deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4545
Published: 2010-01-04
Description: Logoshows BBS 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/globepersonnel.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/9400; https://exchange.xforce.ibmcloud.com/vulnerabilities/52365; http://www.exploit-db.com/exploits/9400
CVE: CVE-2009-4546
Published: 2010-01-04
Description: globepersonnel_login.asp in Logoshows BBS 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) pb_username (aka pb%5Fusername) and (2) level cookies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/9400; https://exchange.xforce.ibmcloud.com/vulnerabilities/52366; http://www.exploit-db.com/exploits/9400
CVE: CVE-2009-4547
Published: 2010-01-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in ViArt CMS 3.x allow remote attackers to inject arbitrary web script or HTML via the (1) category_id parameter to forums.php, or the forum_id parameter to (2) forum.php or (3) forum_topic_new.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56883; http://osvdb.org/56884; http://osvdb.org/56885
CVE: CVE-2009-4548
Published: 2010-01-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web script or HTML via the category_id parameter to (1) products.php, (2) article.php, (3) product_details.php, or (4) reviews.php; the (5) forum_id parameter to forum.php; or the (6) search_category_id parameter to products_search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56877; http://osvdb.org/56878; http://osvdb.org/56879
CVE: CVE-2009-4549
Published: 2010-01-04
Description: Stack-based buffer overflow in A2 Media Player Pro 2.51 allows remote attackers to execute arbitrary code via a long string in a (1) .m3u or (2) .m3l playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9377; http://www.exploit-db.com/exploits/9377
CVE: CVE-2009-4550
Published: 2010-01-04
Description: SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the func parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36245; http://www.exploit-db.com/exploits/9408; http://www.securityfocus.com/bid/36020
CVE: CVE-2009-4551
Published: 2010-01-04
Description: SQL injection vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the campaign_id parameter in a results action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9339; http://www.securityfocus.com/bid/35870; http://www.exploit-db.com/exploits/9339
CVE: CVE-2009-4552
Published: 2010-01-04
Description: Cross-site scripting (XSS) vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/9339; http://www.securityfocus.com/bid/35870; http://www.exploit-db.com/exploits/9339
CVE: CVE-2009-4553
Published: 2010-01-04
Description: Stack-based buffer overflow in iRehearse allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in a .m3u playlist file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9392; https://exchange.xforce.ibmcloud.com/vulnerabilities/55479; http://www.exploit-db.com/exploits/9392
CVE: CVE-2009-4554
Published: 2010-01-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in Snitz Forums 2000 3.4.07 allow remote attackers to inject arbitrary web script or HTML via (1) the url parameter to pop_send_to_friend.asp, related to a crafted onload attribute of an IMG element; or (2) an onload attribute in a sound tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35733; http://www.securityfocus.com/archive/1/507207/100/0/threaded; http://www.securityfocus.com/bid/36710
CVE: CVE-2009-4555
Published: 2010-01-04
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in AgoraCart 5.2.005 and 5.2.006 and AgoraCart GOLD 5.5.005 allow remote attackers to hijack the authentication of administrators for requests that (1) modify a .htaccess file via an unspecified request to protected/manager.cgi or (2) change the password of an administrative account.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/129/45/; http://secunia.com/advisories/36789; https://exchange.xforce.ibmcloud.com/vulnerabilities/53808
CVE: CVE-2009-4556
Published: 2010-01-04
Description: Quick Heal AntiVirus Plus 2009 10.00 SP1 and Quick Heal Total Security 2009 10.00 SP1 use weak permissions (Everyone: Full Control) for the product files, which allows local users to gain privileges by replacing executables with Trojan horse programs, as demonstrated by replacing quhlpsvc.exe.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/37033; http://www.securityfocus.com/archive/1/507121/100/0/threaded; http://www.securityfocus.com/bid/36662
CVE: CVE-2009-4557
Published: 2010-01-04
Description: Cross-site scripting (XSS) vulnerability in the Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, allows remote authenticated users, with image-node creation privileges, to inject arbitrary web script or HTML via a node title.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/520564; http://osvdb.org/55866; http://secunia.com/advisories/35879
CVE: CVE-2009-4558
Published: 2010-01-04
Description: The Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, does not properly enforce privilege requirements for unspecified pages, which allows remote attackers to read the (1) title or (2) body of an arbitrary node via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/520564; http://osvdb.org/55867; http://secunia.com/advisories/35879
CVE: CVE-2009-4559
Published: 2010-01-04
Description: Cross-site scripting (XSS) vulnerability in the Submitted By module 6.x before 6.x-1.3 for Drupal allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via an input string for "submitted by" text.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/520372; http://www.securityfocus.com/bid/35708; https://exchange.xforce.ibmcloud.com/vulnerabilities/51788
CVE: CVE-2009-4560
Published: 2010-01-04
Description: SQL injection vulnerability in profile.php in WebLeague 2.2.0 allows remote attackers to execute arbitrary SQL commands via the name parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9162; https://exchange.xforce.ibmcloud.com/vulnerabilities/51777; http://www.exploit-db.com/exploits/9162
CVE: CVE-2009-4561
Published: 2010-01-04
Description: Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9165; https://exchange.xforce.ibmcloud.com/vulnerabilities/51777; http://www.exploit-db.com/exploits/9165
CVE: CVE-2009-4562
Published: 2010-01-04
Description: Cross-site scripting (XSS) vulnerability in zp-core/admin.php in Zenphoto 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the from parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55922; http://secunia.com/advisories/35863; http://www.exploit-db.com/exploits/9166
CVE: CVE-2009-4563
Published: 2010-01-04
Description: Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass_2 parameters in a saveoptions action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55921; http://secunia.com/advisories/35863; http://www.exploit-db.com/exploits/9166
CVE: CVE-2009-4564
Published: 2010-01-04
Description: SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers to execute arbitrary SQL commands via the category parameter, related to a URI under news/category/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9154; http://www.exploit-db.com/exploits/9154
CVE: CVE-2009-4565
Published: 2010-01-04
Description: sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6317&w=2; http://secunia.com/advisories/37998
CVE: CVE-2009-4566
Published: 2010-01-04
Description: SQL injection vulnerability in index.php in Zenphoto 1.2.5 allows remote attackers to execute arbitrary SQL commands via the title parameter in a news action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55920; http://secunia.com/advisories/35863; https://exchange.xforce.ibmcloud.com/vulnerabilities/51799
CVE: CVE-2009-3734
Published: 2010-01-05
Description: Unspecified vulnerability in the management console in the S2 Security Linear eMerge Access Control System 2.5.x allows remote attackers to cause a denial of service (configuration reset) via a request to a crafted URI.
CVSS Score: 5.0 (MEDIUM)
References: http://blip.tv/file/3414004; http://www.kb.cert.org/vuls/id/571629; http://www.kb.cert.org/vuls/id/WDON-7ZDNNE
CVE: CVE-2009-4567
Published: 2010-01-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated users to inject arbitrary web script or HTML via the (1) skype, (2) yahoo, (3) aol, (4) msn, or (5) jabber parameter in a profile2 action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/viscacha-xss.txt; http://secunia.com/advisories/37608; http://www.exploit-db.com/exploits/10354
CVE: CVE-2009-4568
Published: 2010-01-05
Description: Cross-site scripting (XSS) vulnerability in Webmin before 1.500 and Usermin before 1.430 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37648; http://www.mandriva.com/security/advisories?name=MDVSA-2010:036; http://www.securityfocus.com/bid/37259
CVE: CVE-2009-4569
Published: 2010-01-05
Description: SQL injection vulnerability in elkagroup Image Gallery allows remote attackers to execute arbitrary SQL commands via the id parameter to the default URI under news/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0912-exploits/elkagroupv-sql.txt; http://www.exploit-db.com/exploits/10330; http://www.securityfocus.com/bid/37229
CVE: CVE-2009-4570
Published: 2010-01-05
Description: Cross-site scripting (XSS) vulnerability in PhpShop 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in an order/order_print action to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31948; http://www.andreafabrizi.it/?exploits:phpshop; http://www.securityfocus.com/archive/1/508270/100/0/threaded
CVE: CVE-2009-4571
Published: 2010-01-05
Description: Multiple SQL injection vulnerabilities in index.php in PhpShop 0.8.1 allow remote attackers to execute arbitrary SQL commands via the (1) module_id parameter in an admin/function_list action, the (2) vendor_id parameter in a vendor/vendor_form action, the (3) module_id parameter in an admin/module_form action, the (4) user_id parameter in an admin/user_form action, the (5) vendor_category_id parameter in a vendor/vendor_category_form action, the (6) user_id parameter in a store/user_form action, the (7) payment_method_id parameter in a store/payment_method_form action, the (8) tax_rate_id parameter in a tax/tax_form action, or the (9) category parameter in a shop/browse action.  NOTE: the product_id vector is already covered by CVE-2008-0681.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31948; http://www.andreafabrizi.it/?exploits:phpshop; http://www.securityfocus.com/archive/1/508270/100/0/threaded
CVE: CVE-2009-4572
Published: 2010-01-05
Description: Cross-site request forgery (CSRF) vulnerability in PhpShop 0.8.1 allows remote attackers to hijack the authentication of arbitrary users for requests that invoke the cartAdd function in a shop/cart action to the default URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/31948; http://www.andreafabrizi.it/?exploits:phpshop; http://www.securityfocus.com/archive/1/508270/100/0/threaded
CVE: CVE-2009-4573
Published: 2010-01-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Joomulus (mod_joomulus) module 2.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action to (1) tagcloud_ell.swf, (2) tagcloud_eng.swf, (3) tagcloud_por.swf, (4) tagcloud_rus.swf, and possibly (5) tagcloud_jpn.swf.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37994; http://www.osvdb.org/61343; http://www.osvdb.org/61344
CVE: CVE-2009-4574
Published: 2010-01-06
Description: SQL injection vulnerability in country_escorts.php in I-Escorts Directory Script allows remote attackers to execute arbitrary SQL commands via the country_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0912-exploits/iescorts-sql.txt; http://secunia.com/advisories/37957; http://www.exploit-db.com/exploits/10809
CVE: CVE-2009-4575
Published: 2010-01-06
Description: Cross-site scripting (XSS) vulnerability in the Q-Personel (com_qpersonel) component 1.0.2 RC2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the personel_sira parameter in a sirala action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37897; http://www.exploit-db.com/exploits/10738; http://www.osvdb.org/61354
CVE: CVE-2009-4576
Published: 2010-01-06
Description: SQL injection vulnerability in the BeeHeard (com_beeheard) component 1.x for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a suggestions action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0912-exploits/joomlabeeheard-sql.txt; http://secunia.com/advisories/37872; http://www.exploit-db.com/exploits/10734
CVE: CVE-2009-4577
Published: 2010-01-06
Description: SQL injection vulnerability in the MDForum module 2.x through 2.07 for MAXdev MDPro allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/37748; http://www.maxdev.com/Article661.phtml; http://www.osvdb.org/61347
CVE: CVE-2009-4578
Published: 2010-01-06
Description: Cross-site scripting (XSS) vulnerability in the Facileforms (com_facileforms) component for Joomla! and Mambo allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/joomlafacileforms-xss.txt; http://www.exploit-db.com/exploits/10737; http://www.securityfocus.com/bid/37477
CVE: CVE-2009-4579
Published: 2010-01-06
Description: Cross-site scripting (XSS) vulnerability in the Artist avenue (com_artistavenue) component for Joomla! and Mambo allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/joomlaartistavenue-xss.txt; http://www.exploit-db.com/exploits/10818; http://www.securityfocus.com/bid/37537
CVE: CVE-2009-4580
Published: 2010-01-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Hasta Blog 2.3 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) yorumyaz.php and (2) blog.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/hastablog-xss.txt; http://secunia.com/advisories/37975; http://www.exploit-db.com/exploits/10641
CVE: CVE-2009-4581
Published: 2010-01-06
Description: Directory traversal vulnerability in modules/admincp.php in RoseOnlineCMS 3 B1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the admin parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://packetstormsecurity.org/0912-exploits/roseonlinecms-lfi.txt; http://www.exploit-db.com/exploits/10793; http://www.securityfocus.com/bid/37529
CVE: CVE-2009-4582
Published: 2010-01-06
Description: SQL injection vulnerability in detail.php in the Dictionary module for XOOPS 2.0.18 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/10807; http://www.securityfocus.com/bid/37535; https://exchange.xforce.ibmcloud.com/vulnerabilities/55222
CVE: CVE-2009-4583
Published: 2010-01-06
Description: SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a grouplist action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0912-exploits/joomladhforum-sql.txt; http://www.exploit-db.com/exploits/10742; http://www.securityfocus.com/bid/37475
CVE: CVE-2009-4584
Published: 2010-01-06
Description: admin.php in dB Masters Multimedia Links Directory 3.1.3 allows remote attackers to bypass authentication and gain administrative access via a certain value of the admin_log cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.org/0912-exploits/dbmastersmm-insecure.txt; http://secunia.com/advisories/37985; http://www.osvdb.org/61393
CVE: CVE-2009-4585
Published: 2010-01-06
Description: UranyumSoft Listing Service stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/db.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/0912-exploits/uranyumsoft-disclose.txt; http://secunia.com/advisories/37912; http://www.exploit-db.com/exploits/10823
CVE: CVE-2010-0157
Published: 2010-01-06
Description: Directory traversal vulnerability in the Bible Study (com_biblestudy) component 6.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter in a studieslist action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1001-exploits/joomlabiblestudy-lfi.txt; http://secunia.com/advisories/37896; http://www.securityfocus.com/bid/37583
CVE: CVE-2010-0158
Published: 2010-01-06
Description: SQL injection vulnerability in the JoomlaBamboo (JB) Simpla Admin template for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an article action to the com_content component, reachable through index.php.  NOTE: the vendor disputes this report, saying: "JoomlaBamboo has investigated this report, and it is incorrect.  There is no SQL injection vulnerability involving the id parameter in an article view, and there never was. JoomlaBamboo customers have no reason to be concerned about this report.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1001-exploits/joomlabamboo-sql.txt; http://www.attrition.org/pipermail/vim/2010-February/002319.html; http://www.attrition.org/pipermail/vim/2010-February/002320.html
CVE: CVE-2009-4586
Published: 2010-01-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.html in Wowd client before 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sortby, (2) tags, or (3) ctx parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2009/10/wowd-search-client-multiple-variable.html; http://packetstormsecurity.org/0910-exploits/wowd-xss.txt; http://www.vupen.com/english/advisories/2009/3071
CVE: CVE-2009-4587
Published: 2010-01-07
Description: Cherokee Web Server 0.5.4 allows remote attackers to cause a denial of service (daemon crash) via an MS-DOS reserved word in a URI, as demonstrated by the AUX reserved word.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/507456/100/0/threaded; http://www.securityfocus.com/archive/1/507651/100/0/thread; http://www.securityfocus.com/bid/36814
CVE: CVE-2009-4588
Published: 2010-01-07
Description: Heap-based buffer overflow in the WindsPlayerIE.View.1 ActiveX control in WindsPly.ocx 3.5.0.0 Beta, 3.0.0.5, and earlier in AwingSoft Awakening Web3D Player and Winds3D Viewer allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long SceneUrl property value, a different vulnerability than CVE-2009-2386.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/35764; http://www.exploit-db.com/exploits/9116; http://www.shinnai.net/exploits/nsGUdeley3EHfKEV690p.txt
CVE: CVE-2009-4589
Published: 2010-01-07
Description: Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-July/000087.html; http://osvdb.org/55824; http://secunia.com/advisories/35818
CVE: CVE-2009-4590
Published: 2010-01-07
Description: Cross-site scripting (XSS) vulnerability in base_local_rules.php in Basic Analysis and Security Engine (BASE) before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://base.secureideas.net/news.php; http://secunia.com/advisories/37147; http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/docs/CHANGELOG?revision=1.359&view=markup