deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0704
Published: 2009-02-23
Description: SQL injection vulnerability in search.php in WSN Guest 1.23 allows remote attackers to execute arbitrary SQL commands via the search parameter in an advanced action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33097; https://exchange.xforce.ibmcloud.com/vulnerabilities/47723; https://www.exploit-db.com/exploits/7659
CVE: CVE-2009-0705
Published: 2009-02-23
Description: SQL injection vulnerability in news.php in PowerScripts PowerNews 2.5.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/51110; http://secunia.com/advisories/33363; http://www.securityfocus.com/bid/33081
CVE: CVE-2009-0706
Published: 2009-02-23
Description: SQL injection vulnerability in the Simple Review (com_simple_review) component 1.3.5 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the category parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0901-exploits/joomlasimplereview-sql.txt; http://www.securityfocus.com/bid/33102; https://exchange.xforce.ibmcloud.com/vulnerabilities/47726
CVE: CVE-2009-0707
Published: 2009-02-23
Description: SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL commands via the loginemail parameter (aka login field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51112; http://secunia.com/advisories/33362; http://www.securityfocus.com/bid/33083
CVE: CVE-2009-0708
Published: 2009-02-23
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in SemanticScuttle before 0.91 allow remote attackers to (1) hijack the authentication of administrators via unknown vectors or (2) hijack the authentication of arbitrary users via vectors involving the profile page.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/33383; http://sourceforge.net/project/shownotes.php?release_id=651587; http://secunia.com/advisories/33383
CVE: CVE-2009-0709
Published: 2009-02-23
Description: SQL injection vulnerability in login.php in PHPFootball 1.6 allows remote attackers to execute arbitrary SQL commands via the user parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51104; http://secunia.com/advisories/33367; https://exchange.xforce.ibmcloud.com/vulnerabilities/47720
CVE: CVE-2009-0710
Published: 2009-02-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHPFootball 1.6 allow remote attackers to inject arbitrary web script or HTML via (1) the user parameter to login.php or (2) the dbfield parameter to filter.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51105; http://secunia.com/advisories/33367; http://www.osvdb.org/51103
CVE: CVE-2009-0711
Published: 2009-02-23
Description: filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter.  NOTE: this has been reported as a SQL injection vulnerability by some sources, but the provenance of that information is unknown.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/33367; http://www.osvdb.org/51102; https://www.exploit-db.com/exploits/7636
CVE: CVE-2008-6242
Published: 2009-02-23
Description: SQL injection vulnerability in SearchResults.php in Scripts For Sites (SFS) EZ e-store allows remote attackers to execute arbitrary SQL commands via the where parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32525; http://www.securityfocus.com/bid/32039; https://exchange.xforce.ibmcloud.com/vulnerabilities/46273
CVE: CVE-2008-6243
Published: 2009-02-23
Description: SQL injection vulnerability in showcategory.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49546; http://secunia.com/advisories/32536; https://exchange.xforce.ibmcloud.com/vulnerabilities/46277
CVE: CVE-2008-6244
Published: 2009-02-23
Description: SQL injection vulnerability in view_reviews.php in Scripts for Sites (SFS) EZ Gaming Cheats allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32522; https://exchange.xforce.ibmcloud.com/vulnerabilities/46288; https://www.exploit-db.com/exploits/6924
CVE: CVE-2008-6245
Published: 2009-02-23
Description: SQL injection vulnerability in track.php in Scripts For Sites (SFS) EZ BIZ PRO allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32552; http://www.securityfocus.com/bid/32033; https://exchange.xforce.ibmcloud.com/vulnerabilities/46280
CVE: CVE-2008-6246
Published: 2009-02-23
Description: SQL injection vulnerability in category.php in Scripts For Sites (SFS) EZ Webring allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32550; http://www.securityfocus.com/bid/32032; https://exchange.xforce.ibmcloud.com/vulnerabilities/46279
CVE: CVE-2008-6247
Published: 2009-02-23
Description: SQL injection vulnerability in topsite.php in Scripts For Sites (SFS) EZ Top Sites allows remote attackers to execute arbitrary SQL commands via the ts parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32526; http://www.securityfocus.com/bid/32038; https://exchange.xforce.ibmcloud.com/vulnerabilities/46274
CVE: CVE-2008-6248
Published: 2009-02-23
Description: Cross-site scripting (XSS) vulnerability in all.php in Galatolo WebManager 1.3a and earlier allows remote attackers to inject arbitrary web script or HTML via the tag parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31098; http://www.securityfocus.com/bid/30232; https://exchange.xforce.ibmcloud.com/vulnerabilities/43781
CVE: CVE-2008-6249
Published: 2009-02-23
Description: SQL injection vulnerability in plugins/users/index.php in Galatolo WebManager 1.3a and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31098; http://www.securityfocus.com/bid/30232; https://exchange.xforce.ibmcloud.com/vulnerabilities/46677
CVE: CVE-2008-6250
Published: 2009-02-23
Description: SQL injection vulnerability in Comdev Web Blogger 4.1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the arcmonth parameter to a blog page.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://e-rdc.org/v1/news.php?readmore=102; http://secunia.com/advisories/31100; http://www.securityfocus.com/archive/1/494412/100/0/threaded
CVE: CVE-2007-5289
Published: 2009-02-24
Description: HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture (OTA) API, as demonstrated by modifying (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\TD_80, and then setting the file's properties to read-only.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://blogs.exposit.co.uk/2009/02/23/vulnerability-in-quality-center/; http://secunia.com/advisories/34015; http://secunia.com/advisories/34046
CVE: CVE-2009-0439
Published: 2009-02-24
Description: Unspecified vulnerability in the queue manager in IBM WebSphere MQ (WMQ) 5.3, 6.0 before 6.0.2.6, and 7.0 before 7.0.0.2 allows local users to gain privileges via vectors related to the (1) setmqaut, (2) dmpmqaut, and (3) dspmqaut authorization commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/52297; http://secunia.com/advisories/34034; http://www-01.ibm.com/support/docview.wss?rs=171&uid=swg27006037
CVE: CVE-2008-6251
Published: 2009-02-24
Description: PHP remote file inclusion vulnerability in includes/init.php in phpFan 3.3.4 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://scripts.ishallnotcare.org/2008/11/18/phpfan-335-security-release-important/; http://secunia.com/advisories/32734; http://www.securityfocus.com/bid/32335
CVE: CVE-2008-6252
Published: 2009-02-24
Description: Stack-based buffer overflow in the smc program in smcFanControl 2.1.2 allows local users to execute arbitrary code and gain privileges via a long -k option.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://blog.xwings.net/?p=127; http://osvdb.org/49796; http://secunia.com/advisories/32679
CVE: CVE-2008-6253
Published: 2009-02-24
Description: Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the g_pcltar_lib_dir parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32736; http://www.pluck-cms.org/index.php?file=kop11.php; http://www.securityfocus.com/archive/1/498438
CVE: CVE-2008-6254
Published: 2009-02-24
Description: SQL injection vulnerability in scripts/documents.php in Jadu Galaxies allows remote attackers to execute arbitrary SQL commands via the categoryID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32733; http://www.securityfocus.com/bid/32337; https://exchange.xforce.ibmcloud.com/vulnerabilities/46652
CVE: CVE-2008-6255
Published: 2009-02-24
Description: Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) answer parameter to admincp/verify.php, (2) extension parameter in an edit action to admincp/attachmentpermission.php, and the (3) iperm parameter to admincp/image.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32775; http://www.securityfocus.com/archive/1/498390/100/0/threaded; http://www.waraxe.us/advisory-69.html
CVE: CVE-2008-6256
Published: 2009-02-24
Description: SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands via the holidayinfo[recurring] parameter, a different vector than CVE-2005-3022.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32735; http://www.securityfocus.com/archive/1/498369/100/0/threaded; http://www.waraxe.us/advisory-68.html
CVE: CVE-2008-6257
Published: 2009-02-24
Description: SQL injection vulnerability in default.asp in Openasp 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idpage parameter in the pages module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32750; http://www.securityfocus.com/bid/32322; https://exchange.xforce.ibmcloud.com/vulnerabilities/46648
CVE: CVE-2008-6258
Published: 2009-02-24
Description: SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the (1) UserID and (2) Pwd parameters.  NOTE: this might be related to CVE-2004-2108.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32742; http://www.securityfocus.com/bid/32329; https://exchange.xforce.ibmcloud.com/vulnerabilities/46649
CVE: CVE-2008-6259
Published: 2009-02-24
Description: Cross-site scripting (XSS) vulnerability in search.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the srkeys parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32742; http://www.securityfocus.com/bid/32329; https://exchange.xforce.ibmcloud.com/vulnerabilities/46650
CVE: CVE-2008-6260
Published: 2009-02-24
Description: SQL injection vulnerability in index.php in Ultrastats 0.2.144 and 0.3.11 allows remote attackers to execute arbitrary SQL commands via the serverid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32724; http://www.securityfocus.com/bid/32340; https://exchange.xforce.ibmcloud.com/vulnerabilities/46661
CVE: CVE-2008-6261
Published: 2009-02-24
Description: SQL injection vulnerability in view.php in E-topbiz AdManager 4 allows remote attackers to execute arbitrary SQL commands via the group parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32747; http://www.securityfocus.com/bid/32328; https://exchange.xforce.ibmcloud.com/vulnerabilities/46643
CVE: CVE-2008-6262
Published: 2009-02-24
Description: SQL injection vulnerability in lib/url/meta_url.php in SaturnCMS allows remote attackers to execute arbitrary SQL commands via the URL to the translate function.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32726; https://exchange.xforce.ibmcloud.com/vulnerabilities/46651; http://secunia.com/advisories/32726
CVE: CVE-2008-6263
Published: 2009-02-24
Description: SQL injection vulnerability in lib/user/t_user.php in SaturnCMS allows remote attackers to execute arbitrary SQL commands via the username parameter to the _userLoggedIn function.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32726; http://www.securityfocus.com/bid/32336; https://exchange.xforce.ibmcloud.com/vulnerabilities/46651
CVE: CVE-2008-6264
Published: 2009-02-24
Description: SQL injection vulnerability in admin/admin.php in E-topbiz Slide Popups 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0811-exploits/slidepopups-sql.txt; http://www.securityfocus.com/bid/32171; http://www.vupen.com/english/advisories/2008/3049
CVE: CVE-2008-6265
Published: 2009-02-24
Description: Directory traversal vulnerability in portfolio/css.php in Cyberfolio 7.12.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/32218; http://www.vupen.com/english/advisories/2008/3070; https://exchange.xforce.ibmcloud.com/vulnerabilities/46490
CVE: CVE-2009-0722
Published: 2009-02-24
Description: Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the user cookie parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/33729; https://www.exploit-db.com/exploits/8032; http://www.securityfocus.com/bid/33729
CVE: CVE-2009-0726
Published: 2009-02-24
Description: SQL injection vulnerability in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the gigcal_gigs_id parameter in a details action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33241; https://exchange.xforce.ibmcloud.com/vulnerabilities/47919; https://www.exploit-db.com/exploits/7746
CVE: CVE-2009-0727
Published: 2009-02-24
Description: SQL injection vulnerability in jobdetails.php in taifajobs 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the jobid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://e-rdc.org/v1/news.php?readmore=126; http://osvdb.org/52256; http://www.securityfocus.com/archive/1/501183/100/0/threaded
CVE: CVE-2009-0728
Published: 2009-02-24
Description: SQL injection vulnerability in the My_eGallery module for MAXdev MDPro (MD-Pro) and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33871; https://www.exploit-db.com/exploits/8100; http://www.securityfocus.com/bid/33871
CVE: CVE-2009-0729
Published: 2009-02-24
Description: Multiple directory traversal vulnerabilities in Page Engine CMS 2.0 Basic and Pro allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the fPrefix parameter to (1) modules/recent_poll_include.php, (2) modules/login_include.php, and (3) modules/statistics_include.php and (4) configuration.inc.php in includes/.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/52175; http://osvdb.org/52176; http://osvdb.org/52177
CVE: CVE-2009-0730
Published: 2009-02-24
Description: Multiple SQL injection vulnerabilities in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the gigcal _venues_id parameter in a details action to index.php, which is not properly handled by venuedetails.php, and (2) the gigcal_bands_id parameter in a details action to index.php, which is not properly handled by banddetails.php, different vectors than CVE-2009-0726.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/501174/100/0/threaded; http://www.securityfocus.com/archive/1/501175/100/0/threaded; http://www.securityfocus.com/archive/1/501176/100/0/threaded
CVE: CVE-2009-0731
Published: 2009-02-24
Description: Directory traversal vulnerability in pages/play.php in Free Arcade Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the template parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/34023; http://www.securityfocus.com/bid/33869; https://www.exploit-db.com/exploits/8094
CVE: CVE-2009-0732
Published: 2009-02-24
Description: Downloadcenter 2.1 stores common.h under the web root with insufficient access control, which allows remote attackers to obtain user credentials and other sensitive information via a direct request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/52180; http://secunia.com/advisories/33992; https://exchange.xforce.ibmcloud.com/vulnerabilities/48862
CVE: CVE-2008-6266
Published: 2009-02-25
Description: SQL injection vulnerability in links.php in Appalachian State University phpWebSite allows remote attackers to execute arbitrary SQL commands via the cid parameter in a viewlink action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/497960/100/0/threaded; http://www.securityfocus.com/bid/32011; https://exchange.xforce.ibmcloud.com/vulnerabilities/46298
CVE: CVE-2008-6267
Published: 2009-02-25
Description: Cross-site scripting (XSS) vulnerability in detail.php in Multi Languages WebShop Online 1.02 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/32092; https://exchange.xforce.ibmcloud.com/vulnerabilities/46370; https://www.exploit-db.com/exploits/6974
CVE: CVE-2008-6268
Published: 2009-02-25
Description: SQL injection vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49718; http://secunia.com/advisories/32499; http://www.securityfocus.com/bid/32092
CVE: CVE-2008-6269
Published: 2009-02-25
Description: Joovili 3.1.4 allows remote attackers to bypass authentication and gain privileges as other users, including the administrator, by setting the (1) session_id, session_logged_in, and session_username cookies for user privileges; (2) session_admin_id, session_admin_username, and session_admin cookies for admin privileges; and (3) session_staff_id, session_staff_username, and session_staff cookies for staff users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32491; http://www.securityfocus.com/bid/32058; http://www.vupen.com/english/advisories/2008/2978
CVE: CVE-2008-6270
Published: 2009-02-25
Description: SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL command via the user parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32079; https://exchange.xforce.ibmcloud.com/vulnerabilities/46286; https://exchange.xforce.ibmcloud.com/vulnerabilities/48982
CVE: CVE-2008-6271
Published: 2009-02-25
Description: Directory traversal vulnerability in index.php in TBmnetCMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the content parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32462; http://www.securityfocus.com/bid/32087; https://exchange.xforce.ibmcloud.com/vulnerabilities/46314
CVE: CVE-2008-6272
Published: 2009-02-25
Description: SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL command via the pass parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/46286; https://www.exploit-db.com/exploits/6969; https://exchange.xforce.ibmcloud.com/vulnerabilities/46286
CVE: CVE-2008-6273
Published: 2009-02-25
Description: Directory traversal vulnerability in configuration_script.php in MyKtools 3.0 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the langage parameter, a different vulnerability than CVE-2008-4781.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32432; https://exchange.xforce.ibmcloud.com/vulnerabilities/48957; http://secunia.com/advisories/32432
CVE: CVE-2009-0238
Published: 2009-02-25
Description: Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://blogs.zdnet.com/security/?p=2658; http://isc.sans.org/diary.html?storyid=5923; http://securitytracker.com/id?1021744