deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1293
Published: 2009-04-16
Description: The web login functionality (c/portal/login) in Novell Teaming 1.0 through SP3 (1.0.3) generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/34714; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7002997&sliceId=1&docTypeID=DT_TID_1_1&dialogID=33090060&stateId=1%200%[PII_REDACTED]; http://www.securityfocus.com/archive/1/502704/100/0/threaded
CVE: CVE-2009-1294
Published: 2009-04-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 (1.0.3) allow remote attackers to inject arbitrary web script or HTML via the (1) p_p_state or (2) p_p_mode parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34714; http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7002999&sliceId=1&docTypeID=DT_TID_1_1&dialogID=33090060&stateId=1%200%[PII_REDACTED]; http://www.securityfocus.com/archive/1/502704/100/0/threaded
CVE: CVE-2009-1300
Published: 2009-04-16
Description: apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=523213; http://secunia.com/advisories/34829; http://secunia.com/advisories/34832
CVE: CVE-2009-1301
Published: 2009-04-16
Description: Integer signedness error in the store_id3_text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via an ID3 tag with a negative encoding value.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=265342; http://secunia.com/advisories/34587; http://secunia.com/advisories/34748
CVE: CVE-2008-1107
Published: 2009-04-17
Description: Multiple stack-based buffer overflows in the Danske Bank e-Sec Control Module ActiveX control (DanskeSikker.ocx) 3.1.0.48, and possibly earlier versions, allow remote attackers to execute arbitrary code via long arguments to unspecified methods, which are not properly handled by a logging function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/53715; http://secunia.com/advisories/29635; http://secunia.com/secunia_research/2008-17/
CVE: CVE-2009-0946
Published: 2009-04-17
Description: Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5; http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5b; http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4e
CVE: CVE-2009-1314
Published: 2009-04-17
Description: body.asp in Web File Explorer 3.1 allows remote attackers to create arbitrary files and execute arbitrary code via the savefile action with a file parameter containing a filename that has an executable extension.
CVSS Score: 10.0 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/50389; https://www.exploit-db.com/exploits/8382; https://exchange.xforce.ibmcloud.com/vulnerabilities/50389
CVE: CVE-2008-6724
Published: 2009-04-17
Description: Cross-site scripting (XSS) vulnerability in index.pl in Perl Nopaste 1.0 allows remote attackers to inject arbitrary web script or HTML via the language parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51010; http://secunia.com/advisories/33251; http://sourceforge.net/project/shownotes.php?group_id=237095&release_id=649688
CVE: CVE-2008-6725
Published: 2009-04-17
Description: Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) index.php in a mythings page (mythings.php) and (2) the users page in admin.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/51118; http://secunia.com/advisories/33375; http://www.cmscout.co.za/index.php?page=news&id=30
CVE: CVE-2008-6726
Published: 2009-04-17
Description: Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bit parameter to (1) admin.php and (2) index.php, different vectors than CVE-2008-3415.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/51119; http://osvdb.org/51120; http://secunia.com/advisories/33375
CVE: CVE-2009-1315
Published: 2009-04-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in AbleSpace 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) gid parameter to groups_profile.php, (2) cat_id and (3) razd_id parameters to adv_cat.php, and the (4) URL to blogs_full.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dsecrg.com/pages/vul/show.php?id=137; http://secunia.com/advisories/34663; http://www.securityfocus.com/archive/1/502670/100/0/threaded
CVE: CVE-2009-1316
Published: 2009-04-17
Description: Multiple SQL injection vulnerabilities in AbleSpace 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to events_view.php and the (2) id parameter to events_clndr_view.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://dsecrg.com/pages/vul/show.php?id=137; http://secunia.com/advisories/34663; http://www.securityfocus.com/archive/1/502670/100/0/threaded
CVE: CVE-2009-1317
Published: 2009-04-17
Description: Multiple SQL injection vulnerabilities in Aqua CMS 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) userSID cookie parameter to droplets/functions/base.php and the (2) username parameter to admin/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/34720; http://www.securityfocus.com/bid/34516; https://www.exploit-db.com/exploits/8432
CVE: CVE-2009-1318
Published: 2009-04-17
Description: Directory traversal vulnerability in index.php in Jamroom 3.1.2, 3.2.3 through 3.2.6, 4.0.2, and possibly other versions before 3.4.0 allows remote attackers to include arbitrary files via directory traversal sequences in the t parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.jamroom.net/index.php?m=td_tracker&o=view&id=1470; http://www.securityfocus.com/bid/34511; https://exchange.xforce.ibmcloud.com/vulnerabilities/49869
CVE: CVE-2009-1319
Published: 2009-04-17
Description: Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the lang parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/34721; http://www.securityfocus.com/bid/34519; https://www.exploit-db.com/exploits/8431
CVE: CVE-2009-1320
Published: 2009-04-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in include/zstore.php in Zazzle Store Builder 1.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) gridPage and (2) gridSort parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/102/45/; http://secunia.com/advisories/34009; http://www.securityfocus.com/bid/34525
CVE: CVE-2009-1321
Published: 2009-04-17
Description: Cross-site scripting (XSS) vulnerability in search.asp in ASP Product Catalog 1.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/34504; https://exchange.xforce.ibmcloud.com/vulnerabilities/49858; https://www.exploit-db.com/exploits/8418
CVE: CVE-2009-1322
Published: 2009-04-17
Description: ASP Product Catalog 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for database/aspProductCatalog.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/49859; https://www.exploit-db.com/exploits/8418; https://exchange.xforce.ibmcloud.com/vulnerabilities/49859
CVE: CVE-2009-1323
Published: 2009-04-17
Description: SQL injection vulnerability in body.asp in Web File Explorer 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34648; http://www.securityfocus.com/bid/34462; https://exchange.xforce.ibmcloud.com/vulnerabilities/49801
CVE: CVE-2009-1324
Published: 2009-04-17
Description: Stack-based buffer overflow in Mini-stream ASX to MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34681; http://www.securityfocus.com/bid/34494; https://exchange.xforce.ibmcloud.com/vulnerabilities/49840
CVE: CVE-2009-1325
Published: 2009-04-17
Description: Stack-based buffer overflow in Mini-stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34692; http://www.securityfocus.com/bid/34494; https://exchange.xforce.ibmcloud.com/vulnerabilities/49844
CVE: CVE-2009-1326
Published: 2009-04-17
Description: Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34647; http://www.securityfocus.com/bid/34494; https://exchange.xforce.ibmcloud.com/vulnerabilities/49843
CVE: CVE-2009-1327
Published: 2009-04-17
Description: Stack-based buffer overflow in Mini-stream WM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34674; http://www.securityfocus.com/bid/34494; https://exchange.xforce.ibmcloud.com/vulnerabilities/49842
CVE: CVE-2009-1328
Published: 2009-04-17
Description: Stack-based buffer overflow in Mini-stream RM-MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34653; http://www.securityfocus.com/bid/34494; https://exchange.xforce.ibmcloud.com/vulnerabilities/49841
CVE: CVE-2009-1329
Published: 2009-04-17
Description: Stack-based buffer overflow in Mini-stream Shadow Stream Recorder 3.0.1.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34719; http://www.securityfocus.com/bid/34494; https://www.exploit-db.com/exploits/8405/
CVE: CVE-2009-1330
Published: 2009-04-17
Description: Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long filename in a playlist (.pls) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34514; https://exchange.xforce.ibmcloud.com/vulnerabilities/50326; https://www.exploit-db.com/exploits/39933/
CVE: CVE-2008-5518
Published: 2009-04-17
Description: Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.
CVSS Score: 9.4 (HIGH)
CWE: CWE-22
References: http://dsecrg.com/pages/vul/show.php?id=118; http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214; http://issues.apache.org/jira/browse/GERONIMO-4597
CVE: CVE-2009-0038
Published: 2009-04-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dsecrg.com/pages/vul/show.php?id=119; http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214; http://issues.apache.org/jira/browse/GERONIMO-4597
CVE: CVE-2009-0039
Published: 2009-04-17
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://dsecrg.com/pages/vul/show.php?id=120; http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214; http://issues.apache.org/jira/browse/GERONIMO-4597
CVE: CVE-2009-1185
Published: 2009-04-17
Description: udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
CVSS Score: 7.2 (HIGH)
CWE: CWE-346
References: http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e2b362d9f23d4c63018709ab5f81a02f72b91e75; http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e86a923d508c2aed371cdd958ce82489cf2ab615; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691
CVE: CVE-2009-1186
Published: 2009-04-17
Description: Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of service (service outage) via vectors that trigger a call with crafted arguments.
CVSS Score: 2.1 (LOW)
CWE: CWE-120
References: http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=662c3110803bd8c1aedacc36788e6fd028944314; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00006.html; http://secunia.com/advisories/34731
CVE: CVE-2009-1331
Published: 2009-04-17
Description: Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of service (application crash) via a crafted .mid file, as demonstrated by crash.mid.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://osvdb.org/53804; http://www.securityfocus.com/bid/34534; https://www.exploit-db.com/exploits/8445
CVE: CVE-2009-1332
Published: 2009-04-17
Description: The Online Help feature in Sun Java System Directory Server 5.2 and Enterprise Edition 5 allows remote attackers to determine the existence of files and directories, and possibly obtain partial contents of files, via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/53800; http://secunia.com/advisories/34751; http://sunsolve.sun.com/search/document.do?assetkey=1-66-255848-1
CVE: CVE-2009-1333
Published: 2009-04-17
Description: Cross-site scripting (XSS) vulnerability in refresh_rate.htm in the web interface on the HP Deskjet 6840 printer with firmware XF1M131A allows remote attackers to inject arbitrary web script or HTML via the POST request body.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/53769; http://secunia.com/advisories/34702; http://www.securityfocus.com/archive/1/502620/100/0/threaded
CVE: CVE-2009-1334
Published: 2009-04-17
Description: Cross-site scripting (XSS) vulnerability in login/FilepathLogin.html in IBM Tivoli Continuous Data Protection (CDP) for Files 3.1.4.0 allows remote attackers to inject arbitrary web script or HTML via the reason parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34646; http://securitytracker.com/id?1022060; http://www.insight-tech.org/index.php?p=IBM-Tivoli-Continuous-Data-Protection-for-Files-version-3-1-4-0---XSS
CVE: CVE-2009-1335
Published: 2009-04-17
Description: Microsoft Internet Explorer 7 and 8 on Windows XP and Vista allows remote attackers to cause a denial of service (application hang) via a large document composed of unprintable characters, aka MSRC 9011jr.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0111.html; http://www.securityfocus.com/archive/1/502617/100/0/threaded; http://www.securityfocus.com/bid/34478
CVE: CVE-2008-6727
Published: 2009-04-20
Description: Cross-site scripting (XSS) vulnerability in Ultimate PHP Board (UPB) 2.2.2, 2.2.1, and earlier 2.x versions allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51011; http://secunia.com/advisories/33329; http://www.securityfocus.com/bid/33029
CVE: CVE-2008-6728
Published: 2009-04-20
Description: SQL injection vulnerability in the Sections module in PHP-Nuke, probably before 8.0, allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printpage action to modules.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1700&w=2; http://osvdb.org/52033; http://www.securityfocus.com/archive/1/499656/100/0/threaded
CVE: CVE-2008-6729
Published: 2009-04-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that modify an account via the (1) password or (2) email_address parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/50999; http://secunia.com/advisories/33309; https://exchange.xforce.ibmcloud.com/vulnerabilities/47585
CVE: CVE-2008-6730
Published: 2009-04-20
Description: Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPLink Pro 0.0.6 and 0.0.7, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2) the checkpass parameter (aka password field), to admin/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/33343; http://www.osvdb.org/53188; https://exchange.xforce.ibmcloud.com/vulnerabilities/47644
CVE: CVE-2008-6731
Published: 2009-04-20
Description: Unrestricted file upload vulnerability in submitlink.php in FlexPHPLink Pro 0.0.7 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the renamed file in linkphoto/.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/33343; http://www.osvdb.org/53187; http://www.securityfocus.com/bid/33034
CVE: CVE-2009-1342
Published: 2009-04-20
Description: Cross-site scripting (XSS) vulnerability in the CCK comment reference module 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via certain comment titles associated with a node edit form.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/434836; http://osvdb.org/53702; http://secunia.com/advisories/34739
CVE: CVE-2009-1343
Published: 2009-04-20
Description: Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.5 and 6.x before 6.x-1.5, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via content titles.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/434748; http://secunia.com/advisories/34738; http://www.osvdb.org/53704
CVE: CVE-2009-1344
Published: 2009-04-20
Description: Cross-site scripting (XSS) vulnerability in the Localization client module 5.x before 5.x-1.2 and 6.x before 6.x-1.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via input to the translation functionality.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/434682; http://osvdb.org/53703; http://secunia.com/advisories/34718
CVE: CVE-2009-1345
Published: 2009-04-20
Description: SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/34556; http://www.securitytracker.com/id?1022082; https://exchange.xforce.ibmcloud.com/vulnerabilities/49901
CVE: CVE-2009-1346
Published: 2009-04-20
Description: SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL commands via the id_establecimiento parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/53814; http://secunia.com/advisories/34743; http://www.securityfocus.com/bid/34561
CVE: CVE-2009-1347
Published: 2009-04-20
Description: Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary SQL commands via (1) the login_name parameter (aka the username field) or (2) the login_pw parameter (aka the password field).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/24879; http://www.securityfocus.com/bid/34572; https://www.exploit-db.com/exploits/8461
CVE: CVE-2009-0715
Published: 2009-04-21
Description: Unspecified vulnerability in Secure NaviCLI in HP Storage Essentials 6.0.2 through 6.0.4 allows remote authenticated users to obtain "access" or "extended privileges" via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1157&w=2; http://osvdb.org/53881; http://secunia.com/advisories/34807
CVE: CVE-2009-0716
Published: 2009-04-21
Description: Unspecified vulnerability in HP StorageWorks Storage Mirroring 5 before 5.1.1.1090.15 allows remote attackers to cause a denial of service or obtain "access" via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3175&w=2; http://secunia.com/advisories/34808; http://www.securitytracker.com/id?1022085
CVE: CVE-2009-0717
Published: 2009-04-21
Description: Unspecified vulnerability in HP StorageWorks Storage Mirroring 5 before 5.1.1.1090.15 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3175&w=2; http://secunia.com/advisories/34808; http://www.securitytracker.com/id?1022086
CVE: CVE-2009-0718
Published: 2009-04-21
Description: Unspecified vulnerability in HP StorageWorks Storage Mirroring 5 before 5.1.1.1090.15 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3175&w=2; http://secunia.com/advisories/34808; http://www.securitytracker.com/id?1022087