deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1431
Published: 2009-04-29
Description: XFR.EXE in the Intel File Transfer service in the console in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allows remote attackers to execute arbitrary code by placing the code on a (1) share or (2) WebDAV server, and then sending the UNC share pathname to this service.
CVSS Score: 9.3 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=786; http://secunia.com/advisories/34856; http://www.securityfocus.com/bid/34675
CVE: CVE-2009-1478
Published: 2009-04-29
Description: Multiple unspecified vulnerabilities in the DTrace ioctl handlers in Sun Solaris 10, and OpenSolaris before snv_114, allow local users to cause a denial of service (panic) via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/54138; http://secunia.com/advisories/34836; http://secunia.com/advisories/35098
CVE: CVE-2008-6768
Published: 2009-04-29
Description: Unrestricted file upload vulnerability in admin/editor/images.php in K&S Shopsoftware allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/upload/.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/51210; http://secunia.com/advisories/33212; http://www.securityfocus.com/bid/32888
CVE: CVE-2008-6769
Published: 2009-04-29
Description: Unrestricted file upload vulnerability in upload.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file.
CVSS Score: 6.0 (MEDIUM)
References: http://www.securityfocus.com/bid/32971; https://exchange.xforce.ibmcloud.com/vulnerabilities/47569; https://www.exploit-db.com/exploits/7545
CVE: CVE-2008-6770
Published: 2009-04-29
Description: YourPlace 1.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to a database containing user credentials via a direct request for users.txt.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33272; http://www.securityfocus.com/bid/32971; https://exchange.xforce.ibmcloud.com/vulnerabilities/47565
CVE: CVE-2008-6771
Published: 2009-04-29
Description: YourPlace 1.0.2 and earlier allows remote attackers to obtain sensitive system information via a direct request via a direct request to user/uploads/phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33272; http://www.securityfocus.com/bid/32971; https://exchange.xforce.ibmcloud.com/vulnerabilities/47563
CVE: CVE-2008-6772
Published: 2009-04-29
Description: login/register_form.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account is created, which allows remote attackers to bypass intended access restrictions by registering a new account with the username of a target user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/33272; http://www.securityfocus.com/bid/32971; https://exchange.xforce.ibmcloud.com/vulnerabilities/47564
CVE: CVE-2008-6773
Published: 2009-04-29
Description: Static code injection vulnerability in user/internettoolbar/edit.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary PHP code into user/internettoolbar/index.php via the (1) fav1_url, (2) fav1_name, (3) fav2_url, (4) fav2_name, (5) fav3_url, (6) fav3_name, (7) fav4_url, (8) fav4_name, (9) fav5_url, or (10) fav5_name parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/33272; http://www.securityfocus.com/bid/32971; https://exchange.xforce.ibmcloud.com/vulnerabilities/47562
CVE: CVE-2008-6774
Published: 2009-04-29
Description: internettoolbar/edit.php in YourPlace 1.0.2 and earlier does not end execution when an invalid username is detected, which allows remote attackers to bypass intended restrictions and edit toolbar settings via an invalid username.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33272; https://exchange.xforce.ibmcloud.com/vulnerabilities/47566; http://secunia.com/advisories/33272
CVE: CVE-2009-1480
Published: 2009-04-29
Description: SQL injection vulnerability in index.php Pragyan CMS 2.6.4 allows remote attackers to execute arbitrary SQL commands via the fileget parameter in a view action and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/502933/100/0/threaded; http://www.securityfocus.com/bid/34707; https://www.exploit-db.com/exploits/8533
CVE: CVE-2009-1481
Published: 2009-04-29
Description: SQL injection vulnerability in action.asp in PuterJam's Blog (PJBlog3) 3.0.6.170 allows remote attackers to execute arbitrary SQL commands via the cname parameter in a checkAlias action, as exploited in the wild in April 2009.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://downloads.securityfocus.com/vulnerabilities/exploits/34701.vbs; http://osvdb.org/53939; http://secunia.com/advisories/34897
CVE: CVE-2009-1482
Published: 2009-04-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an AttachFile sub-action in the error_msg function or (2) multiple vectors related to package file errors in the upload_form function, different vectors than CVE-2009-0260.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hg.moinmo.in/moin/1.8/rev/5f51246a4df1; http://moinmo.in/SecurityFixes; http://secunia.com/advisories/34821
CVE: CVE-2009-1483
Published: 2009-04-29
Description: Unrestricted file upload vulnerability in upload-file.php in Adam Patterson Studio Lounge Address Book 2.5, as reachable from index2.php, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in profiles/.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/34761; http://www.osvdb.org/53813; http://www.securityfocus.com/bid/34652
CVE: CVE-2009-1484
Published: 2009-04-29
Description: Cross-site scripting (XSS) vulnerability in the web mail interface feature in AXIGEN Mail Server 6.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving e-mail messages.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34402; http://www.securityfocus.com/bid/34716; http://secunia.com/advisories/34402
CVE: CVE-2009-1485
Published: 2009-04-29
Description: The logging feature in eMule Plus before 1.2e allows remote attackers to cause a denial of service (infinite loop) via unspecified attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/34799; http://sourceforge.net/project/shownotes.php?release_id=676726; https://exchange.xforce.ibmcloud.com/vulnerabilities/50081
CVE: CVE-2009-1486
Published: 2009-04-29
Description: Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the with parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/34904; https://www.exploit-db.com/exploits/8549; http://secunia.com/advisories/34904
CVE: CVE-2009-1487
Published: 2009-04-29
Description: SQL injection vulnerability in pages/login.php in FunGamez RC1 allows remote attackers to execute arbitrary SQL commands via the login_user (aka username) parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6068&w=2; http://www.securityfocus.com/bid/34610; http://www.vupen.com/english/advisories/2009/1117
CVE: CVE-2009-1488
Published: 2009-04-29
Description: Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6068&w=2; http://www.securityfocus.com/bid/34610; http://www.vupen.com/english/advisories/2009/1117
CVE: CVE-2009-1489
Published: 2009-04-29
Description: includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6068&w=2; http://www.vupen.com/english/advisories/2009/1117; https://exchange.xforce.ibmcloud.com/vulnerabilities/50424
CVE: CVE-2009-0663
Published: 2009-04-30
Description: Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pg_getline functions to read database rows.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34909; http://secunia.com/advisories/35058
CVE: CVE-2009-1255
Published: 2009-04-30
Description: The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html; http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98; http://code.google.com/p/memcachedb/source/detail?r=98
CVE: CVE-2009-1291
Published: 2009-04-30
Description: Stack-based buffer overflow in TIBCO SmartSockets before 6.8.2, SmartSockets Product Family (aka RTworks) before 4.0.5, and Enterprise Message Service (EMS) 4.0.0 through 5.1.1, as used in SmartSockets Server and RTworks Server (aka RTserver), SmartSockets client libraries and add-on products, RTworks libraries and components, EMS Server (aka tibemsd), SmartMQ, iProcess Engine, ActiveMatrix products, and CA Enterprise Communicator, allows remote attackers to execute arbitrary code via "inbound data," as demonstrated by requests to the UDP interface of the RTserver component, and data injection into the TCP stream to tibemsd.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=785; http://secunia.com/advisories/34911; http://securitytracker.com/id?1022129
CVE: CVE-2009-1295
Published: 2009-04-30
Description: Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on Ubuntu 8.10, and before 1.0-0ubuntu5.2 on Ubuntu 9.04 does not properly remove files from the application's crash-report directory, which allows local users to delete arbitrary files via unspecified vectors.
CVSS Score: 1.9 (LOW)
CWE: CWE-16
References: http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html; http://secunia.com/advisories/34947; http://secunia.com/advisories/34952
CVE: CVE-2009-1339
Published: 2009-04-30
Description: Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the SRC attribute of an IMG element, a related issue to CVE-2009-1434.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://bugs.debian.org/526258; http://secunia.com/advisories/34880; http://securitytracker.com/id?1022146
CVE: CVE-2009-1341
Published: 2009-04-30
Description: Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service (memory consumption) by fetching data with BYTEA columns.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://cpansearch.perl.org/src/TURNSTEP/DBD-Pg-2.13.1/Changes; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://rt.cpan.org/Public/Bug/Display.html?id=21392
CVE: CVE-2009-1348
Published: 2009-04-30
Description: The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html; http://secunia.com/advisories/34949; http://www.securityfocus.com/archive/1/503173/100/0/threaded
CVE: CVE-2009-1415
Published: 2009-04-30
Description: lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-824
References: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515; http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3502; http://secunia.com/advisories/34842
CVE: CVE-2009-1416
Published: 2009-04-30
Description: lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516; http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html; http://secunia.com/advisories/34842
CVE: CVE-2009-1417
Published: 2009-04-30
Description: gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517; http://secunia.com/advisories/34842; http://secunia.com/advisories/35211
CVE: CVE-2009-1432
Published: 2009-04-30
Description: Symantec Reporting Server, as used in Symantec AntiVirus (SAV) Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Client Security (SCS) before 3.1 MR8, and the Symantec Endpoint Protection Manager (SEPM) component in Symantec Endpoint Protection (SEP) before 11.0 MR2, allows remote attackers to inject arbitrary text into the login screen, and possibly conduct phishing attacks, via vectors involving a URL that is not properly handled.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/34856; http://secunia.com/advisories/34935; http://securitytracker.com/id?1022136
CVE: CVE-2009-1434
Published: 2009-04-30
Description: Cross-site request forgery (CSRF) vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a (1) save or (2) view script in the SRC attribute of an IMG element, a related issue to CVE-2009-1339.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://foswiki.org/Support/SecurityAlert-CVE-2009-1434; http://osvdb.org/54148; http://secunia.com/advisories/34863
CVE: CVE-2009-1492
Published: 2009-04-30
Description: The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html; http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html; http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html
CVE: CVE-2009-1493
Published: 2009-04-30
Description: The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and UNIX allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that triggers a call to this method with a long string in the second argument.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html; http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.html
CVE: CVE-2009-1494
Published: 2009-04-30
Description: The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98; http://code.google.com/p/memcachedb/source/detail?r=98; http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.c
CVE: CVE-2009-1313
Published: 2009-04-30
Description: The nsTextFrame::ClearTextRun function in layout/generic/nsTextFrameThebes.cpp in Mozilla Firefox 3.0.9 allows remote attackers to cause a denial of service (memory corruption) and probably execute arbitrary code via unspecified vectors.  NOTE: this vulnerability reportedly exists because of an incorrect fix for CVE-2009-1302.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/34851; http://secunia.com/advisories/34866; http://secunia.com/advisories/34910
CVE: CVE-2008-6775
Published: 2009-05-01
Description: HTC Touch Pro and HTC Touch Cruise vCard allows remote attackers to cause denial of service (CPU consumption, SMS consumption, and connectivity loss) via a flood of vCards to UDP port 9204.
CVSS Score: 7.1 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0370.html; http://osvdb.org/52009; http://www.mseclab.com/index.php?page_id=110
CVE: CVE-2009-1495
Published: 2009-05-01
Description: Web File Explorer 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for data/db.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/34648; https://www.exploit-db.com/exploits/8374; http://secunia.com/advisories/34648
CVE: CVE-2009-1496
Published: 2009-05-01
Description: Directory traversal vulnerability in the Cmi Marketplace (com_cmimarketplace) component 0.1 for Joomla! allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/34431; https://www.exploit-db.com/exploits/8367; http://www.securityfocus.com/bid/34431
CVE: CVE-2009-1497
Published: 2009-05-01
Description: Stack-based buffer overflow in srt2smi.exe in Gretech Online Movie Player (GOM Player) 2.1.16.4635 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long string in an SRT file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/53361; http://secunia.com/advisories/34639; http://security.bkis.vn/?p=501
CVE: CVE-2009-1498
Published: 2009-05-01
Description: Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alpha SVN 243 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter in a settings action to profile.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/34397; https://exchange.xforce.ibmcloud.com/vulnerabilities/49697; https://www.exploit-db.com/exploits/8357
CVE: CVE-2009-1499
Published: 2009-05-01
Description: SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the article parameter in index.php.  NOTE: SecurityFocus states that this issue has been disputed by the vendor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/34433; https://www.exploit-db.com/exploits/8366; http://www.securityfocus.com/bid/34433
CVE: CVE-2008-6776
Published: 2009-05-01
Description: SQL injection vulnerability in viewcomments.php in Scripts For Sites (SFS) EZ Hot or Not allows remote attackers to execute arbitrary SQL commands via the phid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49540; http://secunia.com/advisories/32532; https://exchange.xforce.ibmcloud.com/vulnerabilities/46278
CVE: CVE-2008-6777
Published: 2009-05-01
Description: Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a confirm action, the (2) user parameter in a newconfirm action, and (3) reqpwd action to member.php; and the (4) quote parameter in a post action and (5) pid parameter in an edit action to post.php, different vectors than CVE-2005-0413.2 and CVE-2007-6667.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28280; http://www.securityfocus.com/bid/31995; https://exchange.xforce.ibmcloud.com/vulnerabilities/46238
CVE: CVE-2008-6778
Published: 2009-05-01
Description: SQL injection vulnerability in viewfaqs.php in Scripts for Sites (SFS) EZ Auction allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49513; http://secunia.com/advisories/32528; http://www.securityfocus.com/bid/32036
CVE: CVE-2008-6779
Published: 2009-05-01
Description: SQL injection vulnerability in the Sarkilar module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a showcontent action to modules.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0810-exploits/phpnukesarkilar-sql.txt; http://www.securityfocus.com/bid/31830; https://exchange.xforce.ibmcloud.com/vulnerabilities/45992
CVE: CVE-2008-6780
Published: 2009-05-01
Description: SQL injection vulnerability in directory.php in Scripts for Sites (SFS) SFS EZ Affiliate allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49554; http://secunia.com/advisories/32558; https://www.exploit-db.com/exploits/6911