deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1726
Published: 2010-05-06
Description: SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/ec21clone-sql.txt; http://www.exploit-db.com/exploits/12459; http://www.securityfocus.com/bid/39832
CVE: CVE-2010-1727
Published: 2010-05-06
Description: SQL injection vulnerability in type.asp in JobPost 1.0 allows remote attackers to execute arbitrary SQL commands via the iType parameter. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/jobpost-sql.txt; http://secunia.com/advisories/39708; http://www.exploit-db.com/exploits/12461
CVE: CVE-2010-1728
Published: 2010-05-06
Description: Opera before 10.53 on Windows and Mac OS X does not properly handle a series of document modifications that occur asynchronously, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via JavaScript that writes <marquee> sequences in an infinite loop, leading to attempted use of uninitialized memory.  NOTE: this might overlap CVE-2006-6955.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://h.ackack.net/?p=258; http://my.opera.com/desktopteam/blog/2010/04/28/opera-10-53-rc1-for-windows-and-mac; http://secunia.com/advisories/39590
CVE: CVE-2010-1729
Published: 2010-05-06
Description: WebKit.dll in WebKit, as used in Safari.exe 4.531.9.1 in Apple Safari, allows remote attackers to cause a denial of service (application crash) via JavaScript that writes <marquee> sequences in an infinite loop.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://h.ackack.net/?p=258; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/43068
CVE: CVE-2010-1730
Published: 2010-05-06
Description: Dolphin Browser 2.5.0 on the HTC Hero allows remote attackers to cause a denial of service (application crash) via JavaScript that writes <marquee> sequences in an infinite loop.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://h.ackack.net/?p=258; http://h.ackack.net/?p=258
CVE: CVE-2010-1731
Published: 2010-05-06
Description: Google Chrome on the HTC Hero allows remote attackers to cause a denial of service (application crash) via JavaScript that writes <marquee> sequences in an infinite loop.
CVSS Score: 4.3 (MEDIUM)
References: http://h.ackack.net/?p=258; http://h.ackack.net/?p=258
CVE: CVE-2010-1736
Published: 2010-05-06
Description: KrM Haber 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for d_atabase/Krmdb.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/64217; http://packetstormsecurity.org/1004-exploits/krmhaber-disclose.txt; http://secunia.com/advisories/39700
CVE: CVE-2010-1737
Published: 2010-05-06
Description: PHP remote file inclusion vulnerability in core/includes/gfw_smarty.php in Gallo 0.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the config[gfwroot] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.org/1005-exploits/gallo-rfi.txt; http://secunia.com/advisories/39706; http://www.exploit-db.com/exploits/12488
CVE: CVE-2010-1738
Published: 2010-05-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-1448.  Reason: This candidate is a duplicate of CVE-2010-1448.  Notes: All CVE users should reference CVE-2010-1448 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-1739
Published: 2010-05-06
Description: SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the feedid parameter in a categories action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/joomlanewsfeeds-sql.txt; http://www.exploit-db.com/exploits/12465; http://www.securityfocus.com/bid/39834
CVE: CVE-2010-1740
Published: 2010-05-06
Description: SQL injection vulnerability in newsletter.php in GuppY 4.5.18 allows remote attackers to execute arbitrary SQL commands via the lng parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1005-exploits/guppy-sql.txt; http://www.exploit-db.com/exploits/12484; http://www.securityfocus.com/bid/39860
CVE: CVE-2010-1741
Published: 2010-05-06
Description: SQL injection vulnerability in request_account.php in Billwerx RC 5.2.2 PL2 allows remote attackers to execute arbitrary SQL commands via the primary_number parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1005-exploits/billwerx-sql.txt; http://www.securityfocus.com/bid/39867; https://exchange.xforce.ibmcloud.com/vulnerabilities/58278
CVE: CVE-2010-1742
Published: 2010-05-06
Description: Cross-site scripting (XSS) vulnerability in projects.php in Scratcher allows remote attackers to inject arbitrary web script or HTML via the show parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/64219; http://packetstormsecurity.org/1004-exploits/scratcher-sqlxss.txt; http://secunia.com/advisories/39631
CVE: CVE-2010-1743
Published: 2010-05-06
Description: SQL injection vulnerability in projects.php in Scratcher allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/64220; http://packetstormsecurity.org/1004-exploits/scratcher-sqlxss.txt; http://secunia.com/advisories/39631
CVE: CVE-2010-1744
Published: 2010-05-06
Description: SQL injection vulnerability in product.html in B2B Gold Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/64212; http://packetstormsecurity.org/1004-exploits/b2bgoldscript-sql.txt; http://secunia.com/advisories/39710
CVE: CVE-2010-1745
Published: 2010-05-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-1867.  Reason: This candidate is a duplicate of CVE-2010-1867.  Notes: All CVE users should reference CVE-2010-1867 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-1746
Published: 2010-05-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Table JX (com_grid) component for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) data_search and (2) rpp parameters to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/12473; http://www.securityfocus.com/bid/39854; http://www.vupen.com/english/advisories/2010/1053
CVE: CVE-2009-4842
Published: 2010-05-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in ToutVirtual VirtualIQ Pro 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the (1) addNewDept, (2) deptId, or (3) deptDesc parameter to tvserver/server/user/addDepartment.jsp; or the (4) firstName, (5) lastName, or (6) email parameter in a save action to tvserver/user/user.do.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37359; http://secunia.com/advisories/37359
CVE: CVE-2009-4843
Published: 2010-05-07
Description: ToutVirtual VirtualIQ Pro before 3.5 build 8691 does not require administrative authentication for JBoss console access, which allows remote attackers to execute arbitrary commands via requests to (1) the JMX Management Console or (2) the Web Console.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/37297; http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt; http://www.securityfocus.com/archive/1/507729/100/0/threaded
CVE: CVE-2009-4844
Published: 2010-05-07
Description: ToutVirtual VirtualIQ Pro 3.2 build 7882 does not restrict access to the /status URI on port 9080, which allows remote attackers to obtain sensitive Tomcat information via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt; http://www.securityfocus.com/archive/1/507729/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/58576
CVE: CVE-2009-4845
Published: 2010-05-07
Description: The configuration page in ToutVirtual VirtualIQ Pro 3.2 build 7882 contains cleartext SSH credentials, which allows remote attackers to obtain sensitive information by reading the username and password fields.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt; http://www.securityfocus.com/archive/1/507729/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/58575
CVE: CVE-2010-0827
Published: 2010-05-07
Description: Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted virtual font (VF) file associated with a DVI file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://security-tracker.debian.org/tracker/CVE-2010-0827
CVE: CVE-2010-0829
Published: 2010-05-07
Description: Multiple array index errors in set.c in dvipng 1.11 and 1.12, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed DVI file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041587.html; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
CVE: CVE-2010-1143
Published: 2010-05-07
Description: Cross-site scripting (XSS) vulnerability in VMware View (formerly Virtual Desktop Manager or VDM) 3.1.x before 3.1.3 build 252693 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.vmware.com/pipermail/security-announce/2010/000092.html; http://security.gentoo.org/glsa/glsa-201209-25.xml; http://securitytracker.com/id?1023945
CVE: CVE-2010-1167
Published: 2010-05-07
Description: fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does not properly handle invalid characters in a multi-character locale, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted (1) message header or (2) POP3 UIDL list.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://developer.berlios.de/project/shownotes.php?group_id=1824&release_id=17512; http://www.fetchmail.info/fetchmail-SA-2010-02.txt; http://www.mandriva.com/security/advisories?name=MDVSA-2011:107
CVE: CVE-2010-1440
Published: 2010-05-07
Description: Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a special command in a DVI file, related to the (1) predospecial and (2) bbdospecial functions, a different vulnerability than CVE-2010-0739.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041573.html; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
CVE: CVE-2010-1453
Published: 2010-05-07
Description: Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/; http://secunia.com/advisories/39666; http://www.openwall.com/lists/oss-security/2010/05/05/3
CVE: CVE-2010-1549
Published: 2010-05-07
Description: Unspecified vulnerability in the Agent in HP LoadRunner before 9.50 and HP Performance Center before 9.50 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://seclists.org/bugtraq/2010/May/69; http://www.securityfocus.com/archive/1/511146/100/0/threaded; https://www.exploit-db.com/exploits/43411/
CVE: CVE-2010-1851
Published: 2010-05-07
Description: Google Chrome, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a "cross-site data leakage" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.cnet.com/8301-31361_1-20004265-254.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11757; http://www.cnet.com/8301-31361_1-20004265-254.html
CVE: CVE-2010-1852
Published: 2010-05-07
Description: Microsoft Internet Explorer, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a "cross-site data leakage" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.cnet.com/8301-31361_1-20004265-254.html; http://www.cnet.com/8301-31361_1-20004265-254.html
CVE: CVE-2009-4846
Published: 2010-05-07
Description: Multiple buffer overflows in Deliantra Server before 2.82 allow remote attackers to execute arbitrary code via vectors related to (1) the command_gsay function in server/c_party.C and (2) the book implementation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://cvs.schmorp.de/deliantra/server/Changes?pathrev=rel-2_82; http://cvs.schmorp.de/deliantra/server/server/c_party.C?r1=1.29&r2=1.30; http://secunia.com/advisories/37317
CVE: CVE-2009-4847
Published: 2010-05-07
Description: Deliantra Server before 2.82 allows remote authenticated users to cause a denial of service (daemon crash) via vectors involving an empty treasure list.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://cvs.schmorp.de/deliantra/server/Changes?pathrev=rel-2_82; http://www.vupen.com/english/advisories/2009/3176; https://exchange.xforce.ibmcloud.com/vulnerabilities/54207
CVE: CVE-2009-4848
Published: 2010-05-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the (1) userId parameter to tvserver/server/user/setPermissions.jsp, (2) deptName parameter to tvserver/server/user/addDepartment.jsp, (3) ID parameter to tvserver/server/inventory/inventoryTabs.jsp, (4) reportName parameter to tvserver/reports/virtualIQAdminReports.do, or (5) middleName parameter in a save action to tvserver/user/user.do.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37359; http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt; http://www.securityfocus.com/archive/1/507729/100/0/threaded
CVE: CVE-2009-4849
Published: 2010-05-07
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new user account via a save action to tvserver/user/user.do, (2) shutdown a virtual machine, (3) start a virtual machine, (4) restart a virtual machine, or (5) schedule an activity.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/37359; http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt; http://www.securityfocus.com/archive/1/507729/100/0/threaded
CVE: CVE-2009-4850
Published: 2010-05-07
Description: The Awingsoft Awakening Winds3D Viewer plugin 3.5.0.9 allows remote attackers to execute arbitrary programs via a SceneURL property value with a URL for a .exe file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/60049; http://secunia.com/advisories/35764; http://www.metasploit.com/modules/exploit/windows/browser/awingsoft_winds3d_sceneurl
CVE: CVE-2009-4851
Published: 2010-05-07
Description: The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/37274; http://www.vupen.com/english/advisories/2009/3256; http://www.xoops.org/modules/newbb/viewtopic.php?post_id=319132
CVE: CVE-2009-4852
Published: 2010-05-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in SemanticScuttle before 0.94.1 allow remote attackers to inject arbitrary web script or HTML via the sort parameter to index.php, and other unspecified vectors, a different issue than CVE-2008-6113.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37387; http://semanticscuttle.svn.sourceforge.net/viewvc/semanticscuttle/branches/0.94.1/ChangeLog?view=markup&pathrev=471; http://secunia.com/advisories/37387
CVE: CVE-2009-4853
Published: 2010-05-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in JumpBox before 1.1.2 for Foswiki Wiki System allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://static.jumpbox.com/README/README-foswiki.txt; http://www.vupen.com/english/advisories/2009/3258; https://exchange.xforce.ibmcloud.com/vulnerabilities/58588
CVE: CVE-2010-1173
Published: 2010-05-07
Description: The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://article.gmane.org/gmane.linux.network/159531; http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809; http://kbase.redhat.com/faq/docs/DOC-31052
CVE: CVE-2010-1437
Published: 2010-05-07
Description: Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]7857&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]2730&w=2
CVE: CVE-2010-1451
Published: 2010-05-07
Description: The TSB I-TLB load implementation in arch/sparc/kernel/tsb.S in the Linux kernel before 2.6.33 on the SPARC platform does not properly obtain the value of a certain _PAGE_EXEC_4U bit and consequently does not properly implement a non-executable stack, which makes it easier for context-dependent attackers to exploit stack-based buffer overflows via a crafted application.
CVSS Score: 2.1 (LOW)
CWE: CWE-787
References: http://marc.info/?l=linux-sparc&m=[PII_REDACTED]2378&w=2; http://marc.info/?l=linux-sparc&m=[PII_REDACTED]2830&w=2; http://secunia.com/advisories/39830
CVE: CVE-2010-1689
Published: 2010-05-07
Description: The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange Server 2007 SP2 and earlier, and Exchange Server 2010 uses predictable transaction IDs that are formed by incrementing a previous ID by 1, which makes it easier for man-in-the-middle attackers to spoof DNS responses, a different vulnerability than CVE-2010-0024 and CVE-2010-0025.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0058.html; http://securitytracker.com/id?1023939; http://www.coresecurity.com/content/CORE-2010-0424-windows-smtp-dns-query-id-bugs
CVE: CVE-2010-1690
Published: 2010-05-07
Description: The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange Server 2007 SP2 and earlier, and Exchange Server 2010 does not verify that transaction IDs of responses match transaction IDs of queries, which makes it easier for man-in-the-middle attackers to spoof DNS responses, a different vulnerability than CVE-2010-0024 and CVE-2010-0025.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0058.html; http://securitytracker.com/id?1023939; http://www.coresecurity.com/content/CORE-2010-0424-windows-smtp-dns-query-id-bugs
CVE: CVE-2010-1853
Published: 2010-05-07
Description: Multiple stack-based buffer overflows in the tr_magnetParse function in libtransmission/magnet.c in Transmission 1.91 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted magnet URL with a large number of (1) tr or (2) ws links.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/39031; http://trac.transmissionbt.com/changeset/10279; http://trac.transmissionbt.com/ticket/2965
CVE: CVE-2010-1854
Published: 2010-05-07
Description: Cross-site scripting (XSS) vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to inject arbitrary web script or HTML via the id_auk parameter, which is not properly handled in a forced SQL error message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this might be resultant from CVE-2010-1855.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39059; http://secunia.com/advisories/39059
CVE: CVE-2010-1855
Published: 2010-05-07
Description: SQL injection vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://4004securityproject.wordpress.com/2010/03/20/pay-per-watch-bid-auktions-system-blind-sql-injection-auktion-php-id_auk/; http://osvdb.org/63131; http://packetstormsecurity.org/1003-exploits/ppwb-sql.txt
CVE: CVE-2010-1856
Published: 2010-05-07
Description: Cross-site scripting (XSS) vulnerability in index.php in RepairShop2 1.9.023 Trial, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the prod parameter in a products.details action.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.org/1003-exploits/repairshop2-xss.txt; http://secunia.com/advisories/39043; http://www.securityfocus.com/bid/38907