deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-4246
Published: 2005-12-14
Description: SQL injection vulnerability in Plogger Beta 2 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id parameter to index.php and (2) page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://masendav.com/~duke/PloggerChanges_files/FileComparisonReport5.html; http://pridels0.blogspot.com/2005/12/plogger-sqlxss-vuln.html; http://www.osvdb.org/21710
CVE: CVE-2005-4247
Published: 2005-12-14
Description: Cross-site scripting (XSS) vulnerability in index.php in Plogger Beta 2 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchterms parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pridels0.blogspot.com/2005/12/plogger-sqlxss-vuln.html; http://www.osvdb.org/21711; http://www.securityfocus.com/bid/15839
CVE: CVE-2005-4250
Published: 2005-12-14
Description: Directory traversal vulnerability in mcGallery PRO 2.2 and earlier allows remote attackers to read arbitrary files via the language parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/mcgallery-pro-vuln.html; http://secunia.com/advisories/18039; http://www.osvdb.org/21718
CVE: CVE-2005-4251
Published: 2005-12-14
Description: Multiple SQL injection vulnerabilities in mcGallery PRO 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) start, and (3) rand parameters to show.php, and the (4) album parameter to index.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/mcgallery-pro-vuln.html; http://secunia.com/advisories/18039; http://www.osvdb.org/21719
CVE: CVE-2005-4252
Published: 2005-12-14
Description: Cross-site scripting (XSS) vulnerability in mcGallery PRO 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search module parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/mcgallery-pro-vuln.html; http://secunia.com/advisories/18039; http://www.osvdb.org/21721
CVE: CVE-2005-3358
Published: 2005-12-14
Description: Linux kernel before 2.6.15 allows local users to cause a denial of service (panic) via a set_mempolicy call with a 0 bitmask, which causes a panic when a page fault occurs.
CVSS Score: 4.9 (MEDIUM)
References: http://linux.bkbits.net:8080/linux-2.6/cset%4042307e9fp8ihEMrfaoPMp_agDevQNA; http://lists.suse.de/archive/suse-security-announce/2006-Feb/0010.html; http://secunia.com/advisories/18216
CVE: CVE-2005-4242
Published: 2005-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the address book and (2) contact data.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.horde.org/archives/announce/2005/000235.html; http://secunia.com/advisories/17968; http://www.vupen.com/english/advisories/2005/2837
CVE: CVE-2005-1930
Published: 2005-12-14
Description: Directory traversal vulnerability in the Crystal Report component (rptserver.asp) in Trend Micro ServerProtect Management Console 5.58, as used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1, and possibly earlier versions, allows remote attackers to read arbitrary files via the IMAGE parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18038; http://securityreason.com/securityalert/258; http://securitytracker.com/id?1015358
CVE: CVE-2005-3360
Published: 2005-12-14
Description: The installation of Trend Micro PC-Cillin Internet Security 2005 12.00 build 1244, and probably previous versions, uses insecure default ACLs, which allows local users to cause a denial of service (disabled service) and gain system privileges by modifying or moving critical program files.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/18044; http://securitytracker.com/id?1015357; http://www.idefense.com/application/poi/display?id=351&type=vulnerabilities
CVE: CVE-2005-1929
Published: 2005-12-14
Description: Multiple heap-based buffer overflows in (1) isaNVWRequest.dll and (2) relay.dll in Trend Micro ServerProtect Management Console 5.58 and earlier, as used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1, allow remote attackers to execute arbitrary code via "wrapped" length values in Chunked transfer requests.  NOTE: the original report suggests that the relay.dll issue is related to a problem in which a Microsoft Foundation Classes (MFC) static library returns invalid values under heavy load.  As such, this might not be a vulnerability in Trend Micro's product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/039972.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/039978.html; http://secunia.com/advisories/18038
CVE: CVE-2005-1928
Published: 2005-12-14
Description: Trend Micro ServerProtect EarthAgent for Windows Management Console 5.58 and possibly earlier versions, when running with Trend Micro Control Manager 2.5 and 3.0, and Damage Cleanup Server 1.1, allows remote attackers to cause a denial of service (CPU consumption) via a flood of crafted packets with a certain "magic value" to port 5005, which also leads to a memory leak.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://kb.trendmicro.com/solutions/search/main/search/solutionDetail.asp?solutionID=25254; http://secunia.com/advisories/18038; http://securityreason.com/securityalert/259
CVE: CVE-2005-4243
Published: 2005-12-15
Description: Multiple SQL injection vulnerabilities in QuickPayPro 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) popupid parameter in popups.edit.php; (2) so, (3) sb, and (4) nr parameters in customer.tickets.view.php; (5) subrackingid parameter in subscribers.tracking.edit.php; (6) delete parameter in design.php; (7) trackingid parameter in tracking.details.php; and (8) customerid parameter in sales.view.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/quickpaypro-31-multiple-vuln.html; http://secunia.com/advisories/17981; http://www.osvdb.org/21676
CVE: CVE-2005-4248
Published: 2005-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in QuickPayPro 3.1 allow remote attackers to inject arbitrary web script or HTML via various fields, such as those in (1) communication/subscribers.tracking.add.php, (2) support/tickets.add.php, and (3) mycompany/categories.php.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/quickpaypro-31-multiple-vuln.html; http://secunia.com/advisories/17981; http://www.osvdb.org/21682
CVE: CVE-2005-4249
Published: 2005-12-15
Description: ADP Forum 2.0 through 2.0.3 stores sensitive information in plaintext files under the web document root with insufficient access control, which allows remote attackers to obtain user credentials via requests to the forum/users directory.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18027; http://securityreason.com/securityalert/253; http://www.blogcu.com/Liz0ziM/144336/
CVE: CVE-2005-4253
Published: 2005-12-15
Description: Cross-site scripting (XSS) vulnerability in getdox.php in Torrential 1.2 allows remote attackers to inject arbitrary web script or HTML via the URL.  NOTE: this might be resultant from CVE-2005-4160.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0720.html; http://securitytracker.com/id?1015338; http://www.osvdb.org/21304
CVE: CVE-2005-4254
Published: 2005-12-15
Description: SQL injection vulnerability in view_Results.php in DreamLevels DreamPoll 3.0 final allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/dreampoll-sql-inj.html; http://secunia.com/advisories/18014; http://www.osvdb.org/21688
CVE: CVE-2005-4255
Published: 2005-12-15
Description: Cross-site scripting (XSS) vulnerability in TextSearch in WikkaWiki 1.1.6.0 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded phrase parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/wikkawiki-xss-vuln.html; http://secunia.com/advisories/18015; http://www.securityfocus.com/bid/15860
CVE: CVE-2005-4256
Published: 2005-12-15
Description: Cross-site scripting (XSS) vulnerability in forum.asp in ASP-DEV XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via the forum_title parameter.  NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID.  In addition, its accuracy is in question because "forum_title" does not appear to be specified in the source code for XM Forum RC3.  It is possible, but not certain, that this is CVE-2004-2211.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/15858; http://www.securityfocus.com/bid/15858
CVE: CVE-2005-4257
Published: 2005-12-15
Description: Linksys WRT54GS and BEFW11S4 allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LAND). NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/15861; http://www.securityfocus.com/bid/15861
CVE: CVE-2005-4258
Published: 2005-12-15
Description: Unspecified Cisco Catalyst Switches allow remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LanD). NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/15864; https://exchange.xforce.ibmcloud.com/vulnerabilities/44543; http://www.securityfocus.com/bid/15864
CVE: CVE-2005-4259
Published: 2005-12-15
Description: Multiple SQL injection vulnerabilities in ASPBB 0.4 allow remote attackers to execute arbitrary SQL commands via the (1) TID parameter in topic.asp, (2) FORUM_ID parameter in forum.asp, and (3) PROFILE_ID parameter in profile.asp.  NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/15859; https://exchange.xforce.ibmcloud.com/vulnerabilities/40004; http://www.securityfocus.com/bid/15859
CVE: CVE-2005-4260
Published: 2005-12-15
Description: Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting (XSS) attacks by replacing the ">" in the tag with a "<", which bypasses the regular expressions that sanitize the data, but is automatically corrected by many web browsers.  NOTE: it could be argued that this vulnerability is due to a design limitation of many web browsers; if so, then this should not be treated as a vulnerability in PHP-Nuke.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/419496/100/0/threaded; http://www.securityfocus.com/archive/1/419991/100/0/threaded; http://www.securityfocus.com/bid/15855
CVE: CVE-2005-4261
Published: 2005-12-15
Description: Unspecified vulnerability in Positive Software Corporation CP+ (cpplus) before 2.5.5 allows attackers to have unknown impact and attack vectors, related to "a possible security flaw caused by a bug in Perl." NOTE: unless CP+ includes its own copy of Perl with CVE-2005-3962, this is a different vulnerability than CVE-2005-3962; however, there is insufficient information to be sure.
CVSS Score: 7.8 (HIGH)
References: http://cpplus.info/feature_25.html; http://secunia.com/advisories/17975; http://secunia.com/advisories/18005
CVE: CVE-2005-4262
Published: 2005-12-15
Description: Cross-site scripting (XSS) vulnerability in the News module in Envolution allows remote attackers to inject arbitrary web script or HTML via the (1) startrow and (2) catid parameter.  NOTE: this issue might be resultant from the SQL injection problem (CVE-2005-4263).
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18069; http://securitytracker.com/id?1015351; http://www.osvdb.org/21751
CVE: CVE-2005-4263
Published: 2005-12-15
Description: SQL injection vulnerability in the News module in Envolution allows remote attackers to execute arbitrary SQL commands via the (1) startrow and (2) catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/18069; http://securitytracker.com/id?1015351; http://www.osvdb.org/21752
CVE: CVE-2005-4264
Published: 2005-12-15
Description: Multiple SQL injection vulnerabilities in index.php in PHP Support Tickets 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields, and (3) id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18067; http://securitytracker.com/id?1015352; http://www.nii.co.in/vuln/PHPSupportTickets.html
CVE: CVE-2005-4265
Published: 2005-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-4209.  Reason: This candidate is a duplicate of CVE-2005-4209.  Notes: All CVE users should reference CVE-2005-4209 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-4266
Published: 2005-12-15
Description: WorldClient.dll in Alt-N MDaemon and WorldClient 8.1.3 trusts a Session parameter that contains a randomly generated session ID that is associated with a username, which allows remote attackers to perform actions as other users by guessing or sniffing the random value.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17990; http://www.ipomonis.com/advisories/mdaemon.zip; http://secunia.com/advisories/17990
CVE: CVE-2005-4268
Published: 2005-12-15
Description: Buffer overflow in cpio 2.6-8.FC4 on 64-bit platforms, when creating a cpio archive, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a file whose size is represented by more than 8 digits.
CVSS Score: 3.7 (LOW)
CWE: CWE-119
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:03.cpio.asc; http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:237; http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
CVE: CVE-2005-4269
Published: 2005-12-15
Description: mshtml.dll in Microsoft Windows XP, Server 2003, and Internet Explorer 6.0 SP1 allows attackers to cause a denial of service (access violation) by causing mshtml.dll to process button-focus events at the same time that a document is reloading, as seen in Microsoft Office InfoPath 2003 by repeatedly clicking the "Delete" button in a repeating section in a form.  NOTE: the normal operation of InfoPath appears to involve a local user without any privilege boundaries, so this might not be a vulnerability in InfoPath.  If no realistic scenarios exist for this problem in other products, then perhaps it should be excluded from CVE.
CVSS Score: 7.8 (HIGH)
References: http://support.microsoft.com/kb/908233/; http://www.securiteam.com/windowsntfocus/6V00B1FEUE.html; http://support.microsoft.com/kb/908233/
CVE: CVE-2005-4270
Published: 2005-12-15
Description: Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Authenticate header containing a long Realm field.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18013; http://securityreason.com/securityalert/260; http://securitytracker.com/id?1015362
CVE: CVE-2005-4271
Published: 2005-12-15
Description: Buffer overflow in the malloc debug system in IBM AIX 5.3 allows local users to execute arbitrary code.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/18088; http://www-1.ibm.com/support/search.wss?rs=0&q=IY78227&apar=only; http://www.securityfocus.com/archive/1/419577/100/0/threaded
CVE: CVE-2005-4272
Published: 2005-12-15
Description: Multiple buffer overflows in IBM AIX 5.1, 5.2, and 5.3 allow remote attackers to execute arbitrary code via (1) muxatmd and (2) slocal.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18088; http://securitytracker.com/id?1015366; http://securitytracker.com/id?1015367
CVE: CVE-2005-4273
Published: 2005-12-15
Description: Multiple unspecified vulnerabilities in (1) getShell and (2) getCommand in IBM AIX 5.3 allow local users to append to arbitrary files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/18088; http://www.securityfocus.com/archive/1/419577/100/0/threaded; http://www.securityfocus.com/archive/1/419634/100/0/threaded
CVE: CVE-2005-4274
Published: 2005-12-15
Description: Unspecified vulnerability in Business Objects WebIntelligence 6.5x allows remote attackers to cause a denial of service (user account lock out) via unknown attack vectors related to "authentication mechanisms" and "form input."
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1015355; http://www.securityfocus.com/archive/1/419493/100/0/threaded; http://securitytracker.com/id?1015355
CVE: CVE-2005-3253
Published: 2005-12-16
Description: Wireless Access Points (AP) for (1) Avaya AP-3 through AP-6 2.5 to 2.5.4, and AP-7/AP-8 2.5 and other versions before 3.1, and (2) Proxim AP-600 and AP-2000 before 2.5.5, and Proxim AP-700 and AP-4000 after 2.4.11 and before 3.1, use a static WEP key of "12345", which allows remote attackers to bypass authentication.
CVSS Score: 7.5 (HIGH)
References: http://keygen.proxim.com/support/cs/Documents/802.1x_vulnerability.pdf; http://secunia.com/advisories/18047; http://secunia.com/advisories/18057
CVE: CVE-2005-4275
Published: 2005-12-16
Description: Scientific Atlanta DPX2100 Cable Modem allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LanD), as demonstrated using hping2.  NOTE: the provenance of this issue is unknown; the details are obtained solely from third party information.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/15870; http://www.securityfocus.com/bid/15870
CVE: CVE-2005-4276
Published: 2005-12-16
Description: Westell Versalink 327W allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LanD). NOTE: the provenance of this issue is unknown; the details are obtained solely from third party information.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/15869; http://www.securityfocus.com/bid/15869
CVE: CVE-2005-4277
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in index.php in toendaCMS before 0.7 Beta allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18058; http://securitytracker.com/id?1015354; http://www.osvdb.org/21767
CVE: CVE-2005-4278
Published: 2005-12-16
Description: Untrusted search path vulnerability in Perl before 5.8.7-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/17232; http://secunia.com/advisories/55314; http://www.gentoo.org/security/en/glsa/glsa-200510-14.xml
CVE: CVE-2005-4279
Published: 2005-12-16
Description: Untrusted search path vulnerability in Qt-UnixODBC before 3.3.4-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/17232; http://www.gentoo.org/security/en/glsa/glsa-200510-14.xml; http://www.osvdb.org/20087
CVE: CVE-2005-4280
Published: 2005-12-16
Description: Untrusted search path vulnerability in CMake before 2.2.0-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/17232; http://www.gentoo.org/security/en/glsa/glsa-200510-14.xml; http://www.osvdb.org/20088
CVE: CVE-2005-4281
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in Zaygo HostingCart 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via certain search module parameters, possibly the root parameter to zaygo.cgi.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/hostingcart-xss.html; http://secunia.com/advisories/18036; http://www.osvdb.org/21729
CVE: CVE-2005-4282
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in Zaygo DomainCart 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML, possibly via the root parameter to zaygo.cgi.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/domaincart-xss.html; http://secunia.com/advisories/18035; http://www.osvdb.org/21729
CVE: CVE-2005-4283
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in The CITY Shop 1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via parameters to the search module, possibly SKey to store.cgi.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/city-shop-xss-vuln.html; http://secunia.com/advisories/18041; http://www.osvdb.org/21728
CVE: CVE-2005-4284
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in StaticStore Search Engine 1.189A and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to search.cgi, possibly the keywords parameter.  NOTE: this issue was originally disputed by the vendor, but it has since been acknowledged.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/staticstore-search-engine-friendly-e.html; http://secunia.com/advisories/18037; http://www.osvdb.org/21714
CVE: CVE-2005-4285
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in pdestore.cgi in Dick Copits PDEstore 1.8 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) the search module parameter or the (2) product and (3) cart_id parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/pdestore-xss-vuln.html; http://secunia.com/advisories/18042; http://www.osvdb.org/21727
CVE: CVE-2005-4286
Published: 2005-12-16
Description: Unspecified vulnerability in PhpLogCon before 1.2.2 allows remote attackers to use arbitrary profiles via unknown vectors involving "'smart' values for userid and password," probably involving an SQL injection vulnerability in the (1) pass and (2) usr parameters in submit.php.
CVSS Score: 7.5 (HIGH)
References: http://cvs.sourceforge.net/viewcvs.py/phplogcon/phplogcon/submit.php?r1=1.4&r2=1.5; http://secunia.com/advisories/18053; http://www.phplogcon.com/Article9.phtml
CVE: CVE-2005-4287
Published: 2005-12-16
Description: PHP remote file include vulnerability in MarmaraWeb E-commerce allows remote attackers to execute arbitrary code via the page parameter to index.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/263; http://www.osvdb.org/21903; http://www.securityfocus.com/archive/1/419587/100/0/threaded
CVE: CVE-2005-4288
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in index.php in MarmaraWeb E-commerce allows remote attackers to inject arbitrary web script or HTML via the page parameter to index.php.  NOTE: this might be resultant from CVE-2005-4287.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/264; http://www.osvdb.org/21902; http://www.securityfocus.com/archive/1/419588/100/0/threaded