deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1271
Published: 2010-04-06
Description: SQL injection vulnerability in showplugs.php in smartplugs 1.3 allows remote attackers to execute arbitrary SQL commands via the domain parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://4004securityproject.wordpress.com/2010/03/03/smartplugs-1-3-sql-injection-showplugs-php; http://packetstormsecurity.org/1003-exploits/smartplugs-sql.txt; http://secunia.com/advisories/38819
CVE: CVE-2010-1272
Published: 2010-04-06
Description: PHP remote file inclusion vulnerability in includes/tgpinc.php in Gnat-TGP 1.2.20 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1003-exploits/gnattgp-rfi.txt; http://www.exploit-db.com/exploits/11621; http://www.securityfocus.com/bid/38522
CVE: CVE-2010-1273
Published: 2010-04-06
Description: Emweb Wt before 3.1.1 does not validate the UTF-8 encoding of (1) form values and (2) JSignal arguments, which has unspecified impact and remote attack vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/38759; http://www.osvdb.org/62717; http://www.securityfocus.com/bid/38541
CVE: CVE-2010-1274
Published: 2010-04-06
Description: Cross-site scripting (XSS) vulnerability in Emweb Wt before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to "insertions of the URL" that occur during a redirection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38759; http://www.osvdb.org/62716; http://www.securityfocus.com/bid/38541
CVE: CVE-2010-1275
Published: 2010-04-06
Description: Cross-site scripting (XSS) vulnerability in ShowPost.asp in BBSXP 2008 allows remote attackers to inject arbitrary web script or HTML via the ThreadID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38855; http://www.securityfocus.com/archive/1/509860/100/0/threaded; http://www.securityfocus.com/bid/38542
CVE: CVE-2010-1276
Published: 2010-04-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in BBSXP 2008 SP2 allow remote attackers to inject arbitrary web script or HTML via the URI in a request to (1) AddPost.asp, (2) AddTopic.asp, (3) Admin_Default.asp, (4) Bank.asp, (5) Manage.asp, and (6) ShowPost.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38855; http://secunia.com/advisories/38855
CVE: CVE-2010-1277
Published: 2010-04-06
Description: SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter in JSON data to api_jsonrpc.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0001.html; http://legalhackers.com/advisories/zabbix181api-sql.txt; http://legalhackers.com/poc/zabbix181api.pl-poc
CVE: CVE-2009-4737
Published: 2010-04-06
Description: Stack-based buffer overflow in JustSystems Corporation Ichitaro 13, 2004 through 2009, Viewer 2009 19.0.1.0 and earlier, and other versions allows context-dependent attackers to execute arbitrary code via a crafted Rich Text File (RTF), related to "pvpara ffooter."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN33846134/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000018.html; http://secunia.com/advisories/34611
CVE: CVE-2010-1083
Published: 2010-04-06
Description: The processcompl_compat function in drivers/usb/core/devio.c in Linux kernel 2.6.x through 2.6.32, and possibly other versions, does not clear the transfer buffer before returning to userspace when a USB command fails, which might make it easier for physically proximate attackers to obtain sensitive information (kernel memory).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html; http://lkml.org/lkml/2010/3/30/759; http://lwn.net/Articles/375350/
CVE: CVE-2010-1084
Published: 2010-04-06
Description: Linux kernel 2.6.18 through 2.6.33, and possibly other versions, allows remote attackers to cause a denial of service (memory corruption) via a large number of Bluetooth sockets, related to the size of sysfs files in (1) net/bluetooth/l2cap.c, (2) net/bluetooth/rfcomm/core.c, (3) net/bluetooth/rfcomm/sock.c, and (4) net/bluetooth/sco.c.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=101545f6fef4a0a3ea8daf0b5b880df2c6a92a69; http://secunia.com/advisories/39830; http://secunia.com/advisories/43315
CVE: CVE-2010-1085
Published: 2010-04-06
Description: The azx_position_ok function in hda_intel.c in Linux kernel 2.6.33-rc4 and earlier, when running on the AMD780V chip set, allows context-dependent attackers to cause a denial of service (crash) via unknown manipulations that trigger a divide-by-zero error.
CVSS Score: 7.1 (HIGH)
CWE: CWE-189
References: http://lkml.org/lkml/2010/2/5/322; http://nctritech.net/bugreport.txt; http://secunia.com/advisories/39649
CVE: CVE-2010-1086
Published: 2010-04-06
Description: The ULE decapsulation functionality in drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in Linux kernel 2.6.33 and earlier allows attackers to cause a denial of service (infinite loop) via a crafted MPEG2-TS frame, related to an invalid Payload Pointer ULE.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=29e1fa3565a7951cc415c634eb2b78dbdbee151d; http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html; http://secunia.com/advisories/39649
CVE: CVE-2010-1087
Published: 2010-04-06
Description: The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x through 2.6.33-rc5 allows attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible.
CVSS Score: 7.8 (HIGH)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=9f557cd8073104b39528794d44e129331ded649f; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html; http://secunia.com/advisories/39830
CVE: CVE-2010-1088
Published: 2010-04-06
Description: fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount "symlinks," which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW.
CVSS Score: 5.4 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=ac278a9c505092dd82077a2446af8f9fc0d9c095; http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html; http://secunia.com/advisories/39742
CVE: CVE-2010-1298
Published: 2010-04-06
Description: Directory traversal vulnerability in view.php in Pulse CMS 1.2.2 allows remote attackers to read arbitrary files via directory traversal sequences in the f parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/38650; http://secunia.com/advisories/38650
CVE: CVE-2010-0400
Published: 2010-04-07
Description: SQL injection vulnerability in lib/user.php in mahara 1.0.4 allows remote attackers to execute arbitrary SQL commands via a username.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny5.diff.gz; http://www.debian.org/security/2010/dsa-2030; http://www.securityfocus.com/bid/39253
CVE: CVE-2010-0629
Published: 2010-04-07
Description: Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567052; http://krbdev.mit.edu/rt/Ticket/Display.html?id=5998; http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038556.html
CVE: CVE-2010-1186
Published: 2010-04-07
Description: Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39341; http://wordpress.org/extend/plugins/nextgen-gallery/changelog/; http://www.coresecurity.com/content/nextgen-gallery-xss-vulnerability
CVE: CVE-2010-1221
Published: 2010-04-07
Description: CA XOsoft r12.0 and r12.5 does not properly perform authentication, which allows remote attackers to enumerate usernames via a SOAP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/archive/1/510564/100/0/threaded; http://www.securityfocus.com/bid/39244; https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=232869
CVE: CVE-2010-1222
Published: 2010-04-07
Description: CA XOsoft r12.5 does not properly perform authentication, which allows remote attackers to obtain potentially sensitive information via a SOAP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/archive/1/510564/100/0/threaded; http://www.securityfocus.com/bid/39249; https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=232869
CVE: CVE-2010-1223
Published: 2010-04-07
Description: Multiple buffer overflows in CA XOsoft r12.0 and r12.5 allow remote attackers to execute arbitrary code via (1) a malformed request to the ws_man/xosoapapi.asmx SOAP endpoint or (2) a long string to the entry_point.aspx service.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/510564/100/0/threaded; http://www.securityfocus.com/archive/1/510565/100/0/threaded; http://www.securityfocus.com/archive/1/510567/100/0/threaded
CVE: CVE-2008-7254
Published: 2010-04-07
Description: Directory traversal vulnerability in includes/template-loader.php in Irmin CMS (formerly Pepsi CMS) 0.5 and 0.6 BETA2, when register_globals is enabled, allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the _Root_Path parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63348; http://packetstormsecurity.org/0808-exploits/pepsicms-rfi.txt; http://secunia.com/advisories/39214
CVE: CVE-2010-1299
Published: 2010-04-07
Description: Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) DefineRootToTool parameter to counter.php, (2) PathToRoot parameter to plugins/DPGguestbook/guestbookaction.php and (3) get_popUpResource parameter to backendpopup/popup.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/63415; http://packetstormsecurity.org/1004-exploits/dynpgcms-rfi.txt; http://secunia.com/advisories/39185
CVE: CVE-2010-1300
Published: 2010-04-07
Description: SQL injection vulnerability in index.php in Yamamah (aka Dove Photo Album) 1.00 allows remote attackers to execute arbitrary SQL commands via the calbums parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63344; http://packetstormsecurity.org/1003-exploits/yamamah-sql.txt; http://secunia.com/advisories/39205
CVE: CVE-2010-1301
Published: 2010-04-07
Description: SQL injection vulnerability in main.php in Centreon 2.1.5 allows remote attackers to execute arbitrary SQL commands via the host_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63347; http://packetstormsecurity.org/1004-exploits/centreon-sql.txt; http://secunia.com/advisories/39236
CVE: CVE-2010-1302
Published: 2010-04-07
Description: Directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs (com_dwgraphs) component 1.0 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63345; http://packetstormsecurity.org/1003-exploits/joomladwgraph-lfi.txt; http://secunia.com/advisories/39200
CVE: CVE-2010-1303
Published: 2010-04-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy Filter module 6.x before 6.x-1.1 for Drupal allow remote authenticated users, with administer taxonomy permissions or create node permissions when free tagging is enabled, to inject arbitrary web script or HTML via vocabulary (1) names, (2) terms, and (3) filter menus.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/622096; http://drupal.org/node/758756; http://secunia.com/advisories/39220
CVE: CVE-2010-1304
Published: 2010-04-08
Description: Directory traversal vulnerability in userstatus.php in the User Status (com_userstatus) component 1.21.16 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/11998; http://www.securityfocus.com/bid/39174; https://exchange.xforce.ibmcloud.com/vulnerabilities/57483
CVE: CVE-2010-1305
Published: 2010-04-08
Description: Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://extensions.joomla.org/extensions/e-commerce/shopping-cart/7951; http://packetstormsecurity.org/1004-exploits/jinventory-lfi.txt; http://secunia.com/advisories/39351
CVE: CVE-2010-1306
Published: 2010-04-08
Description: Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlapicasa-lfi.txt; http://secunia.com/advisories/39338; http://www.exploit-db.com/exploits/12058
CVE: CVE-2010-1307
Published: 2010-04-08
Description: Directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaupdater-lfi.txt; http://secunia.com/advisories/39348; http://www.exploit-db.com/exploits/12070
CVE: CVE-2010-1308
Published: 2010-04-08
Description: Directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlasvmap-lfi.txt; http://secunia.com/advisories/39350; http://www.exploit-db.com/exploits/12066
CVE: CVE-2010-0098
Published: 2010-04-08
Description: ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities.
CVSS Score: 10.0 (HIGH)
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=clamav-0.96; http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html
CVE: CVE-2010-0743
Published: 2010-04-08
Description: Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574935; http://git.kernel.org/?p=linux/kernel/git/tomo/tgt.git%3Ba=commit%3Bh=107d922706cd36f3bb79bcca9bc4678c32f22e59; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
CVE: CVE-2010-1309
Published: 2010-04-08
Description: Directory traversal vulnerability in Irmin CMS (formerly Pepsi CMS) 0.6 BETA2 allows remote attackers to read arbitrary files via a .. (dot dot) in the w parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/11938; http://www.exploit-db.com/exploits/11938
CVE: CVE-2010-1310
Published: 2010-04-08
Description: Opera 10.50 allows remote attackers to obtain sensitive information via crafted XSLT constructs, which cause Opera to return cached contents of other pages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/38820; http://www.opera.com/docs/changelogs/windows/1051/; http://www.opera.com/support/kb/view/949/
CVE: CVE-2010-1311
Published: 2010-04-08
Description: The qtm_decompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted CAB archive that uses the Quantum (aka .Q) compression format.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=clamav-0.96; http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html
CVE: CVE-2010-1312
Published: 2010-04-08
Description: Directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63572; http://packetstormsecurity.org/1004-exploits/joomlanewportal-lfi.txt; http://secunia.com/advisories/39289
CVE: CVE-2010-1313
Published: 2010-04-08
Description: Directory traversal vulnerability in the Seber Cart (com_sebercart) component 1.0.0.12 and 1.0.0.13 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/39355; http://www.exploit-db.com/exploits/12082; http://www.securityfocus.com/bid/39237
CVE: CVE-2010-1314
Published: 2010-04-08
Description: Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlahsconfig-lfi.txt; http://secunia.com/advisories/39359; http://www.exploit-db.com/exploits/12086
CVE: CVE-2010-1315
Published: 2010-04-08
Description: Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaweberpcustomer-lfi.txt; http://secunia.com/advisories/39209; http://www.exploit-db.com/exploits/11999
CVE: CVE-2010-0992
Published: 2010-04-09
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allow remote attackers to hijack the authentication of users for requests that (1) upload image files, (2) delete image files, or (3) create blocks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://pulsecms.com/blog.php; http://secunia.com/advisories/39046; http://secunia.com/secunia_research/2010-46/
CVE: CVE-2010-0993
Published: 2010-04-09
Description: Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 6.0 (MEDIUM)
References: http://pulsecms.com/blog.php; http://secunia.com/advisories/39046; http://secunia.com/secunia_research/2010-47/
CVE: CVE-2010-1331
Published: 2010-04-09
Description: SQL injection vulnerability in Heartlogic HL-SiteManager allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN60969543/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000010.html; http://www.heartlogic.jp/docs/free_cgi/hl-sitemanager.html
CVE: CVE-2010-1332
Published: 2010-04-09
Description: Cross-site scripting (XSS) vulnerability in PrettyBook PrettyFormMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN41842181/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000007.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/57492
CVE: CVE-2010-1333
Published: 2010-04-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Almas Inc. Compiere J300_A02 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN38687002/index.html; http://jvn.jp/en/jp/JVN57963254/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000008.html
CVE: CVE-2010-1334
Published: 2010-04-09
Description: Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified directory, a different vulnerability than CVE-2010-0993.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/39046; http://secunia.com/advisories/39046
CVE: CVE-2010-1335
Published: 2010-04-09
Description: Multiple PHP remote file inclusion vulnerabilities in Insky CMS 006-0111, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the ROOT parameter to (1) city.get/city.get.php, (2) city.get/index.php, (3) message2.send/message.send.php, (4) message.send/message.send.php, and (5) pages.add/pages.add.php in insky/modules/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/63149; http://osvdb.org/63150; http://osvdb.org/63151