deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4619
Published: 2008-10-21
Description: The RPC subsystem in Sun Solaris 9 allows remote attackers to cause a denial of service (daemon crash) via a crafted request to procedure 8 in program 100000 (rpcbind), related to the XDR_DECODE operation and the taddr2uaddr function.  NOTE: this might be a duplicate of CVE-2007-0165.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/32475; http://securityreason.com/securityalert/4440; http://sunsolve.sun.com/search/document.do?assetkey=1-66-200412-1
CVE: CVE-2008-1547
Published: 2008-10-21
Description: Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: http://securityreason.com/securityalert/4441; http://www.securityfocus.com/archive/1/497374/100/0/threaded; http://www.securityfocus.com/archive/1/497390/100/0/threaded
CVE: CVE-2008-4620
Published: 2008-10-21
Description: SQL injection vulnerability in Meeting Room Booking System (MRBS) before 1.4 allows remote attackers to execute arbitrary SQL commands via the area parameter to (1) month.php, and possibly (2) day.php and (3) week.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4450; http://www.securityfocus.com/bid/31809; http://www.vupen.com/english/advisories/2008/2865
CVE: CVE-2008-4621
Published: 2008-10-21
Description: SQL injection vulnerability in bannerclick.php in ZeeScripts Zeeproperty allows remote attackers to execute arbitrary SQL commands via the adid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32333; http://securityreason.com/securityalert/4451; http://www.securityfocus.com/bid/31807
CVE: CVE-2008-4622
Published: 2008-10-21
Description: The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and gain administrative access by setting the fn-loggedin cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32334; http://securityreason.com/securityalert/4452; http://www.securityfocus.com/bid/31811
CVE: CVE-2008-4623
Published: 2008-10-21
Description: SQL injection vulnerability in the DS-Syndicate (com_ds-syndicate) component 1.1.1 for Joomla allows remote attackers to execute arbitrary SQL commands via the feed_id parameter to index2.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32321; http://securityreason.com/securityalert/4453; http://www.securityfocus.com/bid/31819
CVE: CVE-2008-4624
Published: 2008-10-21
Description: PHP remote file inclusion vulnerability in init.php in Fast Click SQL Lite 1.1.7, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CFG[CDIR] parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32328; http://securityreason.com/securityalert/4454; http://www.securityfocus.com/bid/31817
CVE: CVE-2008-4625
Published: 2008-10-21
Description: SQL injection vulnerability in stnl_iframe.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter, a different vector than CVE-2008-0683.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32336; http://securityreason.com/securityalert/4446; http://www.securityfocus.com/bid/31806
CVE: CVE-2008-4626
Published: 2008-10-21
Description: Directory traversal vulnerability in index.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 and possibly other versions through 2.3.3-beta0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the album parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32325; http://securityreason.com/securityalert/4444; http://www.osvdb.org/49171
CVE: CVE-2008-4627
Published: 2008-10-21
Description: SQL injection vulnerability in the rGallery plugin 1.09 for WoltLab Burning Board (WBB) allows remote attackers to execute arbitrary SQL commands via the itemID parameter in the RGalleryImageWrapper page in index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32323; http://securityreason.com/securityalert/4443; http://www.securityfocus.com/bid/31820
CVE: CVE-2008-4628
Published: 2008-10-21
Description: SQL injection vulnerability in del.php in myWebland miniBloggie 1.0 allows remote attackers to execute arbitrary SQL commands via the post_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4442; http://www.securityfocus.com/bid/31810; http://www.vupen.com/english/advisories/2008/2864
CVE: CVE-2008-4629
Published: 2008-10-21
Description: Cross-site scripting (XSS) vulnerability in Usagi Project MyNETS 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN53267766/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000071.html; http://secunia.com/advisories/32348
CVE: CVE-2008-4630
Published: 2008-10-21
Description: Multiple unspecified vulnerabilities in Midgard Components (MidCOM) Framework before 8.09.1 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://freshmeat.net/projects/midcom/?branch_id=38063&release_id=286210; http://secunia.com/advisories/32178; http://www.securityfocus.com/bid/31829
CVE: CVE-2008-4631
Published: 2008-10-21
Description: Stack-based buffer overflow in the Message::AddToString function in message/Message.cpp in MUSCLE before 4.40 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted message.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32318; http://www.securityfocus.com/bid/31822; http://www.vupen.com/english/advisories/2008/2869
CVE: CVE-2008-4632
Published: 2008-10-21
Description: Multiple directory traversal vulnerabilities in index.php in Kure 0.6.3, when magic_quotes_gpc is disabled, allow remote attackers to read and possibly execute arbitrary local files via a .. (dot dot) in the (1) post and (2) doc parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4445; http://www.securityfocus.com/bid/31785; https://exchange.xforce.ibmcloud.com/vulnerabilities/45927
CVE: CVE-2008-4633
Published: 2008-10-21
Description: SQL injection vulnerability in Node Vote 5.x before 5.x-1.1 and 6.x before 6.x-1.0, a module for Drupal, when "Allow user to vote again" is enabled, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to a "previously cast vote."
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://drupal.org/node/321685; http://secunia.com/advisories/32276; http://www.securityfocus.com/bid/31779
CVE: CVE-2008-4634
Published: 2008-10-21
Description: Cross-site scripting (XSS) vulnerability in Movable Type 4 through 4.21 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the administrative page, a different vulnerability than CVE-2008-4079.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN81490697/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000072.html; http://secunia.com/advisories/32305
CVE: CVE-2008-4635
Published: 2008-10-21
Description: Unspecified vulnerability in Hisanaga Electric Co, Ltd. hisa_cart 1.29 and earlier, a module for XOOPS, allows remote attackers to obtain sensitive user information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://hisacart.chushokigyo.net/modules/info/index.php/intro/url.html; http://jvn.jp/en/jp/JVN67334580/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000068.html
CVE: CVE-2007-4350
Published: 2008-10-21
Description: Cross-site scripting (XSS) vulnerability in the management interface in HP SiteScope 9.0 build 911 allows remote attackers to inject arbitrary web script or HTML via an SNMP trap message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/27126; http://secunia.com/secunia_research/2007-84/; http://securityreason.com/securityalert/4447
CVE: CVE-2008-3248
Published: 2008-10-21
Description: qiomkfile in the Quick I/O for Database feature in Symantec Veritas File System (VxFS) on HP-UX, and before 5.0 MP3 on Solaris, Linux, and AIX, does not initialize filesystem blocks during creation of a file, which allows local users to obtain sensitive information by creating and then reading files.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/32332; http://seer.entsupport.symantec.com/docs/310872.htm; http://www.security-objectives.com/advisories/SECOBJADV-2008-04.txt
CVE: CVE-2008-4121
Published: 2008-10-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cpcommerce.cpradio.org/; http://secunia.com/advisories/32353; http://securityreason.com/securityalert/4448
CVE: CVE-2008-4637
Published: 2008-10-21
Description: Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors in the advanced search feature.  NOTE: this is probably a variant of CVE-2008-4121.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cpcommerce.cpradio.org/; https://exchange.xforce.ibmcloud.com/vulnerabilities/46090; http://cpcommerce.cpradio.org/
CVE: CVE-2008-4638
Published: 2008-10-21
Description: qioadmin in the Quick I/O for Database feature in Symantec Veritas File System (VxFS) on HP-UX, and before 5.0 MP3 on Solaris, Linux, and AIX, allows local users to read arbitrary files by causing qioadmin to write a file's content to standard error in an error message.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://seer.entsupport.symantec.com/docs/310872.htm; http://www.security-objectives.com/advisories/SECOBJSADV-2008-05.txt; http://www.securityfocus.com/archive/1/497675/100/0/threaded
CVE: CVE-2008-4639
Published: 2008-10-21
Description: jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2008/10/15/5; http://www.openwall.com/lists/oss-security/2008/10/15/6; http://www.openwall.com/lists/oss-security/2008/10/16/3
CVE: CVE-2008-4640
Published: 2008-10-21
Description: The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename in which (1) a final "z" character is replaced by a "t" character or (2) a final "t" character is replaced by a "z" character.
CVSS Score: 3.6 (LOW)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2008/10/16/3; http://www.openwall.com/lists/oss-security/2008/11/26/4; http://www.securityfocus.com/bid/32506
CVE: CVE-2008-4641
Published: 2008-10-21
Description: The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2008/10/15/5; http://www.openwall.com/lists/oss-security/2008/10/15/6; http://www.openwall.com/lists/oss-security/2008/10/16/3
CVE: CVE-2008-4642
Published: 2008-10-21
Description: SQL injection vulnerability in profile.php in AstroSPACES 1.1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32290; http://securityreason.com/securityalert/4449; http://www.securityfocus.com/bid/31771
CVE: CVE-2008-4643
Published: 2008-10-22
Description: SQL injection vulnerability in hits.php in myWebland myStats allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32289; http://securityreason.com/securityalert/4455; http://www.securityfocus.com/bid/31772
CVE: CVE-2008-4644
Published: 2008-10-22
Description: hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For HTTP header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32289; http://securityreason.com/securityalert/4455; http://www.securityfocus.com/bid/31772
CVE: CVE-2008-4645
Published: 2008-10-22
Description: plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP sequences in the sort parameter, which is processed by create_function.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4456; http://www.securityfocus.com/bid/31762; https://exchange.xforce.ibmcloud.com/vulnerabilities/45875
CVE: CVE-2008-4646
Published: 2008-10-22
Description: The Websense Reporter Module in Websense Enterprise 6.3.2 stores the SQL database system administrator password in plaintext in CreateDbInstall.log, which allows local users to gain privileges to the database.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/32264; http://www.securityfocus.com/bid/31746; http://www.securitytracker.com/id?1021058
CVE: CVE-2008-4647
Published: 2008-10-22
Description: SQL injection vulnerability in index.php in sweetCMS 1.5.2 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0810-exploits/sweetcms-sql.txt; http://secunia.com/advisories/32277; http://www.securityfocus.com/bid/31774
CVE: CVE-2008-4648
Published: 2008-10-22
Description: Cross-site scripting (XSS) vulnerability in index.php in Elxis CMS 2008.1 revision 2204 allows remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO or the (2) option, (3) Itemid, (4) id, (5) task, (6) bid, and (7) contact_id parameters.  NOTE: the error might be located in modules/mod_language.php, and index.php might be the interaction point.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0810-exploits/elxis-xss.txt; http://secunia.com/advisories/32278; http://www.securityfocus.com/bid/31764
CVE: CVE-2008-4649
Published: 2008-10-22
Description: Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.org/0810-exploits/elxis-xss.txt; http://www.securityfocus.com/bid/31764; https://exchange.xforce.ibmcloud.com/vulnerabilities/45868
CVE: CVE-2008-4650
Published: 2008-10-22
Description: SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands via the eventdate parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4457; http://www.securityfocus.com/bid/31773; https://exchange.xforce.ibmcloud.com/vulnerabilities/45919
CVE: CVE-2008-4651
Published: 2008-10-22
Description: Multiple SQL injection vulnerabilities in Jetbox CMS 2.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby parameter to admin/cms/images.php and the (2) nav_id parameter in an editrecord action to admin/cms/nav.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://www.digitrustgroup.com/advisories/web-application-security-jetbox; http://www.securityfocus.com/bid/31824; https://exchange.xforce.ibmcloud.com/vulnerabilities/45986
CVE: CVE-2008-4652
Published: 2008-10-22
Description: Buffer overflow in the ActiveX control (DartFtp.dll) in Dart Communications PowerTCP FTP for ActiveX 2.0.2 0 allows remote attackers to execute arbitrary code via a long SecretKey property.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4458; http://www.securityfocus.com/bid/31814; https://exchange.xforce.ibmcloud.com/vulnerabilities/45975
CVE: CVE-2008-4653
Published: 2008-10-22
Description: SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32347; http://securityreason.com/securityalert/4459; http://www.securityfocus.com/bid/31834
CVE: CVE-2008-4654
Published: 2008-10-22
Description: Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502726; http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=fde9e1cc1fe1ec9635169fa071e42b3aa6436033; http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=26d92b87bba99b5ea2e17b7eaa39c462d65e9133
CVE: CVE-2008-4655
Published: 2008-10-22
Description: SQL injection vulnerability in the Simple survey (simplesurvey) 1.7.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32369; http://typo3.org/extensions/repository/view/simplesurvey/1.8.1/; http://typo3.org/teams/security/security-bulletins/typo3-20081020-1/
CVE: CVE-2008-4656
Published: 2008-10-22
Description: SQL injection vulnerability in the Frontend Users View (feusersview) 0.1.6 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20081020-1/; http://www.securityfocus.com/bid/31843; http://www.vupen.com/english/advisories/2008/2870
CVE: CVE-2008-4657
Published: 2008-10-22
Description: SQL injection vulnerability in the Econda Plugin (econda) 0.0.2 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/econda/0.0.4/; http://typo3.org/teams/security/security-bulletins/typo3-20081020-1/; http://www.securityfocus.com/bid/31841
CVE: CVE-2008-4658
Published: 2008-10-22
Description: SQL injection vulnerability in the JobControl (dmmjobcontrol) 1.15.4 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32342; http://typo3.org/extensions/repository/view/dmmjobcontrol/1.15.5/; http://typo3.org/teams/security/security-bulletins/typo3-20081020-1/
CVE: CVE-2008-4659
Published: 2008-10-22
Description: SQL injection vulnerability in the Mannschaftsliste (kiddog_playerlist) 1.0.3 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20081020-1/; http://www.securityfocus.com/bid/31844; http://www.vupen.com/english/advisories/2008/2870
CVE: CVE-2008-4660
Published: 2008-10-22
Description: SQL injection vulnerability in the M1 Intern (m1_intern) 1.0.0 extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20081020-1/; http://www.securityfocus.com/bid/31845; http://www.vupen.com/english/advisories/2008/2870
CVE: CVE-2008-4661
Published: 2008-10-22
Description: Cross-site scripting (XSS) vulnerability in the Page Improvements (sm_pageimprovements) 1.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/extensions/repository/view/sm_pageimprovements/0.3.0/info/ChangeLog/; http://typo3.org/teams/security/security-bulletins/typo3-20081020-1/; http://www.vupen.com/english/advisories/2008/2870
CVE: CVE-2008-4664
Published: 2008-10-22
Description: Heap-based buffer overflow in QvodInsert.QvodCtrl.1 ActiveX control (QvodInsert.dll) in QVOD Player before 2.1.5 build 0053 allows remote attackers to execute arbitrary code via a long URL property.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://hi.baidu.com/muma_reader/blog/item/46bd0d7a04eb75e92f73b36e.html; http://secunia.com/advisories/28494; http://www.securityfocus.com/bid/27271
CVE: CVE-2008-4662
Published: 2008-10-22
Description: Directory traversal vulnerability in admin.php in LokiCMS 0.3.4, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30472; http://securityreason.com/securityalert/4463; http://www.securityfocus.com/archive/1/492877/100/0/threaded
CVE: CVE-2008-4663
Published: 2008-10-22
Description: Cross-site scripting (XSS) vulnerability in analysis.cgi 1.44, as used in K's CGI Access Log Kaiseki (1) jcode.pl and (2) Jcode.pm, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN46869708/index.html; http://jvn.jp/en/jp/JVN72065744/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000043.html
CVE: CVE-2008-4665
Published: 2008-10-22
Description: SQL injection vulnerability in PG Matchmaking allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) news_read.php and (2) gifts_show.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32016; http://securityreason.com/securityalert/4466; http://www.securityfocus.com/bid/31477
CVE: CVE-2008-4666
Published: 2008-10-22
Description: SQL injection vulnerability in webboard.php in Ultimate Webboard 3.00 allows remote attackers to execute arbitrary SQL commands via the Category parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4467; http://www.securityfocus.com/bid/31424; https://exchange.xforce.ibmcloud.com/vulnerabilities/45469
CVE: CVE-2008-4667
Published: 2008-10-22
Description: Directory traversal vulnerability in rss.php in ArabCMS 2.0 beta 1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the rss parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4468; http://www.securityfocus.com/bid/31480; http://www.vupen.com/english/advisories/2008/2697
CVE: CVE-2008-4668
Published: 2008-10-22
Description: Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4464; http://www.securityfocus.com/bid/31458; https://exchange.xforce.ibmcloud.com/vulnerabilities/45490