deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0483
Published: 2009-02-09
Description: Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22 before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete keywords and user preferences via a link or IMG tag to (1) editkeywords.cgi or (2) userprefs.cgi.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/34361; http://www.bugzilla.org/security/2.22.6/; http://www.securityfocus.com/bid/33580
CVE: CVE-2009-0484
Published: 2009-02-09
Description: Cross-site request forgery (CSRF) vulnerability in Bugzilla 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete shared or saved searches via a link or IMG tag to buglist.cgi.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/34361; http://www.bugzilla.org/security/2.22.6/; http://www.securityfocus.com/bid/33580
CVE: CVE-2009-0485
Published: 2009-02-09
Description: Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.17 to 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete unused flag types via a link or IMG tag to editflagtypes.cgi.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/34361; http://www.bugzilla.org/security/2.22.6/; http://www.securityfocus.com/bid/33580
CVE: CVE-2009-0486
Published: 2009-02-09
Description: Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://secunia.com/advisories/34361; http://www.bugzilla.org/security/3.0.7/; http://www.securityfocus.com/bid/33581
CVE: CVE-2008-6098
Published: 2009-02-09
Description: Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and other versions after 2.17.4 allows remote authenticated users to bypass moderation to approve and disapprove quips via a direct request to quips.cgi with the action parameter set to "approve."
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/32501; http://secunia.com/advisories/34361; http://www.bugzilla.org/security/2.20.6/
CVE: CVE-2009-0487
Published: 2009-02-09
Description: Cross-site scripting (XSS) vulnerability in Mahara before 1.0.9 allows remote attackers to inject arbitrary web script or HTML via a crafted forum post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://mahara.org/interaction/forum/topic.php?id=198; http://secunia.com/advisories/33813; http://www.securityfocus.com/bid/33619
CVE: CVE-2009-0488
Published: 2009-02-09
Description: Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.phorum.org/phorum5/read.php?64%2C136129; http://www.securityfocus.com/bid/33657; http://www.phorum.org/phorum5/read.php?64%2C136129
CVE: CVE-2009-0489
Published: 2009-02-09
Description: The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon, possibly including credentials.
CVSS Score: 2.1 (LOW)
CWE: CWE-16
References: http://bazaar.launchpad.net/~wicd-devel/wicd/trunk/revision/222; http://secunia.com/advisories/33870; http://secunia.com/advisories/34685
CVE: CVE-2009-0490
Published: 2009-02-10
Description: Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other versions before 1.3.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a .gro file containing a long string.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://bugs.gentoo.org/show_bug.cgi?id=253493; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://n2.nabble.com/Audacity-%22String_parse::get_nonspace_quoted%28%29%22-Buffer-Overflow-td2139537.html
CVE: CVE-2009-0491
Published: 2009-02-10
Description: Stack-based buffer overflow in Elecard MPEG Player 5.5 build 15884.081218 allows remote attackers to execute arbitrary code via a M3U file containing a long URL.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/51075; http://secunia.com/advisories/33355; http://www.vupen.com/english/advisories/2009/0007
CVE: CVE-2009-0492
Published: 2009-02-10
Description: Unspecified vulnerability in SimpleIrcBot before 1.0 Stable has unknown impact and attack vectors related to an "auth vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://sourceforge.net/project/shownotes.php?group_id=249202&release_id=650796; http://www.securityfocus.com/bid/33127; http://www.vupen.com/english/advisories/2009/0020
CVE: CVE-2009-0493
Published: 2009-02-10
Description: SQL injection vulnerability in login.php in IT!CMS 2.1a and earlier allows remote attackers to execute arbitrary SQL commands via the Username.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33139; https://exchange.xforce.ibmcloud.com/vulnerabilities/47791; https://www.exploit-db.com/exploits/7686
CVE: CVE-2009-0494
Published: 2009-02-10
Description: SQL injection vulnerability in the Portfol (com_portfol) 1.2 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the vcatid parameter in a viewcategory action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33218; https://www.exploit-db.com/exploits/7734; http://www.securityfocus.com/bid/33218
CVE: CVE-2009-0495
Published: 2009-02-10
Description: PHP remote file inclusion vulnerability in include/define.php in REALTOR 747 4.11 allows remote attackers to execute arbitrary PHP code via a URL in the INC_DIR parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/33227; https://www.exploit-db.com/exploits/7743; http://www.securityfocus.com/bid/33227
CVE: CVE-2009-0496
Published: 2009-02-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) log parameter to (a) logviewer.jsp and (b) log.jsp; (2) search parameter to (c) group-summary.jsp; (3) username parameter to (d) user-properties.jsp; (4) logDir, (5) maxTotalSize, (6) maxFileSize, (7) maxDays, and (8) logTimeout parameters to (e) audit-policy.jsp; (9) propName parameter to (f) server-properties.jsp; and the (10) roomconfig_roomname and (11) roomconfig_roomdesc parameters to (g) muc-room-edit-form.jsp.  NOTE: this can be leveraged for arbitrary code execution by using XSS to upload a malicious plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33452; http://www.coresecurity.com/content/openfire-multiple-vulnerabilities; http://www.igniterealtime.org/issues/browse/JM-1506
CVE: CVE-2009-0497
Published: 2009-02-10
Description: Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the log parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33452; http://svn.igniterealtime.org/svn/repos/openfire/trunk/src/web/log.jsp; http://www.coresecurity.com/content/openfire-multiple-vulnerabilities
CVE: CVE-2009-0498
Published: 2009-02-10
Description: Virtual GuestBook (vgbook) 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to guestbook.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://www.exploit-db.com/exploits/7744; https://www.exploit-db.com/exploits/7744
CVE: CVE-2009-0499
Published: 2009-02-10
Description: Cross-site request forgery (CSRF) vulnerability in the forum code in Moodle 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to delete unauthorized forum posts via a link or IMG tag to post.php.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-352
References: http://cvs.moodle.org/moodle/mod/forum/post.php?r1=1.154.2.14&r2=1.154.2.15; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://moodle.org/security/
CVE: CVE-2009-0500
Published: 2009-02-10
Description: Cross-site scripting (XSS) vulnerability in course/lib.php in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to inject arbitrary web script or HTML via crafted log table information that is not properly handled when it is displayed in a log report.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://moodle.org/security/; http://secunia.com/advisories/33955
CVE: CVE-2009-0501
Published: 2009-02-10
Description: Unspecified vulnerability in the Calendar export feature in Moodle 1.8 before 1.8.8 and 1.9 before 1.9.4 allows attackers to obtain sensitive information and conduct "brute force attacks on user accounts" via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://moodle.org/security/; http://secunia.com/advisories/34418
CVE: CVE-2009-0502
Published: 2009-02-10
Description: Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the "Login as" feature is used to visit a MyMoodle or Blog page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://moodle.org/security/; http://secunia.com/advisories/33955
CVE: CVE-2008-6068
Published: 2009-02-10
Description: SQL injection vulnerability in the JoomlaDate (com_joomladate) component 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the user parameter in a viewProfile action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30441; https://exchange.xforce.ibmcloud.com/vulnerabilities/42873; https://www.exploit-db.com/exploits/5748
CVE: CVE-2008-6069
Published: 2009-02-10
Description: SQL injection vulnerability in e107chat.php in the eChat plugin 4.2 for e107, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the nick parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30561; http://www.securityfocus.com/archive/1/493126/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/42883
CVE: CVE-2008-6070
Published: 2009-02-10
Description: Multiple heap-based buffer underflows in the ReadPALMImage function in coders/palm.c in GraphicsMagick before 1.2.3 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted PALM image, a different vulnerability than CVE-2007-0770.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://cvs.graphicsmagick.org/cgi-bin/cvsweb.cgi/GraphicsMagick/coders/palm.c; http://secunia.com/advisories/30549; http://sourceforge.net/project/shownotes.php?release_id=604837
CVE: CVE-2008-6071
Published: 2009-02-10
Description: Heap-based buffer overflow in the DecodeImage function in coders/pict.c in GraphicsMagick before 1.1.14, and 1.2.x before 1.2.3, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted PICT image.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://cvs.graphicsmagick.org/cgi-bin/cvsweb.cgi/GraphicsMagick/coders/pict.c; http://secunia.com/advisories/30549; http://sourceforge.net/project/shownotes.php?release_id=604785
CVE: CVE-2008-6072
Published: 2009-02-10
Description: Multiple unspecified vulnerabilities in GraphicsMagick before 1.1.14, and 1.2.x before 1.2.3, allow remote attackers to cause a denial of service (crash) via unspecified vectors in (1) XCF and (2) CINEON images.
CVSS Score: 5.0 (MEDIUM)
References: http://cvs.graphicsmagick.org/cgi-bin/cvsweb.cgi/GraphicsMagick/coders/cineon.c; http://cvs.graphicsmagick.org/cgi-bin/cvsweb.cgi/GraphicsMagick/coders/xcf.c; http://secunia.com/advisories/30549
CVE: CVE-2008-6073
Published: 2009-02-10
Description: StorageCrypt 2.0.1 does not properly encrypt disks, which allows local users to obtain sensitive information via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/30471; https://exchange.xforce.ibmcloud.com/vulnerabilities/42905; http://secunia.com/advisories/30471
CVE: CVE-2009-0417
Published: 2009-02-10
Description: Cross-site scripting (XSS) vulnerability in the AgaviWebRouting::gen(null) method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not strictly follow RFC 3986, such as Internet Explorer 6 and 7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.agavi.org/post/75829956/agavi-0-11-6-released-fixes-vulnerability; http://blog.agavi.org/post/75830918/agavi-1-0-0-beta-8-released-fixes-vulnerability; http://trac.agavi.org/ticket/1019
CVE: CVE-2009-0441
Published: 2009-02-10
Description: PHP remote file inclusion vulnerability in skin_shop/standard/2_view_body/body_default.php in TECHNOTE 7.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the shop_this_skin_path parameter, a different vector than CVE-2008-4138.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/51740; http://secunia.com/advisories/33732; http://www.securityfocus.com/bid/33592
CVE: CVE-2009-0442
Published: 2009-02-10
Description: Directory traversal vulnerability in bbcode.php in PHPbbBook 1.3 and 1.3h allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the l parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/51737; http://secunia.com/advisories/33811; http://www.securityfocus.com/bid/33603
CVE: CVE-2009-0443
Published: 2009-02-10
Description: Stack-based buffer overflow in Elecard AVC HD PLAYER 5.5.90116 allows remote attackers to execute arbitrary code via an M3U file containing a long string in a URL.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/51717; http://secunia.com/advisories/33742; http://www.securityfocus.com/bid/33089
CVE: CVE-2009-0444
Published: 2009-02-10
Description: Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) theme parameter to (a) 179_squarebox_pds_list/view.php, (b) 179_squarebox_minishop_expand/view.php, (c) 179_squarebox_gallery_list_pds/view.php, (d) 179_squarebox_gallery_list/view.php, (e) 179_squarebox_gallery/view.php, (f) 179_squarebox_board_swfupload/view.php, (g) 179_squarebox_board_expand/view.php, (h) 179_squarebox_board_basic_with_grcode/view.php, (i) 179_squarebox_board_basic/view.php, (j) 179_simplebar_pds_list/view.php, (k) 179_simplebar_notice/view.php, (l) 179_simplebar_gallery_list_pds/view.php, (m) 179_simplebar_gallery/view.php, and (n) 179_simplebar_basic/view.php in theme/; the (2) path parameter to (o) latest/sirini_gallery_latest/list.php; and the (3) grboard parameter to (p) include.php and (q) form_mail.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/33812; http://www.securityfocus.com/bid/33602; https://www.exploit-db.com/exploits/7979
CVE: CVE-2009-0445
Published: 2009-02-10
Description: SQL injection vulnerability in index.php in Dreampics Gallery Builder allows remote attackers to execute arbitrary SQL commands via the exhibition_id parameter in a gallery.viewPhotos action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51741; http://secunia.com/advisories/33730; http://www.securityfocus.com/bid/33596
CVE: CVE-2009-0446
Published: 2009-02-10
Description: SQL injection vulnerability in photo.php in WEBalbum 2.4b allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33590; https://www.exploit-db.com/exploits/7961; http://www.securityfocus.com/bid/33590
CVE: CVE-2009-0447
Published: 2009-02-10
Description: Multiple SQL injection vulnerabilities in default.asp in MyDesign Sayac 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the user parameter (aka UserName field) or (2) the pass parameter (aka Pass field) to (a) admin/admin.asp or (b) the default URI under admin/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51754; http://secunia.com/advisories/33771; http://www.securityfocus.com/bid/33593
CVE: CVE-2009-0448
Published: 2009-02-10
Description: Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the synTarget parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/33601; http://www.vupen.com/english/advisories/2009/0319; https://exchange.xforce.ibmcloud.com/vulnerabilities/48496
CVE: CVE-2009-0449
Published: 2009-02-10
Description: Buffer overflow in klim5.sys in Kaspersky Anti-Virus for Workstations 6.0 and Anti-Virus 2008 allows local users to gain privileges via an IOCTL 0x80052110 call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://kartoffel.reversemode.com/downloads/kaspersky_klim5_plugin.zip; http://secunia.com/advisories/33788; http://www.reversemode.com/index.php?option=com_content&task=view&id=60&Itemid=1
CVE: CVE-2009-0450
Published: 2009-02-10
Description: Stack-based buffer overflow in BlazeVideo HDTV Player 3.5 and earlier allows remote attackers to execute arbitrary code via a long string in a playlist (aka .plf) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/33588; https://exchange.xforce.ibmcloud.com/vulnerabilities/48498; https://www.exploit-db.com/exploits/7975
CVE: CVE-2009-0451
Published: 2009-02-10
Description: SQL injection vulnerability in Skalfa SkaLinks 1.5 allows remote attackers to execute arbitrary SQL commands via the Admin name field to the default URI under admin/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33546; https://www.exploit-db.com/exploits/7932; http://www.securityfocus.com/bid/33546
CVE: CVE-2009-0452
Published: 2009-02-10
Description: Multiple SQL injection vulnerabilities in parents/login.php in Online Grades 3.2.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pass parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/51712; http://secunia.com/advisories/33767; http://www.securityfocus.com/bid/33576
CVE: CVE-2009-0453
Published: 2009-02-10
Description: Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/51713; http://secunia.com/advisories/33767; https://www.exploit-db.com/exploits/7956
CVE: CVE-2009-0454
Published: 2009-02-10
Description: Multiple SQL injection vulnerabilities in DMXReady Online Notebook Manager 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.  NOTE: some third parties report inability to verify this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33600; https://exchange.xforce.ibmcloud.com/vulnerabilities/48503; https://www.exploit-db.com/exploits/7970
CVE: CVE-2009-0456
Published: 2009-02-10
Description: PHP remote file inclusion vulnerability in examples/example_clientside_javascript.php in patForms, as used in Sourdough 0.3.5, allows remote attackers to execute arbitrary PHP code via a URL in the neededFiles[patForms] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/33569; https://www.exploit-db.com/exploits/7946; http://www.securityfocus.com/bid/33569
CVE: CVE-2009-0457
Published: 2009-02-10
Description: Multiple directory traversal vulnerabilities in AJA Portal 1.2 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the currentlang parameter to admin/case.php in the (1) Contact_Plus and (2) Reviews modules, and (3) the module_name parameter to admin/includes/FANCYNLOptions.php in the Fancy_NewsLetter module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/51708; http://osvdb.org/51709; http://secunia.com/advisories/33735
CVE: CVE-2009-0458
Published: 2009-02-10
Description: Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Ware Support 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parameter (aka Password field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51733; http://secunia.com/advisories/33777; http://www.securityfocus.com/bid/33564
CVE: CVE-2009-0459
Published: 2009-02-10
Description: Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Password Protect: Enhanced 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parameter (aka Password field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51733; http://secunia.com/advisories/33777; http://www.securityfocus.com/bid/33564
CVE: CVE-2009-0460
Published: 2009-02-10
Description: Whole Hog Ware Support 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/51734; http://secunia.com/advisories/33777; http://www.securityfocus.com/bid/33577
CVE: CVE-2009-0461
Published: 2009-02-10
Description: Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative access via an integer value in the adminid cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/51734; http://secunia.com/advisories/33777; http://www.securityfocus.com/bid/33577
CVE: CVE-2009-0462
Published: 2009-02-10
Description: Multiple SQL injection vulnerabilities in customer_login_check.asp in ClickTech ClickCart 6.0 allow remote attackers to execute arbitrary SQL commands via (1) the txtEmail parameter (aka E-MAIL field) or (2) the txtPassword parameter (aka password field) to customer_login.asp. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51718; http://secunia.com/advisories/33774; http://www.securityfocus.com/bid/33575
CVE: CVE-2009-0463
Published: 2009-02-10
Description: PHP remote file inclusion vulnerability in includes/header.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/33649; http://www.securityfocus.com/bid/33578; https://www.exploit-db.com/exploits/7954