deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2499
Published: 2008-05-29
Description: Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30309; http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920; http://www.securityfocus.com/bid/29328
CVE: CVE-2008-2500
Published: 2008-05-29
Description: Cross-site scripting (XSS) vulnerability in the MOStlyContent Editor (MOStlyCE) component before 3.0 for Mambo allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.mambo-foundation.org/showthread.php?t=11799; https://exchange.xforce.ibmcloud.com/vulnerabilities/42749; http://forum.mambo-foundation.org/showthread.php?t=11799
CVE: CVE-2008-2501
Published: 2008-05-29
Description: Multiple SQL injection vulnerabilities in PHPhotoalbum 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) album parameter to thumbnails.php and the (2) pid parameter to displayimage.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30407; https://exchange.xforce.ibmcloud.com/vulnerabilities/42670; https://www.exploit-db.com/exploits/5683
CVE: CVE-2008-2502
Published: 2008-05-29
Description: Unspecified vulnerability in the web server in eMule X-Ray before 1.4 allows remote attackers to trigger memory corruption via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/30292; http://sourceforge.net/project/shownotes.php?release_id=599894; http://www.vupen.com/english/advisories/2008/1685/references
CVE: CVE-2008-2503
Published: 2008-05-29
Description: Buffer overflow in Uploadlist in eMule X-Ray before 1.4 has unknown impact and remote attack vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30292; http://sourceforge.net/project/shownotes.php?release_id=599894; http://www.vupen.com/english/advisories/2008/1685/references
CVE: CVE-2008-2504
Published: 2008-05-29
Description: Multiple SQL injection vulnerabilities in Simpel Side Netbutik 1 through 4 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to netbutik.php and the (2) id parameter to product.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29333; http://www.vupen.com/english/advisories/2008/1658; https://exchange.xforce.ibmcloud.com/vulnerabilities/42572
CVE: CVE-2008-2505
Published: 2008-05-29
Description: Cross-site scripting (XSS) vulnerability in result.php in Simpel Side Weblosning 1 through 4 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29332; https://exchange.xforce.ibmcloud.com/vulnerabilities/42574; https://www.exploit-db.com/exploits/5664
CVE: CVE-2008-2506
Published: 2008-05-29
Description: Multiple SQL injection vulnerabilities in Simpel Side Weblosning 1 through 4 allow remote attackers to execute arbitrary SQL commands via the (1) mainid and (2) id parameters to index2.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29332; https://exchange.xforce.ibmcloud.com/vulnerabilities/42573; https://www.exploit-db.com/exploits/5664
CVE: CVE-2008-2507
Published: 2008-05-29
Description: Cross-site scripting (XSS) vulnerability in Calcium40.pl in Brown Bear Software Calcium 3.10 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the CalendarName parameter in a ShowIt action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30431; http://www.securityfocus.com/archive/1/492719/100/0/threaded; http://www.securityfocus.com/bid/29411
CVE: CVE-2008-2508
Published: 2008-05-29
Description: Cross-site scripting (XSS) vulnerability in news.php in Tr Script News 2.1 allows remote attackers to inject arbitrary web script or HTML via the "nb" parameter in voir mode.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29388; http://www.z0rlu.ownspace.org/index.php?/archives/91-TR-News-v2.1-xss.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/42648
CVE: CVE-2008-2509
Published: 2008-05-29
Description: SQL injection vulnerability in pwd.asp in Excuse Online allows remote attackers to execute arbitrary SQL commands via the pID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.chroot.org/exploits/chroot_uu_002; http://www.securityfocus.com/archive/1/492580/100/0/threaded; http://www.securityfocus.com/bid/29370
CVE: CVE-2008-2510
Published: 2008-05-29
Description: SQL injection vulnerability in wp-uploadfile.php in the Upload File plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the f_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/492555/100/0/threaded; http://www.securityfocus.com/bid/29352; https://exchange.xforce.ibmcloud.com/vulnerabilities/42659
CVE: CVE-2008-1027
Published: 2008-06-02
Description: Apple Filing Protocol (AFP) Server in Apple Mac OS X before 10.5.3 does not verify that requested files and directories are inside shared folders, which allows remote attackers to read arbitrary files via unspecified AFP traffic.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020130
CVE: CVE-2008-1028
Published: 2008-06-02
Description: Unspecified vulnerability in AppKit in Apple Mac OS X before 10.5 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document file, as demonstrated by opening the document with TextEdit.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020131
CVE: CVE-2008-1030
Published: 2008-06-02
Description: Integer overflow in the CFDataReplaceBytes function in the CFData API in CoreFoundation in Apple Mac OS X before 10.5.3 allows context-dependent attackers to execute arbitrary code or cause a denial of service (crash) via an invalid length argument, which triggers a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020135
CVE: CVE-2008-1031
Published: 2008-06-02
Description: CoreGraphics in Apple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document, related to an uninitialized variable.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020136
CVE: CVE-2008-1032
Published: 2008-06-02
Description: Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.5.3 allows user-assisted remote attackers to execute arbitrary code via an (1) Automator, (2) Help, (3) Safari, or (4) Terminal content type for a downloadable object, which does not trigger a "potentially unsafe" warning message in (a) the Download Validation feature in Mac OS X 10.4 or (b) the Quarantine feature in Mac OS X 10.5.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020137
CVE: CVE-2008-1033
Published: 2008-06-02
Description: The scheduler in CUPS in Apple Mac OS X 10.5 before 10.5.3, when debug logging is enabled and a printer requires a password, allows attackers to obtain sensitive information (credentials) by reading the log data, related to "authentication environment variables."
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020145
CVE: CVE-2008-1034
Published: 2008-06-02
Description: Integer underflow in Help Viewer in Apple Mac OS X before 10.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted help:topic URL that triggers a buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020138
CVE: CVE-2008-1036
Published: 2008-06-02
Description: The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://secunia.com/advisories/34290
CVE: CVE-2008-1571
Published: 2008-06-02
Description: Directory traversal vulnerability in the embedded web server in Image Capture in Apple Mac OS X before 10.5 allows remote attackers to read arbitrary files via directory traversal sequences in the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020141
CVE: CVE-2008-1572
Published: 2008-06-02
Description: Image Capture in Apple Mac OS X before 10.5 does not properly use temporary files, which allows local users to overwrite arbitrary files, and display images that are being resized by this application.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020141
CVE: CVE-2008-1573
Published: 2008-06-02
Description: The BMP and GIF image decoding engine in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to obtain sensitive information (memory contents) via a crafted (1) BMP or (2) GIF image, which causes an out-of-bounds read.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430
CVE: CVE-2008-1574
Published: 2008-06-02
Description: Integer overflow in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG2000 image that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020144
CVE: CVE-2008-1575
Published: 2008-06-02
Description: Unspecified vulnerability in the Apple Type Services (ATS) server in Apple Mac OS X 10.5 before 10.5.3 allows user-assisted remote attackers to execute arbitrary code via a crafted embedded font in a PDF document, related to memory corruption that occurs during printing.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020133
CVE: CVE-2008-1576
Published: 2008-06-02
Description: Mail in Apple Mac OS X before 10.5, when an IPv6 SMTP server is used, does not properly initialize memory, which might allow remote attackers to execute arbitrary code or cause a denial of service (application crash), or obtain sensitive information (memory contents) in opportunistic circumstances, by sending an e-mail message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020140
CVE: CVE-2008-1577
Published: 2008-06-02
Description: Unspecified vulnerability in the Pixlet codec in Apple Pixlet Video in Apple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file, related to "multiple memory corruption issues."
CVSS Score: 9.3 (HIGH)
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020132
CVE: CVE-2008-1578
Published: 2008-06-02
Description: The sso_util program in Single Sign-On in Apple Mac OS X before 10.5.3 places passwords on the command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020142
CVE: CVE-2008-1579
Published: 2008-06-02
Description: Wiki Server in Apple Mac OS X 10.5 before 10.5.3 allows remote attackers to obtain sensitive information (user names) by reading the error message produced upon access to a nonexistent blog.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020143
CVE: CVE-2008-1580
Published: 2008-06-02
Description: CFNetwork in Safari in Apple Mac OS X before 10.5.3 automatically sends an SSL client certificate in response to a web server's certificate request, which allows remote web sites to obtain sensitive information (Subject data) from personally identifiable certificates, and use arbitrary certificates to track user activities across domains, a related issue to CVE-2007-4879.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html; http://secunia.com/advisories/30430; http://securitytracker.com/id?1020134
CVE: CVE-2008-2098
Published: 2008-06-02
Description: Heap-based buffer overflow in the VMware Host Guest File System (HGFS) in VMware Workstation 6 before 6.0.4 build 93057, VMware Player 2 before 2.0.4 build 93057, VMware ACE 2 before 2.0.2 build 93057, and VMware Fusion before 1.1.2 build 87978, when folder sharing is used, allows guest OS users to execute arbitrary code on the host OS via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/30476; http://security.gentoo.org/glsa/glsa-201209-25.xml; http://www.securityfocus.com/archive/1/492831/100/0/threaded
CVE: CVE-2008-2099
Published: 2008-06-02
Description: Unspecified vulnerability in VMCI in VMware Workstation 6 before 6.0.4 build 93057, VMware Player 2 before 2.0.4 build 93057, and VMware ACE 2 before 2.0.2 build 93057 on Windows allows guest OS users to execute arbitrary code on the host OS via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/30476; http://www.securityfocus.com/archive/1/492831/100/0/threaded; http://www.securityfocus.com/bid/29443
CVE: CVE-2008-2359
Published: 2008-06-02
Description: The default configuration of consolehelper in system-config-network before 1.5.10-1 on Fedora 8 lacks the USER=root directive, which allows local users of the workstation console to gain privileges and change the network configuration.
CVSS Score: 7.2 (HIGH)
CWE: CWE-16
References: http://secunia.com/advisories/30399; https://bugzilla.redhat.com/show_bug.cgi?id=448557; https://exchange.xforce.ibmcloud.com/vulnerabilities/42867
CVE: CVE-2008-2363
Published: 2008-06-02
Description: The PartsBatch class in Pan 0.132 and earlier does not properly manage the data structures for Parts batches, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted .nzb file that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=224051; http://bugzilla.gnome.org/show_bug.cgi?id=535413; http://marc.info/?l=oss-security&m=[PII_REDACTED]0564&w=2
CVE: CVE-2008-2426
Published: 2008-06-02
Description: Multiple stack-based buffer overflows in Imlib 2 (aka imlib2) 1.4.0 allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) a PNM image with a crafted header, related to the load function in src/modules/loaders/loader_pnm.c; or (2) a crafted XPM image, related to the load function in src/modules/loader_xpm.c.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html; http://secunia.com/advisories/30401; http://secunia.com/advisories/30485
CVE: CVE-2008-2511
Published: 2008-06-02
Description: Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 (aka UmxEventCliLib) ActiveX control in UmxEventCli.dll in CA Internet Security Suite 2008 allows remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the argument to the SaveToFile method.  NOTE: this can be leveraged for code execution by writing to a Startup folder.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://retrogod.altervista.org/9sg_CA_poc.html; http://secunia.com/advisories/30420; http://www.securityfocus.com/archive/1/492679/100/0/threaded
CVE: CVE-2008-2512
Published: 2008-06-02
Description: Directory traversal vulnerability in Symantec Backup Exec System Recovery Manager 7.x before 7.0.4 and 8.x before 8.0.2 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30432; http://securityresponse.symantec.com/avcenter/security/Content/2008.05.28c.html; http://www.securityfocus.com/bid/29350
CVE: CVE-2008-2513
Published: 2008-06-02
Description: Buffer overflow in the kernel in IBM AIX 5.2, 5.3, and 6.1 allows local users to execute arbitrary code in kernel mode via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://aix.software.ibm.com/aix/efixes/security/unix_advisory.asc; http://secunia.com/advisories/30349; http://securitytracker.com/id?1020083
CVE: CVE-2008-2514
Published: 2008-06-02
Description: Buffer overflow in errpt in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via unknown attack vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://aix.software.ibm.com/aix/efixes/security/errpt_advisory.asc; http://secunia.com/advisories/30349; http://securitytracker.com/id?1020084
CVE: CVE-2008-2515
Published: 2008-06-02
Description: Unspecified vulnerability in iostat in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via unknown vectors related to an "environment variable handling error."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/iostat_advisory.asc; http://secunia.com/advisories/30349; http://securitytracker.com/id?1020085
CVE: CVE-2008-2516
Published: 2008-06-03
Description: pam_sm_authenticate in pam_pgsql.c in libpam-pgsql 0.6.3 does not properly consider operator precedence when evaluating the success of a pam_get_pass function call, which allows local users to gain privileges via a SIGINT signal when this function is executing, as demonstrated by a CTRL-C sequence at a sudo password prompt in an "auth sufficient pam_pgsql.so" configuration.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=481970; http://secunia.com/advisories/30391; http://sourceforge.net/project/shownotes.php?release_id=601775
CVE: CVE-2008-2517
Published: 2008-06-03
Description: The sarab.sh script in SaraB before 0.2.4 places the dar program's encryption key on the command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?r1=34&r2=36; http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?view=log; http://secunia.com/advisories/30394
CVE: CVE-2008-2518
Published: 2008-06-03
Description: Cross-site scripting (XSS) vulnerability in the advanced search mechanism (webapps/search/advanced.jsp) in Sun Java System Web Server 6.1 before SP9 and 7.0 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably related to the next parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30381; http://sunsolve.sun.com/search/document.do?assetkey=1-26-236481-1; http://www.securityfocus.com/bid/29355
CVE: CVE-2008-2519
Published: 2008-06-03
Description: Directory traversal vulnerability in Core FTP client 2.1 Build 1565 allows remote FTP servers to create or overwrite arbitrary files via .. (dot dot) sequences in responses to LIST commands, a related issue to CVE-2002-1345.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30389; http://vuln.sg/coreftp211565-en.html; http://www.coreftp.com/forums/viewtopic.php?t=6078
CVE: CVE-2008-0169
Published: 2008-06-03
Description: Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=483770; http://ikiwiki.info/news/version_2.48/index.html; http://ikiwiki.info/security/#index33h2
CVE: CVE-2008-2520
Published: 2008-06-03
Description: Multiple PHP remote file inclusion vulnerabilities in BigACE 2.4, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[_BIGACE][DIR][addon] parameter to (a) addon/smarty/plugins/function.captcha.php and (b) system/classes/sql/AdoDBConnection.php; and the (2) GLOBALS[_BIGACE][DIR][admin] parameter to (c) item_information.php and (d) jstree.php in system/application/util/, and (e) system/admin/plugins/menu/menuTree/plugin.php, different vectors than CVE-2006-4423.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30183; http://www.securityfocus.com/bid/29157; https://exchange.xforce.ibmcloud.com/vulnerabilities/42343
CVE: CVE-2008-2521
Published: 2008-06-03
Description: SQL injection vulnerability in members.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote authenticated users to execute arbitrary SQL commands via the fid parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30210; http://www.securityfocus.com/bid/29167; https://exchange.xforce.ibmcloud.com/vulnerabilities/42355
CVE: CVE-2008-2522
Published: 2008-06-03
Description: SQL injection vulnerability in members.php in Battle.net Clan Script for PHP 1.5.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the showmember parameter in a members action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30211; http://www.securityfocus.com/bid/29166; https://exchange.xforce.ibmcloud.com/vulnerabilities/42354
CVE: CVE-2008-2523
Published: 2008-06-03
Description: SQL injection vulnerability in the Autopatcher server plugin in RakNet before 3.23 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30200; http://www.jenkinssoftware.com/raknet/forum/index.php?topic=1787.0; http://www.securityfocus.com/bid/29178