deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3550
Published: 2008-08-08
Description: The CQWeb login page in IBM Rational ClearQuest 7.0.1 allows remote attackers to obtain potentially sensitive information (page source code) via a combination of ?script? and ?/script? sequences in the id field, possibly related to a cross-site scripting (XSS) vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-1.ibm.com/support/docview.wss?uid=swg1PK68332; http://www.securitytracker.com/id?1020642; http://www.vupen.com/english/advisories/2008/2317
CVE: CVE-2008-3551
Published: 2008-08-08
Description: Multiple unspecified vulnerabilities in Sun Java Platform Micro Edition (aka Java ME, J2ME, or mobile Java), as distributed in Sun Wireless Toolkit 2.5.2, allow remote attackers to execute arbitrary code via unknown vectors.  NOTE: as of 20080807, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a company led by a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
References: http://www.security-explorations.com/n2press.htm; http://www.security-explorations.com/n2srp.htm; http://www.security-explorations.com/n2vendors.htm
CVE: CVE-2008-3552
Published: 2008-08-08
Description: Multiple unspecified vulnerabilities in Nokia Series 40 3rd edition FP1, and possibly later devices, allow remote attackers to execute arbitrary code via unknown vectors, probably related to MIDP privilege escalation and persistent MIDlets, aka "ISSUES 11-15." NOTE: as of 20080807, the only disclosure is a vague pre-advisory with no actionable information.  However, because it is from a company led by a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
References: http://www.security-explorations.com/n2press.htm; http://www.security-explorations.com/n2srp.htm; http://www.security-explorations.com/n2vendors.htm
CVE: CVE-2008-3553
Published: 2008-08-08
Description: Multiple unspecified vulnerabilities in Nokia Series 40 3rd edition devices allow remote attackers to execute arbitrary code via unknown vectors, probably related to MIDP privilege escalation and persistent MIDlets, aka "ISSUES 3-10." NOTE: as of 20080807, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a company led by a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.security-explorations.com/n2press.htm; http://www.security-explorations.com/n2srp.htm; http://www.security-explorations.com/n2vendors.htm
CVE: CVE-2008-3554
Published: 2008-08-08
Description: SQL injection vulnerability in index.php in Discuz! 6.0.1 allows remote attackers to execute arbitrary SQL commands via the searchid parameter in a search action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30583; https://exchange.xforce.ibmcloud.com/vulnerabilities/44251; https://www.exploit-db.com/exploits/6214
CVE: CVE-2008-3555
Published: 2008-08-08
Description: Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3) Knowledge Base (WSNKB) 4.1.36 and earlier, (4) Links 4.1.44 and earlier, and possibly (5) Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the TID parameter, as demonstrated by uploading a .jpg file containing PHP sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31392; http://securityreason.com/securityalert/4120; https://exchange.xforce.ibmcloud.com/vulnerabilities/44236
CVE: CVE-2008-3556
Published: 2008-08-08
Description: Multiple SQL injection vulnerabilities in index.php in Battle.net Clan Script 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) showmember parameter in a members action and the (2) thread parameter in a board action.  NOTE: vector 1 might be the same as CVE-2008-2522.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4119; http://www.securityfocus.com/archive/1/495167/100/0/threaded; http://www.securityfocus.com/bid/30565
CVE: CVE-2008-3557
Published: 2008-08-08
Description: Free Hosting Manager 1.2 and 2.0 allows remote attackers to bypass authentication and gain administrative access by setting both the adminuser and loggedin cookies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31383; http://securityreason.com/securityalert/4118; http://www.securityfocus.com/bid/30580
CVE: CVE-2008-3558
Published: 2008-08-08
Description: Stack-based buffer overflow in the WebexUCFObject ActiveX control in atucfobj.dll in Cisco WebEx Meeting Manager before 20.2008.2606.4919 allows remote attackers to execute arbitrary code via a long argument to the NewObject method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063692.html; http://secunia.com/advisories/31397; http://www.cisco.com/en/US/products/products_security_advisory09186a00809e2006.shtml
CVE: CVE-2008-3559
Published: 2008-08-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in KAPhotoservice allow remote attackers to inject arbitrary web script or HTML via the (1) filename parameter to search.asp and the (2) page parameter to order.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/30567.html; http://secunia.com/advisories/31369; http://www.securityfocus.com/bid/30567
CVE: CVE-2008-3560
Published: 2008-08-08
Description: Cross-site scripting (XSS) vulnerability in kshop_search.php in the Kshop module 2.22 for Xoops allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/30576.html; http://lostmon.blogspot.com/2008/08/kshop-module-search-variable-and-field.html; http://secunia.com/advisories/31402
CVE: CVE-2008-3273
Published: 2008-08-10
Description: JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8872&w=2; http://rhn.redhat.com/errata/RHSA-2008-0825.html; http://rhn.redhat.com/errata/RHSA-2008-0826.html
CVE: CVE-2008-3561
Published: 2008-08-10
Description: SQL injection vulnerability in s03.php in Powergap Shopsystem, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the ag parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0808-exploits/powergap-sql.txt; http://secunia.com/advisories/31382; http://www.securityfocus.com/bid/30558
CVE: CVE-2008-3562
Published: 2008-08-10
Description: Directory traversal vulnerability in index.php in the Contact module in Chupix CMS 0.1.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mods parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31362; http://www.securityfocus.com/bid/30564; http://www.securityfocus.com/bid/30564/exploit
CVE: CVE-2008-3563
Published: 2008-08-10
Description: Multiple SQL injection vulnerabilities in Plogger 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the checked array parameter to plog-download.php in an album action and (2) unspecified parameters to plog-remote.php, and (3) allow remote authenticated administrators to execute arbitrary SQL commands via the activate parameter to admin/plog-themes.php, related to theme_dir settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://dev.plogger.org/changeset/569; http://securityreason.com/securityalert/4121; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8
CVE: CVE-2008-3564
Published: 2008-08-10
Description: Multiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) p, (2) cat, and (3) archive parameters.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4122; http://www.securityfocus.com/bid/30538; https://exchange.xforce.ibmcloud.com/vulnerabilities/44203
CVE: CVE-2008-3565
Published: 2008-08-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Meeting Room Booking System (MRBS) 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the area parameter to (1) day.php, (2) week.php, (3) month.php, (4) search.php, (5) report.php, and (6) help.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31355; http://www.securityfocus.com/bid/30531; http://www.securityfocus.com/bid/30531/exploit
CVE: CVE-2008-3566
Published: 2008-08-10
Description: Cross-site scripting (XSS) vulnerability in ZoneO-soft freeForum 1.7 allows remote attackers to inject arbitrary web script or HTML via the acuparam parameter to (1) the default URI or (2) index.php, or (3) the PATH_INFO to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/30509.html; http://secunia.com/advisories/31349; http://www.securityfocus.com/bid/30509
CVE: CVE-2008-3567
Published: 2008-08-10
Description: Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5.541 allows remote attackers to conduct cross-site scripting (XSS) attacks via an MP3 file with JavaScript in id3 tags.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.watchfire.com/wfblog/2008/09/winamp-nowplayi.html; http://forums.winamp.com/showthread.php?threadid=295505; http://secunia.com/advisories/31371
CVE: CVE-2008-3568
Published: 2008-08-10
Description: Absolute path traversal vulnerability in fckeditor/editor/filemanager/browser/default/connectors/php/connector.php in UNAK-CMS 1.5.5 allows remote attackers to include and execute arbitrary local files via a full pathname in the Dirroot parameter, a different vulnerability than CVE-2006-4890.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4123; http://www.securityfocus.com/archive/1/495090/100/0/threaded; http://www.securityfocus.com/bid/30533
CVE: CVE-2008-3569
Published: 2008-08-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in XAMPP 1.6.7, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the text parameter to (1) iart.php and (2) ming.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4127; http://www.securityfocus.com/archive/1/495096/100/0/threaded; http://www.securityfocus.com/bid/30535
CVE: CVE-2008-3570
Published: 2008-08-10
Description: PHP remote file inclusion vulnerability in index.php in Africa Be Gone (ABG) 1.0a allows remote attackers to execute arbitrary PHP code via a URL in the abg_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4124; https://exchange.xforce.ibmcloud.com/vulnerabilities/44195; https://www.exploit-db.com/exploits/6183
CVE: CVE-2008-3571
Published: 2008-08-10
Description: The Xerox Phaser 8400 allows remote attackers to cause a denial of service (reboot) via an empty UDP packet to port 1900.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31329; http://securityreason.com/securityalert/4128; http://www.securityfocus.com/bid/30522
CVE: CVE-2008-3572
Published: 2008-08-10
Description: Cross-site scripting (XSS) vulnerability in index.php in Pligg 9.9.5 allows remote attackers to inject arbitrary web script or HTML via the category parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3356&w=2; http://securityreason.com/securityalert/4129; http://www.rooksecurity.com/blog/?p=19
CVE: CVE-2008-3573
Published: 2008-08-10
Description: The CAPTCHA implementation in (1) Pligg 9.9.5 and possibly (2) Francisco Burzi PHP-Nuke 8.1 provides a critical random number (the ts_random value) within the URL in the SRC attribute of an IMG element, which allows remote attackers to pass the CAPTCHA test via a calculation that combines this value with the current date and the HTTP User-Agent string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189, CWE-264
References: http://www.rooksecurity.com/blog/?p=17; http://www.securityfocus.com/bid/30518; https://exchange.xforce.ibmcloud.com/vulnerabilities/44192
CVE: CVE-2008-3574
Published: 2008-08-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lang_footer parameter to (a) data/inc/footer.php; the (2) pluck_version, (3) lang_install22, (4) titelkop, (5) lang_kop1, (6) lang_kop2, (7) lang_modules, (8) lang_kop4, (9) lang_kop15, (10) lang_kop5, and (11) titelkop parameters to (b) data/inc/header.php; the pluck_version and titelkop parameters to (c) data/inc/header2.php; and the (14) lang_theme6 parameter to (d) data/inc/themeinstall.php.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://securityreason.com/securityalert/4125; http://www.securityfocus.com/archive/1/495110/100/0/threaded; http://www.securityfocus.com/bid/30542
CVE: CVE-2008-3575
Published: 2008-08-10
Description: PHP remote file inclusion vulnerability in modules/calendar/minicalendar.php in ezContents CMS allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[gsLanguage] parameter, a different vector than CVE-2006-4477 and CVE-2004-0132.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4130; http://www.securityfocus.com/archive/1/494755/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/44480
CVE: CVE-2008-3576
Published: 2008-08-10
Description: Buffer overflow in the TruncateString function in src/gfx.cpp in OpenTTD before 0.6.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted string.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=233929; http://secunia.com/advisories/31350; http://secunia.com/advisories/34161
CVE: CVE-2008-3577
Published: 2008-08-10
Description: Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows local users to execute arbitrary code via a large filename supplied to the "-g" parameter in the ttd_main function.  NOTE: it is unlikely that this issue would cross privilege boundaries in typical environments.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=233929; http://secunia.com/advisories/34161; http://security.gentoo.org/glsa/glsa-200903-09.xml
CVE: CVE-2008-3578
Published: 2008-08-10
Description: HydraIRC 0.3.164 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a long irc:// URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/31376; http://securityreason.com/securityalert/4126; http://www.securityfocus.com/bid/30523
CVE: CVE-2008-3579
Published: 2008-08-10
Description: Calacode @Mail 5.41 on Linux does not require administrative authentication for build-plesk-upgrade.php, which allows remote attackers to obtain sensitive information by creating and downloading a backup archive of the entire @Mail directory tree.  NOTE: this can be leveraged for remote exploitation of CVE-2008-3395.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31279; https://exchange.xforce.ibmcloud.com/vulnerabilities/44145; http://secunia.com/advisories/31279
CVE: CVE-2008-3580
Published: 2008-08-10
Description: Multiple SQL injection vulnerabilities in Qsoft K-Links allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to visit.php, or the PATH_INFO to the default URI under (2) report/, (3) addreview/, or (4) refer/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31245; http://securityreason.com/securityalert/4131; http://www.securityfocus.com/bid/30520
CVE: CVE-2008-3581
Published: 2008-08-10
Description: Cross-site scripting (XSS) vulnerability in index.php in Qsoft K-Links allows remote attackers to inject arbitrary web script or HTML via the login_message parameter in a login action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31245; http://securityreason.com/securityalert/4131; http://www.securityfocus.com/bid/30520
CVE: CVE-2008-3582
Published: 2008-08-10
Description: SQL injection vulnerability in login.php in Keld PHP-MySQL News Script 0.7.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4132; http://www.securityfocus.com/archive/1/495086/100/0/threaded; http://www.securityfocus.com/bid/30529
CVE: CVE-2008-3583
Published: 2008-08-10
Description: Buffer overflow in the HTML parser in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a long URL in the SRC attribute of an IMG element.  NOTE: this might be related to CVE-2008-3360.  NOTE: it was later reported that 2.08 Beta 4 is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/30521; https://exchange.xforce.ibmcloud.com/vulnerabilities/44215; https://www.exploit-db.com/exploits/6195
CVE: CVE-2008-3585
Published: 2008-08-11
Description: Multiple SQL injection vulnerabilities in PozScripts GreenCart PHP Shopping Cart allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) product_desc.php and (2) store_info.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4133; http://www.securityfocus.com/bid/30506; https://exchange.xforce.ibmcloud.com/vulnerabilities/44164
CVE: CVE-2008-3586
Published: 2008-08-11
Description: SQL injection vulnerability in the EZ Store (com_ezstore) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30527; https://exchange.xforce.ibmcloud.com/vulnerabilities/44196; https://www.exploit-db.com/exploits/6199
CVE: CVE-2008-3587
Published: 2008-08-11
Description: Cross-site scripting (XSS) vulnerability in result.php in Chris Bunting Homes 4 Sale allows remote attackers to inject arbitrary web script or HTML via the r parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4134; http://www.securityfocus.com/archive/1/495059/100/0/threaded; http://www.securityfocus.com/bid/30517
CVE: CVE-2008-3588
Published: 2008-08-11
Description: Multiple SQL injection vulnerabilities in phsBlog 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to comments.php, (2) cid parameter to index.php, and the (3) urltitle parameter to entries.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4135; https://exchange.xforce.ibmcloud.com/vulnerabilities/44163; https://www.exploit-db.com/exploits/6190
CVE: CVE-2008-3589
Published: 2008-08-11
Description: Directory traversal vulnerability in download.php in moziloCMS 1.10.1, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the cat parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31327; http://securityreason.com/securityalert/4136; http://www.securityfocus.com/bid/30526
CVE: CVE-2008-3590
Published: 2008-08-11
Description: Multiple SQL injection vulnerabilities in admin/login.asp in E. Z. Poll 2 allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31368; http://secunia.com/advisories/31368
CVE: CVE-2008-3591
Published: 2008-08-11
Description: SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary SQL commands via the sym_auth cookie in a /publish/filemanager/ request to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://overture21.com/forum/comments.php?DiscussionID=1823; http://secunia.com/advisories/31293; http://securityreason.com/securityalert/4137
CVE: CVE-2008-3592
Published: 2008-08-11
Description: Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to a directory specified in the destination parameter, then accessing the uploaded file via a direct request, as demonstrated using workspace/masters/.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://overture21.com/forum/comments.php?DiscussionID=1823; http://secunia.com/advisories/31293; http://securityreason.com/securityalert/4137
CVE: CVE-2008-3593
Published: 2008-08-11
Description: Directory traversal vulnerability in index.php in SyzygyCMS 0.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4138; http://www.securityfocus.com/bid/30530; https://exchange.xforce.ibmcloud.com/vulnerabilities/44157
CVE: CVE-2008-3594
Published: 2008-08-11
Description: SQL injection vulnerability in viewdetails.php in MagicScripts E-Store Kit-1, E-Store Kit-2, E-Store Kit-1 Pro PayPal Edition, and E-Store Kit-2 PayPal Edition allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31273; http://securityreason.com/securityalert/4139; http://www.securityfocus.com/bid/30524
CVE: CVE-2008-3595
Published: 2008-08-12
Description: PHP remote file inclusion vulnerability in examples/txtSQLAdmin/startup.php in txtSQL 2.2 Final allows remote attackers to execute arbitrary PHP code via a URL in the CFG[txtsql][class] parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/30625; https://exchange.xforce.ibmcloud.com/vulnerabilities/44377; https://www.exploit-db.com/exploits/6224
CVE: CVE-2008-3596
Published: 2008-08-12
Description: Cross-site scripting (XSS) vulnerability in Harmoni before 1.4.7 allows remote attackers to inject arbitrary web script or HTML via the Username field, which is inserted into logs that could be rendered when viewed by an administrator.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31406; http://sourceforge.net/tracker/index.php?func=detail&aid=2040255&group_id=82171&atid=1098812; http://www.securityfocus.com/bid/30637