deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3540
Published: 2009-10-02
Description: Cross-site scripting (XSS) vulnerability in listads.php in YourFreeWorld Ultra Classifieds Pro allows remote attackers to inject arbitrary web script or HTML via the cn parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35857; http://www.vupen.com/english/advisories/2009/1965; http://secunia.com/advisories/35857
CVE: CVE-2009-3541
Published: 2009-10-02
Description: PHP remote file inclusion vulnerability in CoupleDB.php in PHPGenealogy 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the DataDirectory parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9155; https://exchange.xforce.ibmcloud.com/vulnerabilities/51728; http://www.exploit-db.com/exploits/9155
CVE: CVE-2009-3542
Published: 2009-10-02
Description: Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter to index.php.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/55969; http://packetstormsecurity.org/0907-exploits/ls-lfi.txt; http://secunia.com/advisories/35907
CVE: CVE-2009-3543
Published: 2009-10-02
Description: SQL injection vulnerability in _phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka the login name).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35792; http://www.exploit-db.com/exploits/9107; http://www.osvdb.org/55799
CVE: CVE-2009-2679
Published: 2009-10-05
Description: Unspecified vulnerability in bootpd in HP HP-UX B.11.11, B.11.23, and B.11.31 allows remote attackers to cause a denial of service via unknown attack vectors.
CVSS Score: 7.8 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01866324; http://secunia.com/advisories/36663; http://www.securityfocus.com/bid/36395
CVE: CVE-2009-3525
Published: 2009-10-05
Description: The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's kernel boot parameters without providing the expected password.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html; http://secunia.com/advisories/36908; http://www.openwall.com/lists/oss-security/2009/09/25/1
CVE: CVE-2009-3544
Published: 2009-10-05
Description: Xerver HTTP Server 4.32 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/58104; http://secunia.com/advisories/36681; http://www.exploit-db.com/exploits/9649
CVE: CVE-2009-3545
Published: 2009-10-05
Description: DataWizard Technologies FtpXQ FTP Server 3.0 allows remote authenticated users to cause a denial of service (crash) via a long ABOR command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/9664; http://www.securityfocus.com/bid/36391; http://www.vupen.com/english/advisories/2009/2655
CVE: CVE-2009-3561
Published: 2009-10-05
Description: Directory traversal vulnerability in Xerver HTTP Server 4.32 allows remote attackers to read arbitrary files via a full pathname with a drive letter in the currentPath parameter in a chooseDirectory action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9718; http://www.exploit-db.com/exploits/9718
CVE: CVE-2009-3562
Published: 2009-10-05
Description: Cross-site scripting (XSS) vulnerability in Xerver HTTP Server 4.32 allows remote attackers to inject arbitrary web script or HTML via the currentPath parameter in a chooseDirectory action.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/36681; http://www.exploit-db.com/exploits/9718; http://www.securityfocus.com/bid/36457
CVE: CVE-2009-3564
Published: 2009-10-06
Description: puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://projects.reductivelabs.com/issues/1806; https://bugzilla.redhat.com/show_bug.cgi?id=475201; https://puppet.com/security/cve/cve-2009-3564
CVE: CVE-2009-3567
Published: 2009-10-06
Description: Cross-site scripting (XSS) vulnerability in modules/tickets/functions_ticketsui.php in Kayako SupportSuite and eSupport 3.60.04 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the staff control panel, a different vector than CVE-2007-1145.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.kayako.com/2009/09/security-bulletin-supportsuite-and-esupport/; http://osvdb.org/58516; http://secunia.com/advisories/36807
CVE: CVE-2009-3568
Published: 2009-10-06
Description: Comment RSS 5.x before 5.x-2.2 and 6.x before 6.x-2.2, a module for Drupal, does not properly enforce permissions when a link is added to the RSS feed, which allows remote attackers to obtain the node title and possibly other sensitive content by reading the feed.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/579280; http://drupal.org/node/579290; http://drupal.org/node/579292
CVE: CVE-2009-3569
Published: 2009-10-06
Description: Stack-based buffer overflow in OpenOffice.org (OOo) allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, aka "Client-side stack overflow exploit." NOTE: as of 20091005, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/35036; http://www.securityfocus.com/bid/36285
CVE: CVE-2009-3570
Published: 2009-10-06
Description: Unspecified vulnerability in OpenOffice.org (OOo) has unspecified impact and remote attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.9.  NOTE: as of 20091005, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/35036; http://www.securityfocus.com/bid/36285
CVE: CVE-2009-3571
Published: 2009-10-06
Description: Unspecified vulnerability in OpenOffice.org (OOo) has unknown impact and client-side attack vector, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, aka "Client-side exploit." NOTE: as of 20091005, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/35036; http://www.securityfocus.com/bid/36285
CVE: CVE-2009-3572
Published: 2009-10-06
Description: OpenBSD 4.4, 4.5, and 4.6, when running on an i386 kernel, does not properly handle XMM exceptions, which allows local users to cause a denial of service (kernel panic) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://marc.info/?l=openbsd-security-announce&m=[PII_REDACTED]1594; http://secunia.com/advisories/36956; http://www.openbsd.org/errata44.html
CVE: CVE-2009-3573
Published: 2009-10-06
Description: Multiple insecure method vulnerabilities in the PDIControl.PDI.1 ActiveX control (PDIControl.dll) 2.2.3160.0 in EMC Captiva PixTools Distributed Imaging 2.2 allow remote attackers to create or overwrite arbitrary files via the (1) SetLogFileName and (2) WriteToLog methods.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/36896; http://www.securityfocus.com/bid/36566; http://www.shinnai.net/xplits/TXT_17zVMhRhsRE6qC6DAj52.html
CVE: CVE-2009-3574
Published: 2009-10-06
Description: Tuniac 090517c allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long File1 argument in a .pls playlist file, possibly a buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9671; http://www.exploit-db.com/exploits/9671
CVE: CVE-2009-3527
Published: 2009-10-06
Description: Race condition in the Pipe (IPC) close function in FreeBSD 6.3 and 6.4 allows local users to cause a denial of service (crash) or gain privileges via vectors related to kqueues, which triggers a use after free, leading to a NULL pointer dereference or memory corruption.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://osvdb.org/58544; http://security.freebsd.org/advisories/FreeBSD-SA-09:13.pipe.asc; http://www.securityfocus.com/archive/1/506449
CVE: CVE-2009-3575
Published: 2009-10-07
Description: Buffer overflow in DHTRoutingTableDeserializer.cc in aria2 0.15.3, 1.2.0, and other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/37971; http://www.debian.org/security/2009/dsa-1957; http://www.mandriva.com/security/advisories?name=MDVSA-2009:226
CVE: CVE-2009-3579
Published: 2009-10-07
Description: Cross-site scripting (XSS) vulnerability in the CookieDump.java sample application in Mort Bay Jetty 6.1.19 and 6.1.20 allows remote attackers to inject arbitrary web script or HTML via the Value parameter in a GET request to cookie/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.coresecurity.com/content/jetty-persistent-xss; http://www.securityfocus.com/archive/1/507013/100/0/threaded; http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt
CVE: CVE-2009-2906
Published: 2009-10-07
Description: smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-835
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html; http://news.samba.org/releases/3.0.37/
CVE: CVE-2009-2948
Published: 2009-10-07
Description: mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.
CVSS Score: 1.9 (LOW)
CWE: CWE-732
References: http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html; http://news.samba.org/releases/3.0.37/; http://news.samba.org/releases/3.2.15/
CVE: CVE-2009-3589
Published: 2009-10-08
Description: incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://koji.fedoraproject.org/koji/buildinfo?buildID=134880; https://admin.fedoraproject.org/updates/incron-0.5.5-2.el5; http://koji.fedoraproject.org/koji/buildinfo?buildID=134880
CVE: CVE-2009-3590
Published: 2009-10-08
Description: SQL injection vulnerability in showcat.php in VS PANEL 7.3.6 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34848; http://www.exploit-db.com/exploits/8506; http://www.securityfocus.com/bid/34648
CVE: CVE-2009-3591
Published: 2009-10-08
Description: Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://dopewars.svn.sourceforge.net/viewvc/dopewars/dopewars/trunk/ChangeLog?view=markup&pathrev=1033; http://dopewars.svn.sourceforge.net/viewvc/dopewars/dopewars/trunk/src/serverside.c?r1=1023&r2=1033&pathrev=1033; http://secunia.com/advisories/36961
CVE: CVE-2009-3592
Published: 2009-10-08
Description: Cross-site scripting (XSS) vulnerability in customer/home.php in Qualiteam X-Cart allows remote attackers to inject arbitrary web script or HTML via the email parameter in a subscribed action, a different vector than CVE-2005-1823.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0910-exploits/X-Cart-submail-XSS.txt; http://www.securityfocus.com/bid/36601; https://exchange.xforce.ibmcloud.com/vulnerabilities/53664
CVE: CVE-2009-3593
Published: 2009-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Freelancers 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to placebid.php and (2) jobid parameter to post_resume.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/freelancers-xss.txt; http://secunia.com/advisories/35903; http://www.osvdb.org/55992
CVE: CVE-2009-3594
Published: 2009-10-08
Description: Cross-site scripting (XSS) vulnerability in bpost.php in BLOB Blog System before 1.2 allows remote attackers to inject arbitrary web script or HTML via the postid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blob.yewipeya.net/bpost.php?postid=0008; http://secunia.com/advisories/35938; http://www.osvdb.org/56261
CVE: CVE-2009-3595
Published: 2009-10-08
Description: SQL injection vulnerability in results.php in VS PANEL 7.5.5 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter, a different vector than CVE-2009-3590.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35953; http://www.exploit-db.com/exploits/9171; http://www.osvdb.org/56570
CVE: CVE-2009-3596
Published: 2009-10-08
Description: JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypass authentication and gain administrative access via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/9182; https://exchange.xforce.ibmcloud.com/vulnerabilities/51809; http://www.exploit-db.com/exploits/9182
CVE: CVE-2009-3597
Published: 2009-10-08
Description: Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for autoconfig.dd.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-552
References: http://www.exploit-db.com/exploits/9115; https://exchange.xforce.ibmcloud.com/vulnerabilities/51676; http://www.exploit-db.com/exploits/9115
CVE: CVE-2009-3598
Published: 2009-10-08
Description: Cross-site scripting (XSS) vulnerability in survey_result.php in eCardMAX FormXP 2007 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55859; http://packetstormsecurity.org/0907-exploits/formxp-xss.txt; http://secunia.com/advisories/35836
CVE: CVE-2009-3599
Published: 2009-10-08
Description: Cross-site scripting (XSS) vulnerability in single_winner1.php in HUBScript 1.0 allows remote attackers to inject arbitrary web script or HTML via the bid_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55961; http://packetstormsecurity.org/0907-exploits/hubscript-xssphpinfo.txt; http://secunia.com/advisories/35895
CVE: CVE-2009-3600
Published: 2009-10-08
Description: HUBScript 1.0 allows remote attackers to obtain configuration information via a direct request to manage/phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/55962; http://packetstormsecurity.org/0907-exploits/hubscript-xssphpinfo.txt; http://secunia.com/advisories/35895
CVE: CVE-2009-3601
Published: 2009-10-08
Description: Cross-site scripting (XSS) vulnerability in demo_page.php in Scriptsez Ultimate Poll allows remote attackers to inject arbitrary web script or HTML via the clr parameter in a vote action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55914; http://packetstormsecurity.org/0907-exploits/ultimatepoll-xss.txt; http://secunia.com/advisories/35834
CVE: CVE-2009-3642
Published: 2009-10-09
Description: Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/heat-sql.txt; http://secunia.com/advisories/36900; http://packetstormsecurity.org/0909-exploits/heat-sql.txt
CVE: CVE-2009-3643
Published: 2009-10-09
Description: Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote attackers to cause a denial of service via a long argument to the (1) LIST and (2) NLST commands, a differnt issue than CVE-2008-5626 and CVE-2006-5728.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/58542; http://packetstormsecurity.org/0910-exploits/XM-ftp-dos.txt; http://secunia.com/advisories/36941
CVE: CVE-2009-3644
Published: 2009-10-09
Description: SQL injection vulnerability in the Soundset (com_soundset) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0910-exploits/joomlasoundset-sql.txt; http://www.securityfocus.com/bid/36597; http://packetstormsecurity.org/0910-exploits/joomlasoundset-sql.txt
CVE: CVE-2009-3645
Published: 2009-10-09
Description: SQL injection vulnerability in the JoomlaCache CB Resume Builder (com_cbresumebuilder) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a group_members action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0910-exploits/joomlacbrb-sql.txt; http://secunia.com/advisories/36954; http://www.securityfocus.com/bid/36598
CVE: CVE-2009-3646
Published: 2009-10-09
Description: InterVations NaviCOPA Web Server 3.01 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/33766; http://www.exploit-db.com/exploits/9694; http://www.osvdb.org/58386
CVE: CVE-2009-3647
Published: 2009-10-09
Description: Cross-site scripting (XSS) vulnerability in emaullinks.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote attackers to inject arbitrary web script or HTML via the moudi parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/36413; https://exchange.xforce.ibmcloud.com/vulnerabilities/53642; http://www.securityfocus.com/bid/36413
CVE: CVE-2009-3648
Published: 2009-10-09
Description: Cross-site scripting (XSS) vulnerability in Service Links 6.x-1.0, a module for Drupal, allows remote authenticated users, with 'administer content types' permissions, to inject arbitrary web script or HTML via unspecified vectors when displaying content type names.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.madirish.net/?article=251; http://www.securityfocus.com/bid/36584; https://exchange.xforce.ibmcloud.com/vulnerabilities/53633
CVE: CVE-2009-3649
Published: 2009-10-09
Description: Cross-site scripting (XSS) vulnerability in forums/index.php in Power Bulletin Board (PBBoard) 2.0.2 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter in a new_topic action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.sec-area.com/?p=141%23more-141&gtlang=en; http://www.securityfocus.com/archive/1/506992/100/0/threaded; http://www.sec-area.com/?p=141%23more-141&gtlang=en
CVE: CVE-2009-3650
Published: 2009-10-09
Description: Cross-site scripting (XSS) vulnerability in Dex 5.x-1.0 and earlier and 6.x-1.0-rc1 and earlier, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/592394; http://www.securityfocus.com/bid/36559; https://exchange.xforce.ibmcloud.com/vulnerabilities/53569
CVE: CVE-2009-3651
Published: 2009-10-09
Description: Cross-site scripting (XSS) vulnerability in the "Monitor browsers' feature in Browscap before 5.x-1.1 and 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/592262; http://drupal.org/node/592264; http://drupal.org/node/592272
CVE: CVE-2009-3652
Published: 2009-10-09
Description: Cross-site scripting (XSS) vulnerability in Organic Groups (OG) 5.x-7.x before 5.x-7.4, 5.x-8.x before 5.x-8.1, and 6.x-1.x before 6.x-1.4, a module for Drupal, allows remote authenticated users, with create or edit group nodes permissions, to inject arbitrary web script or HTML via the User-Agent HTTP header, a different issue than CVE-2008-3095.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/592358; http://drupal.org/node/592410; http://drupal.org/node/592412
CVE: CVE-2009-3653
Published: 2009-10-09
Description: Cross-site scripting (XSS) vulnerability in the additional links interface in XML Sitemap 5.x-1.6, a module for Drupal, allows remote authenticated users, with "administer site configuration" permission, to inject arbitrary web script or HTML via unspecified vectors, related to link path output.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/591724; http://drupal.org/node/591732; http://www.securityfocus.com/bid/36556
CVE: CVE-2009-3654
Published: 2009-10-09
Description: Unspecified vulnerability in Boost before 6.x-1.03, a module for Drupal, allows remote attackers to create new webroot directories via unknown attack vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://drupal.org/node/592470; http://drupal.org/node/592490; http://osvdb.org/58424
CVE: CVE-2009-3655
Published: 2009-10-09
Description: Rhino Software Serv-U 7.0.0.1 through 8.2.0.3 allows remote attackers to cause a denial of service (server crash) via unspecified vectors related to the "SITE SET TRANSFERPROGRESS ON" FTP command.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/36873; http://www.serv-u.com/releasenotes/; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5798
CVE: CVE-2009-3656
Published: 2009-10-09
Description: Cross-site request forgery (CSRF) vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/592488; http://www.securityfocus.com/bid/36563; https://exchange.xforce.ibmcloud.com/vulnerabilities/53559