deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0886
Published: 2009-03-12
Description: Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the default_language parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/34029; https://exchange.xforce.ibmcloud.com/vulnerabilities/49114; https://www.exploit-db.com/exploits/8168
CVE: CVE-2009-0887
Published: 2009-03-12
Description: Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-189
References: http://openwall.com/lists/oss-security/2009/03/05/1; http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?r1=1.9&amp%3Br2=1.10&amp%3Bview=patch; http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?view=log
CVE: CVE-2008-6451
Published: 2009-03-13
Description: SQL injection vulnerability in humor.php in jPORTAL 2 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: this might overlap CVE-2004-2036 or CVE-2005-3509.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31274; https://www.exploit-db.com/exploits/6505; http://www.securityfocus.com/bid/31274
CVE: CVE-2008-6452
Published: 2009-03-13
Description: SQL injection vulnerability in show_vote.php in Oceandir 2.9 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31277; https://www.exploit-db.com/exploits/6504; http://www.securityfocus.com/bid/31277
CVE: CVE-2008-6453
Published: 2009-03-13
Description: Directory traversal vulnerability in section.php in 6rbScript 3.3, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/48508; http://secunia.com/advisories/31945; http://www.securityfocus.com/bid/31299
CVE: CVE-2008-6454
Published: 2009-03-13
Description: SQL injection vulnerability in section.php in 6rbScript 3.3 allows remote attackers to execute arbitrary SQL commands via the singerid parameter in a singers action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48509; http://secunia.com/advisories/31945; http://www.securityfocus.com/bid/31282
CVE: CVE-2008-6455
Published: 2009-03-13
Description: Session fixation vulnerability in Edikon phpShop 0.8.1 allows remote attackers to hijack web sessions via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/48231; http://secunia.com/advisories/31948; http://www.securityfocus.com/bid/31251
CVE: CVE-2008-6456
Published: 2009-03-13
Description: SQL injection vulnerability in the HBook (h_book) extension 2.3.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48276; http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/; http://www.securityfocus.com/bid/31261
CVE: CVE-2008-6457
Published: 2009-03-13
Description: SQL injection vulnerability in the Swigmore institute (cgswigmore) extension before 0.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48273; http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/; http://www.securityfocus.com/bid/31258
CVE: CVE-2008-6458
Published: 2009-03-13
Description: SQL injection vulnerability in the FE address edit for tt_address & direct mail (dmaddredit) extension 0.4.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48274; http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/; http://www.securityfocus.com/bid/31259
CVE: CVE-2008-6459
Published: 2009-03-13
Description: SQL injection vulnerability in the auto BE User Registration (autobeuser) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48272; http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/; http://www.securityfocus.com/bid/31239
CVE: CVE-2008-6460
Published: 2009-03-13
Description: SQL injection vulnerability in the Simple Random Objects (mw_random_objects) extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48277; http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/; http://www.securityfocus.com/bid/31254
CVE: CVE-2008-6461
Published: 2009-03-13
Description: SQL injection vulnerability in the Random Prayer 2 (ste_prayer2) extension before 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48280; http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/; http://www.securityfocus.com/bid/31264
CVE: CVE-2008-6462
Published: 2009-03-13
Description: SQL injection vulnerability in the My quiz and poll (myquizpoll) extension before 0.1.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48278; http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/; http://www.securityfocus.com/bid/31257
CVE: CVE-2008-6463
Published: 2009-03-13
Description: SQL injection vulnerability in the Diocese of Portsmouth Church Search (pd_churchsearch) extension before 0.1.1, and 0.2.10 and earlier 0.2.x versions, an extension for TYPO3, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48279; http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/; http://www.securityfocus.com/bid/31260
CVE: CVE-2008-6464
Published: 2009-03-13
Description: SQL injection vulnerability in event.php in Mevin Productions Basic PHP Events Lister 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48499; http://secunia.com/advisories/31779; http://www.securityfocus.com/bid/31278
CVE: CVE-2008-6465
Published: 2009-03-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the (1) err, (2) errorcode, and (3) login parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/48232; http://secunia.com/advisories/31830; http://www.securityfocus.com/bid/31256
CVE: CVE-2008-6466
Published: 2009-03-13
Description: SQL injection vulnerability in image_gallery.php in the Akira Powered Image Gallery (image_gallery) plugin 0.9.6.2 for e107 allows remote attackers to execute arbitrary SQL commands via the image parameter in an image-detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34384; http://www.securityfocus.com/bid/31286; https://www.exploit-db.com/exploits/6516
CVE: CVE-2008-6467
Published: 2009-03-13
Description: SQL injection vulnerability in jobs/jobseekers/job-info.php in Diesel Job Site allows remote attackers to execute arbitrary SQL commands via the job_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31284; https://www.exploit-db.com/exploits/6512; http://www.securityfocus.com/bid/31284
CVE: CVE-2008-6468
Published: 2009-03-13
Description: SQL injection vulnerability in index.php in Diesel Pay allows remote attackers to execute arbitrary SQL commands via the area parameter in a browse action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31276; https://www.exploit-db.com/exploits/6502; http://www.securityfocus.com/bid/31276
CVE: CVE-2008-6469
Published: 2009-03-13
Description: SQL injection vulnerability in index.php in PlainCart 1.1.2 allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48436; http://secunia.com/advisories/31952; http://www.securityfocus.com/bid/31275
CVE: CVE-2008-6470
Published: 2009-03-13
Description: Multiple unspecified vulnerabilities in ClanSphere before 2008.2.1 allow remote attackers to obtain sensitive information, and possibly have unknown other impact, via vectors related to "javascript insert" and the (1) mods/messages/getusers.php and (2) mods/abcode/listimg.php files.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/48451; http://secunia.com/advisories/31965; http://sourceforge.net/project/shownotes.php?release_id=627530
CVE: CVE-2008-6471
Published: 2009-03-13
Description: SQL injection vulnerability in detail.php in MountainGrafix easyLink 1.1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter in a show action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/48395; http://secunia.com/advisories/31957; https://www.exploit-db.com/exploits/6494
CVE: CVE-2008-4316
Published: 2009-03-14
Description: Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00014.html; http://lists.vmware.com/pipermail/security-announce/2010/000082.html; http://ocert.org/patches/2008-015/glib-CVE-2008-4316.diff
CVE: CVE-2008-6472
Published: 2009-03-14
Description: The WLCCP dissector in Wireshark 0.99.7 through 1.0.4 allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32840; http://secunia.com/advisories/34144; http://www.mandriva.com/security/advisories?name=MDVSA-2008:242
CVE: CVE-2009-0016
Published: 2009-03-14
Description: Apple iTunes before 8.1 on Windows allows remote attackers to cause a denial of service (infinite loop) via a Digital Audio Access Protocol (DAAP) message with a crafted Content-Length header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0236.html; http://lists.apple.com/archives/security-announce//2009/Mar/msg00001.html; http://osvdb.org/52578
CVE: CVE-2009-0143
Published: 2009-03-14
Description: Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscribing to a crafted podcast.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce//2009/Mar/msg00001.html; http://osvdb.org/52579; http://secunia.com/advisories/34254
CVE: CVE-2009-0582
Published: 2009-03-14
Description: The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html; http://mail.gnome.org/archives/release-team/2009-March/msg00096.html; http://osvdb.org/52673
CVE: CVE-2009-0585
Published: 2009-03-14
Description: Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html; http://ocert.org/patches/2008-015/libsoup-CVE-2009-0585.diff; http://openwall.com/lists/oss-security/2009/03/12/2
CVE: CVE-2009-0586
Published: 2009-03-14
Description: Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://cgit.freedesktop.org/gstreamer/gst-plugins-base/commit/?id=566583e87147f774e7fc4c78b5f7e61d427e40a9; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html; http://ocert.org/patches/2008-015/gst-plugins-base-CVE-2009-0586.diff
CVE: CVE-2009-0587
Published: 2009-03-14
Description: Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html; http://ocert.org/patches/2008-015/camel-CVE-2009-0587.diff; http://ocert.org/patches/2008-015/evc-CVE-2009-0587.diff
CVE: CVE-2009-0824
Published: 2009-03-14
Description: Elaborate Bytes ElbyCDIO.sys 6.0.2.0 and earlier, as distributed in SlySoft AnyDVD before 6.5.2.6, Virtual CloneDrive 5.4.2.3 and earlier, CloneDVD 2.9.2.0 and earlier, and CloneCD 5.3.1.3 and earlier, uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to cause a denial of service (system crash) via a crafted IOCTL call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://en.securitylab.ru/lab/PT-2009-11; http://osvdb.org/52679; http://secunia.com/advisories/34269
CVE: CVE-2008-6473
Published: 2009-03-16
Description: _blogadata/include/init_pass2.php in Blogator-script 0.95 allows remote attackers to change the password for arbitrary users via a modified "a" parameter with a "%" wildcard symbol in the b parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-255
References: http://osvdb.org/51227; http://www.securityfocus.com/archive/1/490501/100/0/threaded; https://www.exploit-db.com/exploits/5370
CVE: CVE-2008-6474
Published: 2009-03-16
Description: The management interface in F5 BIG-IP 9.4.3 allows remote authenticated users with Resource Manager privileges to inject arbitrary Perl code via unspecified configuration settings related to Perl EP3 with templates, probably triggering static code injection.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/51116; http://www.securityfocus.com/archive/1/490496/100/0/threaded; http://www.securityfocus.com/bid/28639
CVE: CVE-2008-6475
Published: 2009-03-16
Description: SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earlier allows remote attackers to execute arbitrary SQL commands via the Via HTTP header (HTTP_VIA) to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28656; https://exchange.xforce.ibmcloud.com/vulnerabilities/41677; https://www.exploit-db.com/exploits/5391
CVE: CVE-2008-6476
Published: 2009-03-16
Description: Cross-site scripting (XSS) vulnerability in blog/search.aspx in BlogEngine.NET allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/44290; http://osvdb.org/ref/44/blogengine-search-xss.txt; http://www.securityfocus.com/bid/34227
CVE: CVE-2008-6477
Published: 2009-03-16
Description: SQL injection vulnerability in Mumbo Jumbo Media OP4 allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28763; http://www.vupen.com/english/advisories/2008/1211/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/49303
CVE: CVE-2009-0912
Published: 2009-03-16
Description: perl-MDK-Common 1.1.11 and 1.1.24, 1.2.9 through 1.2.14, and possibly other versions, in Mandriva Linux does not properly handle strings when writing them to configuration files, which allows attackers to gain privileges via "special characters" in unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.mandriva.com/security/advisories?name=MDVSA-2009:072; http://www.securityfocus.com/bid/34089; http://www.vupen.com/english/advisories/2009/0688
CVE: CVE-2009-0913
Published: 2009-03-16
Description: Unspecified vulnerability in the keysock kernel module in Solaris 10 and OpenSolaris builds snv_01 through snv_108 allows local users to cause a denial of service (system panic) via unknown vectors related to PF_KEY socket, probably related to setting socket options.
CVSS Score: 4.7 (MEDIUM)
References: http://osvdb.org/52678; http://secunia.com/advisories/34277; http://secunia.com/advisories/34456
CVE: CVE-2008-6478
Published: 2009-03-16
Description: Cross-site request forgery (CSRF) vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft (build 4.0.0-365.6.swsoft) and 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to create and delete arbitrary files as the administrator via a link or IMG tag to (1) create-file and (2) list-control in vz/cp/vzdir/infrman/envs/files/; or modify system configuration via the path parameter to vz/cp/vzdir/infrman/envs/files/index.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/44395; http://px.dynalias.org/files/virtuozzo_overwrite.html.txt; http://secunia.com/advisories/29675
CVE: CVE-2008-6479
Published: 2009-03-16
Description: Cross-site request forgery (CSRF) vulnerability in the "change password" feature in the VZPP web interface for Parallels Virtuozzo 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to modify the password via a link or IMG tag to vz/cp/pwd.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/44394; http://px.dynalias.org/files/virtuozzo_pwd.html.txt; http://secunia.com/advisories/29675
CVE: CVE-2008-6480
Published: 2009-03-16
Description: Cross-site request forgery (CSRF) vulnerability in engine/modules/imagepreview.php in Datalife Engine 6.7 allows remote attackers to hijack the authentication of arbitrary users for requests that use a modified image parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/51107; http://www.securityfocus.com/archive/1/490372/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/41598
CVE: CVE-2009-0508
Published: 2009-03-16
Description: The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in (1) web-inf, (2) meta-inf, and unspecified other directories via unknown vectors, related to (a) web-based applications and (b) the administrative console.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/34283; http://secunia.com/advisories/34876; http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg24022456
CVE: CVE-2009-0914
Published: 2009-03-16
Description: Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://secunia.com/advisories/34135; http://secunia.com/advisories/34294
CVE: CVE-2009-0915
Published: 2009-03-16
Description: Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://secunia.com/advisories/34135; http://secunia.com/advisories/34418
CVE: CVE-2009-0916
Published: 2009-03-16
Description: Unspecified vulnerability in Opera before 9.64 has unknown impact and attack vectors, related to a "moderately severe issue."
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://secunia.com/advisories/34135; http://secunia.com/advisories/34418
CVE: CVE-2009-0917
Published: 2009-03-16
Description: Cross-site scripting (XSS) vulnerability in DFLabs PTK 1.0.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML by providing a forensic image containing HTML documents, which are rendered in web browsers during inspection by PTK.  NOTE: the vendor states that the product is intended for use in a laboratory with "no contact from / to internet."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ptk.dflabs.com/faq.html; http://ptk.dflabs.com/security.html; http://secunia.com/advisories/34257
CVE: CVE-2009-0918
Published: 2009-03-16
Description: Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via (1) "external tools" or (2) a crafted forensic image.
CVSS Score: 7.5 (HIGH)
References: http://ptk.dflabs.com/faq.html; http://ptk.dflabs.com/security.html; http://www.kb.cert.org/vuls/id/845747
CVE: CVE-2009-0919
Published: 2009-03-16
Description: XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via (1) the "lampp" default password for the "nobody" account within the included ProFTPD installation, (2) a blank default password for the "root" account within the included MySQL installation, (3) a blank default password for the "pma" account within the phpMyAdmin installation, and possibly other unspecified passwords.  NOTE: this was originally reported as a problem in DFLabs PTK, but this issue affects any product that is installed within the XAMPP environment, and should not be viewed as a vulnerability within that product. NOTE: DFLabs states that PTK is intended for use in a laboratory with "no contact from / to internet."
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://ptk.dflabs.com/security.html; http://www.apachefriends.org/en/faq-xampp-linux.html; http://www.debianhelp.co.uk/xampp.htm
CVE: CVE-2009-0922
Published: 2009-03-17
Description: PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://archives.postgresql.org//pgsql-bugs/2009-02/msg00176.php; http://archives.postgresql.org/pgsql-bugs/2009-02/msg00172.php; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517405