deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2297
Published: 2009-07-02
Description: Unspecified vulnerability in the udp subsystem in the kernel in Sun Solaris 10, and OpenSolaris snv_90 through snv_108, when Solaris Trusted Extensions is enabled, allows remote attackers to cause a denial of service (panic) via unspecified vectors involving the crgetlabel function, related to a "TX panic." NOTE: this issue exists because of a regression in earlier kernel patches.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/35579; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141414-02-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-262048-1
CVE: CVE-2009-2298
Published: 2009-07-02
Description: Stack-based buffer overflow in rping in HP OpenView Network Node Manager (OV NNM) 7.53 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a CGI request to webappmon.exe.  NOTE: this may overlap CVE-2009-1420.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=810; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=810
CVE: CVE-2009-2299
Published: 2009-07-02
Description: The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/35645; http://www.h4ck1nb3rg.at/wafs/advisory_artofdefence_hyperguard_200907.txt; http://www.securityfocus.com/archive/1/504680/100/0/threaded
CVE: CVE-2009-2300
Published: 2009-07-02
Description: The management interface in the phion airlock Web Application Firewall (WAF) 4.1-10.41 does not properly handle CGI requests that specify large width and height parameters for an image, which allows remote attackers to execute arbitrary commands or cause a denial of service (resource consumption) via a crafted request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/35641; http://www.securityfocus.com/archive/1/504681/100/0/threaded; https://techzone.phion.com/hotfix_HF4112
CVE: CVE-2009-2301
Published: 2009-07-02
Description: The radware AppWall Web Application Firewall (WAF) 1.0.2.6, with Gateway 4.6.0.2, allows remote attackers to read source code via a direct request to (1) funcs.inc, (2) defines.inc, or (3) msg.inc in Management/.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/504682/100/0/threaded; http://www.securityfocus.com/archive/1/504682/100/0/threaded
CVE: CVE-2009-2302
Published: 2009-07-02
Description: Cross-site scripting (XSS) vulnerability in index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. NOTE: it was later reported that 5.2.1 is also affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41985; http://websec.id3as.com/aardvark-topsites-php-521-security-vulnerabilities-disclosure/; http://www.securityfocus.com/archive/1/504574/100/0/threaded
CVE: CVE-2009-2303
Published: 2009-07-02
Description: index.php in Aardvark Topsites PHP 5.2.1 and earlier allows remote attackers to obtain sensitive information via a negative integer value for the start parameter in a search action, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://websec.id3as.com/aardvark-topsites-php-521-security-vulnerabilities-disclosure/; http://www.securityfocus.com/archive/1/504574/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/51392
CVE: CVE-2009-2304
Published: 2009-07-02
Description: index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to obtain sensitive information via a nonexistent account name in the u parameter in a rate action, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://websec.id3as.com/aardvark-topsites-php-521-security-vulnerabilities-disclosure/; http://www.securityfocus.com/archive/1/504574/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/51392
CVE: CVE-2009-2305
Published: 2009-07-02
Description: The ARD-9808 DVR card security camera allows remote attackers to cause a denial of service via a long URI composed of //.\ (slash slash dot backslash) sequences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/35671; http://www.exploit-db.com/exploits/9067; http://secunia.com/advisories/35671
CVE: CVE-2009-2306
Published: 2009-07-02
Description: The ARD-9808 DVR card security camera stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing usernames and passwords via a direct request for dvr.ini.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/35671; http://www.exploit-db.com/exploits/9066; http://secunia.com/advisories/35671
CVE: CVE-2009-2307
Published: 2009-07-02
Description: SQL injection vulnerability in the CWGuestBook module 2.1 and earlier for MAXdev MDPro (aka MD-Pro) allows remote attackers to execute arbitrary SQL commands via the rid parameter in a viewrecords action to modules.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9056; https://exchange.xforce.ibmcloud.com/vulnerabilities/51478; http://www.exploit-db.com/exploits/9056
CVE: CVE-2009-2308
Published: 2009-07-02
Description: Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt; http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt; http://secunia.com/advisories/35654
CVE: CVE-2009-2309
Published: 2009-07-02
Description: SQL injection vulnerability in index.php in Codice CMS 2 allows remote attackers to execute arbitrary SQL commands via the tag parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8272; http://www.securityfocus.com/bid/34208; http://www.exploit-db.com/exploits/8272
CVE: CVE-2009-2310
Published: 2009-07-02
Description: SQL injection vulnerability in include/get_read.php in Extensible-BioLawCom CMS (X-BLC) 0.2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8258; http://www.securityfocus.com/bid/34197; https://exchange.xforce.ibmcloud.com/vulnerabilities/49352
CVE: CVE-2009-2311
Published: 2009-07-02
Description: SQL injection vulnerability in the rGallery plugin 1.2.3 for WoltLab Burning Board (WBB3) allows remote attackers to execute arbitrary SQL commands via the userID parameter in the RGalleryUserGallery page to index.php, a different vector than CVE-2008-4627.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8254; http://www.securityfocus.com/bid/34194; https://exchange.xforce.ibmcloud.com/vulnerabilities/49351
CVE: CVE-2009-2312
Published: 2009-07-02
Description: SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in config.txt and uses insecure permissions for this file, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0314.html; http://secunia.com/advisories/34390; https://exchange.xforce.ibmcloud.com/vulnerabilities/49338
CVE: CVE-2009-2313
Published: 2009-07-02
Description: Directory traversal vulnerability in index.php in Jinzora Media Jukebox 2.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/8278; http://www.exploit-db.com/exploits/8278
CVE: CVE-2007-6727
Published: 2009-07-05
Description: SQL injection vulnerability in topic.php in KerviNet Forum 1.1 allows remote attackers to execute arbitrary SQL commands via the forum parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forum.antichat.ru/showpost.php?p=340740; http://forum.antichat.ru/showpost.php?p=340740
CVE: CVE-2007-6728
Published: 2009-07-05
Description: Cross-site scripting (XSS) vulnerability in XMB 1.5 allows remote attackers to inject arbitrary web script or HTML via the MSN field during user registration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.antichat.ru/showpost.php?p=340740; https://docs.xmbforum2.com/index.php?title=Security_Issue_History; http://forum.antichat.ru/showpost.php?p=340740
CVE: CVE-2009-0904
Published: 2009-07-05
Description: The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly process XML encoding, which allows remote attackers to bypass intended access restrictions and possibly modify data via "XML fuzzing attacks" sent through SOAP requests.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg27007951; http://www-1.ibm.com/support/docview.wss?uid=swg1PK84015; http://www.securityfocus.com/bid/35741
CVE: CVE-2009-1388
Published: 2009-07-05
Description: The ptrace_start function in kernel/ptrace.c in the Linux kernel 2.6.18 does not properly handle simultaneous execution of the do_coredump function, which allows local users to cause a denial of service (deadlock) via vectors involving the ptrace system call and a coredumping thread.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]9434&w=2; http://osvdb.org/55679; http://secunia.com/advisories/36131
CVE: CVE-2009-1648
Published: 2009-07-05
Description: The YaST2 LDAP module in yast2-ldap-server on SUSE Linux Enterprise Server 11 (aka SLE11) does not enable the firewall in certain circumstances involving reboots during online updates, which makes it easier for remote attackers to access network services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/35685; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
CVE: CVE-2009-1890
Published: 2009-07-05
Description: The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
CVSS Score: 7.1 (HIGH)
CWE: CWE-400
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2998&w=2
CVE: CVE-2009-2265
Published: 2009-07-05
Description: Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://isc.sans.org/diary.html?storyid=6724; http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html; http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html
CVE: CVE-2009-2294
Published: 2009-07-05
Description: Integer overflow in the Png_datainfo_callback function in Dillo 2.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG image with crafted (1) width or (2) height values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://osvdb.org/55656; http://secunia.com/advisories/35647; http://www.ocert.org/advisories/ocert-2009-008.html
CVE: CVE-2009-2295
Published: 2009-07-05
Description: Multiple integer overflows in CamlImages 2.2 and earlier might allow context-dependent attackers to execute arbitrary code via a crafted PNG image with large width and height values that trigger a heap-based buffer overflow in the (1) read_png_file or (2) read_png_file_as_rgb24 function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/35819; http://www.debian.org/security/2009/dsa-1832; http://www.ocert.org/advisories/ocert-2009-009.html
CVE: CVE-2009-2314
Published: 2009-07-05
Description: Race condition in the Sun Lightweight Availability Collection Tool 3.0 on Solaris 7 through 10 allows local users to overwrite arbitrary files via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-362
References: http://osvdb.org/55559; http://secunia.com/advisories/35707; http://sunsolve.sun.com/search/document.do?assetkey=1-66-261408-1
CVE: CVE-2009-2315
Published: 2009-07-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-2204.  Reason: This candidate is a duplicate of CVE-2009-2204.  Notes: All CVE users should reference CVE-2009-2204 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-2316
Published: 2009-07-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0 allow remote attackers to inject arbitrary web script or HTML by entering an unspecified URL in (1) the self-service UI interface or (2) the console interface. NOTE: it was later reported that 4.6.0 is also affected by the first vector.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55550; http://osvdb.org/55551; http://secunia.com/advisories/35696
CVE: CVE-2009-2317
Published: 2009-07-05
Description: The Axesstel MV 410R has a certain default administrator password, and does not force a password change, which makes it easier for remote attackers to obtain access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://osvdb.org/55680; http://www.securityfocus.com/archive/1/504716/100/0/threaded; http://www.securityfocus.com/bid/35563
CVE: CVE-2009-2318
Published: 2009-07-05
Description: The Axesstel MV 410R allows remote attackers to cause a denial of service via a flood of SYN packets, a related issue to CVE-1999-0116.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/504716/100/0/threaded; http://www.securityfocus.com/bid/35563; http://www.securityfocus.com/archive/1/504716/100/0/threaded
CVE: CVE-2009-2319
Published: 2009-07-05
Description: The default configuration of the Wi-Fi component on the Axesstel MV 410R does not use encryption, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/archive/1/504716/100/0/threaded; http://www.securityfocus.com/bid/35563; http://www.securityfocus.com/archive/1/504716/100/0/threaded
CVE: CVE-2009-2320
Published: 2009-07-05
Description: The web interface on the Axesstel MV 410R relies on client-side JavaScript code to validate input, which allows remote attackers to send crafted data, and possibly have unspecified other impact, via a client that does not process JavaScript.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/504716/100/0/threaded; http://www.securityfocus.com/bid/35563; http://www.securityfocus.com/archive/1/504716/100/0/threaded
CVE: CVE-2009-2321
Published: 2009-07-05
Description: cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to cause a denial of service (configuration reset) via a RESTORE=RESTORE query string.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/55681; http://www.securityfocus.com/archive/1/504716/100/0/threaded; http://www.securityfocus.com/bid/35563
CVE: CVE-2009-2322
Published: 2009-07-05
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/504716/100/0/threaded; http://www.securityfocus.com/bid/35563; http://www.securityfocus.com/archive/1/504716/100/0/threaded
CVE: CVE-2009-2323
Published: 2009-07-05
Description: The web interface on the Axesstel MV 410R redirects users back to the referring page after execution of some CGI scripts, which makes it easier for remote attackers to avoid detection of cross-site request forgery (CSRF) attacks, as demonstrated by a redirect from the cgi-bin/wireless.cgi script.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/archive/1/504716/100/0/threaded; http://www.securityfocus.com/bid/35563; http://www.securityfocus.com/archive/1/504716/100/0/threaded
CVE: CVE-2009-2324
Published: 2009-07-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inject arbitrary web script or HTML via components in the samples (aka _samples) directory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.ocert.org/advisories/ocert-2009-007.html; http://www.securityfocus.com/archive/1/504721/100/0/threaded; http://www.securitytracker.com/id?1022513
CVE: CVE-2009-2325
Published: 2009-07-05
Description: Directory traversal vulnerability in index.php in Clicknet CMS 2.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the side parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/35607; http://www.exploit-db.com/exploits/9037; http://www.osvdb.org/55484
CVE: CVE-2009-2326
Published: 2009-07-05
Description: Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) an enter_parol cookie to index.php in an auto action or (2) the topic parameter to message.php.  NOTE: vector 2 can be leveraged for a cross-site scripting (XSS) attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55693; http://www.exploit-db.com/exploits/9068; http://osvdb.org/55693
CVE: CVE-2009-2327
Published: 2009-07-05
Description: Cross-site scripting (XSS) vulnerability in add_voting.php in KerviNet Forum 1.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the v_variant1 parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/55676; http://osvdb.org/55695; http://www.exploit-db.com/exploits/9068
CVE: CVE-2009-2328
Published: 2009-07-05
Description: admin/edit_user.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the del_user_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.exploit-db.com/exploits/9068; http://www.exploit-db.com/exploits/9068
CVE: CVE-2009-2329
Published: 2009-07-05
Description: KerviNet Forum 1.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) admin/head.php, or (2) voting_diagram.php, (3) voting.php, (4) topics_search.php, (5) topics_list.php, (6) top_part.php, (7) quick_search.php, (8) quick_reply.php, (9) moder_menu.php, (10) messages_list.php, (11) menu.php, (12) head.php, (13) forums_list.php, (14) forum_statistics.php, (15) forum_info.php, or (16) birthday.php in include_files/, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.exploit-db.com/exploits/9068; http://www.exploit-db.com/exploits/9068
CVE: CVE-2009-2330
Published: 2009-07-05
Description: Cross-site scripting (XSS) vulnerability in admin/admin_menu.php in CMS Chainuk 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the menu parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55674; http://www.exploit-db.com/exploits/9069; http://osvdb.org/55674
CVE: CVE-2009-2331
Published: 2009-07-05
Description: Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inject arbitrary PHP code (1) into settings.php via the menu parameter to admin_settings.php or (2) into a content/=NUMBER.php file via the title parameter to admin_new.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/55672; http://osvdb.org/55673; http://www.exploit-db.com/exploits/9069
CVE: CVE-2009-2332
Published: 2009-07-05
Description: CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to index.php or (2) a nonexistent folder name in the id parameter to admin/admin_delete.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/55670; http://osvdb.org/55671; http://www.exploit-db.com/exploits/9069
CVE: CVE-2009-2333
Published: 2009-07-05
Description: Multiple directory traversal vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the menu parameter to admin/admin_menu.php, and the id parameter to (2) index.php and (3) admin/admin_edit.php; and (4) delete arbitrary local files via a .. (dot dot) in the id parameter to admin/admin_delete.php.  NOTE: vector 2 can be leveraged for static code injection by sending a crafted menu parameter to admin/admin_menu.php, and then sending an id=../menu.csv request to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/55666; http://osvdb.org/55667; http://osvdb.org/55668
CVE: CVE-2008-6848
Published: 2009-07-07
Description: Cross-site scripting (XSS) vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to inject arbitrary web script or HTML via the category parameter in a select action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/50989; http://secunia.com/advisories/33304; http://www.securityfocus.com/bid/33001
CVE: CVE-2008-6849
Published: 2009-07-07
Description: Unrestricted file upload vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a via a link that is listed by userfiles/number_shell.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/50988; http://secunia.com/advisories/33304; http://www.securityfocus.com/bid/32995
CVE: CVE-2008-6850
Published: 2009-07-07
Description: Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51053; http://secunia.com/advisories/33295; http://www.php-fusion.co.uk/news.php?readmore=443
CVE: CVE-2008-6851
Published: 2009-07-07
Description: SQL injection vulnerability in page.php in PHP Link Directory (phpLD) 3.3, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the name parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32989; https://exchange.xforce.ibmcloud.com/vulnerabilities/47580; https://www.exploit-db.com/exploits/7558
CVE: CVE-2008-6852
Published: 2009-07-07
Description: SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33008; https://exchange.xforce.ibmcloud.com/vulnerabilities/47604; https://www.exploit-db.com/exploits/7572