deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2144
Published: 2009-06-22
Description: SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://firestats.cc/wiki/ChangeLog#a1.6.2-stable13062009; http://secunia.com/advisories/35400; http://firestats.cc/wiki/ChangeLog#a1.6.2-stable13062009
CVE: CVE-2009-2145
Published: 2009-06-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in transLucid 1.75 allow remote attackers to inject arbitrary web script or HTML via the (a) NodeID and (b) action parameters to the default URI, and the (c) NodeID parameter to the default URI for the admin section; and allow remote authenticated users to inject arbitrary web script or HTML via the (d) Title (aka page name) and (e) Url fields in a (1) new or (2) modified page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.intern0t.net/intern0t-advisories/1122-intern0t-translucid-1-75-multiple-vulnerabilities.html; http://secunia.com/advisories/35389; https://www.exploit-db.com/exploits/8943
CVE: CVE-2009-2146
Published: 2009-06-22
Description: Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the file via a direct request to a modified filename under cache/modules/Emails/, as demonstrated using .php as the entire original name.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/35445; http://www.securityfocus.com/bid/35361; http://www.sugarforge.org/frs/download.php/5598/Sugar_CommunityEdition_ReleaseNotes_5.2f.pdf
CVE: CVE-2009-2147
Published: 2009-06-22
Description: SQL injection vulnerability in fdown.php in phpWebThings 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35396; http://www.securityfocus.com/bid/35336; https://exchange.xforce.ibmcloud.com/vulnerabilities/51094
CVE: CVE-2009-2148
Published: 2009-06-22
Description: SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.vupen.com/english/advisories/2009/1583; https://www.exploit-db.com/exploits/8937; http://www.vupen.com/english/advisories/2009/1583
CVE: CVE-2009-2149
Published: 2009-06-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web script or HTML via the (1) courseid parameter to enrolments/step1.php, or the (2) search or (3) siteid parameter to files/shared_list.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.vupen.com/english/advisories/2009/1583; https://www.exploit-db.com/exploits/8937; http://www.vupen.com/english/advisories/2009/1583
CVE: CVE-2009-2150
Published: 2009-06-22
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack the authentication of arbitrary users for requests that terminate a session via login/logout.php, and might allow remote attackers to hijack the authentication of certain users via a (2) ADD or (3) DELETE action to enrolments/step2.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/8937; https://www.exploit-db.com/exploits/8937
CVE: CVE-2009-2151
Published: 2009-06-22
Description: Directory traversal vulnerability in index.php in AdaptWeb 0.9.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the newlang parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/8954; https://www.exploit-db.com/exploits/8954
CVE: CVE-2009-2152
Published: 2009-06-22
Description: SQL injection vulnerability in a_index.php in AdaptWeb 0.9.2 allows remote attackers to execute arbitrary SQL commands via the CodigoDisciplina parameter in a TopicosCadastro1 action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/8954; https://www.exploit-db.com/exploits/8954
CVE: CVE-2009-2153
Published: 2009-06-22
Description: Cross-site scripting (XSS) vulnerability in index.php in Impleo Music Collection 2.0 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/8947; https://www.exploit-db.com/exploits/8947
CVE: CVE-2009-2154
Published: 2009-06-22
Description: SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/8947; https://www.exploit-db.com/exploits/8947
CVE: CVE-2009-2155
Published: 2009-06-22
Description: Cross-site scripting (XSS) vulnerability in report/ReportViewAction.do in WebNMS Free Edition 5 allows remote attackers to inject arbitrary web script or HTML via the type parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55188; http://secunia.com/advisories/35495; https://exchange.xforce.ibmcloud.com/vulnerabilities/51250
CVE: CVE-2009-2156
Published: 2009-06-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Title field to requests.php, related to viewrequests.php; and (2) the Torrent Name field to torrents-upload.php, related to the logging of torrent uploads; and allow remote attackers to inject arbitrary web script or HTML via (3) the ttversion parameter to themes/default/footer.php, the (4) SITENAME and (5) CURUSER[username] parameters to themes/default/header.php, (6) the todayactive parameter to visitorstoday.php, (7) the activepeople parameter to visitorsnow.php, (8) the faq_categ[999][title] parameter to faq.php, and (9) the keepget parameter to torrents-details.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/35456; http://www.securityfocus.com/archive/1/504294/100/0/threaded; http://www.securityfocus.com/bid/35369
CVE: CVE-2009-2157
Published: 2009-06-22
Description: Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitrary SQL commands via (1) the origmsg parameter to account-inbox.php; the categ parameter to (2) delreq.php and (3) admin-delreq.php; (4) the choice parameter to index.php; (5) the id parameter to modrules.php in an edited (aka edit) action; the (6) user, (7) torrent, (8) forumid, and (9) forumpost parameters to report.php; (10) the delmp parameter to take-deletepm.php; (11) the delreport parameter to takedelreport.php; (12) the delreq parameter to takedelreq.php; (13) the clases parameter to takestaffmess.php; and (14) the warndisable parameter to takewarndisable.php; and allow remote attackers to execute arbitrary SQL commands via (15) the wherecatin parameter to browse.php, (16) the limit parameter to today.php, and (17) the where parameter to torrents-details.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35456; http://www.securityfocus.com/archive/1/504294/100/0/threaded; http://www.securityfocus.com/bid/35369
CVE: CVE-2009-2158
Published: 2009-06-22
Description: account-recover.php in TorrentTrader Classic 1.09 chooses random passwords from an insufficiently large set, which makes it easier for remote attackers to obtain a password via a brute-force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: http://www.securityfocus.com/archive/1/504294/100/0/threaded; http://www.securityfocus.com/bid/35369; http://www.waraxe.us/advisory-74.html
CVE: CVE-2009-2159
Published: 2009-06-22
Description: backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote attackers to create and download a backup database by making a direct request and then retrieving a .gz file from backups/.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/35456; http://www.securityfocus.com/archive/1/504294/100/0/threaded; http://www.securityfocus.com/bid/35369
CVE: CVE-2009-2160
Published: 2009-06-22
Description: TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function; and allows remote attackers to (2) obtain other potentially sensitive information via a direct request to check.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/35456; http://www.securityfocus.com/archive/1/504294/100/0/threaded; http://www.securityfocus.com/bid/35369
CVE: CVE-2009-2161
Published: 2009-06-22
Description: Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter, in conjunction with a modified component name.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/35456; http://www.securityfocus.com/archive/1/504294/100/0/threaded; http://www.securityfocus.com/bid/35369
CVE: CVE-2009-2162
Published: 2009-06-22
Description: Cross-site scripting (XSS) vulnerability in the XOOPS MANIAC PukiWikiMod module 1.6.6.2 and earlier for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN12244807/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000041.html; http://osvdb.org/55189
CVE: CVE-2008-6833
Published: 2009-06-22
Description: Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a files array element for a blogs action, as demonstrated by the files[0] parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://osvdb.org/49873; http://secunia.com/advisories/30930; https://exchange.xforce.ibmcloud.com/vulnerabilities/43941
CVE: CVE-2008-6834
Published: 2009-06-22
Description: Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.01 and 3.01a allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the s parameter to code/commupdate.php in a count action or (2) the heads parameter to code/newsheads.php.  NOTE: the blog.php vector is already covered by CVE-2008-3164.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/6016; https://www.exploit-db.com/exploits/6016
CVE: CVE-2009-2163
Published: 2009-06-22
Description: Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the sc_error parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.intern0t.net/intern0t-advisories/1082-intern0t-sitecore-net-6-0-0-cross-site-scripting-vulnerability.html; http://secunia.com/advisories/35353; http://www.securityfocus.com/archive/1/504093/100/0/threaded
CVE: CVE-2009-2164
Published: 2009-06-22
Description: Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the code parameter to activate.php or (2) the dest parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/504136/100/0/threaded; https://www.exploit-db.com/exploits/8884; https://www.exploit-db.com/exploits/8885
CVE: CVE-2009-2165
Published: 2009-06-22
Description: SerendipityNZ (aka SimpleBoxes) Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN20689557/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000035.html; http://secunia.com/advisories/35335
CVE: CVE-2009-2166
Published: 2009-06-22
Description: Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_directory_traversal.shtml; http://www.securityfocus.com/archive/1/504047/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/50946
CVE: CVE-2009-2167
Published: 2009-06-22
Description: Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.vupen.com/english/advisories/2009/1491; https://exchange.xforce.ibmcloud.com/vulnerabilities/50935; https://www.exploit-db.com/exploits/8865
CVE: CVE-2009-2168
Published: 2009-06-22
Description: cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied credentials are incorrect, which allows remote attackers to bypass authentication by providing arbitrary username and password parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.exploit-db.com/exploits/8865; https://www.exploit-db.com/exploits/8865
CVE: CVE-2009-2169
Published: 2009-06-22
Description: Insecure method vulnerability in the PDFVIEWER.PDFViewerCtrl.1 ActiveX control (pdfviewer.ocx) in Edraw PDF Viewer Component before 3.2.0.126 allows remote attackers to create and overwrite arbitrary files via a URL argument to the FtpConnect argument and a target filename argument to the FtpDownloadFile method.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-06/0198.html; http://secunia.com/advisories/35509; http://archives.neohapsis.com/archives/fulldisclosure/2009-06/0198.html
CVE: CVE-2009-2170
Published: 2009-06-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0 before 1.0.12 and 1.1 before 1.1.5 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://mahara.org/interaction/forum/topic.php?id=752; http://mahara.org/interaction/forum/topic.php?id=752
CVE: CVE-2009-2171
Published: 2009-06-23
Description: Mahara 1.1 before 1.1.5 does not apply permission checks when saving a view that contains artefacts, which allows remote authenticated users to read another user's artefact.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://mahara.org/interaction/forum/topic.php?id=753; http://mahara.org/interaction/forum/topic.php?id=753
CVE: CVE-2009-0690
Published: 2009-06-23
Description: The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a negative value for the stream offset in a JPEG2000 (aka JPX) stream, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted PDF file that triggers an out-of-bounds read.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/35512; http://securitytracker.com/id?1022425; http://www.foxitsoftware.com/pdf/reader/security.htm#0602
CVE: CVE-2009-0691
Published: 2009-06-23
Description: The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a fatal error during decoding of a JPEG2000 (aka JPX) header, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted PDF file that triggers an invalid memory access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/35512; http://securitytracker.com/id?1022425; http://www.foxitsoftware.com/pdf/reader/security.htm#0602
CVE: CVE-2009-2121
Published: 2009-06-23
Description: Buffer overflow in the browser kernel in Google Chrome before 2.0.172.33 allows remote HTTP servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted response.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=14508; http://googlechromereleases.blogspot.com/2009/06/stable-beta-update-security-fix.html; http://osvdb.org/55278
CVE: CVE-2009-2172
Published: 2009-06-23
Description: Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows remote registered users to inject arbitrary web script or HTML via the station parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/35385; https://www.exploit-db.com/exploits/8965; http://www.securityfocus.com/bid/35385
CVE: CVE-2009-2173
Published: 2009-06-23
Description: The LAN game feature in Carom3D 5.06 allows remote authenticated users to cause a denial of service (application hang) via a crafted HTTP request to TCP port 28012.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/51219; https://www.exploit-db.com/exploits/8971; https://exchange.xforce.ibmcloud.com/vulnerabilities/51219
CVE: CVE-2009-2174
Published: 2009-06-23
Description: GUPnP 0.12.7 allows remote attackers to cause a denial of service (crash) via an empty (1) subscription or (2) control message.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.openedhand.com/show_bug.cgi?id=1604; http://git.gupnp.org/cgit.cgi?url=gupnp/tree/NEWS&id=ce714a6700ce03953a2886a66ec57db59205f4e6; http://secunia.com/advisories/35472
CVE: CVE-2009-2175
Published: 2009-06-23
Description: Stack-based buffer overflow in the flattenIncrementally function in flatten.c in xcftools 1.0.4, as reachable from the (1) xcf2pnm and (2) xcf2png utilities, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted image that causes a conversion to a location "above or to the left of the canvas." NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=533361; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050526.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050542.html
CVE: CVE-2009-2176
Published: 2009-06-23
Description: Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) list parameter to code/confirm.php and the (2) template parameter to code/display.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/55182; http://osvdb.org/55183; http://secunia.com/advisories/35489
CVE: CVE-2009-2177
Published: 2009-06-23
Description: code/display.php in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allows remote attackers to conduct directory traversal attacks and overwrite arbitrary files via a "....//" (dot dot) in the s parameter, which is collapsed into a "../" value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/55184; http://secunia.com/advisories/35489; http://www.securityfocus.com/bid/35418
CVE: CVE-2009-2178
Published: 2009-06-23
Description: Cross-site scripting (XSS) vulnerability in website.php in phpDatingClub 3.7 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55316; https://www.exploit-db.com/exploits/8990; http://osvdb.org/55316
CVE: CVE-2009-2179
Published: 2009-06-23
Description: SQL injection vulnerability in search.php in phpDatingClub 3.7 allows remote attackers to execute arbitrary SQL commands via the sform[day] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55315; https://www.exploit-db.com/exploits/8990; http://osvdb.org/55315
CVE: CVE-2009-2180
Published: 2009-06-23
Description: Multiple directory traversal vulnerabilities in upfiles/index.php in Pc4 Uploader 10.0 and earlier allow remote attackers to read arbitrary files via (1) a .. (dot dot) or (2) absolute path in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/55314; https://www.exploit-db.com/exploits/8988; http://osvdb.org/55314
CVE: CVE-2009-2181
Published: 2009-06-23
Description: Cross-site scripting (XSS) vulnerability in admin-files/templates/list_dir.php in Campsite 3.3.0 RC1 allows remote attackers to inject arbitrary web script or HTML via the listbasedir parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55313; https://www.exploit-db.com/exploits/8995; http://osvdb.org/55313
CVE: CVE-2009-2182
Published: 2009-06-23
Description: Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[g_campsiteDir] parameter to (1) ad_popup.php, (2) camp_html.php, (3) init_content.php, (4) logout.php, (5) menu.php, and (6) set-author.php in admin-files/; (7) conf/liveuser_configuration.php; (8) include/phorum_load.php; (9) CommandProcessor.php and (10) index.php in admin-files/article_import; and (11) add.php, (12) add_move.php, (13) autopublish.php, and (14) autopublish_del.php in admin-files/articles/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://www.exploit-db.com/exploits/8995; https://www.exploit-db.com/exploits/8995
CVE: CVE-2009-2183
Published: 2009-06-23
Description: Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possibly execute arbitrary local files via a .. (dot dot) in the GLOBALS[g_campsiteDir] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/55312; https://www.exploit-db.com/exploits/8995; http://osvdb.org/55312
CVE: CVE-2009-2184
Published: 2009-06-23
Description: Absolute path traversal vulnerability in forcedownload.php in Gravy Media Photo Host 1.0.8 allows remote attackers to read arbitrary files via an encoded "/" (slash) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/55280; http://secunia.com/advisories/35518; http://www.vupen.com/english/advisories/2009/1651
CVE: CVE-2009-0903
Published: 2009-06-25
Description: IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remote attackers to bypass intended access restrictions via a crafted request to a JAX-WS application.
CVSS Score: 7.5 (HIGH)
References: http://www-1.ibm.com/support/docview.wss?uid=swg1PK72138; http://www-1.ibm.com/support/docview.wss?uid=swg1PK81944; http://www-1.ibm.com/support/docview.wss?uid=swg1PK87767
CVE: CVE-2009-1163
Published: 2009-06-25
Description: Memory leak on the Cisco Physical Access Gateway with software before 1.1 allows remote attackers to cause a denial of service (memory consumption) via unspecified TCP packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080ad0fb2.html; http://www.cisco.com/en/US/products/products_security_advisory09186a0080ad0f8b.shtml; http://www.securityfocus.com/bid/35477