deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0257
Published: 2008-01-15
Description: Cross-site scripting (XSS) vulnerability in search.pl in Dansie Search Engine 2.7 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28465; http://www.securityfocus.com/bid/27269; https://exchange.xforce.ibmcloud.com/vulnerabilities/39636
CVE: CVE-2008-0258
Published: 2008-01-15
Description: Cross-site scripting (XSS) vulnerability in index.php in PHP Running Management (phpRunMan) before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28474; http://sourceforge.net/project/shownotes.php?release_id=568237&group_id=103505; http://sourceforge.net/tracker/index.php?func=detail&aid=1204199&group_id=103505&atid=634992
CVE: CVE-2008-0259
Published: 2008-01-15
Description: Multiple directory traversal vulnerabilities in _mg/php/mg_thumbs.php in minimal Gallery 0.8 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) thumbcat and (2) thumb parameters.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/28391; http://www.securityfocus.com/bid/27265; https://exchange.xforce.ibmcloud.com/vulnerabilities/39649
CVE: CVE-2008-0260
Published: 2008-01-15
Description: minimal Gallery 0.8 allows remote attackers to obtain configuration information via a direct request to php_info.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/28391; https://www.exploit-db.com/exploits/4902; http://secunia.com/advisories/28391
CVE: CVE-2008-0261
Published: 2008-01-15
Description: Unspecified vulnerability in the search component and module in Mambo 4.5.x and 4.6.x allows remote attackers to cause a denial of service (query flood) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://forum.mambo-foundation.org/showthread.php?t=9651; http://secunia.com/advisories/28392; http://www.securityfocus.com/bid/27239
CVE: CVE-2008-0262
Published: 2008-01-15
Description: SQL injection vulnerability in includes/articleblock.php in Agares PhpAutoVideo 2.21 allows remote attackers to execute arbitrary SQL commands via the articlecat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27258; https://exchange.xforce.ibmcloud.com/vulnerabilities/39641; https://www.exploit-db.com/exploits/4898
CVE: CVE-2008-0263
Published: 2008-01-15
Description: The SIP module in Ingate Firewall before 4.6.1 and SIParator before 4.6.1 does not reuse SIP media ports in unspecified call hold and send-only stream scenarios, which allows remote attackers to cause a denial of service (port exhaustion) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://osvdb.org/40365; http://secunia.com/advisories/28394; http://www.ingate.com/relnote-461.php
CVE: CVE-2008-0264
Published: 2008-01-15
Description: Unspecified vulnerability in the Meta Tags (aka Nodewords) 5.x-1.6 module for Drupal, when images are permitted in node bodies, allows remote authenticated users to execute arbitrary code via unspecified vectors involving creation of a node.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/209759; http://secunia.com/advisories/28478; http://www.vupen.com/english/advisories/2008/0129
CVE: CVE-2008-0265
Published: 2008-01-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Search function in the web management interface in F5 BIG-IP 9.4.3 allow remote attackers to inject arbitrary web script or HTML via the SearchString parameter to (1) list_system.jsp, (2) list_pktfilter.jsp, (3) list_ltm.jsp, (4) resources_audit.jsp, and (5) list_asm.jsp in tmui/Control/jspmap/tmui/system/log/; and (6) list.jsp in certain directories.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28505; http://securityreason.com/securityalert/3545; http://www.securityfocus.com/archive/1/486217/100/0/threaded
CVE: CVE-2008-0266
Published: 2008-01-15
Description: Cross-site request forgery (CSRF) vulnerability in admin.php in eTicket 1.5.5.2 allows remote attackers to change the administrative password and possibly perform other administrative tasks.  NOTE: either the old password must be known, or the attacker must leverage a separate SQL injection vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-352
References: http://secunia.com/advisories/28331; http://securityreason.com/securityalert/3542; http://www.securityfocus.com/archive/1/485835/100/0/threaded
CVE: CVE-2008-0267
Published: 2008-01-15
Description: Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) status, (2) sort, and (3) way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the (4) msg and (5) password parameters to admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28331; http://securityreason.com/securityalert/3542; http://www.securityfocus.com/archive/1/485835/100/0/threaded
CVE: CVE-2008-0268
Published: 2008-01-15
Description: Cross-site scripting (XSS) vulnerability in view.php in eTicket 1.5.5.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28331; http://securityreason.com/securityalert/3542; http://www.securityfocus.com/archive/1/485835/100/0/threaded
CVE: CVE-2008-0269
Published: 2008-01-15
Description: Unspecified vulnerability in the dotoprocs function in Sun Solaris 10 allows local users to cause a denial of service (panic) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/28491; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103188-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-201513-1
CVE: CVE-2008-0270
Published: 2008-01-15
Description: SQL injection vulnerability in index.php in TaskFreak! 0.6.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sContext parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28448; http://www.securityfocus.com/bid/27257; https://exchange.xforce.ibmcloud.com/vulnerabilities/39645
CVE: CVE-2008-0271
Published: 2008-01-15
Description: The editor deletion form in BUEditor 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.1, a module for Drupal, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete custom editor interfaces.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/208534; http://secunia.com/advisories/28418; http://www.vupen.com/english/advisories/2008/0128
CVE: CVE-2008-0272
Published: 2008-01-15
Description: Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/208562; http://secunia.com/advisories/28422; http://secunia.com/advisories/28486
CVE: CVE-2008-0273
Published: 2008-01-15
Description: Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but are processed as UTF-8 by Internet Explorer, effectively removing characters from the document and defeating the HTML protection mechanism.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/208564; http://secunia.com/advisories/28422; http://secunia.com/advisories/28486
CVE: CVE-2008-0274
Published: 2008-01-15
Description: Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/208565; http://secunia.com/advisories/28422; http://secunia.com/advisories/28486
CVE: CVE-2008-0275
Published: 2008-01-15
Description: The Atom 4.7 before 4.7.x-1.0 and 5.x before 5.x-1.0 module for Drupal does not properly manage permissions for node (1) titles, (2) teasers, and (3) bodies, which might allow remote attackers to gain access to syndicated content.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/208527; https://exchange.xforce.ibmcloud.com/vulnerabilities/39607; http://drupal.org/node/208527
CVE: CVE-2008-0276
Published: 2008-01-15
Description: Cross-site scripting (XSS) vulnerability in the Devel module before 5.x-0.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via a site variable, related to lack of escaping of the variable table.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/208524; https://exchange.xforce.ibmcloud.com/vulnerabilities/39606; http://drupal.org/node/208524
CVE: CVE-2008-0277
Published: 2008-01-15
Description: Unspecified vulnerability in the Fileshare module for Drupal allows remote authenticated users with node-creation privileges to execute arbitrary code via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://drupal.org/node/208537; https://exchange.xforce.ibmcloud.com/vulnerabilities/39609; http://drupal.org/node/208537
CVE: CVE-2008-0278
Published: 2008-01-15
Description: SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a sm_window action.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28503; http://www.securityfocus.com/bid/27277; https://exchange.xforce.ibmcloud.com/vulnerabilities/39656
CVE: CVE-2008-0279
Published: 2008-01-15
Description: SQL injection vulnerability in liretopic.php in Xforum 1.4 and possibly others allows remote attackers to execute arbitrary SQL commands via the topic parameter.  NOTE: the categorie parameter might also be affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27278; https://exchange.xforce.ibmcloud.com/vulnerabilities/39654; https://www.exploit-db.com/exploits/4908
CVE: CVE-2008-0280
Published: 2008-01-15
Description: SQL injection vulnerability in index.php in MTCMS 2.0 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via the (1) a or (2) cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28428; http://securityreason.com/securityalert/3544; http://www.securityfocus.com/archive/1/486090/100/0/threaded
CVE: CVE-2008-0281
Published: 2008-01-15
Description: SQL injection vulnerability in liste.php in ID-Commerce 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idFamille parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059533.html; http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059537.html; http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059538.html
CVE: CVE-2008-0282
Published: 2008-01-15
Description: SQL injection vulnerability in welcome/inscription.php in DomPHP 0.81 and earlier allows remote attackers to execute arbitrary SQL commands via the mail parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28393; http://www.securityfocus.com/bid/27212; https://exchange.xforce.ibmcloud.com/vulnerabilities/39593
CVE: CVE-2008-0283
Published: 2008-01-15
Description: PHP remote file inclusion vulnerability in /aides/index.php in DomPHP 0.81 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/27226; https://www.exploit-db.com/exploits/4883; http://www.securityfocus.com/bid/27226
CVE: CVE-2008-0284
Published: 2008-01-15
Description: Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) Itemid or (2) topic arguments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3540; http://www.securityfocus.com/archive/1/486074/100/0/threaded; http://www.securityfocus.com/bid/27218
CVE: CVE-2008-0285
Published: 2008-01-16
Description: ngIRCd 0.10.x before 0.10.4 and 0.11.0 before 0.11.0-pre2 allows remote attackers to cause a denial of service (crash) via crafted IRC PART message, which triggers an invalid dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://arthur.barton.de/cgi-bin/viewcvs.cgi/ngircd/ngircd/src/ngircd/irc-channel.c?r1=1.40&r2=1.41&diff_format=h; http://bugs.gentoo.org/show_bug.cgi?id=204834; http://ngircd.barton.de/doc/ChangeLog
CVE: CVE-2008-0286
Published: 2008-01-16
Description: SQL injection vulnerability in admin/login.php in Article Dashboard allows remote attackers to execute arbitrary SQL commands via the (1) user or (2) password fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28495; http://securityreason.com/securityalert/3546; http://www.securityfocus.com/archive/1/486323/100/0/threaded
CVE: CVE-2008-0031
Published: 2008-01-16
Description: Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted Sorenson 3 video file, which triggers memory corruption.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-399
References: http://docs.info.apple.com/article.html?artnum=307301; http://lists.apple.com/archives/security-announce/2008/Jan/msg00001.html; http://secunia.com/advisories/28502
CVE: CVE-2008-0034
Published: 2008-01-16
Description: Unspecified vulnerability in Passcode Lock in Apple iPhone 1.0 through 1.1.2 allows users with physical access to execute applications without entering the passcode via vectors related to emergency calls.
CVSS Score: 4.6 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=307302; http://lists.apple.com/archives/security-announce/2008/Jan/msg00000.html; http://secunia.com/advisories/28497
CVE: CVE-2008-0035
Published: 2008-01-16
Description: Unspecified vulnerability in Foundation, as used in Apple iPhone 1.0 through 1.1.2, iPod touch 1.1 through 1.1.2, and Mac OS X 10.5 through 10.5.1, allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted URL that triggers memory corruption in Safari.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://docs.info.apple.com/article.html?artnum=307302; http://docs.info.apple.com/article.html?artnum=307430; http://lists.apple.com/archives/security-announce/2008/Feb/msg00002.html
CVE: CVE-2008-0122
Published: 2008-01-16
Description: Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html; http://secunia.com/advisories/28367; http://secunia.com/advisories/28429
CVE: CVE-2008-0216
Published: 2008-01-16
Description: The ptsname function in FreeBSD 6.0 through 7.0-PRERELEASE does not properly verify that a certain portion of a device name is associated with a pty of a user who is calling the pt_chown function, which might allow local users to read data from the pty from another user.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/28498; http://security.FreeBSD.org/advisories/FreeBSD-SA-08:01.pty.asc; http://www.securityfocus.com/bid/27284
CVE: CVE-2008-0217
Published: 2008-01-16
Description: The script program in FreeBSD 5.0 through 7.0-PRERELEASE invokes openpty, which creates a pseudo-terminal with world-readable and world-writable permissions when it is not run as root, which allows local users to read data from the terminal of the user running script.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28498; http://security.FreeBSD.org/advisories/FreeBSD-SA-08:01.pty.asc; http://www.securityfocus.com/bid/27284
CVE: CVE-2008-0287
Published: 2008-01-16
Description: PHP remote file inclusion vulnerability in VisionBurst vcart 3.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter to (1) index.php and (2) checkout.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/28424; http://www.securityfocus.com/bid/27231; https://exchange.xforce.ibmcloud.com/vulnerabilities/39616
CVE: CVE-2008-0288
Published: 2008-01-16
Description: Multiple SQL injection vulnerabilities in ImageAlbum 2.0.0b2 allow remote attackers to execute arbitrary SQL commands via the id, which is not properly handled in (1) classes/IADomain.php, (2) classes/IACollection.php, and (3) classes/IAUser.php, as demonstrated via the id parameter in a collection.imageview action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3548; http://www.securityfocus.com/archive/1/486162/100/0/threaded; http://www.securityfocus.com/bid/27240
CVE: CVE-2008-0289
Published: 2008-01-16
Description: PHP remote file inclusion vulnerability in view_func.php in Member Area System (MAS) 1.7 and possibly others allows remote attackers to execute arbitrary PHP code via a URL in the i parameter.  NOTE: a second vector might exist via the l parameter.  NOTE: as of 20080118, the vendor has disputed the set of affected versions, stating that the issue "is already fixed, for almost a year."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://securityreason.com/securityalert/3547; http://www.securityfocus.com/archive/1/486172/100/0/threaded; http://www.securityfocus.com/archive/1/486618/100/0/threaded
CVE: CVE-2008-0290
Published: 2008-01-16
Description: Multiple SQL injection vulnerabilities in Digital Hive 2.0 RC2 and earlier allow (1) remote attackers to execute arbitrary SQL commands via the selectskin parameter to an unspecified program, or (2) remote authenticated administrators to execute arbitrary SQL commands via the user_id parameter in the gestion_membre.php page to base.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27232; https://exchange.xforce.ibmcloud.com/vulnerabilities/39602; https://www.exploit-db.com/exploits/4887
CVE: CVE-2007-5655
Published: 2008-01-16
Description: TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing values that are used as pointers.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=639; http://secunia.com/advisories/28490; http://securitytracker.com/id?1019193
CVE: CVE-2007-5656
Published: 2008-01-16
Description: TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted requests that control loop operations related to memory.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=641; http://secunia.com/advisories/28490; http://securitytracker.com/id?1019193
CVE: CVE-2007-5657
Published: 2008-01-16
Description: TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing values that are used as pointer offsets.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=640; http://secunia.com/advisories/28490; http://securitytracker.com/id?1019193
CVE: CVE-2007-5658
Published: 2008-01-16
Description: Heap-based buffer overflow in TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing size and copy-length values that trigger the overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=638; http://secunia.com/advisories/28490; http://securitytracker.com/id?1019193
CVE: CVE-2008-0032
Published: 2008-01-16
Description: Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a movie file containing a Macintosh Resource record with a modified length value in the resource header, which triggers heap corruption.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-399
References: http://docs.info.apple.com/article.html?artnum=307301; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=642; http://lists.apple.com/archives/security-announce/2008/Jan/msg00001.html
CVE: CVE-2008-0033
Published: 2008-01-16
Description: Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a movie file with Image Descriptor (IDSC) atoms containing an invalid atom size, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://docs.info.apple.com/article.html?artnum=307301; http://dvlabs.tippingpoint.com/advisory/TPTI-08-01; http://lists.apple.com/archives/security-announce/2008/Jan/msg00001.html
CVE: CVE-2008-0036
Published: 2008-01-16
Description: Buffer overflow in Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a crafted compressed PICT image, which triggers the overflow during decoding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307301; http://lists.apple.com/archives/security-announce/2008//Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2008/Jan/msg00001.html
CVE: CVE-2008-0291
Published: 2008-01-16
Description: SQL injection vulnerability in showproduct.asp in RichStrong CMS allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28449; http://www.securityfocus.com/archive/1/486402/100/0/threaded; http://www.securityfocus.com/bid/27281
CVE: CVE-2008-0292
Published: 2008-01-16
Description: Cross-site scripting (XSS) vulnerability in photo_album.pl in Dansie Photo Album 1.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28501; https://exchange.xforce.ibmcloud.com/vulnerabilities/39664; http://secunia.com/advisories/28501
CVE: CVE-2008-0293
Published: 2008-01-16
Description: Unspecified vulnerability in cron.php in FreeSeat before 1.1.5d, when format.php has certain modifications, allows remote attackers to bypass authentication and gain privileges via unspecified vectors related to the show_foot function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/28459; http://sourceforge.net/project/shownotes.php?group_id=160239&release_id=568374; https://exchange.xforce.ibmcloud.com/vulnerabilities/39648