deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4772
Published: 2010-04-20
Description: Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal, when a custom checkout completion message is enabled, allows attackers to obtain sensitive information via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://drupal.org/node/636576; http://osvdb.org/60291; http://secunia.com/advisories/37440
CVE: CVE-2009-4773
Published: 2010-04-20
Description: Cross-site request forgery (CSRF) vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/636576; http://osvdb.org/60292; http://secunia.com/advisories/37440
CVE: CVE-2010-0744
Published: 2010-04-20
Description: aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/?view=log&pathrev=11991; http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/amsn/proxy.tcl?r1=11886&r2=11991&pathrev=11991; http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/amsn/sip.tcl?r1=11953&r2=11991&pathrev=11991
CVE: CVE-2010-1150
Published: 2010-04-20
Description: MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.3.patch.gz; http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0beta2.patch.gz; http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html
CVE: CVE-2010-1158
Published: 2010-04-20
Description: Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://bugs.gentoo.org/show_bug.cgi?id=313565; http://perldoc.perl.org/perl5100delta.html; http://secunia.com/advisories/55314
CVE: CVE-2010-1162
Published: 2010-04-20
Description: The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6da8d866d0d39e9509ff826660f6a86a6757c966; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html; http://secunia.com/advisories/39830
CVE: CVE-2010-1164
Published: 2010-04-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page; the (3) formName parameter, (4) element parameter, or (5) full name field to the User Picker page; the (6) formName parameter, (7) element parameter, or (8) group name field to the Group Picker page; the (9) announcement_preview_banner_st parameter to unspecified components, related to the Announcement Banner Preview page; unspecified vectors involving the (10) groupnames.jsp, (11) indexbrowser.jsp, (12) classpath-debug.jsp, (13) viewdocument.jsp, or (14) cleancommentspam.jsp page; the (15) portletKey parameter to runportleterror.jsp; the (16) URI to issuelinksmall.jsp; the (17) afterURL parameter to screenshot-redirecter.jsp; or the (18) HTTP Referrer header to 500page.jsp, as exploited in the wild in April 2010.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16; http://jira.atlassian.com/browse/JRA-20994; http://jira.atlassian.com/browse/JRA-21004
CVE: CVE-2010-1165
Published: 2010-04-20
Description: Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka attachments), (2) index (aka indexing), or (3) backup path and then uploading a file, as exploited in the wild in April 2010.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16; http://jira.atlassian.com/browse/JRA-20995; http://jira.atlassian.com/browse/JRA-21004
CVE: CVE-2010-1317
Published: 2010-04-20
Description: Heap-based buffer overflow in the NTLM authentication functionality in RealNetworks Helix Server and Helix Mobile Server 11.x, 12.x, and 13.x allows remote attackers to have an unspecified impact via invalid base64-encoded data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/39279; http://www.realnetworks.com/uploadedFiles/Support/helix-support/SecurityUpdate041410HS.pdf; http://www.securityfocus.com/bid/39490
CVE: CVE-2010-1318
Published: 2010-04-20
Description: Stack-based buffer overflow in the AgentX::receive_agentx function in AgentX++ 1.4.16, as used in RealNetworks Helix Server and Helix Mobile Server 11.x through 13.x and other products, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/39279; http://www.realnetworks.com/uploadedFiles/Support/helix-support/SecurityUpdate041410HS.pdf; http://www.securityfocus.com/bid/39490
CVE: CVE-2010-1319
Published: 2010-04-20
Description: Integer overflow in the AgentX::receive_agentx function in AgentX++ 1.4.16, as used in RealNetworks Helix Server and Helix Mobile Server 11.x through 13.x and other products, allows remote attackers to execute arbitrary code via a request with a crafted payload length.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/39279; http://www.realnetworks.com/uploadedFiles/Support/helix-support/SecurityUpdate041410HS.pdf; http://www.securityfocus.com/bid/39490
CVE: CVE-2010-1487
Published: 2010-04-20
Description: IBM Lotus Notes 7.0, 8.0, and 8.5 stores administrative credentials in cleartext in SURunAs.exe, which allows local users to obtain sensitive information by examining this file, aka SPR JSTN837SEG.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/39507; http://www-01.ibm.com/support/docview.wss?uid=swg21427073; http://www.securityfocus.com/bid/39525
CVE: CVE-2010-1488
Published: 2010-04-20
Description: The proc_oom_score function in fs/proc/base.c in the Linux kernel before 2.6.34-rc4 uses inappropriate data structures during selection of a candidate for the OOM killer, which might allow local users to cause a denial of service via unspecified patterns of task creation.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b95c35e76b29ba812e5dabdd91592e25ec640e93; http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.34-rc4; http://www.openwall.com/lists/oss-security/2010/04/14/1
CVE: CVE-2008-7255
Published: 2010-04-20
Description: login_screen.tcl in aMSN (aka Alvaro's Messenger) before 0.97.1 saves a password after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-255
References: http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/amsn/login_screen.tcl?r1=9960&r2=10259&pathrev=10259; http://sourceforge.net/project/shownotes.php?release_id=610067; http://www.amsn-project.net/forums/index.php?topic=5317.0
CVE: CVE-2010-0996
Published: 2010-04-20
Description: Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file.  NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required.
CVSS Score: 6.0 (MEDIUM)
References: http://e107.org/comment.php?comment.news.864; http://e107.org/svn_changelog.php?version=0.7.20; http://secunia.com/advisories/39013
CVE: CVE-2010-0997
Published: 2010-04-20
Description: Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is enabled, allows user-assisted remote authenticated users to inject arbitrary web script or HTML via the content_heading parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://e107.org/comment.php?comment.news.864; http://e107.org/svn_changelog.php?version=0.7.20; http://secunia.com/advisories/39013
CVE: CVE-2010-1151
Published: 2010-04-20
Description: Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to improper interaction with an external helper application for validation of credentials.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041326.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041340.html; http://secunia.com/advisories/39823
CVE: CVE-2010-1458
Published: 2010-04-20
Description: Stack-based buffer overflow in Create and Extract Zips TweakFS Zip Utility 1.0 for Flight Simulator X (FSX) allows remote attackers to execute arbitrary code via a long filename in a ZIP archive.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0242.html; http://secunia.com/advisories/39519; http://www.corelan.be:8800/advisories.php?id=CORELAN-10-026
CVE: CVE-2010-1489
Published: 2010-04-20
Description: The XSS Filter in Microsoft Internet Explorer 8 does not properly perform neutering for the SCRIPT tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities, a different issue than CVE-2009-4074.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogs.technet.com/msrc/archive/2010/04/19/guidance-on-internet-explorer-xss-filter.aspx; http://p42.us/ie8xss/; http://p42.us/ie8xss/Abusing_IE8s_XSS_Filters.pdf
CVE: CVE-2010-0886
Published: 2010-04-20
Description: Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE and Java for Business JDK and JRE 6 Update 10 through 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-0887
Published: 2010-04-20
Description: Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-1153
Published: 2010-04-20
Description: PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]9177&w=2; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008/; http://www.openwall.com/lists/oss-security/2010/04/12/1
CVE: CVE-2009-4774
Published: 2010-04-21
Description: Unspecified vulnerability in Sun Solaris 10 and OpenSolaris snv_49 through snv_117, when 64bit mode is used on the Intel x86 platform and a Linux (lx) branded zone is configured, allows local users to cause a denial of service (panic) via unspecified vectors, a different vulnerability than CVE-2007-6225.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/36691; http://sunsolve.sun.com/search/document.do?assetkey=1-26-266228-1; http://www.securityfocus.com/bid/36340
CVE: CVE-2009-4775
Published: 2010-04-21
Description: Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-134
References: http://docs.ipswitch.com/WS_FTP%20122/ReleaseNotes/English/index.htm?k_id=ipswitch_com_ftp_documents_worldwide_ws_ftp122releasenotesenglish#link23; http://www.exploit-db.com/exploits/9607; http://www.packetstormsecurity.org/0909-exploits/nocoolnameforawsftppoc.pl.txt
CVE: CVE-2009-4776
Published: 2010-04-21
Description: Buffer overflow in Hitachi Cosminexus V4 through V8, Processing Kit for XML, and Developer's Kit for Java, as used in products such as uCosminexus, Electronic Form Workflow, Groupmax, and IBM XL C/C++ Enterprise Edition 7 and 8, allows remote attackers to have an unknown impact via vectors related to the use of GIF image processing APIs by a Java application, and a different issue from CVE-2007-3794.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/57834; http://secunia.com/advisories/36622; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS09-014/index.html
CVE: CVE-2009-4777
Published: 2010-04-21
Description: Unspecified vulnerability in multiple versions of Hitachi JP1/Automatic Job Management System 2 - View, JP1/Integrated Management - View, and JP1/Cm2/SNMP System Observer, allows remote attackers to cause a denial of service ("abnormal" termination) via vectors related to the display of an "invalid GIF file."
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/57832; http://secunia.com/advisories/36646; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS09-016/index.html
CVE: CVE-2009-4778
Published: 2010-04-21
Description: Multiple unspecified vulnerabilities in the PDF distiller in the Attachment Service component in Research In Motion (RIM) BlackBerry Enterprise Server (BES) software 4.1.3 through 4.1.7 and 5.0.0, and BlackBerry Professional Software 4.1.4, allow user-assisted remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .pdf file attachment, a different vulnerability than CVE-2008-3246, CVE-2009-0176, CVE-2009-0219, CVE-2009-2643, and CVE-2009-2646.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/37562; http://www.blackberry.com/btsc/KB19860; http://www.securityfocus.com/bid/37167
CVE: CVE-2009-4779
Published: 2010-04-21
Description: Multiple PHP remote file inclusion vulnerabilities in NukeHall 0.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter to (1) blocks.php, (2) messages.php, and (3) stories.php in admin/modules/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/10217; https://exchange.xforce.ibmcloud.com/vulnerabilities/54393; http://www.exploit-db.com/exploits/10217
CVE: CVE-2009-4780
Published: 2010-04-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter in a sitemap action, (2) the search parameter in a search action, (3) the tagging_id parameter in a search action, (4) the highlight parameter in an artikel action, (5) the artlang parameter in an artikel action, (6) the letter parameter in a sitemap action, (7) the lang parameter in a show action, (8) the cat parameter in a show action, (9) the newslang parameter in a news action, (10) the artlang parameter in a send2friend action, (11) the cat parameter in a send2friend action, (12) the id parameter in a send2friend action, (13) the srclang parameter in a translate action, (14) the id parameter in a translate action, (15) the cat parameter in a translate action, (16) the cat parameter in an add action, or (17) the question parameter in an add action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37520; http://www.securityfocus.com/bid/37180; http://secunia.com/advisories/37520
CVE: CVE-2009-4781
Published: 2010-04-21
Description: TUKEVA Password Reminder before 1.0.0.4 uses a hard-coded password for rem.accdb, which allows local users to discover credentials via a DBI connection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/37553; http://www.exploit-db.com/exploits/10201; http://www.tekuva.com/index.php?option=com_docman&task=doc_details&gid=40&Itemid=9
CVE: CVE-2009-4782
Published: 2010-04-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Theeta CMS, possibly 0.01, allow remote attackers to inject arbitrary web script or HTML via the (1) start, (2) forum, and (3) cat parameters to community/thread.php; (4) start and (5) cat parameters to community/forum.php; and (6) start parameter to blog/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/theeta-sqlxss.txt; http://secunia.com/advisories/37529; http://www.securityfocus.com/archive/1/508148/100/0/threaded
CVE: CVE-2009-4783
Published: 2010-04-21
Description: Multiple SQL injection vulnerabilities in Theeta CMS, possibly 0.01, allow remote attackers to execute arbitrary SQL commands via the start parameter to (1) forum.php and (2) thread.php in community/, and (3) blog/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0912-exploits/theeta-sqlxss.txt; http://secunia.com/advisories/37529; http://www.securityfocus.com/archive/1/508148/100/0/threaded
CVE: CVE-2009-4784
Published: 2010-04-21
Description: SQL injection vulnerability in the Joaktree (com_joaktree) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the treeId parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0912-exploits/joomlajoaktree-sql.txt; http://secunia.com/advisories/37535; http://www.securityfocus.com/bid/37178
CVE: CVE-2009-4785
Published: 2010-04-21
Description: SQL injection vulnerability in the Quick News (com_quicknews) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a view_item action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0911-exploits/joomla-quicknews.txt; http://www.securityfocus.com/bid/37161; http://packetstormsecurity.org/0911-exploits/joomla-quicknews.txt
CVE: CVE-2009-4786
Published: 2010-04-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pligg before 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to (1) admin/admin_config.php, (2) admin/admin_modules.php, (3) delete.php, (4) editlink.php, (5) submit.php, (6) submit_groups.php, (7) user_add_remove_links.php, and (8) user_settings.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/130/45/; http://secunia.com/advisories/37349; http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/
CVE: CVE-2009-4787
Published: 2010-04-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Pligg before 1.0.3 allow remote attackers to hijack the authentication of administrators for requests that create user accounts or have unspecified other impact.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/130/45/; http://secunia.com/advisories/37349; http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/
CVE: CVE-2009-4788
Published: 2010-04-21
Description: Multiple open redirect vulnerabilities in Pligg 1.0.2 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the (1) return parameter to pligg/login.php and the (2) HTTP Referer header to user_settings.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://holisticinfosec.org/content/view/130/45/; http://secunia.com/advisories/37349; http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/
CVE: CVE-2009-4789
Published: 2010-04-21
Description: Multiple PHP remote file inclusion vulnerabilities in the MojoBlog component RC 0.15 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) wp-comments-post.php and (2) wp-trackback.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/0912-exploits/joomlamojoblog-rfi.txt; http://www.securityfocus.com/bid/37179; http://packetstormsecurity.org/0912-exploits/joomlamojoblog-rfi.txt
CVE: CVE-2010-1032
Published: 2010-04-21
Description: Unspecified vulnerability in HP HP-UX B.11.11 allows local users to cause a denial of service via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02091749; http://secunia.com/advisories/39537; http://www.vupen.com/english/advisories/2010/0948
CVE: CVE-2010-1033
Published: 2010-04-21
Description: Multiple stack-based buffer overflows in a certain Tetradyne ActiveX control in HP Operations Manager 7.5, 8.10, and 8.16 might allow remote attackers to execute arbitrary code via a long string argument to the (1) LoadFile or (2) SaveFile method, related to srcvw32.dll and srcvw4.dll.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02078800; http://net-ninja.net/blog/media/blogs/b/exploits/hpoperationsmngr.html.txt; http://secunia.com/advisories/39538
CVE: CVE-2010-1490
Published: 2010-04-21
Description: Unspecified vulnerability in IBM Cognos 8 Business Intelligence before 8.4.1 FP1 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/39451; http://www-01.ibm.com/support/docview.wss?uid=swg1PM04649; http://www.securityfocus.com/bid/39580
CVE: CVE-2009-4790
Published: 2010-04-22
Description: Multiple directory traversal vulnerabilities in Sysax Multi Server 4.5 allow remote authenticated users to read or modify arbitrary files via crafted FTP commands.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/34433; http://secunia.com/advisories/34433
CVE: CVE-2009-4791
Published: 2010-04-22
Description: Multiple SQL injection vulnerabilities in Family Connections (aka FCMS) before 1.8.2 allow remote attackers to execute arbitrary SQL commands via the (1) letter parameter to addressbook.php, (2) id parameter to recipes.php, (3) year parameter to register.php, (4) poll_id parameter to home.php, and (5) email parameter to lostpw.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34503; http://sourceforge.net/project/shownotes.php?release_id=672266; http://sourceforge.net/tracker/?func=detail&aid=2722736&group_id=189733&atid=930513