deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-2440
Published: 2010-06-24
Description: Stack-based buffer overflow in st-wizard.exe in Subtitle Translation Wizard 3.0 allows user-assisted remote attackers to execute arbitrary code via a crafted SRT file with a long line after a time range.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/65678; http://secunia.com/advisories/40303; http://www.exploit-db.com/exploits/13965
CVE: CVE-2010-2441
Published: 2010-06-24
Description: WebKit does not properly restrict focus changes, which allows remote attackers to read keystrokes via "cross-domain IFRAME gadgets," a different vulnerability than CVE-2010-1126, CVE-2010-1422, and CVE-2010-2295.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html; http://secunia.com/advisories/43068
CVE: CVE-2010-2442
Published: 2010-06-24
Description: Microsoft Internet Explorer, possibly 8, does not properly restrict focus changes, which allows remote attackers to read keystrokes via "cross-domain IFRAME gadgets."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: https://bugzilla.mozilla.org/show_bug.cgi?id=552255; https://bugzilla.mozilla.org/show_bug.cgi?id=552255
CVE: CVE-2010-2443
Published: 2010-06-24
Description: The OJPEGReadBufferFill function in tif_ojpeg.c in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an OJPEG image with undefined strip offsets, related to the TIFFVGetField function.
CVSS Score: 5.0 (MEDIUM)
References: http://blogs.sun.com/security/entry/cve_2010_2065_cve_2010; http://marc.info/?l=oss-security&m=[PII_REDACTED]2102&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]5896&w=2
CVE: CVE-2010-2434
Published: 2010-06-25
Description: Buffer overflow in Arcext.dll 2.16.1 and earlier in pon software Explzh 5.62 and earlier allows remote attackers to execute arbitrary code via an LZH LHA file with a crafted header that is not properly handled during expansion.
CVSS Score: 9.3 (HIGH)
CWE: CWE-120
References: http://jvn.jp/en/jp/JVN34729123/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000026.html; http://osvdb.org/65666
CVE: CVE-2010-2444
Published: 2010-06-25
Description: parse/Csv2_parse.c in MaraDNS 1.3.03, and other versions before 1.4.03, does not properly handle hostnames that do not end in a "." (dot) character, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted csv2 zone file.
CVSS Score: 4.3 (MEDIUM)
References: http://maradns.org/download/maradns-1.4.02-parse_segfault.patch; http://www.openwall.com/lists/oss-security/2010/06/09/4; http://www.openwall.com/lists/oss-security/2010/06/24/5
CVE: CVE-2009-4903
Published: 2010-06-25
Description: Cross-site scripting (XSS) vulnerability in index.php in oBlog allows remote attackers to inject arbitrary web script or HTML via the search parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37661; http://www.osvdb.org/60905; https://exchange.xforce.ibmcloud.com/vulnerabilities/54712
CVE: CVE-2009-4904
Published: 2010-06-25
Description: article.php in oBlog does not properly restrict comments, which allows remote attackers to cause a denial of service (blog spam) via a comment=new action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/59825; http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt
CVE: CVE-2009-4905
Published: 2010-06-25
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Acc Statistics 1.1 allow remote attackers to hijack the authentication of administrators for requests that change (1) passwords, (2) usernames, and (3) e-mail addresses.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/37694; http://www.exploit-db.com/exploits/10406; http://www.vupen.com/english/advisories/2009/3509
CVE: CVE-2009-4906
Published: 2010-06-25
Description: Cross-site request forgery (CSRF) vulnerability in index.php in Acc PHP eMail 1.1 allows remote attackers to hijack the authentication of administrators for requests that change passwords.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.org/0912-exploits/ape-xsrf.txt; http://secunia.com/advisories/37666; http://www.exploit-db.com/exploits/10412
CVE: CVE-2009-4907
Published: 2010-06-25
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) force an admin logout, (3) change the visibility of posts, (4) remove links, and (5) change the name fields of a blog.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/60907; http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt; http://secunia.com/advisories/37661
CVE: CVE-2009-4908
Published: 2010-06-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in oBlog allow remote attackers to inject arbitrary web script or HTML via the (1) commentName, (2) commentEmail, (3) commentWeb, or (4) commentText parameter to article.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via the (5) article_id or (6) title parameter to admin/write.php, the (7) category_id or (8) category_name parameter to admin/groups.php, the (9) blogroll_id or (10) title parameter to admin/blogroll.php, or the (11) blog_name or (12) tag_line parameter to admin/settings.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/60906; http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt; http://secunia.com/advisories/37661
CVE: CVE-2009-4909
Published: 2010-06-25
Description: admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/59824; http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt
CVE: CVE-2010-1206
Published: 2010-06-25
Description: The startDocumentLoad function in browser/base/content/browser.js in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, does not properly implement the Same Origin Policy in certain circumstances related to the about:blank document and a document that is currently loading, which allows (1) remote web servers to conduct spoofing attacks via vectors involving a 204 (aka No Content) status code, and allows (2) remote attackers to conduct spoofing attacks via vectors involving a window.stop call.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://hg.mozilla.org/mozilla-central/rev/cadddabb1178; http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html; http://secunia.com/advisories/40283
CVE: CVE-2010-2454
Published: 2010-06-25
Description: Apple Safari does not properly manage the address bar between the request to open a URL and the retrieval of the new document's content, which might allow remote attackers to conduct spoofing attacks via a crafted HTML document, a related issue to CVE-2010-1206.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html; https://bugzilla.mozilla.org/show_bug.cgi?id=556957; https://exchange.xforce.ibmcloud.com/vulnerabilities/59830
CVE: CVE-2010-2455
Published: 2010-06-25
Description: Opera does not properly manage the address bar between the request to open a URL and the retrieval of the new document's content, which might allow remote attackers to conduct spoofing attacks via a crafted HTML document, a related issue to CVE-2010-1206.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: https://bugzilla.mozilla.org/show_bug.cgi?id=556957; https://exchange.xforce.ibmcloud.com/vulnerabilities/59831; https://bugzilla.mozilla.org/show_bug.cgi?id=556957
CVE: CVE-2010-2456
Published: 2010-06-25
Description: Multiple directory traversal vulnerabilities in index.php in Linker IMG 1.0 and earlier allow remote attackers to read and execute arbitrary local files via a URL in the (1) cook_lan cookie parameter ($lan_dir variable) or possibly (2) Sdb_type parameter.  NOTE: this was originally reported as remote file inclusion, but this may be inaccurate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1006-exploits/linkerimg-rfi.txt; http://www.attrition.org/pipermail/vim/2010-June/002354.html; http://www.exploit-db.com/exploits/13964
CVE: CVE-2010-2457
Published: 2010-06-25
Description: Cross-site scripting (XSS) vulnerability in index.php in K-Search allows remote attackers to inject arbitrary web script or HTML via the term parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/65806; http://secunia.com/advisories/17719; http://www.exploit-db.com/exploits/13993
CVE: CVE-2010-2458
Published: 2010-06-25
Description: Cross-site scripting (XSS) vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to inject arbitrary web script or HTML via the videoid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/65669; http://packetstormsecurity.org/1006-exploits/2daybizvcp-sql.txt; http://secunia.com/advisories/40280
CVE: CVE-2010-2459
Published: 2010-06-25
Description: SQL injection vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to execute arbitrary SQL commands via the videoid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/65810; http://packetstormsecurity.org/1006-exploits/2daybizvcp-sql.txt; http://www.exploit-db.com/exploits/13970
CVE: CVE-2010-2460
Published: 2010-06-25
Description: SQL injection vulnerability in merchant_product_list.php in JCE-Tech Shareasale Script (SASS) 1 allows remote attackers to execute arbitrary SQL commands via the mechant_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/13949; http://www.securityfocus.com/bid/40993; https://exchange.xforce.ibmcloud.com/vulnerabilities/59581
CVE: CVE-2010-2461
Published: 2010-06-25
Description: SQL injection vulnerability in storecat.php in JCE-Tech Overstock 1 allows remote attackers to execute arbitrary SQL commands via the store parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/overstock-sql.txt; http://www.exploit-db.com/exploits/13946; http://www.securityfocus.com/bid/40990
CVE: CVE-2010-2462
Published: 2010-06-25
Description: SQL injection vulnerability in withdraw_money.php in Toma Cero OroHYIP allows remote attackers to execute arbitrary SQL commands via the id parameter in a cancel action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/orohyip-sql.txt; http://www.exploit-db.com/exploits/13948; http://www.securityfocus.com/bid/40992
CVE: CVE-2010-2463
Published: 2010-06-25
Description: Cross-site scripting (XSS) vulnerability in forum.php in Jamroom before 4.1.9 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter in a modify action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40259; http://www.htbridge.ch/advisory/xss_vulnerability_in_jamroom.html; http://www.jamroom.net/index.php?m=td_tracker&o=view&id=1756
CVE: CVE-2010-2464
Published: 2010-06-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in the RSComments (com_rscomments) component 1.0.0 Rev 2 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website and (2) name parameters to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1006-exploits/joomlarscomments-xss.txt; http://secunia.com/advisories/40278; http://www.exploit-db.com/exploits/13935
CVE: CVE-2010-2465
Published: 2010-06-25
Description: The S2 Security NetBox 2.5, 3.3, and 4.0, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download node logs, photographs of persons, and backup files via unspecified HTTP requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://blip.tv/file/3414004; http://osvdb.org/65757; http://secunia.com/advisories/40374
CVE: CVE-2010-2466
Published: 2010-06-25
Description: The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not properly prevent downloading of database backups, which allows remote attackers to obtain sensitive information via requests for full_*.dar files with predictable filenames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://blip.tv/file/3414004; http://www.darkreading.com/blog/archives/2010/04/attacking_door.html; http://www.kb.cert.org/vuls/id/228737
CVE: CVE-2010-2467
Published: 2010-06-25
Description: The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not require setting a password for the FTP server that stores database backups, which makes it easier for remote attackers to download backup files via unspecified FTP requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://blip.tv/file/3414004; http://www.darkreading.com/blog/archives/2010/04/attacking_door.html; http://www.securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2
CVE: CVE-2010-2468
Published: 2010-06-25
Description: The S2 Security NetBox 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, uses a weak hash algorithm for storing the Administrator password, which makes it easier for context-dependent attackers to obtain privileged access by recovering the cleartext of this password.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://blip.tv/file/3414004; http://www.darkreading.com/blog/archives/2010/04/attacking_door.html; http://www.securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2
CVE: CVE-2010-2469
Published: 2010-06-25
Description: The Linear eMerge 50 and 5000 uses a default password of eMerge for the IEIeMerge account, which makes it easier for remote attackers to obtain Video Recorder data by establishing a session to the device.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://blip.tv/file/3414004; http://www.darkreading.com/blog/archives/2010/04/attacking_door.html; http://www.securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2
CVE: CVE-2010-0180
Published: 2010-06-28
Description: Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which allows local users to read sensitive configuration fields, as demonstrated by the database password field and the site_wide_secret field.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/40300; http://www.bugzilla.org/security/3.2.6/; http://www.securityfocus.com/bid/41144
CVE: CVE-2010-1204
Published: 2010-06-28
Description: Search.pm in Bugzilla 2.17.1 through 3.2.6, 3.3.1 through 3.4.6, 3.5.1 through 3.6, and 3.7 allows remote attackers to obtain potentially sensitive time-tracking information via a crafted search URL, related to a "boolean chart search."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/40300; http://www.bugzilla.org/security/3.2.6/; http://www.securityfocus.com/bid/41141
CVE: CVE-2010-1929
Published: 2010-06-28
Description: Multiple stack-based buffer overflows in the jclient._Java_novell_jclient_JClient_defineClass@20 function in jclient.dll in the Tomcat web server in Novell iManager 2.7, 2.7.3, and 2.7.3 FTF2 allow remote authenticated users to execute arbitrary code via the (1) EnteredClassID or (2) NewClassName parameter to nps/servlet/webacc.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/40281; http://securitytracker.com/id?1024152; http://www.coresecurity.com/content/novell-imanager-buffer-overflow-off-by-one-vulnerabilities
CVE: CVE-2010-1930
Published: 2010-06-28
Description: Off-by-one error in Novell iManager 2.7, 2.7.3, and 2.7.3 FTF2 allows remote attackers to cause a denial of service (daemon crash) via a long tree parameter in a login request to nps/servlet/webacc.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/40281; http://securitytracker.com/id?1024152; http://www.coresecurity.com/content/novell-imanager-buffer-overflow-off-by-one-vulnerabilities
CVE: CVE-2010-2228
Published: 2010-06-28
Description: Cross-site scripting (XSS) vulnerability in the MNET access-control interface in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via vectors involving extended characters in a username.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.moodle.org/en/Moodle_1.8.13_release_notes; http://docs.moodle.org/en/Moodle_1.9.9_release_notes; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043285.html
CVE: CVE-2010-2229
Published: 2010-06-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in blog/index.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cvs.moodle.org/moodle/blog/lib.php?r1=1.62.2.9&r2=1.62.2.10; http://cvs.moodle.org/moodle/blog/lib.php?r1=1.80.2.20&r2=1.80.2.21; http://docs.moodle.org/en/Moodle_1.8.13_release_notes
CVE: CVE-2010-2230
Published: 2010-06-28
Description: The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79
References: http://cvs.moodle.org/moodle/lib/weblib.php?r1=1.812.2.114&r2=1.812.2.115; http://cvs.moodle.org/moodle/lib/weblib.php?r1=1.970.2.171&r2=1.970.2.172; http://docs.moodle.org/en/Moodle_1.8.13_release_notes
CVE: CVE-2010-2231
Published: 2010-06-28
Description: Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://cvs.moodle.org/moodle/mod/quiz/report/overview/report.php?r1=1.98.2.50&r2=1.98.2.51; http://docs.moodle.org/en/Moodle_1.8.13_release_notes; http://docs.moodle.org/en/Moodle_1.9.9_release_notes
CVE: CVE-2010-2470
Published: 2010-06-28
Description: Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions within (1) .bzr/ and (2) data/webdot/, which allows local users to obtain potentially sensitive data by reading files in these directories, a different vulnerability than CVE-2010-0180.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: https://bugzilla.mozilla.org/show_bug.cgi?id=561797; https://bugzilla.mozilla.org/show_bug.cgi?id=561797
CVE: CVE-2010-2502
Published: 2010-06-28
Description: Multiple directory traversal vulnerabilities in Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allow (1) remote attackers to read arbitrary files, aka SPL-31194; (2) remote authenticated users to modify arbitrary files, aka SPL-31063; or (3) have an unknown impact via redirects, aka SPL-31067.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.splunk.com/view/SP-CAAAFGD; http://www.splunk.com/view/SP-CAAAFGD
CVE: CVE-2010-2503
Published: 2010-06-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) redirects, aka SPL-31067; (2) unspecified "user->user or user->admin" vectors, aka SPL-31084; or (3) unspecified "user input," aka SPL-31085.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.splunk.com/view/SP-CAAAFGD; http://www.splunk.com/view/SP-CAAAFGD
CVE: CVE-2010-2504
Published: 2010-06-28
Description: Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allows remote authenticated users to obtain sensitive information via HTTP header injection, aka SPL-31066.
CVSS Score: 6.0 (MEDIUM)
References: http://www.splunk.com/view/SP-CAAAFGD; http://www.splunk.com/view/SP-CAAAFGD
CVE: CVE-2010-2505
Published: 2010-06-28
Description: Soft SaschArt SasCAM Webcam Server 2.6.5, 2.7, and earlier allows remote attackers to cause a denial of service (crash) via a large number of requests with a long line, as demonstrated using a long GET request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/40214; http://www.exploit-db.com/exploits/13888; http://www.osvdb.org/65544
CVE: CVE-2010-2506
Published: 2010-06-28
Description: Cross-site scripting (XSS) vulnerability in debug.cgi in Linksys WAP54Gv3 firmware 3.05.03 and 3.04.03 allows remote attackers to inject arbitrary web script or HTML via the data1 parameter.
CVSS Score: 2.9 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/511952/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/59699; http://www.securityfocus.com/archive/1/511952/100/0/threaded
CVE: CVE-2010-2507
Published: 2010-06-28
Description: Directory traversal vulnerability in the Picasa2Gallery (com_picasa2gallery) component 1.2.8 and earlier for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/65674; http://packetstormsecurity.org/1006-exploits/joomlapicasa2gallery-lfi.txt; http://secunia.com/advisories/40297
CVE: CVE-2010-2508
Published: 2010-06-28
Description: SQL injection vulnerability in user-profile.php in 2daybiz Video Community Portal Script allows remote attackers to execute arbitrary SQL commands via the userid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40280; http://www.exploit-db.com/exploits/14018; http://www.securityfocus.com/bid/41114
CVE: CVE-2010-2509
Published: 2010-06-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in 2daybiz Web Template Software allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to category.php and the (2) password parameter to memberlogin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40348; http://www.exploit-db.com/exploits/14020; http://secunia.com/advisories/40348
CVE: CVE-2010-2510
Published: 2010-06-28
Description: SQL injection vulnerability in customize.php in 2daybiz Web Template Software allows remote attackers to execute arbitrary SQL commands via the tid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40348; http://www.exploit-db.com/exploits/14020; http://secunia.com/advisories/40348
CVE: CVE-2010-2511
Published: 2010-06-28
Description: SQL injection vulnerability in viewnews.php in 2daybiz Multi Level Marketing (MLM) Software allows remote attackers to execute arbitrary SQL commands via the nwsid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40340; http://www.exploit-db.com/exploits/14005; http://www.securityfocus.com/bid/41097