deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1658
Published: 2008-04-11
Description: Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-134
References: http://bugs.freedesktop.org/show_bug.cgi?id=15295; http://gitweb.freedesktop.org/?p=PolicyKit.git%3Ba=commitdiff%3Bh=5bc86a14cc0e356bcf8b5f861674f842869b1be7; http://secunia.com/advisories/29755
CVE: CVE-2008-1703
Published: 2008-04-11
Description: Multiple buffer overflows in TIBCO Software Rendezvous before 8.1.0, as used in multiple TIBCO products, allow remote attackers to execute arbitrary code via a crafted message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29774; http://www.osvdb.org/44269; http://www.securityfocus.com/bid/28717
CVE: CVE-2008-1704
Published: 2008-04-11
Description: Multiple buffer overflows in TIBCO Software Enterprise Message Service (EMS) before 4.4.3, and iProcess Engine 10.6.0 through 10.6.1, allow remote attackers to execute arbitrary code via a crafted message to the EMS server.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29775; http://www.securityfocus.com/bid/28717; http://www.securitytracker.com/id?1019826
CVE: CVE-2008-1724
Published: 2008-04-11
Description: Stack-based buffer overflow in the IActiveXTransfer.FileTransfer method in the SecureTransport FileTransfer ActiveX control in vcst_en.dll 1.0.0.5 in Tumbleweed SecureTransport Server before 4.6.1 Hotfix 20 allows remote attackers to execute arbitrary code via a long remoteFile parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29717; http://securityreason.com/securityalert/3806; http://www.aushack.com/200708-tumbleweed.txt
CVE: CVE-2008-1725
Published: 2008-04-11
Description: The IBizEBank.FIProfile.1 ActiveX control in fiprofile20.ocx in IBiz E-Banking Integrator (formerly IBiz OFX Integrator) 2.0.2932 exposes the unsafe WriteOFXDataFile method, which allows remote attackers to overwrite arbitrary files via a full pathname in the argument.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/29758; http://www.osvdb.org/44393; http://www.securityfocus.com/bid/28700
CVE: CVE-2008-1726
Published: 2008-04-11
Description: Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kqid parameter to (a) articletext.php and (b) articletextonly.php and the (2) username parameter to (c) logincheck.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29716; http://www.osvdb.org/44254; http://www.osvdb.org/44255
CVE: CVE-2008-1727
Published: 2008-04-11
Description: KnowledgeQuest 2.5 and 2.6 does not require authentication for access to admincheck.php, which allows remote attackers to create arbitrary admin accounts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/29716; http://www.osvdb.org/44257; https://exchange.xforce.ibmcloud.com/vulnerabilities/41747
CVE: CVE-2008-1728
Published: 2008-04-11
Description: ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/29751; http://secunia.com/advisories/29901; http://security.gentoo.org/glsa/glsa-200804-26.xml
CVE: CVE-2008-1729
Published: 2008-04-11
Description: The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the "access content" permission; and (4) allows remote authenticated users, with administration page view access, to edit content types.
CVSS Score: 5.8 (MEDIUM)
References: http://drupal.org/node/244637; http://secunia.com/advisories/29762; http://www.osvdb.org/44270
CVE: CVE-2008-1730
Published: 2008-04-11
Description: Directory traversal vulnerability in download.html in ARWScripts Gallery Script Lite (aka gallery-script-lite or Free Photo Gallery Site Script), as of 20080411, allows remote attackers to read arbitrary local files via directory traversal sequences in the path parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29746; http://www.osvdb.org/44253; http://www.securityfocus.com/bid/28718
CVE: CVE-2008-1731
Published: 2008-04-11
Description: The Simple Access module for Drupal 5.x through 5.x-1.2-2 does not properly handle the privacy information for nodes, which might allow remote attackers to bypass intended access restrictions, and read or modify nodes, in opportunistic circumstances related to interaction between Simple Access and (1) Node clone or (2) Project issue tracking.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/244560; http://secunia.com/advisories/29772; http://www.osvdb.org/44271
CVE: CVE-2008-1732
Published: 2008-04-11
Description: SQL injection vulnerability in showpredictionsformatch.php in Prediction Football 1.x allows remote attackers to execute arbitrary SQL commands via the matchid parameter in a dupa action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28704; http://www.vupen.com/english/advisories/2008/1160/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41728
CVE: CVE-2008-1733
Published: 2008-04-11
Description: SQL injection vulnerability in puarcade.class.php 2.2 and earlier in the Pragmatic Utopia PU Arcade (com_puarcade) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the gid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3807; http://www.osvdb.org/44391; http://www.securityfocus.com/archive/1/490626/100/0/threaded
CVE: CVE-2008-1750
Published: 2008-04-11
Description: SQL injection vulnerability in Integry Systems LiveCart 1.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to the /category URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://livecart.com/news/LiveCart-1-1-2-released.12; http://seclists.org/bugtraq/2008/May/0021.html; http://secunia.com/advisories/29765
CVE: CVE-2008-1751
Published: 2008-04-11
Description: Multiple directory traversal vulnerabilities in index.php in Ksemail allow remote attackers to read arbitrary local files via a .. (dot dot) in the (1) language and (2) lang parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29776; http://www.osvdb.org/44362; http://www.securityfocus.com/bid/28724
CVE: CVE-2008-1752
Published: 2008-04-11
Description: ezRADIUS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials via a direct request for (1) config.ini or (2) database.ini.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/29769; http://sourceforge.net/forum/forum.php?forum_id=809832; http://sourceforge.net/project/shownotes.php?release_id=591272&group_id=221332
CVE: CVE-2008-1753
Published: 2008-04-11
Description: Cross-site scripting (XSS) vulnerability in system/workplace/admin/workplace/sessions.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the searchfilter parameter, a different vector than CVE-2008-1510.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3808; http://www.securityfocus.com/archive/1/490498/100/0/threaded; http://www.securityfocus.com/archive/1/490710/100/0/threaded
CVE: CVE-2008-1754
Published: 2008-04-11
Description: Symantec Altiris Deployment Solution before 6.9.164 stores the Deployment Solution Agent (aka AClient) password in cleartext in memory, which allows local users to obtain sensitive information by dumping the AClient.exe process memory.
CVSS Score: 1.7 (LOW)
CWE: CWE-310
References: http://secunia.com/advisories/29771; http://securityresponse.symantec.com/avcenter/security/Content/2008.04.10.html; http://www.osvdb.org/44388
CVE: CVE-2008-1755
Published: 2008-04-11
Description: Directory traversal vulnerability in the showSource function in showSource.php in World of Phaos 4.0.1 allows remote attackers to read arbitrary files via directory traversal sequences in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.osvdb.org/44387; http://www.securityfocus.com/bid/28719; https://exchange.xforce.ibmcloud.com/vulnerabilities/41741
CVE: CVE-2008-1756
Published: 2008-04-11
Description: Unspecified vulnerability in the Qmaster daemon in Sun N1 Grid Engine 6.1 allows local users to cause a denial of service (daemon crash) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/29753; http://sunsolve.sun.com/search/document.do?assetkey=1-26-234822-1; http://www.osvdb.org/44363
CVE: CVE-2007-6712
Published: 2008-04-12
Description: Integer overflow in the hrtimer_forward function (hrtimer.c) in Linux kernel 2.6.21-rc4, when running on 64-bit systems, allows local users to cause a denial of service (infinite loop) via a timer with a large expiry value, which causes the timer to always be expired.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/chris/linux-2.6.git%3Ba=commitdiff%3Bh=13788ccc41ceea5893f9c747c59bc0b28f2416c2; http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html; http://secunia.com/advisories/30294
CVE: CVE-2008-1757
Published: 2008-04-12
Description: Cross-site scripting (XSS) vulnerability in index.php in the ConcoursPhoto module for KwsPHP 1.0 allows remote attackers to inject arbitrary web script or HTML via the VIEW parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3809; http://www.securityfocus.com/archive/1/490470/100/0/threaded; http://www.securityfocus.com/bid/28612
CVE: CVE-2008-1758
Published: 2008-04-12
Description: SQL injection vulnerability in the ConcoursPhoto module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the C_ID parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29664; http://www.securityfocus.com/bid/28738; https://exchange.xforce.ibmcloud.com/vulnerabilities/41636
CVE: CVE-2008-1759
Published: 2008-04-12
Description: SQL injection vulnerability in the jeuxflash module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php, a different vector than CVE-2007-4922.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://koogar.alorys-hebergement.com/kwsphp/modules/maintenance/index.php; http://secunia.com/advisories/29625; http://www.securityfocus.com/bid/28601
CVE: CVE-2008-1760
Published: 2008-04-12
Description: Multiple PHP remote file inclusion vulnerabilities in Blogator-script before 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the incl_page parameter in (1) struct_admin.php, (2) struct_admin_blog.php, and (3) struct_main.php in _blogadata/include.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29684; http://www.blogator-script.com/changelog.php; http://www.securityfocus.com/bid/28627
CVE: CVE-2008-1761
Published: 2008-04-12
Description: Opera before 9.27 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted newsfeed source, which triggers an invalid memory access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00007.html; http://secunia.com/advisories/29662; http://secunia.com/advisories/29679
CVE: CVE-2008-1762
Published: 2008-04-12
Description: Opera before 9.27 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted scaled image pattern in an HTML CANVAS element, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00007.html; http://secunia.com/advisories/29662; http://secunia.com/advisories/29679
CVE: CVE-2008-1763
Published: 2008-04-12
Description: SQL injection vulnerability in _blogadata/include/sond_result.php in Blogator-script 0.95 allows remote attackers to execute arbitrary SQL commands via the id_art parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29684; http://www.blogator-script.com/changelog.php; http://www.securityfocus.com/archive/1/490500/100/0/threaded
CVE: CVE-2008-1764
Published: 2008-04-12
Description: Unspecified vulnerability in Opera before 9.27 has unknown impact and attack vectors related to "keyboard handling of password inputs."
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00007.html; http://secunia.com/advisories/29679; http://secunia.com/advisories/29735
CVE: CVE-2008-1766
Published: 2008-04-12
Description: Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."
CVSS Score: 10.0 (HIGH)
References: http://www.phpbb.com/community/viewtopic.php?f=14&t=879735; http://www.vupen.com/english/advisories/2008/1236/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41886
CVE: CVE-2008-0927
Published: 2008-04-14
Description: dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with (1) multiple Connection headers or (2) a Connection header with multiple comma-separated values.  NOTE: this might be similar to CVE-2008-1777.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/29805; http://www.novell.com/support/viewContent.do?externalId=3829452&sliceId=1; http://www.securityfocus.com/archive/1/491622/100/0/threaded
CVE: CVE-2008-0961
Published: 2008-04-14
Description: EMV DiskXtender 6.20.060 has a hard-coded login and password, which allows remote attackers to bypass authentication via the RPC interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=683; http://secunia.com/advisories/29778; http://www.osvdb.org/44419
CVE: CVE-2008-0962
Published: 2008-04-14
Description: Stack-based buffer overflow in the File System Manager for EMC DiskXtender 6.20.060 allows remote authenticated users to execute arbitrary code via a crafted request to the RPC interface.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=684; http://secunia.com/advisories/29778; http://www.osvdb.org/44418
CVE: CVE-2008-0963
Published: 2008-04-14
Description: Format string vulnerability in EMC DiskXtender MediaStor 6.20.060 allows remote authenticated users to execute arbitrary code via a crafted message to the RPC interface.
CVSS Score: 9.0 (HIGH)
CWE: CWE-134
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=685; http://secunia.com/advisories/29778; http://www.osvdb.org/44417
CVE: CVE-2008-1100
Published: 2008-04-14
Description: Buffer overflow in the cli_scanpe function in libclamav (libclamav/pe.c) for ClamAV 0.92 and 0.92.1 allows remote attackers to execute arbitrary code via a crafted Upack PE file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://kolab.org/security/kolab-vendor-notice-20.txt; http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00009.html
CVE: CVE-2008-1382
Published: 2008-04-14
Description: libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://libpng.sourceforge.net/Advisory-1.2.26.txt; http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
CVE: CVE-2008-1772
Published: 2008-04-14
Description: iScripts SocialWare stores passwords in cleartext in a database, which allows context-dependent attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/29725; http://www.osvdb.org/44326; https://exchange.xforce.ibmcloud.com/vulnerabilities/41812
CVE: CVE-2008-1773
Published: 2008-04-14
Description: PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28660; https://exchange.xforce.ibmcloud.com/vulnerabilities/41680; https://www.exploit-db.com/exploits/5393
CVE: CVE-2008-1774
Published: 2008-04-14
Description: SQL injection vulnerability in editlink.php in Pligg 9.9.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28681; http://www.vupen.com/english/advisories/2008/1164/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41709
CVE: CVE-2008-1775
Published: 2008-04-14
Description: Cross-site scripting (XSS) vulnerability in mindex.do in ManageEngine Firewall Analyzer 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the displayName parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/29632; http://www.securityfocus.com/bid/28604; https://exchange.xforce.ibmcloud.com/vulnerabilities/41810
CVE: CVE-2008-1776
Published: 2008-04-14
Description: PHP remote file inclusion vulnerability in modules/basicfog/basicfogfactory.class.php in PhpBlock A8.4 allows remote attackers to execute arbitrary PHP code via a URL in the PATH_TO_CODE parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28588; https://exchange.xforce.ibmcloud.com/vulnerabilities/41616; https://www.exploit-db.com/exploits/5348
CVE: CVE-2008-1777
Published: 2008-04-14
Description: The eDirectory Host Environment service (dhost.exe) in Novell eDirectory 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via a long HTTP HEAD request to TCP port 8028.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/29639; http://www.offensive-security.com/0day/novel-edir.py.txt; http://www.securityfocus.com/bid/28572
CVE: CVE-2008-1778
Published: 2008-04-14
Description: Unspecified vulnerability in the floating point context switch implementation in Sun Solaris 9 and 10 on x86 platforms might allow local users to cause a denial of service (application exit), corrupt data, or trigger incorrect calculations via unknown vectors.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-16
References: http://secunia.com/advisories/29728; http://sunsolve.sun.com/search/document.do?assetkey=1-26-233921-1; http://www.securityfocus.com/bid/28733
CVE: CVE-2008-1779
Published: 2008-04-14
Description: Sun Solaris 8, 9, and 10 allows "remote privileged" users to cause a denial of service (panic) via unknown vectors related to self encapsulated IP packets.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/29783; http://secunia.com/advisories/29817; http://sunsolve.sun.com/search/document.do?assetkey=1-26-235901-1
CVE: CVE-2008-1780
Published: 2008-04-14
Description: Unspecified vulnerability in the labeled networking functionality in Solaris 10 Trusted Extensions allows applications in separate labeling zones to bypass labeling restrictions via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/29730; http://sunsolve.sun.com/search/document.do?assetkey=1-26-235421-1; http://www.securityfocus.com/bid/28734
CVE: CVE-2008-1782
Published: 2008-04-15
Description: phpdemo/viewsource.php in Advanced Software Engineering ChartDirector 4.1 allows remote attackers to read sensitive files via the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/28674; http://www.vupen.com/english/advisories/2008/1140/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41701
CVE: CVE-2008-1783
Published: 2008-04-15
Description: Prozilla Reviews 1.0 allows remote attackers to delete arbitrary users via a modified UserID parameter in a direct request to siteadmin/DeleteUser.php.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/29722; http://www.securityfocus.com/bid/28642; http://www.vupen.com/english/advisories/2008/1118/references
CVE: CVE-2008-1784
Published: 2008-04-15
Description: Prozilla Topsites 1.0 allows remote attackers to perform administrative actions via a direct request to (1) addu.php, (2) editu.php, and (3) uidx.php in siteadmin/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29689; http://www.securityfocus.com/bid/28641; http://www.vupen.com/english/advisories/2008/1117
CVE: CVE-2008-1785
Published: 2008-04-15
Description: delete.php in Prozilla Top 100 1.2 allows remote authenticated users to delete statistics and accounts of arbitrary users via a modified s parameter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.vupen.com/english/advisories/2008/1119/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41674; https://www.exploit-db.com/exploits/5384
CVE: CVE-2008-1781
Published: 2008-04-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its requester.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2008-1787
Published: 2008-04-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Poplar Gedcom Viewer 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) text and (2) ul parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/28608.html; http://secunia.com/advisories/23761; http://www.securityfocus.com/bid/28608
CVE: CVE-2008-1788
Published: 2008-04-15
Description: SQL injection vulnerability in directory.php in Prozilla Entertainers 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29715; https://www.exploit-db.com/exploits/5371; http://secunia.com/advisories/29715
CVE: CVE-2008-1789
Published: 2008-04-15
Description: SQL injection vulnerability in forum.php in Prozilla Forum allows remote attackers to execute arbitrary SQL commands via the forum parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28643; https://exchange.xforce.ibmcloud.com/vulnerabilities/41702; https://www.exploit-db.com/exploits/5385
CVE: CVE-2008-1790
Published: 2008-04-15
Description: Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated administrators to upload arbitrary files via a crafted logo file in the "Manage Settings" functionality.  NOTE: remote exploitation is facilitated by a separate SQL injection vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/29725; http://www.osvdb.org/44327; http://www.securityfocus.com/bid/28670