deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0657
Published: 2009-02-20
Description: Toshiba Face Recognition 2.0.2.32 allows physically proximate attackers to obtain notebook access by presenting a large number of images for which the viewpoint and lighting have been modified to match a stored image of the authorized notebook user.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-255
References: http://security.bkis.vn/?p=292; http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Nguyen; http://www.blackhat.com/presentations/bh-dc-09/Nguyen/BlackHat-DC-09-Nguyen-Face-not-your-password.pdf
CVE: CVE-2009-0658
Published: 2009-02-20
Description: Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://isc.sans.org/diary.html?n&storyid=5902; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
CVE: CVE-2009-0659
Published: 2009-02-20
Description: Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 allows remote attackers to have an unknown impact via a STATS line with a long email field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/33972; https://exchange.xforce.ibmcloud.com/vulnerabilities/48781; https://exchange.xforce.ibmcloud.com/vulnerabilities/48953
CVE: CVE-2008-6220
Published: 2009-02-20
Description: SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the pass parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32502; http://www.securityfocus.com/bid/32114; https://exchange.xforce.ibmcloud.com/vulnerabilities/46342
CVE: CVE-2008-6221
Published: 2009-02-20
Description: PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32551; http://www.securityfocus.com/bid/32135; http://www.vupen.com/english/advisories/2008/3021
CVE: CVE-2008-6222
Published: 2009-02-20
Description: Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32523; http://www.securityfocus.com/bid/32113; https://exchange.xforce.ibmcloud.com/vulnerabilities/46356
CVE: CVE-2008-6223
Published: 2009-02-20
Description: PHP remote file inclusion vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the plancia parameter to crea.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32515; http://www.securityfocus.com/bid/32115; https://exchange.xforce.ibmcloud.com/vulnerabilities/46341
CVE: CVE-2008-6224
Published: 2009-02-20
Description: Directory traversal vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the plancia parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32515; http://www.securityfocus.com/bid/32115; https://exchange.xforce.ibmcloud.com/vulnerabilities/46340
CVE: CVE-2008-6225
Published: 2009-02-20
Description: SQL injection vulnerability in info.php in Mole Group Airline Ticket Sale Script allows remote attackers to execute arbitrary SQL commands via the flight parameter.  NOTE: the vendor has disputed this issue, stating "crazy hackers and so named Security companies [spread] out such false informations. Such scripts or versions [do not] exist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49694; http://secunia.com/advisories/32577; http://www.mole-group.com/content/view/57/72
CVE: CVE-2008-6226
Published: 2009-02-20
Description: SQL injection vulnerability in moreinfo.php in Pre Projects PHP Auto Listings Script, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the itemno parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32547; http://www.securityfocus.com/bid/32131; http://www.vupen.com/english/advisories/2008/3022
CVE: CVE-2008-6227
Published: 2009-02-20
Description: SQL injection vulnerability in buyer_detail.php in Pre Multi-Vendor Shopping Malls allows remote attackers to execute arbitrary SQL commands via the (1) sid and (2) cid parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32127; http://www.vupen.com/english/advisories/2008/3018; https://exchange.xforce.ibmcloud.com/vulnerabilities/46387
CVE: CVE-2008-6228
Published: 2009-02-20
Description: Pre Multi-Vendor Shopping Malls allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (2) adminid cookies to "admin".
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://www.vupen.com/english/advisories/2008/3018; https://exchange.xforce.ibmcloud.com/vulnerabilities/46388; https://www.exploit-db.com/exploits/6999
CVE: CVE-2008-6229
Published: 2009-02-20
Description: Cross-site scripting (XSS) vulnerability in the administrative interface in Drupal Content Construction Kit (CCK) 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal, allows remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via (1) field labels and (2) content-type names.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/330546; http://secunia.com/advisories/32572; http://secunia.com/advisories/32615
CVE: CVE-2008-6230
Published: 2009-02-20
Description: SQL injection vulnerability in Tour.php in Pre Projects Pre Podcast Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32563; http://www.securityfocus.com/bid/32124; http://www.vupen.com/english/advisories/2008/3016
CVE: CVE-2008-6231
Published: 2009-02-20
Description: Pre Classified Listing PHP allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (2) adminid cookies to "admin".
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/32557; http://www.securityfocus.com/bid/32126; http://www.vupen.com/english/advisories/2008/3019
CVE: CVE-2008-6232
Published: 2009-02-20
Description: Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (2) adminid cookies to "admin".
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/32557; http://www.vupen.com/english/advisories/2008/3017; https://exchange.xforce.ibmcloud.com/vulnerabilities/48984
CVE: CVE-2008-6233
Published: 2009-02-20
Description: SQL injection vulnerability in index.php in Five Dollar Scripts Drinks script allows remote attackers to execute arbitrary SQL commands via the recid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32579; http://www.securityfocus.com/bid/32137; http://www.vupen.com/english/advisories/2008/3025
CVE: CVE-2008-6234
Published: 2009-02-21
Description: SQL injection vulnerability in the com_musica module in Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/488996/100/0/threaded; http://www.securityfocus.com/bid/28061; https://www.exploit-db.com/exploits/5207
CVE: CVE-2008-3074
Published: 2009-02-21
Description: The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive, which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2, tarplugin, and tarplugin.updated test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075.  NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6308&w=2
CVE: CVE-2008-3075
Published: 2009-02-21
Description: The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.  NOTE: this issue has the same root cause as CVE-2008-3074.  NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6308&w=2
CVE: CVE-2008-3076
Published: 2009-02-21
Description: The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6308&w=2
CVE: CVE-2008-6235
Published: 2009-02-21
Description: The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html; http://secunia.com/advisories/34418; http://www.openwall.com/lists/oss-security/2008/10/16/2
CVE: CVE-2008-6236
Published: 2009-02-21
Description: SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the login parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32502; http://www.securityfocus.com/bid/32114; https://exchange.xforce.ibmcloud.com/vulnerabilities/46342
CVE: CVE-2009-0040
Published: 2009-02-22
Description: The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-824
References: ftp://ftp.simplesystems.org/pub/png/src/libpng-1.2.34-ADVISORY.txt; http://downloads.sourceforge.net/libpng/libpng-1.2.34-ADVISORY.txt; http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html
CVE: CVE-2009-0440
Published: 2009-02-22
Description: IBM WebSphere Partner Gateway (WPG) 6.0.0 through 6.0.0.7 does not properly handle failures of signature verification, which might allow remote authenticated users to submit a crafted RosettaNet (aka RNIF) document to a backend application, related to (1) "altered service content" and (2) "digital signature foot-print."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/33994; http://www-01.ibm.com/support/docview.wss?uid=swg21330341; http://www-1.ibm.com/support/docview.wss?uid=swg1JR31231
CVE: CVE-2009-0671
Published: 2009-02-22
Description: Rejected reason: Format string vulnerability in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit imap-2007d and other applications, allows remote attackers to execute arbitrary code via format string specifiers in the initial request to the IMAP port (143/tcp).  NOTE: Red Hat has disputed the vulnerability, stating "The Red Hat Security Response Team have been unable to confirm the existence of this format string vulnerability in the toolkit, and the sample published exploit is not complete or functional."  CVE agrees that the exploit contains syntax errors and uses Unix-only include files while invoking Windows functions
CVE: CVE-2009-0672
Published: 2009-02-22
Description: SQL injection vulnerability in the Resend_Email module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the user_prefix parameter to modules.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/52298; http://ravenphpscripts.com/postt17156.html; http://www.securityfocus.com/archive/1/500988/100/0/threaded
CVE: CVE-2009-0673
Published: 2009-02-22
Description: Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://ravenphpscripts.com/postt17156.html; http://www.securityfocus.com/archive/1/500988/100/0/threaded; http://www.securityfocus.com/bid/33787
CVE: CVE-2009-0674
Published: 2009-02-22
Description: images/captcha.php in Raven Web Services RavenNuke 2.30, when register_globals and display_errors are enabled, allows remote attackers to determine the existence of local files by sending requests with full pathnames in the aFonts array parameter, and then observing the error messages, which differ between existing and nonexistent pathnames.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://ravenphpscripts.com/postt17156.html; http://www.securityfocus.com/archive/1/500988/100/0/threaded; http://www.securityfocus.com/bid/33787
CVE: CVE-2009-0675
Published: 2009-02-22
Description: The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before 2.6.28.6 permits SKFP_CLR_STATS requests only when the CAP_NET_ADMIN capability is absent, instead of when this capability is present, which allows local users to reset the driver statistics, related to an "inverted logic" issue.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c25b9abbc2c2c0da88e180c3933d6e773245815a; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html; http://lists.openwall.net/netdev/2009/01/28/90
CVE: CVE-2009-0676
Published: 2009-02-22
Description: The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=df0bca049d01c0ee94afb7cd5dfd959541e6c8da; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html
CVE: CVE-2009-0677
Published: 2009-02-22
Description: avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the preg_replace function with the eval switch, as specified in an element of the patterns array.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://ravenphpscripts.com/postt17156.html&sid=12d[PII_REDACTED]60a42fa846ebce7bad; http://secunia.com/advisories/33928; http://www.osvdb.org/52007
CVE: CVE-2009-0678
Published: 2009-02-22
Description: images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://ravenphpscripts.com/postt17156.html; http://www.securityfocus.com/archive/1/500988/100/0/threaded; http://www.waraxe.us/advisory-72.html
CVE: CVE-2009-0679
Published: 2009-02-22
Description: Cross-site scripting (XSS) vulnerability in the Your Account module in RavenNuke 2.30 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/52299; http://ravenphpscripts.com/postt17156.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/48978
CVE: CVE-2009-0680
Published: 2009-02-22
Description: cgi-bin/welcome/VPN_only in the web interface in Netgear SSL312 allows remote attackers to cause a denial of service (device crash) via a crafted query string, as demonstrated using directory traversal sequences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0084.html; http://secunia.com/advisories/33896; http://www.helith.net/txt/netgear_ssl312_remote_dos.txt
CVE: CVE-2008-6237
Published: 2009-02-23
Description: SQL injection vulnerability in software-description.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32536; https://exchange.xforce.ibmcloud.com/vulnerabilities/46277; https://www.exploit-db.com/exploits/6915
CVE: CVE-2008-6238
Published: 2009-02-23
Description: Cross-site scripting (XSS) vulnerability in archive/savedqueries/savequeryfinish.html in OpenEdit Digital Asset Management (DAM) before 5.2014 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/96/45/; http://secunia.com/advisories/33339; http://www.osvdb.org/51026
CVE: CVE-2008-6239
Published: 2009-02-23
Description: Cross-site request forgery (CSRF) vulnerability in OpenEdit Digital Asset Management (DAM) before 5.2014 allows remote attackers to perform unspecified actions as arbitrary users via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/96/45/; http://secunia.com/advisories/33339; http://www.osvdb.org/51027
CVE: CVE-2008-6240
Published: 2009-02-23
Description: Cross-site scripting (XSS) vulnerability in data/views/index.html in OpenEdit Digital Asset Management (DAM) before 5.2014 allows remote attackers to inject arbitrary web script or HTML via the catalogid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/95/45/; http://secunia.com/advisories/33296; http://www.osvdb.org/51028
CVE: CVE-2008-6241
Published: 2009-02-23
Description: Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPSite 0.0.1 and 0.0.7, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2) the checkpass parameter (aka password field), to admin/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/33347; https://exchange.xforce.ibmcloud.com/vulnerabilities/47643; https://www.exploit-db.com/exploits/7615
CVE: CVE-2009-0698
Published: 2009-02-23
Description: Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a 4X movie file with a large current_track value, a similar issue to CVE-2009-0385.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://bugs.xine-project.org/show_bug.cgi?id=205; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html; http://sourceforge.net/project/shownotes.php?release_id=660071
CVE: CVE-2009-0699
Published: 2009-02-23
Description: Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the (1) QUB and (2) Bez74 parameters.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2009-01/0032.html; http://archives.neohapsis.com/archives/bugtraq/2009-01/0054.html; http://www.securenetwork.it/ricerca/advisory/download/SN-2008-04.txt
CVE: CVE-2009-0700
Published: 2009-02-23
Description: Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct request to pagesUTF8/auftrag_job.jsp.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2009-01/0032.html; http://archives.neohapsis.com/archives/bugtraq/2009-01/0054.html; http://www.securenetwork.it/ricerca/advisory/download/SN-2008-04.txt
CVE: CVE-2009-0701
Published: 2009-02-23
Description: Multiple PHP remote file inclusion vulnerabilities in index.php in Cybershade CMS 0.2b, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) THEME_header and (2) THEME_footer parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/33101; https://exchange.xforce.ibmcloud.com/vulnerabilities/47725; https://www.exploit-db.com/exploits/7668
CVE: CVE-2009-0702
Published: 2009-02-23
Description: SQL injection vulnerability in the Phoca Documentation (com_phocadocumentation) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a section action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33114; http://www.vupen.com/english/advisories/2009/0026; https://www.exploit-db.com/exploits/7670
CVE: CVE-2009-0703
Published: 2009-02-23
Description: SQL injection vulnerability in bview.asp in ASPThai.Net Webboard 6.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34099; http://www.securityfocus.com/bid/33084; https://exchange.xforce.ibmcloud.com/vulnerabilities/47722