deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0570
Published: 2009-02-13
Description: Directory traversal vulnerability in send.php in Ninja Designs Mailist 3.0, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the load parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33682; http://www.securityfocus.com/bid/33648; https://www.exploit-db.com/exploits/8001
CVE: CVE-2009-0571
Published: 2009-02-13
Description: admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the backup directory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33682; https://www.exploit-db.com/exploits/8001; http://secunia.com/advisories/33682
CVE: CVE-2009-0572
Published: 2009-02-13
Description: PHP remote file inclusion vulnerability in include/flatnux.php in FlatnuX CMS (aka Flatnuke3) 2009-01-27 and 2009-02-04, when register_globals is enabled and magic_quotes_gpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the _FNROOTPATH parameter to (1) index.php and (2) filemanager.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/51728; http://osvdb.org/51729; http://secunia.com/advisories/33721
CVE: CVE-2009-0573
Published: 2009-02-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in FotoWeb 6.0 (Build 273) allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to cmdrequest/Login.fwx and the (2) search parameter to Grid.fwx.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33879; http://www.fortconsult.net/images/pdf/advisories/FotoWebXSS_final.pdf; http://www.securityfocus.com/bid/33677
CVE: CVE-2009-0574
Published: 2009-02-13
Description: SQL injection vulnerability in index.php in Easy CafeEngine allows remote attackers to execute arbitrary SQL commands via the catid parameter, a different vector than CVE-2008-4604.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33655; http://www.vupen.com/english/advisories/2009/0359; https://www.exploit-db.com/exploits/8002
CVE: CVE-2009-0575
Published: 2009-02-13
Description: Cross-site scripting (XSS) vulnerability in the theme_views_bulk_operations_confirmation function in views_bulk_operations.module in Views Bulk Operations 5.x before 5.x-1.3 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to node titles.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/369223; http://osvdb.org/51751; http://secunia.com/advisories/33836
CVE: CVE-2009-0576
Published: 2009-02-13
Description: Unspecified vulnerability in Sun Java System Directory Server 5.2 p6 and earlier, and Enterprise Edition 5, allows remote attackers to cause a denial of service (daemon crash) via crafted LDAP requests.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/33850; http://sunsolve.sun.com/search/document.do?assetkey=1-21-116837-04-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-250086-1
CVE: CVE-2008-6126
Published: 2009-02-13
Description: Multiple directory traversal vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter to download.php and the (2) page parameter to index.php, a different vector than CVE-2008-3589.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://cms.mozilo.de/index.php?cat=10_moziloCMS&page=60_Changelog; http://secunia.com/advisories/32021; http://www.majorsecurity.de/index_2.php?major_rls=major_rls55
CVE: CVE-2008-6127
Published: 2009-02-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) page and (2) query parameters to (a) index.php, (3) cat and (4) file parameters to (b) download.php, (5) gal parameter to gallery.php, and the (6) URL to admin/login.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cms.mozilo.de/index.php?cat=10_moziloCMS&page=60_Changelog; http://secunia.com/advisories/32021; http://www.majorsecurity.de/index_2.php?major_rls=major_rls55
CVE: CVE-2008-6128
Published: 2009-02-13
Description: Session fixation vulnerability in moziloCMS 1.10.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://cms.mozilo.de/index.php?cat=10_moziloCMS&page=60_Changelog; http://secunia.com/advisories/32021; http://www.majorsecurity.de/index_2.php?major_rls=major_rls55
CVE: CVE-2008-6129
Published: 2009-02-13
Description: Directory traversal vulnerability in print.php in moziloWiki 1.0.1 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1348&w=2; http://secunia.com/advisories/32024; http://wiki.mozilo.de/index.php?page=Changelog
CVE: CVE-2008-6130
Published: 2009-02-13
Description: Cross-site scripting (XSS) vulnerability in index.php in moziloWiki 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) action and (2) page parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1348&w=2; http://secunia.com/advisories/32024; http://wiki.mozilo.de/index.php?page=Changelog
CVE: CVE-2008-6131
Published: 2009-02-13
Description: Session fixation vulnerability in moziloWiki 1.0.1 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1348&w=2; http://secunia.com/advisories/32024; http://wiki.mozilo.de/index.php?page=Changelog
CVE: CVE-2008-6132
Published: 2009-02-13
Description: Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via the start_date parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://phpscheduleit.svn.sourceforge.net/viewvc/phpscheduleit/1.2.11/reserve.php?r1=318&r2=328; http://secunia.com/advisories/32073; http://sourceforge.net/project/shownotes.php?release_id=662749
CVE: CVE-2008-6133
Published: 2009-02-13
Description: SQL injection vulnerability in arsaprint.php in Full PHP Emlak Script allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-3942.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/45643; https://www.exploit-db.com/exploits/6659; https://exchange.xforce.ibmcloud.com/vulnerabilities/45643
CVE: CVE-2008-6134
Published: 2009-02-14
Description: SQL injection vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/318746; http://secunia.com/advisories/32194; http://www.securityfocus.com/bid/31656
CVE: CVE-2008-6135
Published: 2009-02-14
Description: Cross-site scripting (XSS) vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/318746; http://secunia.com/advisories/32194; http://www.securityfocus.com/bid/31656
CVE: CVE-2008-6136
Published: 2009-02-14
Description: Unspecified vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to gain privileges as another user or an administrator via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/318746; http://secunia.com/advisories/32194; http://www.securityfocus.com/bid/31656
CVE: CVE-2008-6137
Published: 2009-02-14
Description: EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to bypass access restrictions via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/318746; http://secunia.com/advisories/32194; http://www.securityfocus.com/bid/31656
CVE: CVE-2008-6138
Published: 2009-02-14
Description: PHP remote file inclusion vulnerability in adminhead.php in WebBiscuits Modules Controller 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/31655; https://exchange.xforce.ibmcloud.com/vulnerabilities/45771; https://www.exploit-db.com/exploits/6703
CVE: CVE-2008-6139
Published: 2009-02-14
Description: Directory traversal vulnerability in faqsupport/wce.download.php in WebBiscuits Modules Controller 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the download parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/31655; https://exchange.xforce.ibmcloud.com/vulnerabilities/45772; https://www.exploit-db.com/exploits/6703
CVE: CVE-2008-6140
Published: 2009-02-14
Description: Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Avaya one-X Desktop Edition 2.1.0.78 allows remote attackers to cause a denial of service (crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/32205; http://support.avaya.com/elmodocs2/security/ASA-2008-370.htm; http://www.securityfocus.com/bid/31636
CVE: CVE-2008-6141
Published: 2009-02-14
Description: Unspecified vulnerability in Avaya IP Softphone 6.0 SP4 and 6.01.85 allows remote attackers to cause a denial of service (crash) via a large amount of H.323 data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32206; http://support.avaya.com/elmodocs2/security/ASA-2008-363.htm; http://www.securityfocus.com/bid/31635
CVE: CVE-2008-6142
Published: 2009-02-16
Description: Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPic 0.0.4 and FlexPHPic Pro 0.0.3, and other 0.0.x versions, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2) the checkpass parameter (aka password field), to admin/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33376; https://exchange.xforce.ibmcloud.com/vulnerabilities/47653; https://www.exploit-db.com/exploits/7624
CVE: CVE-2008-6143
Published: 2009-02-16
Description: OwenPoll 1.0 allows remote attackers to bypass authentication and obtain administrative access via a modified account name in the username cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/33032; https://www.exploit-db.com/exploits/7597; http://www.securityfocus.com/bid/33032
CVE: CVE-2008-6144
Published: 2009-02-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WEC Discussion Forum (wec_discussion) extension 1.7.0 and earlier for TYPO3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2008-3029.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33254; http://typo3.org/extensions/repository/view/wec_discussion/1.7.1; http://typo3.org/teams/security/security-bulletins/typo3-20081222-2
CVE: CVE-2008-6145
Published: 2009-02-16
Description: Multiple SQL injection vulnerabilities in the WEC Discussion Forum (wec_discussion) extension 1.7.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33254; http://typo3.org/extensions/repository/view/wec_discussion/1.7.1; http://typo3.org/teams/security/security-bulletins/typo3-20081222-2
CVE: CVE-2008-6146
Published: 2009-02-16
Description: SQL injection vulnerability in pm.php in DeluxeBB 1.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a delete##### parameter in a Delete action, a different vector than CVE-2005-2989.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/33351; http://www.securityfocus.com/bid/33037; https://www.exploit-db.com/exploits/7593
CVE: CVE-2008-6147
Published: 2009-02-16
Description: ForumApp 3.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) data/8690.mdb or (2) data/8690BAK.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33344; https://www.exploit-db.com/exploits/7599; http://secunia.com/advisories/33344
CVE: CVE-2008-6148
Published: 2009-02-16
Description: SQL injection vulnerability in the Live Ticker (com_liveticker) module 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the tid parameter in a viewticker action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33312; http://www.securityfocus.com/bid/33010; https://exchange.xforce.ibmcloud.com/vulnerabilities/47605
CVE: CVE-2008-6149
Published: 2009-02-16
Description: SQL injection vulnerability in the mDigg (com_mdigg) component 2.2.8 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cagtegory parameter in a story_lists action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33306; http://www.osvdb.org/51005; http://www.securityfocus.com/archive/1/499618/100/0/threaded
CVE: CVE-2008-6150
Published: 2009-02-16
Description: SQL injection vulnerability in classdis.asp in SepCity Classified Ads allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33354; http://www.securityfocus.com/bid/33050; https://exchange.xforce.ibmcloud.com/vulnerabilities/47642
CVE: CVE-2008-6151
Published: 2009-02-16
Description: SQL injection vulnerability in shpdetails.asp in SepCity Shopping Mall allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33358; http://www.securityfocus.com/bid/33039; https://exchange.xforce.ibmcloud.com/vulnerabilities/47622
CVE: CVE-2008-6152
Published: 2009-02-16
Description: SQL injection vulnerability in deptdisplay.asp in SepCity Faculty Portal allows remote attackers to execute arbitrary SQL commands via the ID parameter.  NOTE: this was originally reported for Lawyer Portal, which does not have a deptdisplay.asp file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33357; http://www.securityfocus.com/bid/33040; https://exchange.xforce.ibmcloud.com/vulnerabilities/47621
CVE: CVE-2008-6153
Published: 2009-02-16
Description: SQL injection vulnerability in Photo.asp in Jay Patel Pixel8 Web Photo Album 3.0 allows remote attackers to execute arbitrary SQL commands via the AlbumID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33373; http://www.securityfocus.com/bid/33069; https://exchange.xforce.ibmcloud.com/vulnerabilities/47662
CVE: CVE-2009-0592
Published: 2009-02-16
Description: Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to (1) admin_words.php, (2) admin_groups_reapir.php, (3) admin_smilies.php, (4) admin_ranks.php, (5) admin_styles.php, and (6) admin_users.php in admin/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/33365; http://www.securityfocus.com/bid/33103; https://www.exploit-db.com/exploits/7658
CVE: CVE-2009-0593
Published: 2009-02-16
Description: SQL injection vulnerability in members.php in plx Auto Reminder 3.7 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a newar action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/33283; http://www.securityfocus.com/bid/33106; https://www.exploit-db.com/exploits/7663
CVE: CVE-2009-0594
Published: 2009-02-16
Description: Cross-site scripting (XSS) vulnerability in index.php in phpSkelSite 1.4 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33382; http://www.securityfocus.com/bid/33092; https://www.exploit-db.com/exploits/7648
CVE: CVE-2009-0595
Published: 2009-02-16
Description: PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/33382; http://www.securityfocus.com/bid/33092; https://www.exploit-db.com/exploits/7648
CVE: CVE-2009-0596
Published: 2009-02-16
Description: Directory traversal vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the TplSuffix parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33382; http://www.securityfocus.com/bid/33092; https://www.exploit-db.com/exploits/7648
CVE: CVE-2009-0597
Published: 2009-02-16
Description: SQL injection vulnerability in admin/index.php in w3b>cms (aka w3blabor CMS) before 3.4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the benutzername parameter (aka Username field) in a login action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://forum.w3bcms.de/viewtopic.php?f=5&t=256; http://osvdb.org/51108; http://secunia.com/advisories/33364
CVE: CVE-2009-0598
Published: 2009-02-16
Description: SQL injection vulnerability in index.php in PhpMesFilms 1.0 and 1.8 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33332; http://www.securityfocus.com/bid/33105; https://www.exploit-db.com/exploits/7660
CVE: CVE-2008-6154
Published: 2009-02-16
Description: SQL injection vulnerability in index.php in Hispah Text Links Ads 1.1 allows remote attackers to execute arbitrary SQL commands via the idcat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32162; http://www.securityfocus.com/bid/31649; https://exchange.xforce.ibmcloud.com/vulnerabilities/45767
CVE: CVE-2008-6155
Published: 2009-02-16
Description: SQL injection vulnerability in index.php in Hispah Text Links Ads 1.1 allows remote attackers to execute arbitrary SQL commands via the idtl parameter in a buy action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32162; https://exchange.xforce.ibmcloud.com/vulnerabilities/48808; http://secunia.com/advisories/32162
CVE: CVE-2008-6156
Published: 2009-02-16
Description: SQL injection vulnerability in editCampaign.php in AdMan 1.1.20070907 allows remote authenticated users to execute arbitrary SQL commands via the campaignId parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32160; http://www.securityfocus.com/bid/31646; https://exchange.xforce.ibmcloud.com/vulnerabilities/45768
CVE: CVE-2009-0599
Published: 2009-02-16
Description: Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html; http://osvdb.org/51815; http://secunia.com/advisories/33872
CVE: CVE-2009-0600
Published: 2009-02-16
Description: Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html; http://secunia.com/advisories/33872; http://secunia.com/advisories/34144
CVE: CVE-2009-0601
Published: 2009-02-16
Description: Format string vulnerability in Wireshark 0.99.8 through 1.0.5 on non-Windows platforms allows local users to cause a denial of service (application crash) via format string specifiers in the HOME environment variable.
CVSS Score: 2.1 (LOW)
CWE: CWE-134
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html; http://secunia.com/advisories/34264; http://wiki.rpath.com/Advisories:rPSA-2009-0040
CVE: CVE-2009-0602
Published: 2009-02-16
Description: Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/33647; https://exchange.xforce.ibmcloud.com/vulnerabilities/48571; https://www.exploit-db.com/exploits/7998
CVE: CVE-2009-0603
Published: 2009-02-16
Description: Cross-site scripting (XSS) vulnerability in index.php in the Link module 5.x-2.5 for Drupal 5.10 allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via the description parameter (aka the Help field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0036.html; http://osvdb.org/51780; http://secunia.com/advisories/33835
CVE: CVE-2009-0604
Published: 2009-02-16
Description: SQL injection vulnerability in index.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary SQL commands via the searching parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33694; http://www.vupen.com/english/advisories/2009/0379; https://www.exploit-db.com/exploits/8014
CVE: CVE-2008-4285
Published: 2009-02-17
Description: Unspecified vulnerability in the Performance Monitoring Infrastructure (PMI) feature in the Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19, when a component statistic is enabled, allows attackers to cause a denial of service (daemon crash) via vectors related to "a gradual degradation in performance."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg24019260; http://www-01.ibm.com/support/docview.wss?uid=swg27007951; https://exchange.xforce.ibmcloud.com/vulnerabilities/48698
CVE: CVE-2008-6157
Published: 2009-02-17
Description: SepCity Classified Ads stores the admin password in cleartext in data/classifieds.mdb, which allows context-dependent attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://www.attrition.org/pipermail/vim/2009-February/002146.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/48822; https://www.exploit-db.com/exploits/7613
CVE: CVE-2008-6158
Published: 2009-02-17
Description: Multiple unspecified vulnerabilities in the admin backend in w3b>cms (aka w3blabor CMS) before 3.2.0 have unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://forum.w3bcms.de/viewtopic.php?f=5&t=235; http://osvdb.org/52023; https://exchange.xforce.ibmcloud.com/vulnerabilities/48823