deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0794
Published: 2008-02-15
Description: Directory traversal vulnerability in user/header.php in Affiliate Market 0.1 BETA allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/27777; https://exchange.xforce.ibmcloud.com/vulnerabilities/40472; https://www.exploit-db.com/exploits/5108
CVE: CVE-2008-0795
Published: 2008-02-15
Description: SQL injection vulnerability in index.php in the MGFi XfaQ (com_xfaq) 1.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an answer action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27784; https://exchange.xforce.ibmcloud.com/vulnerabilities/40494; https://www.exploit-db.com/exploits/5109
CVE: CVE-2008-0796
Published: 2008-02-15
Description: SQL injection vulnerability in threads.php in Nuboard 0.5 allows remote attackers to execute arbitrary SQL commands via the ssid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/5115; https://www.exploit-db.com/exploits/5115
CVE: CVE-2008-0797
Published: 2008-02-15
Description: Directory traversal vulnerability in lib/download.php in iTheora 1.0 rc1 allows remote attackers to read arbitrary files via directory traversal sequences in the url parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://en.wikipedia.org/wiki/Talk:Itheora; http://menguy.aymeric.free.fr/theora/news.php; http://secunia.com/advisories/28929
CVE: CVE-2008-0798
Published: 2008-02-15
Description: Multiple directory traversal vulnerabilities in artmedic webdesign weblog 1.0, when magic_quotes_gpc is disabled, allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ta parameter to artmedic_index.php, reached through index.php; and the (2) date parameter to artmedic_print.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28927; http://www.securityfocus.com/archive/1/488115/100/100/threaded; http://www.securityfocus.com/bid/27797
CVE: CVE-2008-0799
Published: 2008-02-15
Description: SQL injection vulnerability in index.php in the Quiz (com_quiz) 0.81 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the tid parameter in a user_tst_shw action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28980; http://www.securityfocus.com/bid/27808; https://www.exploit-db.com/exploits/5119
CVE: CVE-2008-0800
Published: 2008-02-15
Description: SQL injection vulnerability in index.php in the McQuiz (com_mcquiz) 0.9 Final component for Joomla! allows remote attackers to execute arbitrary SQL commands via the tid parameter in a user_tst_shw action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28940; http://www.securityfocus.com/bid/27809; https://www.exploit-db.com/exploits/5118
CVE: CVE-2008-0801
Published: 2008-02-15
Description: SQL injection vulnerability in index.php in the PAXXGallery (com_paxxgallery) 0.2 component for Mambo and Joomla! allow remote attackers to execute arbitrary SQL commands via (1) the iid parameter in a view action, and possibly (2) the userid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27811; https://exchange.xforce.ibmcloud.com/vulnerabilities/40497; https://www.exploit-db.com/exploits/5117
CVE: CVE-2008-0802
Published: 2008-02-15
Description: SQL injection vulnerability in index.php in the MediaSlide (com_mediaslide) 0.5 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the albumnum parameter in a contact action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28962; http://www.securityfocus.com/bid/27805; https://exchange.xforce.ibmcloud.com/vulnerabilities/40517
CVE: CVE-2008-0803
Published: 2008-02-15
Description: Multiple PHP remote file inclusion vulnerabilities in LookStrike Lan Manager 0.9 allow remote attackers to execute arbitrary PHP code via a URL in the sys_conf[path][real] parameter to (1) modules\class\Table.php; (2) db_admins.php, (3) db_alert.php, (4) db_double.php, (5) db_games.php, (6) db_matches.php, (7) db_match_teams.php, (8) db_news.php, (9) db_platform.php, (10) db_players.php, (11) db_server_group.php, (12) db_server_ip.php, (13) db_teams.php, (14) db_team_players.php, (15) db_tournaments.php, (16) db_tournament_teams.php, and (17) db_trees.php in modules\class\db\; and (18) Match.php, (19) MatchTeam.php, (20) Rule.php, (21) RuleBuilder.php, (22) RulePool.php, (23) RuleSingle.php, (24) RuleTree.php, (25) Tournament.php, (26) TournamentTeam.php, (27) Tree.php, and (28) TreeSingle.php in modules\class\tournament\.  NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/40519; https://www.exploit-db.com/exploits/5121; https://exchange.xforce.ibmcloud.com/vulnerabilities/40519
CVE: CVE-2007-6313
Published: 2008-02-18
Description: MySQL Server 5.1.x before 5.1.23 and 6.0.x before 6.0.4 does not check the rights of the entity executing BINLOG, which allows remote authorized users to execute arbitrary BINLOG statements.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://bugs.mysql.com/31611; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html; http://osvdb.org/43179
CVE: CVE-2008-0674
Published: 2008-02-18
Description: Buffer overflow in PCRE before 7.6 allows remote attackers to execute arbitrary code via a regular expression containing a character class with a large number of characters with Unicode code points greater than 255.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://ftp.gnome.org/pub/gnome/sources/glib/2.14/glib-2.14.6.news; http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
CVE: CVE-2007-6258
Published: 2008-02-19
Description: Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a long (1) Host header, or (2) Hostname within a Host header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/3661; http://www.ioactive.com/pdfs/mod_jk2.pdf; http://www.ioactive.com/vulnerabilities/mod_jk2LegacyBufferOverflowAdvisory.pdf
CVE: CVE-2008-0556
Published: 2008-02-19
Description: Cross-site request forgery (CSRF) vulnerability in OpenCA PKI 0.9.2.5, and possibly earlier versions, allows remote attackers to perform unauthorized actions as authorized users via a link or IMG tag to RAServer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264, CWE-352
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060300.html; http://secunia.com/advisories/28951; http://securitytracker.com/id?1019426
CVE: CVE-2008-0804
Published: 2008-02-19
Description: PHP remote file inclusion vulnerability in usrgetform.html in Thecus N5200Pro NAS Server allows remote attackers to execute arbitrary PHP code via a URL in the name parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29013; http://www.securityfocus.com/bid/27865; https://www.exploit-db.com/exploits/5150
CVE: CVE-2008-0805
Published: 2008-02-19
Description: Unrestricted file upload vulnerability in image.php in PHPizabi 0.848b C1 HFP1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension from the event page, then accessing it via a direct request to the file in system/cache/pictures.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/27847; http://www.vupen.com/english/advisories/2008/0585; https://www.exploit-db.com/exploits/5136
CVE: CVE-2008-0806
Published: 2008-02-19
Description: wyrd 1.4.3b allows local users to overwrite arbitrary files via a symlink attack on the wyrd-tmp.[USERID] temporary file.
CVSS Score: 3.6 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466382; http://secunia.com/advisories/29009; http://secunia.com/advisories/29113
CVE: CVE-2008-0807
Published: 2008-02-19
Description: lib/Driver/sql.php in Turba 2 (turba2) Contact Manager H3 2.1.x before 2.1.7 and 2.2.x before 2.2-RC3, as used in products such as Horde Groupware before 1.0.4 and Horde Groupware Webmail Edition before 1.0.5, does not properly check access rights, which allows remote authenticated users to modify address data via a modified object_id parameter to edit.php, as demonstrated by modifying a personal address book entry when there is write access to a shared address book.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058; http://lists.horde.org/archives/announce/2008/000378.html; http://lists.horde.org/archives/announce/2008/000379.html
CVE: CVE-2008-0808
Published: 2008-02-19
Description: Cross-site scripting (XSS) vulnerability in the meta plugin in Ikiwiki before 1.1.47 allows remote attackers to inject arbitrary web script or HTML via meta tags.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=465110; http://ikiwiki.info/security/#index30h2; http://secunia.com/advisories/28911
CVE: CVE-2008-0809
Published: 2008-02-19
Description: Cross-site scripting (XSS) vulnerability in the htmlscrubber in Ikiwiki before 1.1.46 allows remote attackers to inject arbitrary web script or HTML via title contents.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ikiwiki.info/security/#index27h2; http://secunia.com/advisories/28911; http://secunia.com/advisories/29369
CVE: CVE-2008-0810
Published: 2008-02-19
Description: SQL injection vulnerability in the com_scheduling module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3662; http://www.securityfocus.com/archive/1/488269/100/0/threaded; http://www.securityfocus.com/bid/27830
CVE: CVE-2008-0811
Published: 2008-02-19
Description: Multiple SQL injection vulnerabilities in AuraCMS 1.62 allow remote attackers to execute arbitrary SQL commands via (1) the kid parameter to (a) mod/dl.php or (b) mod/links.php, and (2) the query parameter to search.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27841; http://www.securitytracker.com/id?1019430; https://www.exploit-db.com/exploits/5130
CVE: CVE-2008-0812
Published: 2008-02-19
Description: Directory traversal vulnerability in DMS/index.php in BanPro DMS 1.0 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the action parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28992; http://securityreason.com/securityalert/3666; http://www.securityfocus.com/archive/1/488271/100/0/threaded
CVE: CVE-2008-0813
Published: 2008-02-19
Description: Directory traversal vulnerability in Download.php in XPWeb 3.0.1, 3.3.2, and possibly other versions, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29006; http://www.securityfocus.com/bid/27838; http://www.vupen.com/english/advisories/2008/0584
CVE: CVE-2008-0814
Published: 2008-02-19
Description: Directory traversal vulnerability in download.php in Tracking Requirements & Use Cases (TRUC) 0.11.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the upload_filename parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/27839; https://www.exploit-db.com/exploits/5129; http://www.securityfocus.com/bid/27839
CVE: CVE-2008-0815
Published: 2008-02-19
Description: SQL injection vulnerability in the com_mezun component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit task.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3663; http://www.securityfocus.com/archive/1/487992/100/100/threaded; http://www.securityfocus.com/bid/27755
CVE: CVE-2008-0816
Published: 2008-02-19
Description: SQL injection vulnerability in the com_sg component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the pid parameter in an order task.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3664; http://www.securityfocus.com/archive/1/488272/100/0/threaded; http://www.securityfocus.com/bid/27821
CVE: CVE-2008-0817
Published: 2008-02-19
Description: SQL injection vulnerability in the com_filebase component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in a selectfolder action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3665; http://www.securityfocus.com/archive/1/488268/100/0/threaded; http://www.securityfocus.com/archive/1/488284/100/0/threaded
CVE: CVE-2008-0818
Published: 2008-02-19
Description: Multiple directory traversal vulnerabilities in freePHPgallery 0.6 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie to (1) comment.php, (2) index.php, and (3) show.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/28972; http://sourceforge.net/forum/forum.php?forum_id=785794; http://www.securityfocus.com/bid/27806
CVE: CVE-2008-0819
Published: 2008-02-19
Description: Directory traversal vulnerability in index.php in PlutoStatus Locator 1.0 pre alpha allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 3.6 (LOW)
CWE: CWE-22
References: http://securityreason.com/securityalert/3667; http://www.securityfocus.com/archive/1/488141/100/0/threaded; http://www.securityfocus.com/bid/27802
CVE: CVE-2008-0820
Published: 2008-02-19
Description: Cross-site scripting (XSS) vulnerability in index.php in Etomite 0.6.1.4 Final allows remote attackers to inject arbitrary web script or HTML via $_SERVER['PHP_INFO'].  NOTE: the vendor disputes this issue in a followup, stating that the affected variable is $_SERVER['PHP_SELF'], and "This is not an Etomite specific exploit and I would like the report rescinded.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28964; http://securityreason.com/securityalert/3669; http://www.etomite.com/forums/index.php?showtopic=7647
CVE: CVE-2008-0821
Published: 2008-02-19
Description: SQL injection vulnerability in admin/traffic/knowledge_searchm.php in OSI Codes Inc. PHP Live! 3.2.2 allows remote attackers to execute arbitrary SQL commands via the questid parameter in an expand_question action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27807; https://www.exploit-db.com/exploits/5125; http://www.securityfocus.com/bid/27807
CVE: CVE-2008-0822
Published: 2008-02-19
Description: Directory traversal vulnerability in index.php in Scribe 0.2 allows remote attackers to read arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 3.6 (LOW)
CWE: CWE-22
References: http://securityreason.com/securityalert/3668; http://www.securityfocus.com/archive/1/488140/100/0/threaded; http://www.securityfocus.com/bid/27803
CVE: CVE-2008-0823
Published: 2008-02-19
Description: Unspecified vulnerability in the Header Image Module before 5.x-1.1 for Drupal allows remote attackers to access the administration pages via unknown attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://drupal.org/node/221359; http://secunia.com/advisories/28876; http://www.securityfocus.com/bid/27787
CVE: CVE-2008-0824
Published: 2008-02-19
Description: Unspecified vulnerability in the php2phps function in Claroline before 1.8.9 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/28942; http://sourceforge.net/project/shownotes.php?release_id=575934; http://secunia.com/advisories/28942
CVE: CVE-2008-0825
Published: 2008-02-19
Description: SQL injection vulnerability in Claroline before 1.8.9 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28942; http://sourceforge.net/project/shownotes.php?release_id=575934; http://www.securityfocus.com/bid/27846
CVE: CVE-2008-0826
Published: 2008-02-19
Description: Cross-site scripting (XSS) vulnerability in Claroline before 1.8.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28942; http://sourceforge.net/project/shownotes.php?release_id=575934; http://www.securityfocus.com/bid/27846
CVE: CVE-2008-0827
Published: 2008-02-19
Description: SQL injection vulnerability in the Books module of PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27863; https://exchange.xforce.ibmcloud.com/vulnerabilities/40857; https://www.exploit-db.com/exploits/5147
CVE: CVE-2008-0828
Published: 2008-02-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) attributes such as style and onmouseover in (a) forum post or (b) mail; or (2) the website field of the profile.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29015; http://securityreason.com/securityalert/3670; http://www.securityfocus.com/archive/1/488293/100/0/threaded
CVE: CVE-2008-0829
Published: 2008-02-19
Description: SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail task.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forum.joomlaitalia.com/index.php?topic=388.0; http://members.joomlapixel.eu/download/componenti/patch-jooget-2.6.8-sql-injection/details.html; http://secunia.com/advisories/28998
CVE: CVE-2007-6319
Published: 2008-02-19
Description: Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to (1) gain list administrator privileges or (2) access arbitrary mailing lists via unknown vectors related to modification of client-side information; and (3) allow remote authenticated administrators to modify other account data by creating "new accounts that collide with existing accounts."
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29019; http://securityreason.com/securityalert/3671; http://securitytracker.com/id?1019436
CVE: CVE-2008-0830
Published: 2008-02-19
Description: The Digital Photo Access Protocol (DPAP) server for iPhoto 4.0.3 allows remote attackers to cause a denial of service (crash) via a malformed dpap: URI, a different vulnerability than CVE-2008-0043.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/27867; http://www.securitytracker.com/id?1019488; https://www.exploit-db.com/exploits/5151
CVE: CVE-2008-0831
Published: 2008-02-20
Description: Multiple SQL injection vulnerabilities in the Rapid Recipe (com_rapidrecipe) 1.6.5 and earlier component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) user_id or (2) category_id parameter.  NOTE: this might overlap CVE-2008-0754.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/5103; https://www.exploit-db.com/exploits/5103
CVE: CVE-2008-0832
Published: 2008-02-20
Description: SQL injection vulnerability in index.php in the Kemas Antonius com_quran 1.1 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the surano parameter in a viewayat action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0399.html; http://osvdb.org/52226; http://secunia.com/advisories/28986
CVE: CVE-2008-0833
Published: 2008-02-20
Description: SQL injection vulnerability in index.php in the com_galeria component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/488285; http://www.securityfocus.com/bid/27833; https://www.exploit-db.com/exploits/5134
CVE: CVE-2008-0834
Published: 2008-02-20
Description: Cross-site scripting (XSS) vulnerability in Lotus Quickr for i5/OS before 8.0.0.2 Hotfix 11, when anonymous access is disabled on HTTP ports, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29004; http://www-1.ibm.com/support/docview.wss?uid=swg24016411; http://www.securityfocus.com/bid/27840
CVE: CVE-2008-0835
Published: 2008-02-20
Description: SQL injection vulnerability in indexen.php in Simple CMS 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the area parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/488288/100/0/threaded; http://www.securityfocus.com/bid/27843; https://www.exploit-db.com/exploits/5131
CVE: CVE-2008-0836
Published: 2008-02-20
Description: Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 9 and 10 on x86 architectures allows local users to cause a denial of service (panic) via unspecified vectors that trigger a NULL pointer dereference in the vuid3ps2 module, a different issue than CVE-2007-5319.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/28990; http://sunsolve.sun.com/search/document.do?assetkey=1-26-200635-1; http://www.securitytracker.com/id?1019429
CVE: CVE-2008-0837
Published: 2008-02-20
Description: Cross-site scripting (XSS) vulnerability in the log feature in the John Godley Search Unleashed 0.2.10 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, which is not properly handled when the administrator views the log file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28968; http://securityreason.com/securityalert/3674; http://urbangiraffe.com/tracker/issues/show/60
CVE: CVE-2008-0838
Published: 2008-02-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface in Sophos ES1000 and ES4000 Email Security Appliance 2.1.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) error and (2) go parameters to the login page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28961; http://securityreason.com/securityalert/3673; http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-02-13
CVE: CVE-2008-0839
Published: 2008-02-20
Description: SQL injection vulnerability in refer.php in the astatsPRO (com_astatspro) 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29008; http://www.securityfocus.com/bid/27850; https://exchange.xforce.ibmcloud.com/vulnerabilities/40611
CVE: CVE-2008-0840
Published: 2008-02-20
Description: Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the username parameter.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29017; http://www.securityfocus.com/archive/1/488283/100/0/threaded; http://www.securityfocus.com/bid/27837