deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2465
Published: 2009-07-22
Description: Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via vectors involving double frame construction, related to (1) nsHTMLContentSink.cpp, (2) nsXMLContentSink.cpp, and (3) nsPresShell.cpp, and the nsSubDocumentFrame::Reflow function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html; http://rhn.redhat.com/errata/RHSA-2009-1162.html
CVE: CVE-2009-2466
Published: 2009-07-22
Description: The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsDOMClassInfo.cpp, (2) JS_HashTableRawLookup, and (3) MirrorWrappedNativeParent and js_LockGCThingRT.
CVSS Score: 10.0 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html; http://rhn.redhat.com/errata/RHSA-2009-1162.html
CVE: CVE-2009-2467
Published: 2009-07-22
Description: Mozilla Firefox before 3.0.12 and 3.5 before 3.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a Flash object, a slow script dialog, and the unloading of the Flash plugin, which triggers attempted use of a deleted object.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html; http://rhn.redhat.com/errata/RHSA-2009-1162.html
CVE: CVE-2009-2468
Published: 2009-07-22
Description: Integer overflow in Apple CoreGraphics, as used in Safari before 4.0.3, Mozilla Firefox before 3.0.12, and Mac OS X 10.4.11 and 10.5.8, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long text run that triggers a heap-based buffer overflow during font glyph rendering, a related issue to CVE-2009-1194.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html; http://secunia.com/advisories/35914
CVE: CVE-2009-2469
Published: 2009-07-22
Description: Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property with a watch function and an __defineSetter__ function, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted document, related to a certain pointer misinterpretation.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html; http://rhn.redhat.com/errata/RHSA-2009-1162.html
CVE: CVE-2009-2471
Published: 2009-07-22
Description: The setTimeout function in Mozilla Firefox before 3.0.12 does not properly preserve object wrapping, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted call, related to XPCNativeWrapper.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html; http://rhn.redhat.com/errata/RHSA-2009-1162.html
CVE: CVE-2009-2472
Published: 2009-07-22
Description: Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html; http://rhn.redhat.com/errata/RHSA-2009-1162.html
CVE: CVE-2009-2575
Published: 2009-07-22
Description: The Research In Motion (RIM) BlackBerry 8800 allows remote attackers to cause a denial of service (memory consumption and browser crash) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://lists.grok.org.uk/pipermail/full-disclosure/2009-July/069772.html; http://lists.grok.org.uk/pipermail/full-disclosure/2009-July/069772.html
CVE: CVE-2009-2576
Published: 2009-07-22
Description: Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.  NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2009-07/0192.html; http://archives.neohapsis.com/archives/bugtraq/2009-07/0193.html; http://websecurity.com.ua/3338/
CVE: CVE-2009-2577
Published: 2009-07-22
Description: Opera 9.52 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption, and application hang) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://websecurity.com.ua/3338/; http://www.securityfocus.com/archive/1/505092/100/0/threaded; http://websecurity.com.ua/3338/
CVE: CVE-2009-2578
Published: 2009-07-22
Description: Google Chrome 2.x through 2.0.172 allows remote attackers to cause a denial of service (application crash) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://websecurity.com.ua/3338/; http://www.securityfocus.com/archive/1/505092/100/0/threaded; http://websecurity.com.ua/3338/
CVE: CVE-2008-6868
Published: 2009-07-23
Description: Cross-site scripting (XSS) vulnerability in default/login.php in EditeurScripts EsBaseAdmin 2.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0903-exploits/editeurscripts-xss.txt; http://secunia.com/advisories/34284; http://www.securityfocus.com/bid/34112
CVE: CVE-2008-6869
Published: 2009-07-23
Description: Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for config/oramon.ini.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.vupen.com/english/advisories/2008/3305; https://exchange.xforce.ibmcloud.com/vulnerabilities/46967; https://www.exploit-db.com/exploits/7286
CVE: CVE-2008-6870
Published: 2009-07-23
Description: Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information via a direct request to (1) config.asp and (2) users.asp.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/47107; https://www.exploit-db.com/exploits/7348; https://exchange.xforce.ibmcloud.com/vulnerabilities/47107
CVE: CVE-2008-6871
Published: 2009-07-23
Description: Merlix Educate Server stores db.mdb under the web root with insufficient access control, which allows remote attackers to obtain unspecified sensitive information via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33018; http://www.osvdb.org/50524; https://exchange.xforce.ibmcloud.com/vulnerabilities/47108
CVE: CVE-2008-6872
Published: 2009-07-23
Description: ASPThai.NET ASPThai Forums 8.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/aspthaiForum.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/32912; http://www.osvdb.org/50329; http://www.vupen.com/english/advisories/2008/3301
CVE: CVE-2008-6873
Published: 2009-07-23
Description: SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the TabOpenQuickTab1 parameter to (1) popaccounts.aspx, (2) addressbook.aspx, and (3) emails.aspx.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.vupen.com/english/advisories/2008/3303; https://exchange.xforce.ibmcloud.com/vulnerabilities/52444; https://www.exploit-db.com/exploits/7288
CVE: CVE-2009-2580
Published: 2009-07-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-1862.  Reason: This candidate is a duplicate of CVE-2009-1862.  Notes: All CVE users should reference CVE-2009-1862 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-2581
Published: 2009-07-23
Description: Cross-site scripting (XSS) vulnerability in modifier.php in EditeurScripts EsNews 1.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0903-exploits/editeurscripts-xss.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/49237; http://packetstorm.linuxsecurity.com/0903-exploits/editeurscripts-xss.txt
CVE: CVE-2009-1862
Published: 2009-07-23
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html; http://bugs.adobe.com/jira/browse/FP-1265; http://isc.sans.org/diary.html?storyid=6847
CVE: CVE-2009-2582
Published: 2009-07-23
Description: Stack-based buffer overflow in manager.exe in Akamai Download Manager (aka DLM or dlmanager) before 2.2.4.8 allows remote web servers to execute arbitrary code via a malformed HTTP response during a Redswoosh download, a different vulnerability than CVE-2007-1891 and CVE-2007-1892.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0351.html; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=813; http://secunia.com/advisories/35951
CVE: CVE-2009-2583
Published: 2009-07-23
Description: Multiple session fixation vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0.0.6 allow remote attackers to hijack web sessions via unspecified vectors involving the (1) console and (2) self service interfaces.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/35931; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ55659; http://www-01.ibm.com/support/docview.wss?uid=swg24023826
CVE: CVE-2009-2584
Published: 2009-07-23
Description: Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument, which triggers a stack-based buffer overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://grsecurity.net/~spender/exploit_demo.c; http://lkml.org/lkml/2009/7/20/348; http://lkml.org/lkml/2009/7/20/362
CVE: CVE-2008-6874
Published: 2009-07-24
Description: Multiple SQL injection vulnerabilities in ASP SiteWare autoDealer 1 and 2 allow remote attackers to execute arbitrary SQL commands via the iType parameter in (1) Auto1/type.asp or (2) auto2/type.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/23572; http://www.securityfocus.com/bid/32812; https://exchange.xforce.ibmcloud.com/vulnerabilities/47365
CVE: CVE-2008-6875
Published: 2009-07-24
Description: SQL injection vulnerability in default.asp in ASP Product Catalog allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-5220.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2738&w=2; http://osvdb.org/51976; http://www.securityfocus.com/bid/25884
CVE: CVE-2009-2585
Published: 2009-07-24
Description: SQL injection vulnerability in index.php in Mlffat 2.2 allows remote attackers to execute arbitrary SQL commands via a member cookie in an account editprofile action, a different vector than CVE-2009-1731.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35728; http://www.exploit-db.com/exploits/9091; http://www.osvdb.org/55826
CVE: CVE-2009-2586
Published: 2009-07-24
Description: Cross-site scripting (XSS) vulnerability in articles.php in EDGEPHP EZArticles allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56002; http://packetstormsecurity.org/0907-exploits/ezarticles-xss.txt; http://secunia.com/advisories/35924
CVE: CVE-2009-2587
Published: 2009-07-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in DragDropCart allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to assets/js/ddcart.php, the (2) prefix parameter to includes/ajax/getstate.php, the search parameter to (3) index.php and (4) search.php, the (5) redirect parameter to login.php, and the (6) product parameter to productdetail.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/dragdopcart-xss.txt; http://secunia.com/advisories/35925; http://www.osvdb.org/56065
CVE: CVE-2009-2588
Published: 2009-07-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in Hotscripts Type PHP Clone Script allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) feedback.php, (2) index.php, and (3) lostpassword.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56167; http://osvdb.org/56168; http://osvdb.org/56169
CVE: CVE-2009-2589
Published: 2009-07-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in Hutscripts PHP Website Script allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) feedback.php, (2) index.php, and (3) lostpassword.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56170; http://osvdb.org/56171; http://osvdb.org/56172
CVE: CVE-2009-2590
Published: 2009-07-24
Description: SQL injection vulnerability in showcategory.php in Hutscripts PHP Website Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/56175; http://packetstormsecurity.org/0907-exploits/hutscript-sqlxss.txt; http://secunia.com/advisories/35893
CVE: CVE-2009-2591
Published: 2009-07-24
Description: SQL injection vulnerability in the MyAnnonces module for E-Xoopport 3.1 allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewannonces action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9217; http://www.securityfocus.com/bid/35744; https://exchange.xforce.ibmcloud.com/vulnerabilities/51852
CVE: CVE-2009-2592
Published: 2009-07-24
Description: SQL injection vulnerability in guestbook.php in PHPJunkYard GBook 1.6 allows remote attackers to execute arbitrary SQL commands via the mes_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9197; https://exchange.xforce.ibmcloud.com/vulnerabilities/51827; http://www.exploit-db.com/exploits/9197
CVE: CVE-2009-2593
Published: 2009-07-24
Description: SQL injection vulnerability in censura.php in Censura 1.16.04 allows remote attackers to execute arbitrary SQL commands via the itemid parameter in a details action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35787; http://www.exploit-db.com/exploits/9129; http://www.osvdb.org/55790
CVE: CVE-2009-2594
Published: 2009-07-24
Description: Cross-site scripting (XSS) vulnerability in censura.php in Censura 1.16.04 allows remote attackers to inject arbitrary web script or HTML via the itemid parameter in a details action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35787; http://www.exploit-db.com/exploits/9129; http://www.securityfocus.com/bid/35637
CVE: CVE-2009-2595
Published: 2009-07-24
Description: Cross-site scripting (XSS) vulnerability in productSearch.html in Censura 2.0.4 and 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a ProductSearch action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35795; http://www.censura.info/forums/project.php?issueid=151; http://www.censura.info/forums/showthread.php?t=969
CVE: CVE-2008-6876
Published: 2009-07-24
Description: Cross-site scripting (XSS) vulnerability in login.php in EsPartenaires 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0903-exploits/editeurscripts-xss.txt; http://secunia.com/advisories/34284; http://www.securityfocus.com/bid/34112
CVE: CVE-2008-6877
Published: 2009-07-27
Description: Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loader_file parameter.  NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/46912; http://secunia.com/advisories/31039; http://www.attrition.org/pipermail/vim/2008-July/002028.html
CVE: CVE-2008-6878
Published: 2009-07-27
Description: Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter.  NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/46913; http://secunia.com/advisories/31039; http://www.attrition.org/pipermail/vim/2008-July/002028.html
CVE: CVE-2009-2596
Published: 2009-07-27
Description: Unspecified vulnerability in the Solaris Auditing subsystem in Sun Solaris 9 and 10 and OpenSolaris before snv_121, when extended file attributes are used, allows local users to cause a denial of service (panic) via vectors related to fad_aupath structure members.
CVSS Score: 4.7 (MEDIUM)
References: http://secunia.com/advisories/35980; http://sunsolve.sun.com/search/document.do?assetkey=1-21-122300-39-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-264428-1
CVE: CVE-2009-2597
Published: 2009-07-27
Description: The Sun Java System (SJS) Access Manager Policy Agent module 2.2 for SJS Web Proxy Server 4.0 allows remote attackers to cause a denial of service (daemon crash) via a GET request.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/35979; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141248-01-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-258508-1
CVE: CVE-2009-2598
Published: 2009-07-27
Description: Multiple SQL injection vulnerabilities in Online Grades & Attendance 3.2.6 and earlier allow (1) remote attackers to execute arbitrary SQL commands via the key parameter in a resetpass action to index.php and (2) remote authenticated users to execute arbitrary SQL commands via the ADD parameter in a mailto action to parents/parents.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35304; http://www.exploit-db.com/exploits/8844; http://www.securityfocus.com/archive/1/503943/100/0/threaded
CVE: CVE-2009-2599
Published: 2009-07-27
Description: SQL injection vulnerability in index.php in RadCLASSIFIEDS Gold 2.0 allows remote attackers to execute arbitrary SQL commands via the seller parameter in a search action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35287; http://www.exploit-db.com/exploits/8834; https://exchange.xforce.ibmcloud.com/vulnerabilities/50867
CVE: CVE-2009-2600
Published: 2009-07-27
Description: Multiple directory traversal vulnerabilities in view.php in Webboard 2.90 beta and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the topic parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/8823; https://exchange.xforce.ibmcloud.com/vulnerabilities/50861; http://www.exploit-db.com/exploits/8823
CVE: CVE-2009-2601
Published: 2009-07-27
Description: SQL injection vulnerability in the Joomlaequipment (aka JUser or com_juser) component 2.0.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a show_profile action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8847; http://www.securityfocus.com/bid/35160; http://www.exploit-db.com/exploits/8847
CVE: CVE-2009-2602
Published: 2009-07-27
Description: R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for admin.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/35312; http://www.exploit-db.com/exploits/8849; http://secunia.com/advisories/35312
CVE: CVE-2009-2603
Published: 2009-07-27
Description: Multiple SQL injection vulnerabilities in index.php in Escon SupportPortal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat and (2) tid parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35300; http://www.exploit-db.com/exploits/8840; https://exchange.xforce.ibmcloud.com/vulnerabilities/50874
CVE: CVE-2009-2604
Published: 2009-07-27
Description: Multiple SQL injection vulnerabilities in adminlogin.asp in Zen Help Desk 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) userid (aka username) and (2) PassWord parameters to admin.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8825; https://exchange.xforce.ibmcloud.com/vulnerabilities/50862; http://www.exploit-db.com/exploits/8825
CVE: CVE-2009-2605
Published: 2009-07-27
Description: Multiple SQL injection vulnerabilities in adminquery.php in Traidnt Up 2.0 allow remote attackers to execute arbitrary SQL commands via (1) trupuser and (2) truppassword cookies to uploadcp/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/54809; http://secunia.com/advisories/35273; http://www.exploit-db.com/exploits/8831
CVE: CVE-2009-2606
Published: 2009-07-27
Description: ASP Football Pool 2.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for NFL.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/35317; http://www.exploit-db.com/exploits/8852; http://secunia.com/advisories/35317