deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1336
Published: 2010-04-09
Description: Multiple SQL injection vulnerabilities in INVOhost 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) newlanguage parameters to site.php, (3) search parameter to manuals.php, and (4) unspecified vectors to faq.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63157; http://osvdb.org/63158; http://secunia.com/advisories/39095
CVE: CVE-2010-1337
Published: 2010-04-09
Description: Multiple PHP remote file inclusion vulnerabilities in definitions.php in Lussumo Vanilla 1.1.10, and possibly 0.9.2 and other versions, allow remote attackers to execute arbitrary PHP code via a URL in the (1) include and (2) Configuration['LANGUAGE'] parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.packetstormsecurity.com/1003-exploits/vanilla-rfi.txt; http://www.securityfocus.com/bid/38889; https://exchange.xforce.ibmcloud.com/vulnerabilities/57147
CVE: CVE-2010-1338
Published: 2010-04-09
Description: SQL injection vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to execute arbitrary SQL commands via the userid parameter in a modboard action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://4004securityproject.wordpress.com/2010/03/22/woltlab-burning-board-teamsite-hack-v3-0-ts_other-php-sql-injection-exploit-2/; http://445544.44.ohost.de/worldlabburningboardadon2python-1.txt; http://osvdb.org/63126
CVE: CVE-2010-1339
Published: 2010-04-09
Description: Cross-site scripting (XSS) vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to inject arbitrary web script or HTML via the userid parameter in a modboard action, which is not properly handled in a forced SQL error message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39009; http://secunia.com/advisories/39009
CVE: CVE-2010-1340
Published: 2010-04-09
Description: Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63147; http://packetstormsecurity.org/1003-exploits/joomlajresearch-lfi.txt; http://secunia.com/advisories/39079
CVE: CVE-2010-1341
Published: 2010-04-09
Description: SQL injection vulnerability in index.php in Systemsoftware Community Black Forum allows remote attackers to execute arbitrary SQL commands via the s_flaeche parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/38960; http://www.exploit-db.com/exploits/11715; http://www.osvdb.org/62920
CVE: CVE-2010-1342
Published: 2010-04-09
Description: Multiple PHP remote file inclusion vulnerabilities in Direct News 4.10.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to (1) admin/menu.php and (2) library/lib.menu.php; and the adminroot parameter to (3) admin/media/update_content.php and (4) library/class.backup.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/39106; http://www.exploit-db.com/exploits/11882; http://www.securityfocus.com/bid/38975
CVE: CVE-2010-1343
Published: 2010-04-09
Description: SQL injection vulnerability in photo.php in SiteX 0.7.4 beta allows remote attackers to execute arbitrary SQL commands via the albumid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/11881; http://www.securityfocus.com/bid/38976; https://exchange.xforce.ibmcloud.com/vulnerabilities/57173
CVE: CVE-2010-1344
Published: 2010-04-09
Description: SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1003-exploits/joomlackforms-lfisql.txt; http://secunia.com/advisories/38976; http://www.exploit-db.com/exploits/11785
CVE: CVE-2010-1345
Published: 2010-04-09
Description: Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1003-exploits/joomlackforms-lfisql.txt; http://secunia.com/advisories/38976; http://www.exploit-db.com/exploits/11785
CVE: CVE-2010-1346
Published: 2010-04-09
Description: SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the login parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/63121; http://packetstormsecurity.org/1003-exploits/minicmsribafs-sql.txt; http://secunia.com/advisories/39018
CVE: CVE-2010-1148
Published: 2010-04-12
Description: The cifs_create function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a NULL nameidata (aka nd) field in a POSIX file-creation request to a server that supports UNIX extensions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: http://lists.samba.org/archive/linux-cifs-client/2010-April/005741.html; http://lists.samba.org/archive/linux-cifs-client/2010-April/005742.html; http://lists.samba.org/archive/linux-cifs-client/2010-April/005746.html
CVE: CVE-2010-1347
Published: 2010-04-12
Description: Director Agent 6.1 before 6.1.2.3 in IBM Systems Director on AIX and Linux uses incorrect permissions for the (1) diruninstall and (2) opt/ibm/director/bin/wcitinst scripts, which allows local users to gain privileges by executing these scripts.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/63595; http://secunia.com/advisories/39194; http://www-01.ibm.com/support/docview.wss?uid=isg1PM08236
CVE: CVE-2010-1348
Published: 2010-04-12
Description: Unspecified vulnerability in the login process in IBM WebSphere Portal 6.0.1.1, and 6.1.0.x before 6.1.0.3 Cumulative Fix 03, has unknown impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/63594; http://secunia.com/advisories/39305; http://www-01.ibm.com/support/docview.wss?uid=swg1PM08667
CVE: CVE-2009-1564
Published: 2010-04-12
Description: Heap-based buffer overflow in vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to execute arbitrary code via an AVI file with crafted video chunks that use HexTile encoding.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=866
CVE: CVE-2009-1565
Published: 2010-04-12
Description: vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to execute arbitrary code via an AVI file with crafted HexTile-encoded video chunks that trigger heap-based buffer overflows, related to "integer truncation errors."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://lists.vmware.com/pipermail/security-announce/2010/000090.html
CVE: CVE-2009-3732
Published: 2010-04-12
Description: Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://lists.vmware.com/pipermail/security-announce/2010/000090.html
CVE: CVE-2010-0741
Published: 2010-04-12
Description: The virtio_net_bad_features function in hw/virtio-net.c in the virtio-net driver in the Linux kernel before 2.6.26, when used on a guest OS in conjunction with qemu-kvm 0.11.0 or KVM 83, allows remote attackers to cause a denial of service (guest OS crash, and an associated qemu-kvm process exit) by sending a large amount of network traffic to a TCP port on the guest OS, related to a virtio-net whitelist that includes an improper implementation of TCP Segment Offloading (TSO).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=184bd0484533b725194fa517ddc271ffd74da7c9; http://lists.gnu.org/archive/html/qemu-devel/2009-10/msg02480.html; http://lists.gnu.org/archive/html/qemu-devel/2009-10/msg02495.html
CVE: CVE-2010-1138
Published: 2010-04-12
Description: The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1 build 227600, VMware Player 2.5.x before 2.5.4 build 246459 on Windows, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware Server 2.x, and VMware Fusion 3.0 before 3.0.1 build 232708 and 2.x before 2.0.7 build 246742 allows remote attackers to obtain sensitive information from memory on the host OS by examining received network packets, related to interaction between the guest OS and the host vmware-vmx process.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://lists.vmware.com/pipermail/security-announce/2010/000090.html
CVE: CVE-2010-1139
Published: 2010-04-12
Description: Format string vulnerability in vmrun in VMware VIX API 1.6.x, VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Linux, and VMware Fusion 2.x before 2.0.7 build 246742, allows local users to gain privileges via format string specifiers in process metadata.
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://lists.vmware.com/pipermail/security-announce/2010/000090.html
CVE: CVE-2010-1140
Published: 2010-04-12
Description: The USB service in VMware Workstation 7.0 before 7.0.1 build 227600 and VMware Player 3.0 before 3.0.1 build 227600 on Windows might allow host OS users to gain privileges by placing a Trojan horse program at an unspecified location on the host OS disk.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://lists.vmware.com/pipermail/security-announce/2010/000090.html
CVE: CVE-2010-1141
Published: 2010-04-12
Description: VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x before 2.0.2 build 203138; VMware Fusion 2.x before 2.0.6 build 246742; VMware ESXi 3.5 and 4.0; and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0 does not properly access libraries, which allows user-assisted remote attackers to execute arbitrary code by tricking a Windows guest OS user into clicking on a file that is stored on a network share.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://lists.vmware.com/pipermail/security-announce/2010/000090.html
CVE: CVE-2010-1142
Published: 2010-04-12
Description: VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x before 2.0.2 build 203138; VMware Fusion 2.x before 2.0.6 build 246742; VMware ESXi 3.5 and 4.0; and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0 does not properly load VMware programs, which might allow Windows guest OS users to gain privileges by placing a Trojan horse program at an unspecified location on the guest OS disk.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://lists.vmware.com/pipermail/security-announce/2010/000090.html
CVE: CVE-2010-1146
Published: 2010-04-12
Description: The Linux kernel 2.6.33.2 and earlier, when a ReiserFS filesystem exists, does not restrict read or write access to the .reiserfs_priv directory, which allows local users to gain privileges by modifying (1) extended attributes or (2) ACLs, as demonstrated by deleting a file under .reiserfs_priv/xattrs/.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]2155&w=2; http://osvdb.org/63601; http://secunia.com/advisories/39316
CVE: CVE-2010-1149
Published: 2010-04-12
Description: probers/udisks-dm-export.c in udisks before 1.0.1 exports UDISKS_DM_TARGETS_PARAMS information to udev even for a crypt UDISKS_DM_TARGETS_TYPE, which allows local users to discover encryption keys by (1) running a certain udevadm command or (2) reading a certain file under /dev/.udev/db/.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576687; http://cgit.freedesktop.org/udisks/commit/?id=0fcc7cb3b66f23fac53ae08647aa0007a2bd56c4; http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039060.html
CVE: CVE-2010-1152
Published: 2010-04-12
Description: memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://blogs.sun.com/security/entry/input_validation_vulnerability_in_memcached; http://code.google.com/p/memcached/issues/detail?id=102; http://github.com/memcached/memcached/commit/75cc83685e103bc8ba380a57468c8f04413033f9
CVE: CVE-2010-1349
Published: 2010-04-12
Description: Integer overflow in Opera 10.10 through 10.50 allows remote attackers to execute arbitrary code via a large Content-Length value, which triggers a heap overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://my.opera.com/securitygroup/blog/2010/03/09/the-malformed-content-length-header-security-issue; http://osvdb.org/62714; http://secunia.com/advisories/38820
CVE: CVE-2010-1350
Published: 2010-04-12
Description: SQL injection vulnerability in the JP Jobs (com_jp_jobs) component 1.4.1 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/joomlajpjobs-sql.txt; http://secunia.com/advisories/39325; http://www.exploit-db.com/exploits/12037
CVE: CVE-2010-1351
Published: 2010-04-12
Description: Multiple PHP remote file inclusion vulnerabilities in Nodesforum 1.033 and 1.045, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) _nodesforum_path_from_here_to_nodesforum_folder parameter to erase_user_data.php and the (2) _nodesforum_code_path parameter to pre_output.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/39311; http://www.exploit-db.com/exploits/12047; https://exchange.xforce.ibmcloud.com/vulnerabilities/57517
CVE: CVE-2010-1352
Published: 2010-04-12
Description: Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlajukebox-lfi.txt; http://secunia.com/advisories/39357; http://www.exploit-db.com/exploits/12084
CVE: CVE-2010-1353
Published: 2010-04-12
Description: Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaloginbox-lfi.txt; http://secunia.com/advisories/39349; http://www.exploit-db.com/exploits/12068
CVE: CVE-2010-1354
Published: 2010-04-12
Description: Directory traversal vulnerability in the VJDEO (com_vjdeo) component 1.0 and 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlavjdeo-lfi.txt; http://secunia.com/advisories/39296; http://www.exploit-db.com/exploits/12102
CVE: CVE-2009-4509
Published: 2010-04-13
Description: The administrative web console on the TANDBERG Video Communication Server (VCS) before X4.3 uses predictable session cookies in (1) tandberg/web/lib/secure.php and (2) tandberg/web/user/lib/secure.php, which makes it easier for remote attackers to bypass authentication, and execute arbitrary code by loading a custom software update, via a crafted "Cookie: tandberg_login=" HTTP header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://ftp.tandberg.com/pub/software/vcs/TANDBERG%20Video%20Communication%20Server%20Software%20Release%20Notes%20%28X4%29.pdf; http://secunia.com/advisories/39275; http://www.securityfocus.com/archive/1/510672/100/0/threaded
CVE: CVE-2009-4510
Published: 2010-04-13
Description: The SSH service on the TANDBERG Video Communication Server (VCS) before X5.1 uses a fixed DSA key, which makes it easier for remote attackers to conduct man-in-the-middle attacks and spoof arbitrary servers via crafted SSH packets.
CVSS Score: 8.5 (HIGH)
CWE: CWE-310
References: http://ftp.tandberg.com/pub/software/vcs/TANDBERG%20Video%20Communication%20Server%20Software%20Release%20Notes%20%28X5%29.pdf; http://secunia.com/advisories/39275; http://www.vsecurity.com/resources/advisory/20100409-2
CVE: CVE-2009-4511
Published: 2010-04-13
Description: Multiple directory traversal vulnerabilities in the web administration interface on the TANDBERG Video Communication Server (VCS) before X5.1 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the page parameter to (1) helppage.php or (2) user/helppage.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/39275; http://www.securityfocus.com/archive/1/510670/100/0/threaded; http://www.vsecurity.com/resources/advisory/20100409-3
CVE: CVE-2010-1355
Published: 2010-04-13
Description: Cross-site scripting (XSS) vulnerability on the TANDBERG Video Communication Server (VCS) before X5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Reference ID 66316.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ftp.tandberg.com/pub/software/vcs/TANDBERG%20Video%20Communication%20Server%20Software%20Release%20Notes%20%28X5%29.pdf; http://ftp.tandberg.com/pub/software/vcs/TANDBERG%20Video%20Communication%20Server%20Software%20Release%20Notes%20%28X5%29.pdf
CVE: CVE-2010-1356
Published: 2010-04-13
Description: Unspecified vulnerability on the TANDBERG Video Communication Server (VCS) before X5.0 allows remote attackers to execute arbitrary code via unknown vectors, aka Reference ID 69773.
CVSS Score: 10.0 (HIGH)
References: http://ftp.tandberg.com/pub/software/vcs/TANDBERG%20Video%20Communication%20Server%20Software%20Release%20Notes%20%28X5%29.pdf; http://ftp.tandberg.com/pub/software/vcs/TANDBERG%20Video%20Communication%20Server%20Software%20Release%20Notes%20%28X5%29.pdf
CVE: CVE-2009-4765
Published: 2010-04-13
Description: CNR Hikaye Portal 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/hikaye.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/1001-exploits/aspcnrhikaye-disclose.txt; http://secunia.com/advisories/38103; http://www.osvdb.org/61480
CVE: CVE-2009-4766
Published: 2010-04-13
Description: YP Portal MS-Pro Surumu (aka MS-Pro Portal Scripti) 1.0 and 1.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for galeri/database/db.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/1001-exploits/ypportal-disclose.txt; http://secunia.com/advisories/38119; http://www.osvdb.org/61467
CVE: CVE-2010-1357
Published: 2010-04-13
Description: Cross-site scripting (XSS) vulnerability in editors/logindialogue.php in SBD Directory Software 4.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/sbddirectory-xss.txt; http://secunia.com/advisories/38148; http://www.exploit-db.com/exploits/11118
CVE: CVE-2010-1358
Published: 2010-04-13
Description: Cross-site scripting (XSS) vulnerability in the Bibliography (Biblio) module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users, with "administer biblio" privileges, to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/683786; http://secunia.com/advisories/38207; http://www.securityfocus.com/bid/37804
CVE: CVE-2010-1359
Published: 2010-04-13
Description: SQL injection vulnerability in bluegate_seo.inc.php in the Direct URL module for xt:Commerce, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the coID parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/38197; http://www.securityfocus.com/bid/37808; http://secunia.com/advisories/38197
CVE: CVE-2010-1360
Published: 2010-04-13
Description: Multiple PHP remote file inclusion vulnerabilities in FAQEngine 4.24.00 allow remote attackers to execute arbitrary PHP code via a URL in the path_faqe parameter to (1) attachs.php, (2) backup.php, (3) badwords.php, (4) categories.php, (5) changepw.php, (6) colorchooser.php, (7) colorwheel.php, (8) dbfiles.php, (9) diraccess.php, (10) faq.php, (11) index.php, (12) kb.php, and (13) stats.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1001-exploits/faqengine-rfi.txt; http://www.exploit-db.com/exploits/11111; http://www.securityfocus.com/bid/37719