deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3291
Published: 2009-09-22
Description: The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5735&w=2
CVE: CVE-2009-3292
Published: 2009-09-22
Description: Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity checks around exif processing."
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5735&w=2
CVE: CVE-2009-3293
Published: 2009-09-22
Description: Unspecified vulnerability in the imagecolortransparent function in PHP before 5.2.11 has unknown impact and attack vectors related to an incorrect "sanity check for the color index."
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5735&w=2
CVE: CVE-2009-3294
Published: 2009-09-22
Description: The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://bugs.php.net/bug.php?id=44683; http://news.php.net/php.announce/79; http://svn.php.net/viewvc?view=revision&revision=287779
CVE: CVE-2009-3306
Published: 2009-09-23
Description: PHP remote file inclusion vulnerability in include/header.php in ClearSite 4.50 allows remote attackers to execute arbitrary PHP code via a URL in the cs_base_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9716; http://www.securityfocus.com/archive/1/511507/100/0/threaded; http://www.securityfocus.com/bid/40457
CVE: CVE-2009-3307
Published: 2009-09-23
Description: Multiple PHP remote file inclusion vulnerabilities in FSphp 0.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the FSPHP_LIB parameter to (1) FSphp.php, (2) navigation.php, and (3) pathwrite.php in lib/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9720; http://www.vupen.com/english/advisories/2009/2704; http://www.exploit-db.com/exploits/9720
CVE: CVE-2009-3308
Published: 2009-09-23
Description: SQL injection vulnerability in show-cat.php in FanUpdate 2.2.1 allows remote attackers to execute arbitrary SQL commands via the listingid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36795; http://www.exploit-db.com/exploits/9719; http://www.vupen.com/english/advisories/2009/2703
CVE: CVE-2009-3309
Published: 2009-09-23
Description: SQL injection vulnerability in index.cfm in CF ShopKart 5.4 beta allows remote attackers to execute arbitrary SQL commands via the itemid parameter in a ViewDetails action, a different vector than CVE-2008-6320.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9710; http://www.securityfocus.com/bid/36442; https://exchange.xforce.ibmcloud.com/vulnerabilities/53331
CVE: CVE-2009-3310
Published: 2009-09-23
Description: SQL injection vulnerability in index.php in Zainu 1.0 allows remote attackers to execute arbitrary SQL commands via the album_id parameter in an AlbumSongs action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36798; http://www.exploit-db.com/exploits/9715; http://www.securityfocus.com/bid/36453
CVE: CVE-2009-3311
Published: 2009-09-23
Description: Cross-site scripting (XSS) vulnerability in index.php in RSSMediaScript allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/58169; http://packetstormsecurity.org/0909-exploits/rssms-xss.txt; http://secunia.com/advisories/36740
CVE: CVE-2009-3312
Published: 2009-09-23
Description: PHP remote file inclusion vulnerability in php/init.poll.php in phpPollScript 1.3 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a crafted URL in the include_class parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/58181; http://secunia.com/advisories/36730; http://www.exploit-db.com/exploits/9703
CVE: CVE-2009-3313
Published: 2009-09-23
Description: Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote attackers to execute arbitrary SQL commands via the comp parameter to (1) index.php and (2) editComments.php, and (3) allow remote authenticated administrators to execute arbitrary SQL commands via the id parameter in a comment action to edit.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/58182; http://osvdb.org/58183; http://osvdb.org/58184
CVE: CVE-2009-3314
Published: 2009-09-23
Description: SQL injection vulnerability in ladders.php in Elite Gaming Ladders 3.2 allows remote attackers to execute arbitrary SQL commands via the platform parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/58168; http://secunia.com/advisories/36732; http://www.exploit-db.com/exploits/9702
CVE: CVE-2009-3315
Published: 2009-09-23
Description: SQL injection vulnerability in admin/index.php in NeLogic Nephp Publisher Enterprise 3.5.9 and 4.5 allows remote attackers to execute arbitrary SQL commands via the Username field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9712; http://www.securityfocus.com/bid/36444; https://exchange.xforce.ibmcloud.com/vulnerabilities/53332
CVE: CVE-2009-3316
Published: 2009-09-23
Description: SQL injection vulnerability in the JReservation (com_jreservation) component 1.0 and 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a propertycpanel action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/58176; http://secunia.com/advisories/36774; http://www.exploit-db.com/exploits/9713
CVE: CVE-2009-3317
Published: 2009-09-23
Description: PHP remote file inclusion vulnerability in pages/pageHeader.php in OpenSiteAdmin 0.9.7 BETA allows remote attackers to execute arbitrary PHP code via a URL in the path parameter, a different vector than CVE-2008-0648.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9708; http://www.securityfocus.com/bid/36445; https://exchange.xforce.ibmcloud.com/vulnerabilities/53326
CVE: CVE-2009-3318
Published: 2009-09-23
Description: Directory traversal vulnerability in the Roland Breedveld Album (com_album) component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. (dot dot) in the target parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9706; http://www.securityfocus.com/bid/36441; http://www.exploit-db.com/exploits/9706
CVE: CVE-2009-3319
Published: 2009-09-23
Description: SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a sec list action, a different vector than CVE-2006-1018.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/506616/100/0/threaded; http://www.securityfocus.com/bid/16909; http://www.securityfocus.com/archive/1/506616/100/0/threaded
CVE: CVE-2009-3320
Published: 2009-09-23
Description: Cross-site scripting (XSS) vulnerability in scrivi.php in Zenas PaoLink (aka Pao-Link) 1.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/58166; http://packetstormsecurity.org/0909-exploits/paolink-xss.txt; http://secunia.com/advisories/36738
CVE: CVE-2009-3321
Published: 2009-09-23
Description: SQL injection vulnerability in SaphpLesson 4.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the CLIENT_IP HTTP header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/58173; http://secunia.com/advisories/36737; http://www.exploit-db.com/exploits/9700
CVE: CVE-2009-3322
Published: 2009-09-23
Description: The Siemens Gigaset SE361 WLAN router allows remote attackers to cause a denial of service (device reboot) via a flood of crafted TCP packets to port 1723.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/36697; http://www.exploit-db.com/exploits/9646; http://www.osvdb.org/58199
CVE: CVE-2009-3323
Published: 2009-09-23
Description: Multiple PHP remote file inclusion vulnerabilities in BAnner ROtation System mini (BAROSmini) 0.32.595 allow remote attackers to execute arbitrary PHP code via a URL in the baros_path parameter to (1) include/common_functions.php, and the main_path parameter to (2) lib_users.php, (3) lib_stats.php, and (4) lib_slots.php in include/lib/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9724; https://exchange.xforce.ibmcloud.com/vulnerabilities/53378; http://www.exploit-db.com/exploits/9724
CVE: CVE-2009-3324
Published: 2009-09-23
Description: PHP remote file inclusion vulnerability in include/prodler.class.php in ProdLer 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sPath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9728; http://www.exploit-db.com/exploits/9728
CVE: CVE-2009-3325
Published: 2009-09-23
Description: SQL injection vulnerability in the Focusplus Developments Survey Manager (com_surveymanager) component 1.5.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the stype parameter in an editsurvey action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9721; http://www.securityfocus.com/bid/36464; http://www.vupen.com/english/advisories/2009/2705
CVE: CVE-2009-3326
Published: 2009-09-23
Description: SQL injection vulnerability in index.php in CMScontrol Content Management System 7.x allows remote attackers to execute arbitrary SQL commands via the id_menu parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9727; http://www.exploit-db.com/exploits/9727
CVE: CVE-2009-3327
Published: 2009-09-23
Description: Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the (1) QUERY parameter to search.php and (2) USERNAME parameter to login.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36806; http://www.exploit-db.com/exploits/9730; http://secunia.com/advisories/36806
CVE: CVE-2009-3328
Published: 2009-09-23
Description: Cross-site scripting (XSS) vulnerability in sign.php in WX-Guestbook 1.1.208 allows remote attackers to inject arbitrary web script or HTML via the sName parameter (aka the name field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36806; http://www.exploit-db.com/exploits/9730; http://secunia.com/advisories/36806
CVE: CVE-2009-3329
Published: 2009-09-23
Description: Stack-based buffer overflow in Winplot 1.25.0.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Plot2D (.wp2) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/36817; http://www.exploit-db.com/exploits/9725; http://secunia.com/advisories/36817
CVE: CVE-2009-3330
Published: 2009-09-23
Description: SQL injection vulnerability in index.php in cP Creator 2.7.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tickets parameter in a support ticket action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/36815; http://www.exploit-db.com/exploits/9726; http://secunia.com/advisories/36815
CVE: CVE-2009-3331
Published: 2009-09-23
Description: Multiple PHP remote file inclusion vulnerabilities in DDL CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the wwwRoot parameter to (1) header.php, (2) submit.php, (3) submitted.php, and (4) autosubmitter/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9722; https://exchange.xforce.ibmcloud.com/vulnerabilities/53373; http://www.exploit-db.com/exploits/9722
CVE: CVE-2009-3332
Published: 2009-09-23
Description: SQL injection vulnerability in the JBudgetsMagic (com_jbudgetsmagic) component 0.3.2 through 0.4.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the bid parameter in a mybudget action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9723; http://www.securityfocus.com/bid/36461; http://www.exploit-db.com/exploits/9723
CVE: CVE-2009-3333
Published: 2009-09-23
Description: PHP remote file inclusion vulnerability in koesubmit.php in the koeSubmit (com_koesubmit) component 1.0 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9714; http://www.securityfocus.com/bid/36447; http://www.exploit-db.com/exploits/9714
CVE: CVE-2009-3334
Published: 2009-09-23
Description: SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component (aka JINC or com_jinc) component 0.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a messages action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9732; http://www.securityfocus.com/bid/36471; http://www.exploit-db.com/exploits/9732
CVE: CVE-2009-2680
Published: 2009-09-24
Description: Unspecified vulnerability in the Remote Management Interface (RMI) for MSL Tape Libraries and 1/8 G2 Tape Autoloaders in HP StorageWorks 1/8 G2 Tape Autoloader firmware 2.30 and earlier, MSL2024 Tape Library firmware 4.20 and earlier, MSL4048 Tape Library firmware 6.50 and earlier, and MSL8096 Tape Library firmware 8.90 and earlier allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 8.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01868405; http://secunia.com/advisories/36764; http://securitytracker.com/id?1022905
CVE: CVE-2009-3335
Published: 2009-09-24
Description: SQL injection vulnerability in the TurtuShout component 0.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Name field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9653; https://exchange.xforce.ibmcloud.com/vulnerabilities/53209; http://www.exploit-db.com/exploits/9653
CVE: CVE-2009-3336
Published: 2009-09-24
Description: SQL injection vulnerability in auction_details.php in PHP Pro Bid allows remote attackers to execute arbitrary SQL commands via the auction_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9665; http://www.securityfocus.com/bid/36389; http://www.vupen.com/english/advisories/2009/2661
CVE: CVE-2009-3337
Published: 2009-09-24
Description: SQL injection vulnerability in the Freetag (serendipity_event_freetag) plugin before 3.09 for Serendipity (S9Y) allows remote attackers to execute arbitrary SQL commands via an unspecified parameter associated with Meta keywords in a blog entry.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.s9y.org/archives/210-Security-update-for-Freetag-Plugin.html; http://secunia.com/advisories/36706; http://www.securityfocus.com/bid/36376
CVE: CVE-2009-3338
Published: 2009-09-24
Description: Stack-based buffer overflow in EffectMatrix (E.M.) Magic Morph 1.95b allows remote attackers to execute arbitrary code via a long string in a .mor file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/36721; http://www.exploit-db.com/exploits/9659; http://www.vupen.com/english/advisories/2009/2658
CVE: CVE-2009-3339
Published: 2009-09-24
Description: Unspecified vulnerability in McAfee Email and Web Security Appliance 5.1 VMtrial allows remote attackers to read arbitrary files via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.9 through 8.11.  NOTE: as of 20090917, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.8 (HIGH)
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36574; http://www.securitytracker.com/id?1022829
CVE: CVE-2009-3340
Published: 2009-09-24
Description: Unspecified vulnerability in FreeSSHD 1.2.4 allows remote attackers to cause a denial of service via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.  NOTE: as of 20090917, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 5.0 (MEDIUM)
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36506; http://www.securitytracker.com/id?1022811
CVE: CVE-2009-3341
Published: 2009-09-24
Description: Buffer overflow on the Linksys WRT54GL wireless router allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.10 through 8.11.  NOTE: as of 20090917, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36571; http://www.securitytracker.com/id?1022827
CVE: CVE-2009-3342
Published: 2009-09-24
Description: SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints (com_alphauserpoints) component 1.5.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the username2points parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/36383; http://www.vupen.com/english/advisories/2009/2659; https://www.exploit-db.com/exploits/9654
CVE: CVE-2009-3343
Published: 2009-09-24
Description: SQL injection vulnerability in details.asp in HotWeb Rentals allows remote attackers to execute arbitrary SQL commands via the PropId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36747; http://www.exploit-db.com/exploits/9675; http://secunia.com/advisories/36747
CVE: CVE-2009-3344
Published: 2009-09-24
Description: Unspecified vulnerability in SAP Crystal Reports Server 2008 on Windows XP allows attackers to cause a denial of service (infinite loop) via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11.  NOTE: as of 20090917, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 5.0 (MEDIUM)
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36583; http://www.securityfocus.com/bid/36267
CVE: CVE-2009-3345
Published: 2009-09-24
Description: Heap-based buffer overflow in SAP Crystal Reports Server 2008 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11.  NOTE: as of 20090917, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36583; http://www.securityfocus.com/bid/36267
CVE: CVE-2009-3346
Published: 2009-09-24
Description: Unspecified vulnerability in SAP Crystal Reports Server 2008 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11.  NOTE: as of 20090917, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36583; http://www.securityfocus.com/bid/36267
CVE: CVE-2009-3347
Published: 2009-09-24
Description: Buffer overflow on the D-Link DIR-400 wireless router allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.10 through 8.11.  NOTE: as of 20090917, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36454; http://www.osvdb.org/57791
CVE: CVE-2009-3348
Published: 2009-09-24
Description: Cross-site scripting (XSS) vulnerability in Datavore Gyro 5.0 allows remote attackers to inject arbitrary web script or HTML via the cid parameter in a cat action to the home component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/9640; https://exchange.xforce.ibmcloud.com/vulnerabilities/53195; http://www.exploit-db.com/exploits/9640
CVE: CVE-2009-3349
Published: 2009-09-24
Description: SQL injection vulnerability in Datavore Gyro 5.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter in a cat action to the home component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9640; https://exchange.xforce.ibmcloud.com/vulnerabilities/53194; http://www.exploit-db.com/exploits/9640
CVE: CVE-2009-3350
Published: 2009-09-24
Description: Multiple unspecified vulnerabilities in the Subdomain Manager module for Drupal have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://drupal.org/node/572852; http://www.securityfocus.com/bid/36329; http://drupal.org/node/572852
CVE: CVE-2009-3351
Published: 2009-09-24
Description: Multiple unspecified vulnerabilities in the Node Browser module for Drupal have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://drupal.org/node/572852; http://www.securityfocus.com/bid/36325; http://drupal.org/node/572852
CVE: CVE-2009-3352
Published: 2009-09-24
Description: Multiple unspecified vulnerabilities in the quota_by_role (Quota by role) module for Drupal have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://drupal.org/node/572852; http://www.securityfocus.com/bid/36330; http://drupal.org/node/572852
CVE: CVE-2009-3353
Published: 2009-09-24
Description: Multiple unspecified vulnerabilities in the Node2Node module for Drupal have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://drupal.org/node/572852; http://www.securityfocus.com/bid/36323; http://drupal.org/node/572852