deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1840
Published: 2009-06-12
Description: Mozilla Firefox before 3.0.11, Thunderbird, and SeaMonkey do not check content policy before loading a script file into a XUL document, which allows remote attackers to bypass intended access restrictions via a crafted HTML document, as demonstrated by a "web bug" in an e-mail message, or web script or an advertisement in a web page.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://osvdb.org/55158; http://secunia.com/advisories/35331; http://secunia.com/advisories/35415
CVE: CVE-2009-1841
Published: 2009-06-12
Description: js/src/xpconnect/src/xpcwrappedjsclass.cpp in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to execute arbitrary web script with the privileges of a chrome object, as demonstrated by the browser sidebar and the FeedWriter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/55159; http://rhn.redhat.com/errata/RHSA-2009-1096.html; http://secunia.com/advisories/35331
CVE: CVE-2009-2043
Published: 2009-06-12
Description: nsViewManager.cpp in Mozilla Firefox 3.0.2 through 3.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to interaction with TinyMCE.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/35413; https://bugzilla.mozilla.org/show_bug.cgi?id=490425; https://bugzilla.redhat.com/show_bug.cgi?id=488570
CVE: CVE-2009-2044
Published: 2009-06-12
Description: Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via a URI for a large GIF image in the BACKGROUND attribute of a BODY element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://e-rdc.org/v1/news.php?readmore=137; http://www.securityfocus.com/archive/1/504214; http://www.securityfocus.com/bid/35280
CVE: CVE-2009-2057
Published: 2009-06-15
Description: Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE: CVE-2009-2058
Published: 2009-06-15
Description: Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/51193
CVE: CVE-2009-2059
Published: 2009-06-15
Description: Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE: CVE-2009-2060
Published: 2009-06-15
Description: src/net/http/http_transaction_winhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://code.google.com/p/chromium/issues/detail?id=7338; http://code.google.com/p/chromium/issues/detail?id=8473; http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE: CVE-2009-2061
Published: 2009-06-15
Description: Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-310
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://www.securityfocus.com/bid/35412
CVE: CVE-2009-2062
Published: 2009-06-15
Description: Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://www.securityfocus.com/bid/35412
CVE: CVE-2009-2063
Published: 2009-06-15
Description: Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://www.securityfocus.com/bid/35412
CVE: CVE-2009-2064
Published: 2009-06-15
Description: Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://www.securityfocus.com/bid/35403
CVE: CVE-2009-2065
Published: 2009-06-15
Description: Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://www.securityfocus.com/bid/35403
CVE: CVE-2009-2066
Published: 2009-06-15
Description: Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://www.securityfocus.com/bid/35403
CVE: CVE-2009-2067
Published: 2009-06-15
Description: Opera detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://www.securityfocus.com/bid/35403
CVE: CVE-2009-2068
Published: 2009-06-15
Description: Google Chrome detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/51192
CVE: CVE-2009-2069
Published: 2009-06-15
Description: Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://www.securityfocus.com/bid/35411
CVE: CVE-2009-2070
Published: 2009-06-15
Description: Opera displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://www.securityfocus.com/bid/35411
CVE: CVE-2009-2071
Published: 2009-06-15
Description: Google Chrome before 1.0.154.53 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://code.google.com/p/chromium/issues/detail?id=7338; http://code.google.com/p/chromium/issues/detail?id=8473; http://research.microsoft.com/apps/pubs/default.aspx?id=79323
CVE: CVE-2009-2072
Published: 2009-06-15
Description: Apple Safari does not require a cached certificate before displaying a lock icon for an https web site, which allows man-in-the-middle attackers to spoof an arbitrary https site by sending the browser a crafted (1) 4xx or (2) 5xx CONNECT response page for an https request sent through a proxy server.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf; http://www.securityfocus.com/bid/35411
CVE: CVE-2009-2073
Published: 2009-06-15
Description: Cross-site request forgery (CSRF) vulnerability in Linksys WRT160N wireless router hardware 1 and firmware 1.02.2 allows remote attackers to hijack the authentication of other users for unspecified requests via unknown vectors, as demonstrated using administrator privileges and actions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/109/45/; http://secunia.com/advisories/34625; http://www.osvdb.org/53414
CVE: CVE-2009-2074
Published: 2009-06-16
Description: Cross-site scripting (XSS) vulnerability in Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via vocabulary names.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/488092; http://drupal.org/node/488102; http://drupal.org/node/488104
CVE: CVE-2009-2075
Published: 2009-06-16
Description: Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, does not properly restrict access when displaying node titles, which has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://drupal.org/node/488092; http://drupal.org/node/488102; http://drupal.org/node/488104
CVE: CVE-2009-2076
Published: 2009-06-16
Description: Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature.  NOTE: vector 2 is only exploitable by users with administer views permissions.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/488068; http://drupal.org/node/488082; http://lampsecurity.org/drupal-views-xss-vulnerability
CVE: CVE-2009-2077
Published: 2009-06-16
Description: Drupal 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to bypass access restrictions and (1) read unpublished content from anonymous users when a view is already configured to display the content, and (2) read private content in generated queries.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/488068; http://drupal.org/node/488082; http://secunia.com/advisories/35425
CVE: CVE-2009-2078
Published: 2009-06-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Booktree 5.x before 5.x-7.3 and 6.x before 6.x-1.1, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the (1) node title and (2) node body in a tree root page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/487810; http://drupal.org/node/487812; http://drupal.org/node/487828
CVE: CVE-2009-2079
Published: 2009-06-16
Description: Cross-site scripting (XSS) vulnerability in the administrative page interface in Taxonomy manager 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to inject arbitrary web script or HTML via (1) vocabulary names, (2) synonyms, and (3) term names.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/487602; http://drupal.org/node/487620; http://drupal.org/node/487818
CVE: CVE-2009-2080
Published: 2009-06-16
Description: admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to (1) obtain sensitive configuration information via the editconfig action or (2) change the administrator's password via the id parameter in an editop action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/35350; https://exchange.xforce.ibmcloud.com/vulnerabilities/51029; https://www.exploit-db.com/exploits/8917
CVE: CVE-2009-2081
Published: 2009-06-16
Description: Directory traversal vulnerability in help.php in phpWebThings 1.5.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/35313; https://www.exploit-db.com/exploits/8928; http://www.securityfocus.com/bid/35313
CVE: CVE-2008-5515
Published: 2009-06-16
Description: Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN63832775/index.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
CVE: CVE-2009-1390
Published: 2009-06-16
Description: Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://dev.mutt.org/hg/mutt/rev/64bf199c8d8a; http://dev.mutt.org/hg/mutt/rev/8f11dd00c770; http://www.openwall.com/lists/oss-security/2009/06/10/2
CVE: CVE-2009-2011
Published: 2009-06-16
Description: Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://secunia.com/advisories/35402; http://www.coresecurity.com/content/DXStudio-player-firefox-plugin; http://www.dxstudio.com/forumtopic.aspx?topicid=b4152459-fb5f-4933-b700-b3fbd54f6bfd
CVE: CVE-2009-2082
Published: 2009-06-16
Description: SQL injection vulnerability in insidepage.php in Creative Web Solutions Multi-Level CMS 1.21 allows remote attackers to execute arbitrary SQL commands via the catid parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54571; http://packetstorm.linuxsecurity.com/0905-exploits/creativecms-sql.txt; http://secunia.com/advisories/35154
CVE: CVE-2009-2083
Published: 2009-06-16
Description: Cross-site scripting (XSS) vulnerability in the term data detail page in Taxonomy manager 5.x before 5.x-1.2, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to inject arbitrary web script or HTML via "Parent and related terms."
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/487620; http://drupal.org/node/487818; http://lampsecurity.org/drupal-6-taxonomy-manager-xss-vulnerability
CVE: CVE-2009-1389
Published: 2009-06-16
Description: Buffer overflow in the RTL8169 NIC driver (drivers/net/r8169.c) in the Linux kernel before 2.6.30 allows remote attackers to cause a denial of service (kernel memory corruption and crash) via a long packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=fdd7b4c3302c93f6833e338903ea77245eb510b4; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html
CVE: CVE-2009-1391
Published: 2009-06-16
Description: Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://article.gmane.org/gmane.mail.virus.amavis.user/33635; http://article.gmane.org/gmane.mail.virus.amavis.user/33638; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
CVE: CVE-2009-1719
Published: 2009-06-16
Description: The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to the undocumented apple.laf.CColourUIResource constructor with a crafted value in the first argument, which is dereferenced as a pointer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00003.html; http://support.apple.com/kb/HT3632; http://www.securityfocus.com/archive/1/504364/100/0/threaded
CVE: CVE-2009-1761
Published: 2009-06-16
Description: The message engine in CA ARCserve Backup r12.0 and r12.0 SP1 for Windows allows remote attackers to cause a denial of service (crash) via (1) an invalid 0x13 message, which is not properly handled in the ASCORE module, or (2) a 0x3B message with invalid stub data that triggers an RPC marshalling error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15/ca20090615-01-ca-arcserve-backup-message-engine-denial-of-service-vulnerabilities.aspx; http://secunia.com/advisories/35473; http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=209502
CVE: CVE-2009-2084
Published: 2009-06-16
Description: Simple Linux Utility for Resource Management (SLURM) 1.2 and 1.3 before 1.3.14 does not properly set supplementary groups before invoking (1) sbcast from the slurmd daemon or (2) strigger from the slurmctld daemon, which might allow local SLURM users to modify files and gain privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-255
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=524980; http://secunia.com/advisories/34831; http://sourceforge.net/project/shownotes.php?release_id=676055&group_id=157944
CVE: CVE-2009-2095
Published: 2009-06-17
Description: PHP remote file inclusion vulnerability in template/simpledefault/admin/_masterlayout.php in Mundi Mail 0.8.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the top parameter.  NOTE: when allow_url_fopen is disabled, directory traversal attacks are possible to include and execute arbitrary local files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://www.exploit-db.com/exploits/8948; https://www.exploit-db.com/exploits/8948
CVE: CVE-2009-2096
Published: 2009-06-17
Description: SQL injection vulnerability in house/listing_view.php in phpCollegeExchange 0.1.5c allows remote attackers to execute arbitrary SQL commands via the itemnr parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35452; https://www.exploit-db.com/exploits/8962; http://secunia.com/advisories/35452
CVE: CVE-2009-2097
Published: 2009-06-17
Description: SQL injection vulnerability in system/application/controllers/catalog.php in Zoki Soft Zoki Catalog (aka Smart Catalog) allows remote attackers to execute arbitrary SQL commands via the search_text parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35476; http://www.davidsopas.com/2009/06/15/zoki-catalog-sql-injection/; http://www.securityfocus.com/archive/1/504311/100/0/threaded
CVE: CVE-2009-2098
Published: 2009-06-17
Description: SQL injection vulnerability in topicler.php in phPortal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55177; http://www.securityfocus.com/bid/35387; https://www.exploit-db.com/exploits/8966
CVE: CVE-2009-2099
Published: 2009-06-17
Description: SQL injection vulnerability in the iJoomla RSS Feeder (com_ijoomla_rss) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in an xml action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55113; http://secunia.com/advisories/35454; http://www.securityfocus.com/bid/35379