deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1738
Published: 2009-05-20
Description: Cross-site scripting (XSS) vulnerability in Feed Block 6.x-1.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with administrator feed permissions to inject arbitrary web script or HTML via unspecified vectors in "aggregator items."
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/453098; http://drupal.org/node/461706; http://secunia.com/advisories/35044
CVE: CVE-2009-1739
Published: 2009-05-20
Description: PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users, including administrative privileges, by setting the authuser cookie parameter to a valid username.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/54593; http://secunia.com/advisories/35155; http://www.securityfocus.com/bid/35027
CVE: CVE-2009-1740
Published: 2009-05-20
Description: Multiple heap-based buffer overflows in the D-Link MPEG4 Viewer ActiveX Control (csviewer.ocx) 2.11.918.2006 allow remote attackers to execute arbitrary code via a long argument to the (1) SetFilePath and (2) SetClientCookie methods.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/54458; http://secunia.com/advisories/35066; http://www.securityfocus.com/bid/34990
CVE: CVE-2009-1741
Published: 2009-05-20
Description: Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/54597; http://secunia.com/advisories/35167; http://www.securityfocus.com/bid/35035
CVE: CVE-2009-1742
Published: 2009-05-20
Description: code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks via crafted keyword sequences that are removed from a filter in the id parameter in a banner action, as demonstrated via the "UNIunionON" string, which is collapsed into "UNION" by the filter_sql function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54572; http://secunia.com/advisories/35122; http://www.securityfocus.com/bid/35004
CVE: CVE-2009-1743
Published: 2009-05-21
Description: Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to create and overwrite arbitrary files via a filename containing a ..\ (dot dot backslash) sequence in a Hollywood FX Compressed Archive (.hfz) file.  NOTE: this can be leveraged for code execution by decompressing a file to a Startup folder.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://osvdb.org/54430; http://retrogod.altervista.org/9sg_pinnacle_studio_12_hfz.htm; http://secunia.com/advisories/35078
CVE: CVE-2009-1744
Published: 2009-05-21
Description: InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to cause a denial of service (application crash) via a crafted Hollywood FX Compressed Archive (.hfz) file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/35137; https://exchange.xforce.ibmcloud.com/vulnerabilities/50856; https://www.exploit-db.com/exploits/8670
CVE: CVE-2009-1161
Published: 2009-05-21
Description: Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessment Manager, Unified Operations Manager, Unified Provisioning Manager, and other products, allows remote attackers to access arbitrary files via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN62527913/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000032.html; http://osvdb.org/54616
CVE: CVE-2009-1593
Published: 2009-05-21
Description: Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "negative model," which allows remote attackers to conduct cross-site scripting (XSS) attacks via a modified end tag of a SCRIPT element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt; http://www.securityfocus.com/archive/1/503649/100/0/threaded; http://www.securityfocus.com/bid/35053
CVE: CVE-2009-1594
Published: 2009-05-21
Description: Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "positive model," which allows remote attackers to bypass certain protection mechanisms via a %0A (encoded newline), as demonstrated by a %0A in a cross-site scripting (XSS) attack URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt; http://www.securityfocus.com/archive/1/503649/100/0/threaded; http://www.securityfocus.com/bid/35053
CVE: CVE-2009-1729
Published: 2009-05-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6 2005Q4 (aka 6.2) and 6.3 allow remote attackers to inject arbitrary web script or HTML via (1) the abperson_displayName parameter to uwc/abs/search.xml in the Add Contact implementation in the Personal Address Book component or (2) the temporaryCalendars parameter to uwc/base/UWCMain.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/54609; http://osvdb.org/54610; http://seclists.org/fulldisclosure/2009/May/0177.html
CVE: CVE-2009-0897
Published: 2009-05-21
Description: IBM WebSphere Partner Gateway (WPG) 6.1.0 before 6.1.0.1 and 6.1.1 before 6.1.1.1 allows remote authenticated users to obtain sensitive information via vectors related to the "schema DB2 instance id" and the bcgarchive (aka the archiver script).
CVSS Score: 4.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21366016; http://www.securityfocus.com/bid/35136; https://exchange.xforce.ibmcloud.com/vulnerabilities/50643
CVE: CVE-2009-1745
Published: 2009-05-21
Description: Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, has a default root password hash, and permits password-based root logins over SSH, which makes it easier for remote attackers to obtain access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt; http://www.securityfocus.com/archive/1/503649/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/50852
CVE: CVE-2009-1746
Published: 2009-05-21
Description: SQL injection vulnerability in berita.php in Dian Gemilang DGNews 3.0 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54658; http://www.securityfocus.com/bid/35016; https://www.exploit-db.com/exploits/8727
CVE: CVE-2008-6812
Published: 2009-05-22
Description: SQL injection vulnerability in bukutamu.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQL commands via the det parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30080; https://exchange.xforce.ibmcloud.com/vulnerabilities/43683; https://www.exploit-db.com/exploits/5999
CVE: CVE-2008-6813
Published: 2009-05-22
Description: SQL injection vulnerability in index.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQL commands via the id_kat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30079; https://exchange.xforce.ibmcloud.com/vulnerabilities/43684; https://www.exploit-db.com/exploits/5998
CVE: CVE-2009-1747
Published: 2009-05-22
Description: SQL injection vulnerability in index.php in 26th Avenue bSpeak 1.10 allows remote attackers to execute arbitrary SQL commands via the forumid parameter in a post action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35139; http://www.securityfocus.com/bid/35049; https://www.exploit-db.com/exploits/8751
CVE: CVE-2009-1748
Published: 2009-05-22
Description: Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) webpages_form or (2) userman_form parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/54657; http://www.securityfocus.com/bid/35042; https://www.exploit-db.com/exploits/8745
CVE: CVE-2009-1749
Published: 2009-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject arbitrary web script or HTML via the (1) userman_form and (2) webpages_form parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/54656; http://www.securityfocus.com/bid/35042; https://www.exploit-db.com/exploits/8745
CVE: CVE-2009-1750
Published: 2009-05-22
Description: Unrestricted file upload vulnerability in VidSharePro allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/54611; http://www.securityfocus.com/bid/35024; https://exchange.xforce.ibmcloud.com/vulnerabilities/50625
CVE: CVE-2009-1751
Published: 2009-05-22
Description: SQL injection vulnerability in list_list.php in Realty Webware Technologies Web-Base 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54655; http://www.securityfocus.com/bid/35043; https://exchange.xforce.ibmcloud.com/vulnerabilities/50646
CVE: CVE-2009-1752
Published: 2009-05-22
Description: exJune Office Message System 1 does not properly restrict access to (1) configure.asp and (2) addmessage2.asp, which allows remote attackers to gain privileges a direct request.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/35172; https://exchange.xforce.ibmcloud.com/vulnerabilities/50647; https://www.exploit-db.com/exploits/8744
CVE: CVE-2009-1755
Published: 2009-05-22
Description: Off-by-one error in the packet_read_query_section function in packet.c in nsd 3.2.1, and process_query_section in query.c in nsd 2.3.7, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529418; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529420; http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html
CVE: CVE-2009-1756
Published: 2009-05-22
Description: SLiM Simple Login Manager 1.3.0 places the X authority magic cookie (mcookie) on the command line when invoking xauth from (1) app.cpp and (2) switchuser.cpp, which allows local users to access the X session by listing the process and its arguments.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529306; http://osvdb.org/54583; http://secunia.com/advisories/35132
CVE: CVE-2009-1757
Published: 2009-05-22
Description: Cross-site request forgery (CSRF) vulnerability in Transmission 1.5 before 1.53 and 1.6 before 1.61 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2009/05/21/1; http://www.transmissionbt.com/index.php; http://www.openwall.com/lists/oss-security/2009/05/21/1
CVE: CVE-2009-1758
Published: 2009-05-22
Description: The hypervisor_callback function in Xen, possibly before 3.4.0, as applied to the Linux kernel 2.6.30-rc4, 2.6.18, and probably other versions allows guest user applications to cause a denial of service (kernel oops) of the guest OS by triggering a segmentation fault in "certain address ranges."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.xensource.com/archives/html/xen-devel/2009-05/msg00561.html; http://secunia.com/advisories/35093; http://secunia.com/advisories/35298
CVE: CVE-2009-1759
Published: 2009-05-22
Description: Stack-based buffer overflow in the btFiles::BuildFromMI function (trunk/btfiles.cpp) in Enhanced CTorrent (aka dTorrent) 3.3.2 and probably earlier, and CTorrent 1.3.4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Torrent file containing a long path.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://dtorrent.svn.sourceforge.net/viewvc/dtorrent/dtorrent/trunk/btfiles.cpp?r1=296&r2=301&view=patch; http://secunia.com/advisories/34752; http://secunia.com/advisories/35499
CVE: CVE-2009-0786
Published: 2009-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This was originally intended for a report about TCP Wrappers and the hosts_ctl API function, but further investigation showed that this was documented behavior by that function. Notes: Future CVE identifiers might be assigned to applications that mis-use the API in a security-relevant fashion.
CVE: CVE-2009-1753
Published: 2009-05-22
Description: Coccinelle 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on an unspecified "result file."
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://packages.debian.org/changelogs/pool/main/c/coccinelle/coccinelle_0.1.7.deb-3/changelog; http://secunia.com/advisories/35012; http://secunia.com/advisories/35459
CVE: CVE-2009-1635
Published: 2009-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt; http://secunia.com/advisories/35177; http://securitytracker.com/id?1022267
CVE: CVE-2009-1762
Published: 2009-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess login page (aka gw/webacc) in Novell GroupWise 7.x before 7.03 HP2 allow remote attackers to inject arbitrary web script or HTML via the (1) GWAP.version or (2) User.Theme (aka User.Theme.index) parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt; http://secunia.com/advisories/35177; http://securitytracker.com/id?1022267
CVE: CVE-2009-1763
Published: 2009-05-22
Description: Unspecified vulnerability in the Solaris Secure Digital slot driver (aka sdhost) in Sun OpenSolaris snv_105 through snv_108 on the x86 platform allows local users to gain privileges or cause a denial of service (filesystem or memory corruption) via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-259408-1; http://www.securityfocus.com/bid/35069; http://www.securitytracker.com/id?1022271
CVE: CVE-2009-1764
Published: 2009-05-22
Description: SQL injection vulnerability in inc/ajax.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a digg action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/34981; https://exchange.xforce.ibmcloud.com/vulnerabilities/50553; https://www.exploit-db.com/exploits/8726
CVE: CVE-2009-1765
Published: 2009-05-22
Description: Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langpref parameter to (1) data/modules/contactform/module_info.php, (2) data/modules/blog/module_info.php, and (3) data/modules/albums/module_info.php, different vectors than CVE-2008-3194.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/35145; http://www.securityfocus.com/bid/35007; https://www.exploit-db.com/exploits/8715
CVE: CVE-2009-1766
Published: 2009-05-22
Description: SQL injection vulnerability in index.php in LightOpenCMS 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/504101/100/0/threaded; https://www.exploit-db.com/exploits/8724; http://www.securityfocus.com/archive/1/504101/100/0/threaded
CVE: CVE-2009-1767
Published: 2009-05-22
Description: admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the (1) loginname, (2) password, (3) email, (4) firstname, or (5) lastname parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/35090; http://www.securityfocus.com/bid/34977; https://exchange.xforce.ibmcloud.com/vulnerabilities/50561
CVE: CVE-2009-1768
Published: 2009-05-22
Description: Directory traversal vulnerability in download.php in Rama Zaiten CMS 0.9.8 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/54546; http://secunia.com/advisories/35116; http://www.securityfocus.com/bid/34995
CVE: CVE-2009-1769
Published: 2009-05-22
Description: The web interface in Open Computer and Software Inventory Next Generation (OCS Inventory NG) 1.01 generates different error messages depending on whether a username is valid, which allows remote attackers to enumerate valid usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529344; http://secunia.com/advisories/35157; http://secunia.com/advisories/35313
CVE: CVE-2009-1770
Published: 2009-05-22
Description: Directory traversal vulnerability in includes/database/examples/addressbook.php in Flyspeck CMS 6.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/35011; http://www.vupen.com/english/advisories/2009/1367; https://www.exploit-db.com/exploits/8714
CVE: CVE-2009-1771
Published: 2009-05-22
Description: index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the (1) users[fullname], (2) users[email], (3) users[role_id], (4) users[username], and (5) users[password] parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/35011; http://www.vupen.com/english/advisories/2009/1367; https://www.exploit-db.com/exploits/8714
CVE: CVE-2009-1772
Published: 2009-05-22
Description: Cross-site scripting (XSS) vulnerability in activeCollab 2.1 Corporate allows remote attackers to inject arbitrary web script or HTML via the re_route parameter to the login script.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pridels-team.blogspot.com/2009/05/activecollab-xss-and-full-path.html; http://secunia.com/advisories/35079; http://www.securityfocus.com/bid/35022
CVE: CVE-2009-1773
Published: 2009-05-22
Description: activeCollab 2.1 Corporate allows remote attackers to obtain sensitive information via an invalid re_route parameter to the login script, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://pridels-team.blogspot.com/2009/05/activecollab-xss-and-full-path.html; http://secunia.com/advisories/35079; http://www.securityfocus.com/bid/35022
CVE: CVE-2009-1774
Published: 2009-05-22
Description: Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter to example/index.php.  NOTE: this was originally reported as an issue affecting the do parameter, but traversal with that parameter might depend on a modified example/index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/28330; http://www.securityfocus.com/bid/34971; https://exchange.xforce.ibmcloud.com/vulnerabilities/50562
CVE: CVE-2009-1381
Published: 2009-05-22
Description: The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program.  NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
CVSS Score: 6.8 (MEDIUM)
References: http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff; http://secunia.com/advisories/35140; http://www.debian.org/security/2009/dsa-1802
CVE: CVE-2009-1775
Published: 2009-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ulteo Open Virtual Desktop 1.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) admin/applications.php, (2) admin/appsgroup.php, (3) admin/users.php, (4) admin/usersgroup.php, and (5) admin/tasks.php; (6) show parameter to admin/logs.php; and (7) mode parameter to admin/configuration-partial.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34923; http://www.insight-tech.org/index.php?p=Ulteo-Open-Virtual-Desktop-v1-0-multiple-XSS; http://www.securityfocus.com/bid/34927
CVE: CVE-2009-1776
Published: 2009-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via javascript: URIs in the (1) request and (2) return_link_url parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35068; http://www.securityfocus.com/archive/1/503446/100/0/threaded; http://www.securityfocus.com/bid/34929
CVE: CVE-2009-1777
Published: 2009-05-22
Description: CRLF injection vulnerability in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the redirect parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/35068; http://www.securityfocus.com/archive/1/503446/100/0/threaded; http://www.securityfocus.com/bid/34929
CVE: CVE-2009-1778
Published: 2009-05-22
Description: SQL injection vulnerability in the new user registration feature in BigACE CMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35063; http://www.bigace.de/BIGACE-2.6.html; http://www.bigace.de/Security-Fix-for-2.5.html
CVE: CVE-2009-1779
Published: 2009-05-22
Description: PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the form_include_template parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/34909; http://www.vupen.com/english/advisories/2009/1287; https://www.exploit-db.com/exploits/8658