deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6585
Published: 2009-04-03
Description: Cross-site request forgery (CSRF) vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/44646; http://secunia.com/advisories/29935; http://www.securityfocus.com/archive/1/491066/100/0/threaded
CVE: CVE-2008-6586
Published: 2009-04-03
Description: Cross-site request forgery (CSRF) vulnerability in gui/index.php in µTorrent (uTorrent) WebUI 0.315 allows remote attackers to (1) hijack the authentication of users for requests that force the download of arbitrary torrent files via the add-url action and (2) hijack the authentication of administrators for requests that modify the administrator account via the setsetting action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/44647; http://www.securityfocus.com/archive/1/491066/100/0/threaded; http://www.securityfocus.com/bid/28847
CVE: CVE-2008-6587
Published: 2009-04-03
Description: Cross-site request forgery (CSRF) vulnerability in index.tmpl in Vuze (formerly Azureus HTML WebUI), probably 0.7.6, allows remote attackers to hijack the authentication of users for requests that force the download of arbitrary torrent files via the upurl parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/archive/1/491066/100/0/threaded; http://www.securityfocus.com/bid/28848; https://exchange.xforce.ibmcloud.com/vulnerabilities/41926
CVE: CVE-2008-6588
Published: 2009-04-03
Description: Aztech ADSL2/2+ 4-port router has a default "isp" account with a default "isp" password, which allows remote attackers to obtain access if this default is not changed.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/vuln-dev/2008-q2/0010.html; http://archives.neohapsis.com/archives/vuln-dev/2008-q2/0012.html; http://osvdb.org/51229
CVE: CVE-2008-6589
Published: 2009-04-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) index.php and (2) LightNEasy.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29833; http://www.osvdb.org/44676; http://www.osvdb.org/44677
CVE: CVE-2008-6590
Published: 2009-04-03
Description: Multiple directory traversal vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to read arbitrary files via a .. (dot dot) in the page parameter to (1) index.php and (2) LightNEasy.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29833; http://www.osvdb.org/44672; http://www.osvdb.org/44673
CVE: CVE-2008-6591
Published: 2009-04-03
Description: LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via the page parameter to (1) index.php and (2) LightNEasy.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/44678; http://osvdb.org/44679; http://secunia.com/advisories/29833
CVE: CVE-2008-6592
Published: 2009-04-03
Description: thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/29833; http://www.osvdb.org/44674; http://www.securityfocus.com/archive/1/491064/100/0/threaded
CVE: CVE-2008-6593
Published: 2009-04-03
Description: SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers to inject arbitrary PHP code into comments.dat via the dlid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29833; http://www.osvdb.org/44675; http://www.securityfocus.com/archive/1/491064/100/0/threaded
CVE: CVE-2008-6594
Published: 2009-04-03
Description: SQL injection vulnerability in the cm_rdfexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45094; http://typo3.org/teams/security/security-bulletins/typo3-20080416-2/; https://exchange.xforce.ibmcloud.com/vulnerabilities/49829
CVE: CVE-2008-6595
Published: 2009-04-03
Description: SQL injection vulnerability in the pmk_rssnewsexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20080416-2/; http://www.osvdb.org/45093; https://exchange.xforce.ibmcloud.com/vulnerabilities/49830
CVE: CVE-2008-6596
Published: 2009-04-03
Description: SQL injection vulnerability in admin/index.php in PHCDownload 1.1 allows remote attackers to execute arbitrary SQL commands via the hash parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://downloads.securityfocus.com/vulnerabilities/exploits/28922.html; http://secunia.com/advisories/28258; http://www.securityfocus.com/bid/28922
CVE: CVE-2008-6597
Published: 2009-04-03
Description: Cross-site scripting (XSS) vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web script or HTML via the step parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/28922.html; http://www.securityfocus.com/bid/28922; http://downloads.securityfocus.com/vulnerabilities/exploits/28922.html
CVE: CVE-2008-6598
Published: 2009-04-03
Description: Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to "bri restart logic."
CVSS Score: 10.0 (HIGH)
CWE: CWE-362
References: http://freshmeat.net/projects/wanpipe/releases/276026; http://osvdb.org/48840; https://exchange.xforce.ibmcloud.com/vulnerabilities/49828
CVE: CVE-2008-6599
Published: 2009-04-03
Description: cookiecheck.php in CookieCheck 1.0 stores tmp/cc_sessions under the web root with insufficient access control, which allows remote attackers to obtain session data via a direct request related to the "default session save path."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://code.google.com/p/cookiecheck/; http://code.google.com/p/cookiecheck/source/browse/patches/cookiecheck-1.0-security-fix-1.patch?spec=svn11&r=11; http://osvdb.org/48865
CVE: CVE-2008-6600
Published: 2009-04-03
Description: Cross-site scripting (XSS) vulnerability in the search feature in XMLPortal 3.0 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/44289; http://osvdb.org/ref/44/xmlportal-xss.txt; http://osvdb.org/44289
CVE: CVE-2008-6601
Published: 2009-04-03
Description: Unspecified vulnerability in Epona 1.5rc3 allows remote attackers to obtain the real IP address of users via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://freshmeat.net/projects/epona/releases/276088; http://osvdb.org/48866; http://www.securityfocus.com/bid/34651
CVE: CVE-2008-6602
Published: 2009-04-03
Description: Unspecified vulnerability in Download Center Lite before 2.1 has unknown impact and attack vectors related to "A minor security fix."
CVSS Score: 10.0 (HIGH)
References: http://freshmeat.net/projects/download-center-lite/releases/275651; http://osvdb.org/48834; http://www.securityfocus.com/bid/34653
CVE: CVE-2008-6603
Published: 2009-04-03
Description: MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability than CVE-2008-1937.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://hg.moinmo.in/moin/1.6/rev/543ae9bdbe26; http://hg.moinmo.in/moin/1.7/rev/88356b3f849a; http://moinmo.in/MoinMoinBugs/AclHierarchicPageAclSupercededByAclRightsAfter
CVE: CVE-2009-0556
Published: 2009-04-03
Description: Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx; http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx; http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx
CVE: CVE-2009-1239
Published: 2009-04-03
Description: IBM DB2 9.1 before FP7 returns incorrect query results in certain situations related to the order of application of an INNER JOIN predicate and an OUTER JOIN predicate, which might allow attackers to obtain sensitive information via a crafted query.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR31886; http://www-01.ibm.com/support/docview.wss?uid=swg21381257; http://www.vupen.com/english/advisories/2009/0912
CVE: CVE-2009-1240
Published: 2009-04-03
Description: Unspecified vulnerability in the IBM Proventia engine 4.9.0.0.44 20081231, as used in IBM Proventia Network Mail Security System, Network Mail Security System Virtual Appliance, Desktop Endpoint Security, Network Multi-Function Security (MFS), and possibly other products, allows remote attackers to bypass detection of malware via a modified RAR archive.
CVSS Score: 10.0 (HIGH)
References: http://blog.zoller.lu/2009/04/ibm-proventia-evasion-limited-details.html; http://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=5417; http://www.securityfocus.com/archive/1/502369/100/0/threaded
CVE: CVE-2009-1241
Published: 2009-04-03
Description: Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive.
CVSS Score: 7.5 (HIGH)
References: http://blog.zoller.lu/2009/04/clamav-094-and-below-evasion-and-bypass.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
CVE: CVE-2008-6604
Published: 2009-04-04
Description: Directory traversal vulnerability in index.php in PicoFlat CMS 0.5.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagina parameter, a different vulnerability than CVE-2007-5390.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29424; https://www.exploit-db.com/exploits/5690; http://www.securityfocus.com/bid/29424
CVE: CVE-2008-6605
Published: 2009-04-06
Description: Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 1701HG, 1800HW, 2071HG, and 2700HG with firmware 3.17.5, 3.7.1, 4.25.19, or 5.29.51 allows remote attackers to hijack the intranet connectivity of arbitrary users for requests that cause a denial of service (network outage) via a page parameter with a % (percent) character followed by a non-alphanumeric character.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/49835; http://www.securityfocus.com/bid/32211; https://exchange.xforce.ibmcloud.com/vulnerabilities/46537
CVE: CVE-2008-6606
Published: 2009-04-06
Description: SQL injection vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32076; https://www.exploit-db.com/exploits/6967; https://www.exploit-db.com/exploits/6971
CVE: CVE-2008-6607
Published: 2009-04-06
Description: Cross-site scripting (XSS) vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to inject arbitrary web script or HTML via the thema parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/32082; https://www.exploit-db.com/exploits/6971; http://www.securityfocus.com/bid/32082
CVE: CVE-2008-6608
Published: 2009-04-06
Description: Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary SQL commands via (1) the user_name parameter (aka user field) to admin/index.php, (2) the user_pass parameter (aka pass field) to admin/index.php, or (3) the id parameter to calendar_details.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49755; http://osvdb.org/49756; http://secunia.com/advisories/32596
CVE: CVE-2009-1242
Published: 2009-04-06
Description: The vmx_set_msr function in arch/x86/kvm/vmx.c in the VMX implementation in the KVM subsystem in the Linux kernel before 2.6.29.1 on the i386 platform allows guest OS users to cause a denial of service (OOPS) by setting the EFER_LME (aka "Long mode enable") bit in the Extended Feature Enable Register (EFER) model-specific register, which is specific to the x86_64 platform.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=16175a796d061833aacfbd9672235f2d2725df65; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00002.html
CVE: CVE-2009-1243
Published: 2009-04-06
Description: net/ipv4/udp.c in the Linux kernel before 2.6.29.1 performs an unlocking step in certain incorrect circumstances, which allows local users to cause a denial of service (panic) by reading zero bytes from the /proc/net/udp file and unspecified other files, related to the "udp seq_file infrastructure."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=30842f2989aacfaba3ccb39829b3417be9313dbe; http://openwall.com/lists/oss-security/2009/04/01/4; http://secunia.com/advisories/34478
CVE: CVE-2008-4916
Published: 2009-04-06
Description: Unspecified vulnerability in a guest virtual device driver in VMware Workstation before 5.5.9 build 126128, and 6.5.1 and earlier 6.x versions; VMware Player before 1.0.9 build 126128, and 2.5.1 and earlier 2.x versions; VMware ACE before 1.0.8 build 125922, and 2.5.1 and earlier 2.x versions; VMware Server 1.x before 1.0.8 build 126538 and 2.0.x before 2.0.1 build 156745; VMware Fusion before 2.0.1; VMware ESXi 3.5; and VMware ESX 3.0.2, 3.0.3, and 3.5 allows guest OS users to cause a denial of service (host OS crash) via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.vmware.com/pipermail/security-announce/2009/000054.html; http://seclists.org/fulldisclosure/2009/Apr/0036.html; http://security.gentoo.org/glsa/glsa-201209-25.xml
CVE: CVE-2009-0518
Published: 2009-04-06
Description: VI Client in VMware VirtualCenter before 2.5 Update 4, VMware ESXi 3.5 before Update 4, and VMware ESX 3.5 before Update 4 retains the VirtualCenter Server password in process memory, which might allow local users to obtain this password.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.vmware.com/pipermail/security-announce/2009/000054.html; http://seclists.org/fulldisclosure/2009/Apr/0036.html; http://secunia.com/advisories/34585
CVE: CVE-2009-0908
Published: 2009-04-06
Description: Unspecified vulnerability in the ACE shared folders implementation in the VMware Host Guest File System (HGFS) shared folders feature in VMware ACE 2.5.1 and earlier allows attackers to enable a disabled shared folder.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.vmware.com/pipermail/security-announce/2009/000054.html; http://seclists.org/fulldisclosure/2009/Apr/0036.html; http://www.securityfocus.com/bid/34373
CVE: CVE-2009-0909
Published: 2009-04-06
Description: Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 156735, VMware ACE 2.5.x before 2.5.2 build 156735, and VMware Server 2.0.x before 2.0.1 build 156745 allows remote attackers to execute arbitrary code via a crafted web page or video file, aka ZDI-CAN-435.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.vmware.com/pipermail/security-announce/2009/000054.html; http://seclists.org/fulldisclosure/2009/Apr/0036.html; http://security.gentoo.org/glsa/glsa-201209-25.xml
CVE: CVE-2009-0910
Published: 2009-04-06
Description: Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 156735, VMware ACE 2.5.x before 2.5.2 build 156735, and VMware Server 2.0.x before 2.0.1 build 156745 allows remote attackers to execute arbitrary code via a crafted web page or video file, aka ZDI-CAN-436.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.vmware.com/pipermail/security-announce/2009/000054.html; http://seclists.org/fulldisclosure/2009/Apr/0036.html; http://security.gentoo.org/glsa/glsa-201209-25.xml
CVE: CVE-2009-1146
Published: 2009-04-06
Description: Unspecified vulnerability in an ioctl in hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 allows local users to cause a denial of service via unknown vectors, a different vulnerability than CVE-2008-3761.
CVSS Score: 4.9 (MEDIUM)
References: http://lists.vmware.com/pipermail/security-announce/2009/000054.html; http://seclists.org/fulldisclosure/2009/Apr/0036.html; http://www.securityfocus.com/bid/34373
CVE: CVE-2009-1147
Published: 2009-04-06
Description: Unspecified vulnerability in vmci.sys in the Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 2.0.x before 2.0.1 build 156745 allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://lists.vmware.com/pipermail/security-announce/2009/000054.html; http://seclists.org/fulldisclosure/2009/Apr/0036.html; http://www.securityfocus.com/bid/34373
CVE: CVE-2008-6609
Published: 2009-04-06
Description: Cross-site scripting (XSS) vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2 allows remote attackers to inject arbitrary web script or HTML via the path parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0812-exploits/phpcksec-xssdisclose.txt; http://www.securityfocus.com/bid/32890; https://exchange.xforce.ibmcloud.com/vulnerabilities/47425
CVE: CVE-2008-6610
Published: 2009-04-06
Description: Absolute path traversal vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2.0 allows remote attackers to list arbitrary directories and read arbitrary files via a full pathname in the file parameter.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/0812-exploits/phpcksec-xssdisclose.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/47426; http://packetstormsecurity.org/0812-exploits/phpcksec-xssdisclose.txt
CVE: CVE-2008-6611
Published: 2009-04-06
Description: SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32886; http://www.osvdb.org/50349; http://www.securityfocus.com/bid/32537
CVE: CVE-2008-6612
Published: 2009-04-06
Description: Unrestricted file upload vulnerability in admin/uploader.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/32886; http://www.securityfocus.com/bid/32537; http://www.vupen.com/english/advisories/2008/3291
CVE: CVE-2008-6613
Published: 2009-04-06
Description: uploader.php in minimal-ablog 0.4 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32886; http://www.osvdb.org/50350; https://exchange.xforce.ibmcloud.com/vulnerabilities/46965
CVE: CVE-2009-1245
Published: 2009-04-06
Description: Multiple SQL injection vulnerabilities in the insert_to_pastebin function in php/cccp-admin/inc/functions.php in CCCP Community Clan Portal Pastebin before 2.80 allow remote attackers to execute arbitrary SQL commands via the (1) subject, (2) language, and (3) nickname parameters to php/cccp-pages/submit.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://jcsfog.cvs.sourceforge.net/viewvc/jcsfog/CCCP-Pastebin/php/cccp-admin/inc/functions.php?r1=1.10&r2=1.11; http://secunia.com/advisories/34474; http://sourceforge.net/project/shownotes.php?release_id=670960
CVE: CVE-2009-1246
Published: 2009-04-06
Description: Multiple directory traversal vulnerabilities in Blogplus 1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) row_mysql_blocks_center_down[file] parameter to includes/block_center_down.php; (2) row_mysql_blocks_center_top[file] includes/parameter to block_center_top.php; (3) row_mysql_blocks_left[file] parameter to includes/block_left.php; (4) row_mysql_blocks_right[file] parameter to includes/block_right.php; and row_mysql_bloginfo[theme] parameter to (5) includes/window_down.php and (6) includes/window_top.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/34261; https://exchange.xforce.ibmcloud.com/vulnerabilities/49446; https://www.exploit-db.com/exploits/8290
CVE: CVE-2009-1247
Published: 2009-04-06
Description: SQL injection vulnerability in login.php in Acute Control Panel 1.0.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34485; http://www.securityfocus.com/bid/34265; https://exchange.xforce.ibmcloud.com/vulnerabilities/49444
CVE: CVE-2009-1248
Published: 2009-04-06
Description: Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the theme_directory parameter to (1) container.php and (2) header.php in themes/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/34485; http://www.securityfocus.com/bid/34265; https://exchange.xforce.ibmcloud.com/vulnerabilities/49443
CVE: CVE-2009-1249
Published: 2009-04-06
Description: Cross-site scripting (XSS) vulnerability in Feed element mapper 5.x before 5.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the content title in admin/content/node-type/nodetype/map.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/414644; http://drupal.org/node/414702; http://secunia.com/advisories/34497