
Description: Cross-site scripting (XSS) vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via vectors involving outbound HTML e-mail.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/406516; http://osvdb.org/52852; http://drupal.org/node/406516
CVE: CVE-2008-6512
Published: 2009-03-24
Description: Cross-domain vulnerability in the WorkerPool API in Google Gears before 0.5.4.2 allows remote attackers to bypass the Same Origin Policy and the intended access restrictions of the allowCrossOrigin function by hosting an assumed-safe file type containing Google Gear commands on the target domain, then accessing that file from the attacking domain, whose response headers are not checked and cause the worker code to run in the target domain.
CVSS Score: 6.8 (MEDIUM)
References: http://blog.watchfire.com/wfblog/2008/12/breaking-google-gears-cross-origin-communication-model.html; http://code.google.com/apis/gears/upcoming/api_workerpool.html#cross_origin; http://lists.grok.org.uk/pipermail/full-disclosure/2008-December/066291.html
CVE: CVE-2008-6513
Published: 2009-03-24
Description: Unrestricted file upload vulnerability in saa.php in Andy's PHP Knowledgebase (aphpkb) 0.92.9 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a link that is listed by authors.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/34476; http://sourceforge.net/project/shownotes.php?group_id=113755&release_id=667918; http://www.securityfocus.com/bid/32559
CVE: CVE-2008-6514
Published: 2009-03-24
Description: The Expo plugin in Compiz Fusion 0.7.8 allows local users with physical access to drag the screen saver aside and access the locked desktop by using Expo mouse shortcuts, a related issue to CVE-2007-3920.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://bugzilla.gnome.org/show_bug.cgi?id=561567; http://gitweb.compiz-fusion.org/?p=fusion/plugins/expo%3Ba=commit%3Bh=f97a9fa6f0ad578f674d1f248bd7bef90e3260e0; http://secunia.com/advisories/33077
CVE: CVE-2008-6515
Published: 2009-03-24
Description: Cross-site scripting (XSS) vulnerability in Fritz Berger yet another php photo album - next generation (yappa-ng) allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0812-exploits/yappang-xss.txt; http://www.securityfocus.com/bid/32623; https://exchange.xforce.ibmcloud.com/vulnerabilities/49494
CVE: CVE-2009-1049
Published: 2009-03-24
Description: SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52839; http://secunia.com/advisories/34395; http://www.securityfocus.com/bid/34187
CVE: CVE-2009-1050
Published: 2009-03-24
Description: Bloginator 1A allows remote attackers to bypass authentication and gain administrative access by setting the identifyYourself cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/52838; http://secunia.com/advisories/34395; http://www.securityfocus.com/bid/34187
CVE: CVE-2009-1051
Published: 2009-03-24
Description: FubarForum 1.6 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for user.tsv.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://e-rdc.org/v1/news.php?readmore=131; http://secunia.com/advisories/34358; http://www.securityfocus.com/archive/1/501902/100/0/threaded