deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0359
Published: 2009-02-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Samizdat before 0.6.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message title or (2) user full name.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/52022; http://samizdat.nongnu.org/release-notes/samizdat-0.6.1-xss-escape-title.patch; http://www.mail-archive.com/debian-testing-security-announce%40lists.debian.org/msg00171.html
CVE: CVE-2009-0363
Published: 2009-02-17
Description: Multiple buffer overflows in (a) BarnOwl before 1.0.5 and (b) owl 2.1.11 allow remote attackers to execute arbitrary code via vectors involving (1) a crafted zcrypt message, related to zcrypt.c; (2) a reply command on a message with a Zephyr Cc: list, related to zwrite.c; and unspecified other use of the products.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://barnowl.mit.edu/browser/ChangeLog; http://barnowl.mit.edu/wiki/barnowl-1.0.5-announce; http://bugs.debian.org/515118
CVE: CVE-2009-0504
Published: 2009-02-17
Description: WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg27014463; http://www-1.ibm.com/support/docview.wss?uid=swg1PK73573; https://exchange.xforce.ibmcloud.com/vulnerabilities/48700
CVE: CVE-2009-0605
Published: 2009-02-17
Description: Stack consumption vulnerability in the do_page_fault function in arch/x86/mm/fault.c in the Linux kernel before 2.6.28.5 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via unspecified vectors that trigger page faults on a machine that has a registered Kprobes probe.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=9be260a646bf76fa418ee519afa10196b3164681; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.5; http://www.securityfocus.com/bid/33758
CVE: CVE-2009-0606
Published: 2009-02-17
Description: The link_image function in linker/linker.c in the dynamic linker in Bionic in Open Handset Alliance Android 1.0 on the T-Mobile G1 phone does not properly handle file descriptors 0, 1, and 2 for a setgid program, which allows local users to create arbitrary files owned by certain groups, possibly a related issue to CVE-2002-0820.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/500753/100/0/threaded; http://www.securityfocus.com/bid/33695; https://exchange.xforce.ibmcloud.com/vulnerabilities/48840
CVE: CVE-2009-0607
Published: 2009-02-17
Description: Multiple integer overflows in malloc_leak.c in Bionic in Open Handset Alliance Android 1.0 have unknown impact and attack vectors, related to the (1) chk_calloc and (2) leak_calloc functions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://www.securityfocus.com/archive/1/500753/100/0/threaded; http://www.securityfocus.com/bid/33695; https://exchange.xforce.ibmcloud.com/vulnerabilities/48841
CVE: CVE-2009-0608
Published: 2009-02-17
Description: Integer overflow in the showLog function in fake_log_device.c in liblog in Open Handset Alliance Android 1.0 allows attackers to trigger a buffer overflow and possibly have unspecified other impact by sending a large number of input lines.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://www.securityfocus.com/archive/1/500753/100/0/threaded; http://www.securityfocus.com/bid/33695; https://exchange.xforce.ibmcloud.com/vulnerabilities/48842
CVE: CVE-2009-0609
Published: 2009-02-17
Description: Sun Java System Directory Proxy Server in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3, when a JDBC data source is used, does not properly handle (1) a long value in an ADD or (2) long string attributes, which allows remote attackers to cause a denial of service (JDBC backend outage) via crafted LDAP requests.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/33923; http://sunsolve.sun.com/search/document.do?assetkey=1-21-125276-08-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-251086-1
CVE: CVE-2009-0610
Published: 2009-02-17
Description: Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.txt via the (1) title or (2) date parameter, and then execute the code via a direct request to display.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/51816; http://secunia.com/advisories/33814; http://osvdb.org/51816
CVE: CVE-2009-0611
Published: 2009-02-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterprise Server 1.x allow remote attackers to inject arbitrary web script or HTML via (1) the siteloc parameter in a displayaddsite action, the site parameter in a (2) generalproperties or (3) clusterserviceproperties action, (4) the adminurl parameter in a global action, or (5) the print-list parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51941; http://packetstormsecurity.org/0902-exploits/nqfs-xss.txt; http://secunia.com/advisories/33886
CVE: CVE-2009-0612
Published: 2009-02-17
Description: Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x, when basic authorization is enabled on the standalone proxy, forwards the Proxy-Authorization header from Windows Media Player, which allows remote web servers to obtain credentials by offering a media stream and then capturing this header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/33891; http://www.securityfocus.com/archive/1/500760/100/0/threaded; http://www.securityfocus.com/bid/33687
CVE: CVE-2009-0613
Published: 2009-02-17
Description: Trend Micro InterScan Web Security Suite (IWSS) 3.1 before build 1237 allows remote authenticated Auditor and Report Only users to bypass intended permission settings, and modify the system configuration, via requests to unspecified JSP pages.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33867; http://www.securitytracker.com/id?1021694; http://www.trendmicro.com/ftp/documentation/readme/iwss_31_win_en_readme_CP_1237_EN.txt
CVE: CVE-2008-6159
Published: 2009-02-18
Description: Content Management Made Easy (CMME) 1.19 allows remote attackers to obtain system information via a direct request to info.php, which invokes the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/32169; http://www.bugreport.ir/index_55.htm; http://www.securityfocus.com/archive/1/497029/100/0/threaded
CVE: CVE-2008-6160
Published: 2009-02-18
Description: Semantically-Interconnected Online Communities (SIOC) 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, does not properly implement menu and database APIs, which allows remote attackers to obtain usernames and read hashed emails and comments via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/318749; http://secunia.com/advisories/32191; http://www.securityfocus.com/bid/31658
CVE: CVE-2008-6161
Published: 2009-02-18
Description: Cross-site scripting (XSS) vulnerability in WOW Raid Manager (WRM) before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32172; http://sourceforge.net/project/shownotes.php?release_id=631789; http://www.wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2044.post
CVE: CVE-2009-0310
Published: 2009-02-18
Description: Buffer overflow in SUSE blinux (aka sbl) in SUSE openSUSE 10.3 through 11.0 has unknown impact and attack vectors related to "incoming data and authentication-strings."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://www.securityfocus.com/bid/33794; https://exchange.xforce.ibmcloud.com/vulnerabilities/48797
CVE: CVE-2009-0639
Published: 2009-02-18
Description: PHP remote file inclusion vulnerability in moduli/libri/index.php in phpyabs 0.1.2 allows remote attackers to execute arbitrary PHP code via a URL in the Azione parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/33670; http://www.vupen.com/english/advisories/2009/0361; https://www.exploit-db.com/exploits/8005
CVE: CVE-2009-0644
Published: 2009-02-18
Description: The HTTP interface in Swann DVR4-SecuraNet has a certain default administrative username and password, which makes it easier for remote attackers to obtain privileged access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://packetstorm.linuxsecurity.com/0902-exploits/cctv-disclose.txt; http://www.securityfocus.com/archive/1/500789/100/0/threaded; http://packetstorm.linuxsecurity.com/0902-exploits/cctv-disclose.txt
CVE: CVE-2005-4878
Published: 2009-02-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (2) base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.2, and unspecified other console scripts in these products, allow remote attackers to inject arbitrary web script or HTML via the sig[1] parameter and possibly other parameters, a different vulnerability than CVE-2007-6156.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=336788; http://secunia.com/advisories/17523; http://www.debian.org/security/2005/dsa-893
CVE: CVE-2009-0645
Published: 2009-02-18
Description: Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) language, (2) Introduction_complete, and (3) use_log parameters, different vectors than CVE-2004-2445.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.jaws-project.com/blog/show/jaws-089-released; http://www.securityfocus.com/bid/33607; https://exchange.xforce.ibmcloud.com/vulnerabilities/48476
CVE: CVE-2009-0646
Published: 2009-02-18
Description: Multiple SQL injection vulnerabilities in 4Site CMS 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) password parameters to pcgi/4site.pl, (3) page parameter to print/print.shtml, (4) s and (5) i parameters to portfolio/index.shtml, (6) h parameter to hotel/index.php, (7) id parameter to news/news1.shtml, and the (8) th parameter to faq/index.shtml.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33733; http://wsec.ru/wsec-09-002-4site-cms-26-multiple-sql-injections/; http://www.htbridge.ch/advisory/sql_injection_in_4site_cms.html
CVE: CVE-2008-6165
Published: 2009-02-19
Description: SQL injection vulnerability in gestion.php in CSPartner 0.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the (1) pseudo and (2) passe parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32376; http://www.securityfocus.com/bid/31886; https://exchange.xforce.ibmcloud.com/vulnerabilities/46067
CVE: CVE-2008-6166
Published: 2009-02-19
Description: SQL injection vulnerability in the KBase (com_kbase) 1.2 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an article action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32365; http://www.securityfocus.com/bid/31902; https://exchange.xforce.ibmcloud.com/vulnerabilities/46076
CVE: CVE-2008-6167
Published: 2009-02-19
Description: Directory traversal vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lng parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/31895; https://exchange.xforce.ibmcloud.com/vulnerabilities/46079; https://www.exploit-db.com/exploits/6821
CVE: CVE-2008-6168
Published: 2009-02-19
Description: Cross-site scripting (XSS) vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified argument, probably the search string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/31895; https://exchange.xforce.ibmcloud.com/vulnerabilities/46080; https://www.exploit-db.com/exploits/6821
CVE: CVE-2008-6169
Published: 2009-02-19
Description: Cross-site request forgery (CSRF) vulnerability in the Localization client 5.x before 5.x-1.1 and 6.x before 6.x-1.6 and the Localization server 5.x before 5.x-1.0-alpha5 and 6.x before 6.x-alpha2, modules for Drupal, allows remote attackers to perform unauthorized actions as administrators via unspecified vectors related to the "local translation submission interface."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/324862; http://secunia.com/advisories/32388; https://exchange.xforce.ibmcloud.com/vulnerabilities/46044
CVE: CVE-2008-6170
Published: 2009-02-19
Description: Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/324824; http://secunia.com/advisories/32297; http://secunia.com/advisories/32441
CVE: CVE-2008-6171
Published: 2009-02-19
Description: includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.
CVSS Score: 9.3 (HIGH)
CWE: CWE-16, CWE-20
References: http://drupal.org/files/sa-2008-067/SA-2008-067-5.11.patch; http://drupal.org/node/324824; http://secunia.com/advisories/32389
CVE: CVE-2008-4392
Published: 2009-02-19
Description: dnscache in Daniel J. Bernstein djbdns 1.05 does not prevent simultaneous identical outbound DNS queries, which makes it easier for remote attackers to spoof DNS responses, as demonstrated by a spoofed A record in the Additional section of a response to a Start of Authority (SOA) query.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/33855; http://www.securityfocus.com/bid/33818; http://www.your.org/dnscache/
CVE: CVE-2008-6172
Published: 2009-02-19
Description: Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32367; http://www.securityfocus.com/bid/31892; https://exchange.xforce.ibmcloud.com/vulnerabilities/46081
CVE: CVE-2008-6173
Published: 2009-02-19
Description: Cross-site scripting (XSS) vulnerability in fullscreen.php in ClipShare Pro 4.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/31898.html; http://secunia.com/advisories/32399; http://www.securityfocus.com/bid/31898
CVE: CVE-2008-6174
Published: 2009-02-19
Description: Cross-site scripting (XSS) vulnerability in admin/postlister/index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the liste parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.digitrustgroup.com/advisories/web-application-security-jetbox2.html; http://www.securityfocus.com/bid/31890; https://exchange.xforce.ibmcloud.com/vulnerabilities/46082
CVE: CVE-2008-6175
Published: 2009-02-19
Description: SilverSHielD 1.0.2.34 allows remote attackers to cause a denial of service (application crash) via a crafted argument to the opendir SFTP command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/32374; http://www.securityfocus.com/bid/31884; https://exchange.xforce.ibmcloud.com/vulnerabilities/46064
CVE: CVE-2008-6176
Published: 2009-02-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-6171.  Reason: This candidate is a duplicate of CVE-2008-6171.  Notes: All CVE users should reference CVE-2008-6171 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-6177
Published: 2009-02-19
Description: Multiple directory traversal vulnerabilities in LightBlog 9.8, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) username parameter to view_member.php, (2) username_post parameter to login.php, and the (3) Lightblog_username cookie parameter to check_user.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32345; http://www.securityfocus.com/bid/31851; https://exchange.xforce.ibmcloud.com/vulnerabilities/46030
CVE: CVE-2008-6178
Published: 2009-02-19
Description: Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploading this file via a FileUpload action with the application/zip content type, and then accessing this file via a direct request to the file in UserFiles/File/, probably a related issue to CVE-2005-4094.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/33973; http://www.securityfocus.com/bid/31812; http://www.vupen.com/english/advisories/2009/0447
CVE: CVE-2009-0647
Published: 2009-02-19
Description: msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.8064.206, and other 14.0.8064.x builds, allows remote attackers to cause a denial of service (application crash) via a modified header in a packet, as possibly demonstrated by a UTF-8.0 value of the charset field in the Content-Type header line.  NOTE: this has been reported as a format string vulnerability by some sources, but the provenance of that information is unknown.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/33985; http://www.securityfocus.com/archive/1/501043/100/0/threaded; http://www.securityfocus.com/bid/33825
CVE: CVE-2009-0648
Published: 2009-02-19
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the manage_users handler in admin/index.php in Falt4 CMS (aka Falt4 Extreme) RC4 allow remote attackers to hijack the authentication of administrators for requests that change passwords via the (1) edit and (2) edit_now actions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstorm.linuxsecurity.com/0902-exploits/falt4-cms-xsrf.txt; http://secunia.com/advisories/33973; https://exchange.xforce.ibmcloud.com/vulnerabilities/48786
CVE: CVE-2008-6179
Published: 2009-02-19
Description: SQL injection vulnerability in sug_cat.php in IndexScript 3.0 allows remote attackers to execute arbitrary SQL commands via the parent_id parameter, a different vector than CVE-2007-4069.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32173; http://www.securityfocus.com/bid/31744; https://www.exploit-db.com/exploits/6746
CVE: CVE-2008-6180
Published: 2009-02-19
Description: SQL injection vulnerability in system/nlb_user.class.php in NewLife Blogger 3.0 and earlier, and possibly 3.3.1, allows remote attackers to execute arbitrary SQL commands via the nlb3 cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32214; http://www.pepelux.org/exploits/newlife-es.txt; http://www.securityfocus.com/archive/1/497283/100/0/threaded
CVE: CVE-2008-6181
Published: 2009-02-19
Description: SQL injection vulnerability in the Mad4Joomla Mailforms (com_mad4joomla) component before 1.1.8.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the jid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32239; http://www.mad4media.de/mad4joomla-mailforms-faq.html; http://www.mad4media.de/mad4joomla-mailforms.html
CVE: CVE-2008-6182
Published: 2009-02-19
Description: SQL injection vulnerability in the Ignite Gallery (com_ignitegallery) component 0.8.0 through 0.8.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gallery parameter in a view action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32240; http://www.securityfocus.com/bid/31714; https://exchange.xforce.ibmcloud.com/vulnerabilities/45816
CVE: CVE-2008-6183
Published: 2009-02-19
Description: Multiple directory traversal vulnerabilities in index.php in My PHP Indexer 1.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) d and (2) f parameters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32215; http://www.securityfocus.com/bid/31726; http://www.vupen.com/english/advisories/2008/2796
CVE: CVE-2008-6184
Published: 2009-02-19
Description: SQL injection vulnerability in the OwnBiblio (com_ownbiblio) component 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a catalogue action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32235; http://www.securityfocus.com/bid/31725; https://exchange.xforce.ibmcloud.com/vulnerabilities/45814
CVE: CVE-2008-6185
Published: 2009-02-19
Description: NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 requests with a long PASS command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/32202; http://www.securityfocus.com/bid/31697; http://www.vupen.com/english/advisories/2008/2802
CVE: CVE-2008-6186
Published: 2009-02-19
Description: Stack-based buffer overflow in RaidenFTPD 2.4 build 3620 allows remote authenticated users to cause a denial of service (crash) or execute arbitrary code via long (1) CWD and (2) MLST commands.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32216; http://www.securityfocus.com/bid/31741; http://www.vupen.com/english/advisories/2008/2804
CVE: CVE-2008-6187
Published: 2009-02-19
Description: SQL injection vulnerability in frs/shownotes.php in Gforge 4.5.19 and earlier allows remote attackers to execute arbitrary SQL commands via the release_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://gforge.org/tracker/index.php?func=detail&aid=5553&group_id=1&atid=105; http://secunia.com/advisories/32217; http://www.securityfocus.com/bid/31674
CVE: CVE-2008-6188
Published: 2009-02-19
Description: SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the skill_edit[] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://gforge.org/tracker/index.php?func=detail&aid=5554&group_id=1&atid=105; http://secunia.com/advisories/32217; http://www.securityfocus.com/bid/31674