deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2100
Published: 2009-06-17
Description: Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/55176; http://www.securityfocus.com/bid/35378; https://www.exploit-db.com/exploits/8946
CVE: CVE-2009-2101
Published: 2009-06-17
Description: Directory traversal vulnerability in archive.php in TorrentVolve 1.4, when register_globals is enabled, allows remote attackers to delete arbitrary files via a .. (dot dot) in the deleteTorrent parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/51088; https://www.exploit-db.com/exploits/8931; https://exchange.xforce.ibmcloud.com/vulnerabilities/51088
CVE: CVE-2009-2102
Published: 2009-06-17
Description: SQL injection vulnerability in the Jumi (com_jumi) component 2.0.3 and possibly other versions for Joomla allows remote attackers to execute arbitrary SQL commands via the fileid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55112; http://secunia.com/advisories/35465; http://www.securityfocus.com/bid/35384
CVE: CVE-2009-2103
Published: 2009-06-17
Description: SQL injection vulnerability in the Frontend MP3 Player (fe_mp3player) 0.2.3 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55123; http://secunia.com/advisories/35484; http://typo3.org/extensions/repository/view/fe_mp3player/0.2.4/
CVE: CVE-2009-2104
Published: 2009-06-17
Description: Cross-site scripting (XSS) vulnerability in the Modern Guestbook / Commenting System (ve_guestbook) extension 2.7.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55122; http://secunia.com/advisories/35483; http://typo3.org/extensions/repository/view/ve_guestbook/2.7.2/
CVE: CVE-2009-2105
Published: 2009-06-17
Description: SQL injection vulnerability in the References database (t3references) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55120; http://secunia.com/advisories/35485; http://typo3.org/extensions/repository/view/t3references/0.1.2/
CVE: CVE-2009-2106
Published: 2009-06-17
Description: SQL injection vulnerability in the Virtual Civil Services (civserv) extension 4.3.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55121; http://secunia.com/advisories/35479; http://typo3.org/extensions/repository/view/civserv/4.3.3/
CVE: CVE-2009-2107
Published: 2009-06-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Webmedia Explorer (webmex) 5.09 and 5.10 allow remote attackers to inject arbitrary web script or HTML via event handlers such as onmouseover in the (1) search or (2) tag parameters; (3) arbitrary invalid parameter names that are not properly handled when triggered on a column; (4) bookmark parameter in an edit action; or (5) email parameter in a remember action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.intern0t.net/intern0t-advisories/1123-intern0t-webmedia-explorer-cross-site-scripting-vulnerability.html; http://secunia.com/advisories/35477; http://www.securityfocus.com/archive/1/504307/100/0/threaded
CVE: CVE-2009-1935
Published: 2009-06-18
Description: Integer overflow in the pipe_build_write_buffer function (sys/kern/sys_pipe.c) in the direct write optimization feature in the pipe implementation in FreeBSD 7.1 through 7.2 and 6.3 through 6.4 allows local users to bypass virtual-to-physical address lookups and read sensitive information in memory pages via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://osvdb.org/55044; http://secunia.com/advisories/35398; http://security.freebsd.org/advisories/FreeBSD-SA-09:09.pipe.asc
CVE: CVE-2009-2108
Published: 2009-06-18
Description: git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://article.gmane.org/gmane.comp.version-control.git/120733; http://osvdb.org/55034; http://secunia.com/advisories/35437
CVE: CVE-2009-2109
Published: 2009-06-18
Description: Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) language parameter to charts.php and the (2) fretsweb_language cookie parameter to unspecified vectors, possibly related to admin/common.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/55166; http://osvdb.org/55196; http://secunia.com/advisories/35492
CVE: CVE-2009-2110
Published: 2009-06-18
Description: Multiple directory traversal vulnerabilities in DB Top Sites 1.0, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the u parameter to (1) full.php, (2) index.php, and (3) contact.php.
CVSS Score: 7.6 (HIGH)
CWE: CWE-22
References: http://osvdb.org/55116; http://osvdb.org/55117; http://osvdb.org/55118
CVE: CVE-2009-2111
Published: 2009-06-18
Description: Static code injection vulnerability in add_reg.php in DB Top Sites 1.0 allows remote attackers to inject arbitrary PHP code via a crafted (1) url and (2) location parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/55119; http://secunia.com/advisories/35419; https://exchange.xforce.ibmcloud.com/vulnerabilities/51121
CVE: CVE-2009-2112
Published: 2009-06-18
Description: Directory traversal vulnerability in include/page_bottom.php in phpFK 7.03 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the _FORUM[settings_design_style] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/55195; https://www.exploit-db.com/exploits/8975; http://osvdb.org/55195
CVE: CVE-2009-2113
Published: 2009-06-18
Description: Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to player.php and the (2) hash parameter to song.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55167; http://osvdb.org/55168; http://secunia.com/advisories/35492
CVE: CVE-2009-2114
Published: 2009-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin.php in SkyBlueCanvas 1.1 r237 allow remote attackers to inject arbitrary web script or HTML via the (1) mgroup, (2) mgr, (3) objtype, (4) id, and (5) dir parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.intern0t.net/intern0t-advisories/1120-intern0t-skybluecanvas-1-1-r237-multiple-vulnerabilities.html; http://osvdb.org/55115; http://secunia.com/advisories/35478
CVE: CVE-2009-2115
Published: 2009-06-18
Description: admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an invalid id parameter, which reveals the installation path in an error message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/35478; http://www.securityfocus.com/archive/1/504302/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/51164
CVE: CVE-2009-2116
Published: 2009-06-18
Description: Directory traversal vulnerability in admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to list directory contents via a .. (dot dot) in the dir parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://forum.intern0t.net/intern0t-advisories/1120-intern0t-skybluecanvas-1-1-r237-multiple-vulnerabilities.html; http://secunia.com/advisories/35478; http://www.securityfocus.com/archive/1/504302/100/0/threaded
CVE: CVE-2009-2117
Published: 2009-06-18
Description: uye_paneli.php in phPortal 1.0 allows remote attackers to bypass authentication and obtain administrative access by setting the kulladi cookie to a valid username.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/55192; https://www.exploit-db.com/exploits/8981; http://osvdb.org/55192
CVE: CVE-2009-2118
Published: 2009-06-18
Description: Integer overflow in IrfanView 4.23, when the resampling or screen fitting option is enabled, allows remote attackers to execute arbitrary code via a crafted TIFF 1 BPP image, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/55150; http://secunia.com/advisories/35359; http://www.irfanview.com/main_history.htm
CVE: CVE-2009-2119
Published: 2009-06-18
Description: Cross-site scripting (XSS) vulnerability in the login interface (my.logon.php3) in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55040; http://secunia.com/advisories/35418; http://secunia.com/advisories/35426
CVE: CVE-2009-2120
Published: 2009-06-18
Description: Multiple SQL injection vulnerabilities in TekBase All-in-One 3.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) ids parameter to admin.php, the (2) y parameter to members.php, and other unspecified vectors.  NOTE: vector 1 requires administrative access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/55190; http://osvdb.org/55191; http://secunia.com/advisories/35481
CVE: CVE-2009-0958
Published: 2009-06-19
Description: Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 stores an exception for a hostname when the user accepts an untrusted Exchange server certificate, which causes it to be accepted without prompting in future usage and allows remote Exchange servers to obtain sensitive information such as credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://osvdb.org/55236; http://support.apple.com/kb/HT3639
CVE: CVE-2009-0959
Published: 2009-06-19
Description: The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted MPEG-4 video file that triggers an "input validation issue."
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://osvdb.org/55237; http://support.apple.com/kb/HT3639
CVE: CVE-2009-0960
Published: 2009-06-19
Description: The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not provide an option to disable remote image loading in HTML email, which allows remote attackers to determine the device address and when an e-mail is read via an HTML email containing an image URL.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://support.apple.com/kb/HT3639; http://www.securityfocus.com/bid/35414
CVE: CVE-2009-0961
Published: 2009-06-19
Description: The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog when another alert appears, which might allow remote attackers to force the iPhone to place a call without user approval by causing an application to trigger an alert.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://osvdb.org/55238; http://support.apple.com/kb/HT3639
CVE: CVE-2009-1679
Published: 2009-06-19
Description: The Profiles component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1, when installing a configuration profile, can replace the password policy from Exchange ActiveSync with a weaker password policy, which allows physically proximate attackers to bypass the intended policy.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://osvdb.org/55239; http://support.apple.com/kb/HT3639
CVE: CVE-2009-1680
Published: 2009-06-19
Description: Safari in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly clear the search history when it is cleared from the Settings application, which allows physically proximate attackers to obtain the search history.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://osvdb.org/55240; http://support.apple.com/kb/HT3639
CVE: CVE-2009-1683
Published: 2009-06-19
Description: The Telephony component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted ICMP echo request, which triggers an assertion error related to a "logic issue."
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN87239696/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000040.html; http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
CVE: CVE-2009-1692
Published: 2009-06-19
Description: WebKit before r41741, as used in Apple iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Safari, and other software, allows remote attackers to cause a denial of service (memory consumption or device reset) via a web page containing an HTMLSelectElement object with a large length attribute, related to the length property of a Select object.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#121; http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2009-2122
Published: 2009-06-19
Description: SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35450; http://www.securityfocus.com/bid/35382; https://exchange.xforce.ibmcloud.com/vulnerabilities/51152
CVE: CVE-2009-2123
Published: 2009-06-19
Description: Multiple SQL injection vulnerabilities in Elvin 1.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) inUser (aka Username) and (2) inPass (aka Password) parameters to (a) inc/login.ei, reachable through login.php; and the (3) id parameter to (b) show_bug.php and (c) show_activity.php.  NOTE: it was later reported that vector 3c also affects 1.2.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35486; https://www.exploit-db.com/exploits/8953; https://www.exploit-db.com/exploits/9342
CVE: CVE-2009-2124
Published: 2009-06-19
Description: Directory traversal vulnerability in page.php in Elvin 1.2.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/35486; https://www.exploit-db.com/exploits/8953; http://secunia.com/advisories/35486
CVE: CVE-2009-2125
Published: 2009-06-19
Description: delete_bug.php in Elvin before 1.2.1 does not require administrative privileges, which allows remote authenticated users to bypass intended access restrictions and delete arbitrary bugs.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://bugs.elvinbts.org/show_bug.php?id=50; http://osvdb.org/55101; http://secunia.com/advisories/35430
CVE: CVE-2009-2126
Published: 2009-06-19
Description: Cross-site scripting (XSS) vulnerability in close_bug.php in Elvin before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the title (aka subject) field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.elvinbts.org/show_bug.php?id=49; http://osvdb.org/55100; http://secunia.com/advisories/35430
CVE: CVE-2009-2127
Published: 2009-06-19
Description: Cross-site scripting (XSS) vulnerability in show_activity.php in Elvin 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35486; https://www.exploit-db.com/exploits/8953; http://secunia.com/advisories/35486
CVE: CVE-2009-2128
Published: 2009-06-19
Description: SQL injection vulnerability in close_bug.php in Elvin before 1.2.1 allows remote attackers to execute arbitrary SQL commands via the title (aka subject) field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.elvinbts.org/show_bug.php?id=49; http://secunia.com/advisories/35430; http://bugs.elvinbts.org/show_bug.php?id=49
CVE: CVE-2009-2129
Published: 2009-06-19
Description: Cross-site request forgery (CSRF) vulnerability in login.php in Elvin 1.2.0 allows remote attackers to hijack the authentication of arbitrary users via a logout action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/8953; https://www.exploit-db.com/exploits/8953
CVE: CVE-2009-2130
Published: 2009-06-19
Description: Elvin 1.2.0 allows remote attackers to read the PHP source code of (1) login.ei, (2) jump_bug.ei, or (3) create_account.ei in inc/ via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://www.exploit-db.com/exploits/8953; https://www.exploit-db.com/exploits/8953
CVE: CVE-2009-2131
Published: 2009-06-19
Description: Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML by providing a crafted user_homepage parameter to member.php, and then posting a comment associated with a picture.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/55092; http://secunia.com/advisories/35427; http://www.4homepages.de/forum/index.php?topic=15186.0
CVE: CVE-2009-2132
Published: 2009-06-19
Description: Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://bbs.wolvez.org/topic/56/; http://secunia.com/advisories/35427; http://www.4homepages.de/forum/index.php?topic=15186.0
CVE: CVE-2009-2133
Published: 2009-06-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.40.4 and 1.40.7 allow remote attackers to inject arbitrary web script or HTML via the (1) menu or (2) sort parameter to pivot/index.php, (3) the value of a check array parameter in a delete action to pivot/index.php, (4) the element name in a check array parameter in a delete action to pivot/index.php, (5) the edituser parameter in an edituser action to pivot/index.php, (6) the edit parameter in a templates action to pivot/index.php, (7) the blog parameter in a blog_edit1 action to pivot/index.php, (8) the cat parameter in a cat_edit action to pivot/index.php, (9) a certain form field in a doaction=1 request to pivot/index.php, (10) the url field in a my_weblog edit_prefs action to pivot/user.php, or (11) the username (aka name) field in a my_weblog reg_user action to pivot/user.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4-7-multiple-vulnerabilities.html; http://osvdb.org/55085; http://osvdb.org/55086
CVE: CVE-2009-2134
Published: 2009-06-19
Description: pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url parameter, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4-7-multiple-vulnerabilities.html; http://www.securityfocus.com/archive/1/504300/100/0/threaded; https://www.exploit-db.com/exploits/8941
CVE: CVE-2009-2135
Published: 2009-06-19
Description: Multiple race conditions in the Solaris Event Port API in Sun Solaris 10 and OpenSolaris before snv_107 allow local users to cause a denial of service (panic) via unspecified vectors related to a race between the port_dissociate and close functions.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-362
References: http://osvdb.org/55231; http://osvdb.org/55232; http://secunia.com/advisories/35279
CVE: CVE-2009-2136
Published: 2009-06-19
Description: Unspecified vulnerability in the TCP/IP networking stack in Sun Solaris 10, and OpenSolaris snv_01 through snv_82 and snv_111 through snv_117, when a Cassini GigaSwift Ethernet Adapter (aka CE) interface is used, allows remote attackers to cause a denial of service (panic) via vectors involving jumbo frames.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/55233; http://secunia.com/advisories/35507; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141414-01-1
CVE: CVE-2009-2137
Published: 2009-06-19
Description: Memory leak in the Ultra-SPARC T2 crypto provider device driver (aka n2cp) in Sun Solaris 10, and OpenSolaris snv_54 through snv_112, allows context-dependent attackers to cause a denial of service (memory consumption) via unspecified vectors related to a large keylen value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/55234; http://secunia.com/advisories/35403; http://sunsolve.sun.com/search/document.do?assetkey=1-21-140386-03-1
CVE: CVE-2009-2138
Published: 2009-06-19
Description: Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the returnto parameter to login.php or (2) the returnto parameter in a delete action to news.php.  NOTE: this can be leveraged for cross-site scripting (XSS) by redirecting to a data: URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html; https://www.exploit-db.com/exploits/8942; http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html
CVE: CVE-2009-2141
Published: 2009-06-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to inject arbitrary web script or HTML via (1) the returnto parameter to makepoll.php, (2) the returnto parameter in a delete action to polls.php, or the (3) Info or (4) Avatar field to my.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html; http://secunia.com/advisories/35378; https://www.exploit-db.com/exploits/8942
CVE: CVE-2009-2142
Published: 2009-06-22
Description: Multiple SQL injection vulnerabilities in admin/index.asp in Zip Store Chat 4.0 and 5.0 allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) senha parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35417; http://www.vupen.com/english/advisories/2009/1581; https://www.exploit-db.com/exploits/8935
CVE: CVE-2009-2143
Published: 2009-06-22
Description: PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://firestats.cc/wiki/ChangeLog#a1.6.2-stable13062009; http://secunia.com/advisories/35400; https://www.exploit-db.com/exploits/8945