deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0973
Published: 2010-03-16
Description: SQL injection vulnerability in index.php in phppool media Domain Verkaus and Auktions Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://4004securityproject.wordpress.com/2010/03/14/phppool-media-domain-verkaufs-und-auktions-portal-index-php-sql-injection/; http://secunia.com/advisories/38939; http://www.exploit-db.com/exploits/11733
CVE: CVE-2010-0974
Published: 2010-03-16
Description: Multiple SQL injection vulnerabilities in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) video_show.php, (2) spotlight_detail.php, (3) real_estate_details.php, and (4) auto_details.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/11678; http://www.packetstormsecurity.com/1003-exploits/phpcityportal-sqlrfi.txt; http://www.securityfocus.com/bid/38649
CVE: CVE-2010-0975
Published: 2010-03-16
Description: PHP remote file inclusion vulnerability in external.php in PHPCityPortal allows remote attackers to execute arbitrary PHP code via a URL in the url parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1003-exploits/phpcityportal-sqlrfi.txt; http://www.exploit-db.com/exploits/11678; https://exchange.xforce.ibmcloud.com/vulnerabilities/56812
CVE: CVE-2007-6733
Published: 2010-03-16
Description: The nfs_lock function in fs/nfs/file.c in the Linux kernel 2.6.9 does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on an NFS filesystem and then changing this file's permissions, a related issue to CVE-2010-0727.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHBA-2007-0304.html; https://bugzilla.redhat.com/show_bug.cgi?id=218777; https://bugzilla.redhat.com/show_bug.cgi?id=570863
CVE: CVE-2010-0397
Published: 2010-03-16
Description: The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) and possibly have unspecified other impact via a crafted argument.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573573; http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
CVE: CVE-2010-0727
Published: 2010-03-16
Description: The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://lkml.org/lkml/2010/3/11/269; http://secunia.com/advisories/39830; http://securitytracker.com/id?1023809
CVE: CVE-2010-0729
Published: 2010-03-16
Description: A certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 4 on the ia64 platform allows local users to use ptrace on an arbitrary process, and consequently gain privileges, via vectors related to a missing ptrace_check_attach call.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://support.avaya.com/css/P8/documents/100090459; http://www.openwall.com/lists/oss-security/2010/03/12/2; http://www.redhat.com/support/errata/RHSA-2010-0394.html
CVE: CVE-2010-0793
Published: 2010-03-16
Description: Buffer overflow in BarnOwl before 1.5.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted CC: header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://barnowl.mit.edu/wiki/barnowl-1.5.1-announce; http://secunia.com/advisories/39908; http://www.debian.org/security/2010/dsa-2049
CVE: CVE-2010-0976
Published: 2010-03-16
Description: Acidcat CMS 3.5.x does not prevent access to install.asp after installation finishes, which might allow remote attackers to restart the installation process and have unspecified other impact via requests to install.asp and other install_*.asp scripts.  NOTE: the final installation screen states "Important: you must now delete all files beginning with 'install' from the root directory."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.org/1001-exploits/acidcatcms-disclose.txt; http://www.exploit-db.com/exploits/10972; https://exchange.xforce.ibmcloud.com/vulnerabilities/55331
CVE: CVE-2010-0977
Published: 2010-03-16
Description: PD PORTAL 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/db.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/61468; http://packetstormsecurity.org/1001-exploits/pdportal-disclose.txt; http://secunia.com/advisories/38109
CVE: CVE-2010-0978
Published: 2010-03-16
Description: KMSoft Guestbook (aka GBook) 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/db.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/61487; http://packetstormsecurity.org/1001-exploits/kmsoftgb-disclose.txt; http://secunia.com/advisories/38076
CVE: CVE-2010-0979
Published: 2010-03-16
Description: Cross-site scripting (XSS) vulnerability in display.php in Obsession-Design Image-Gallery (ODIG) 1.1 allows remote attackers to inject arbitrary web script or HTML via the folder parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/odig-xss.txt; http://secunia.com/advisories/38107; http://www.vupen.com/english/advisories/2010/0048
CVE: CVE-2010-0980
Published: 2010-03-16
Description: SQL injection vulnerability in player.php in Left 4 Dead (L4D) Stats 1.1 allows remote attackers to execute arbitrary SQL commands via the steamid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://greyhathackers.wordpress.com/2010/01/02/left-4-dead-stats-1-1-sql-injection-vulnerability/; http://osvdb.org/61472; http://packetstormsecurity.org/1001-exploits/left4deadstats-sql.txt
CVE: CVE-2010-0981
Published: 2010-03-16
Description: SQL injection vulnerability in the TPJobs (com_tpjobs) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id_c[] parameter in a resadvsearch action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/61477; http://packetstormsecurity.org/0912-exploits/joomlatpjobs-sql.txt; http://secunia.com/advisories/38001
CVE: CVE-2010-0982
Published: 2010-03-16
Description: Directory traversal vulnerability in the CARTwebERP (com_cartweberp) component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/61447; http://packetstormsecurity.org/1001-exploits/joomlacartweberp-lfi.txt; http://secunia.com/advisories/37917
CVE: CVE-2010-0983
Published: 2010-03-16
Description: PHP remote file inclusion vulnerability in include/mail.inc.php in Rezervi 3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the root parameter, a different vector than CVE-2007-2156.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/61450; http://packetstormsecurity.org/1001-exploits/rezervi-rfi.txt; http://secunia.com/advisories/38118
CVE: CVE-2010-0984
Published: 2010-03-16
Description: Acidcat CMS 3.5.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for databases/acidcat_3.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/61436; http://packetstormsecurity.org/1001-exploits/acidcatcms-disclose.txt; http://secunia.com/advisories/38084
CVE: CVE-2010-0985
Published: 2010-03-16
Description: Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/61458; http://secunia.com/advisories/37834; http://www.exploit-db.com/exploits/10948
CVE: CVE-2009-1299
Published: 2010-03-18
Description: The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd-##### temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573615; http://git.0pointer.de/?p=pulseaudio.git%3Ba=patch%3Bh=d3efa43d85ac132c6a5a416a2b6f2115f5d577ee; http://www.debian.org/security/2010/dsa-2017
CVE: CVE-2010-0104
Published: 2010-03-18
Description: Unspecified vulnerability in the Broadcom Integrated NIC Management Firmware 1.x before 1.40.0.0 and 8.x before 8.08 on the HP Small Form Factor and Microtower platforms allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02048471; http://secunia.com/advisories/39003; http://securitytracker.com/id?1023710
CVE: CVE-2010-0421
Published: 2010-03-18
Description: Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://ftp.gnome.org/pub/GNOME/sources/pango/1.27/pango-1.27.1.tar.bz2; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
CVE: CVE-2009-4719
Published: 2010-03-18
Description: SQL injection vulnerability in index.php in Discloser 0.0.4 rc2 allows remote attackers to execute arbitrary SQL commands via the more parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9349; http://www.securityfocus.com/archive/1/505478/100/0/threaded; http://www.securityfocus.com/bid/35923
CVE: CVE-2009-4720
Published: 2010-03-18
Description: SQL injection vulnerability in cgi-bin/gnudip.cgi in GnuDIP 2.1.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539452; http://osvdb.org/56675; http://secunia.com/advisories/36115
CVE: CVE-2009-4721
Published: 2010-03-18
Description: Multiple SQL injection vulnerabilities in Admin/index.asp in Andrews-Web (A-W) BannerAd 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) User and (2) Password parameters. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36135; http://www.exploit-db.com/exploits/9328; http://www.vupen.com/english/advisories/2009/2122
CVE: CVE-2009-4722
Published: 2010-03-18
Description: SQL injection vulnerability in the CheckLogin function in includes/functions.php in Limny 1.01, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35993; http://www.exploit-db.com/exploits/9281; http://www.osvdb.org/56592
CVE: CVE-2009-4723
Published: 2010-03-18
Description: Directory traversal vulnerability in confirm.php in Netpet CMS 1.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9333; http://www.vupen.com/english/advisories/2009/2125; http://www.exploit-db.com/exploits/9333
CVE: CVE-2009-4724
Published: 2010-03-18
Description: SQL injection vulnerability in shop.htm in PaymentProcessorScript.net PPScript allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36100; http://www.exploit-db.com/exploits/9351; http://secunia.com/advisories/36100
CVE: CVE-2009-4725
Published: 2010-03-18
Description: Directory traversal vulnerability in modules/aljazeera/admin/setup.php in Arab Portal 2.2 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9347; http://www.securityfocus.com/bid/35921; http://www.vupen.com/english/advisories/2009/2133
CVE: CVE-2009-4726
Published: 2010-03-18
Description: Directory traversal vulnerability in download.php in Quickdev 4 PHP allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/36130; http://www.exploit-db.com/exploits/9334; http://www.vupen.com/english/advisories/2009/2126
CVE: CVE-2009-4727
Published: 2010-03-18
Description: SQL injection vulnerability in x/login in JungleScripts Ajax Short Url Script allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36132; http://www.exploit-db.com/exploits/9332; http://www.vupen.com/english/advisories/2009/2124
CVE: CVE-2009-4728
Published: 2010-03-18
Description: SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9341; http://www.vupen.com/english/advisories/2009/2130; http://www.exploit-db.com/exploits/9341
CVE: CVE-2009-4729
Published: 2010-03-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in x10 Adult Media Script 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, (3) id parameter to templates/header1.php, and (4) key parameter to video_listing.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36067; http://www.exploit-db.com/exploits/9340; http://www.osvdb.org/56671
CVE: CVE-2009-4730
Published: 2010-03-18
Description: SQL injection vulnerability in report.php in x10 Adult Media Script 1.7 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36067; http://www.exploit-db.com/exploits/9340; https://exchange.xforce.ibmcloud.com/vulnerabilities/52164
CVE: CVE-2009-4731
Published: 2010-03-18
Description: SQL injection vulnerability in photos.php in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allows remote attackers to execute arbitrary SQL commands via the album parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/articlepubpro-sql.txt; http://secunia.com/advisories/36066; http://www.securityfocus.com/bid/35892
CVE: CVE-2009-4732
Published: 2010-03-18
Description: SQL injection vulnerability in tt/index.php in TT Web Site Manager 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tt_name parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/36129; http://www.exploit-db.com/exploits/9335; http://www.vupen.com/english/advisories/2009/2127
CVE: CVE-2009-4733
Published: 2010-03-18
Description: SQL injection vulnerability in checkuser.php in SimpleLoginSys 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9336; http://www.vupen.com/english/advisories/2009/2128; http://www.exploit-db.com/exploits/9336
CVE: CVE-2009-4734
Published: 2010-03-18
Description: SQL injection vulnerability in login.php in Allomani Movies Library (Movies & Clips) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9275; http://www.vupen.com/english/advisories/2009/2031; https://exchange.xforce.ibmcloud.com/vulnerabilities/52011
CVE: CVE-2009-4735
Published: 2010-03-18
Description: SQL injection vulnerability in login.php in Allomani Audio & Video Library (Songs & Clips version) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9274; http://www.vupen.com/english/advisories/2009/2030; https://exchange.xforce.ibmcloud.com/vulnerabilities/52013
CVE: CVE-2010-0735
Published: 2010-03-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-0969.  Reason: This candidate is a duplicate of CVE-2010-0969.  Notes: All CVE users should reference CVE-2010-0969 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-1004
Published: 2010-03-19
Description: SQL injection vulnerability in the Yet another TYPO3 search engine (YATSE) extension before 0.3.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/yatse/0.3.2/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38808
CVE: CVE-2010-1005
Published: 2010-03-19
Description: Cross-site scripting (XSS) vulnerability in the Yet another TYPO3 search engine (YATSE) extension before 0.3.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/extensions/repository/view/yatse/0.3.2/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38808
CVE: CVE-2010-1006
Published: 2010-03-19
Description: SQL injection vulnerability in the Brainstorming extension 0.1.8 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38798; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1007
Published: 2010-03-19
Description: Unspecified vulnerability in the Power Extension Manager (ch_lightem) extension 1.0.34 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38811; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1008
Published: 2010-03-19
Description: Cross-site scripting (XSS) vulnerability in the Sellector.com Widget Integration (chsellector) extension before 0.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/extensions/repository/view/chsellector/0.1.2/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38816
CVE: CVE-2010-1009
Published: 2010-03-19
Description: SQL injection vulnerability in the Educator extension 0.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38789; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1010
Published: 2010-03-19
Description: SQL injection vulnerability in the MK Wastebasket (mk_wastebasket) extension 2.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38792; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1011
Published: 2010-03-19
Description: Cross-site scripting (XSS) vulnerability in the myDashboard (mydashboard) extension 0.1.13 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38795; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1012
Published: 2010-03-19
Description: SQL injection vulnerability in the CleanDB (nf_cleandb) extension 1.0.7 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38810; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1013
Published: 2010-03-19
Description: SQL injection vulnerability in the Diocese of Portsmouth Database (pd_diocesedatabase) extension before 0.7.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63034; http://secunia.com/advisories/38996; http://typo3.org/extensions/repository/view/pd_diocesedatabase/0.7.13/
CVE: CVE-2010-1014
Published: 2010-03-19
Description: Cross-site scripting (XSS) vulnerability in the Reports Logfile View (reports_logview) extension 1.2.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/; http://www.securityfocus.com/bid/38823; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-006/
CVE: CVE-2010-1015
Published: 2010-03-19
Description: SQL injection vulnerability in the SAV Filter Alphabetic (sav_filter_abc) extension before 1.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63033; http://secunia.com/advisories/38995; http://typo3.org/extensions/repository/view/sav_filter_abc/1.0.9/