deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4398
Published: 2009-12-22
Description: Cross-site scripting (XSS) vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs_religiousartgallery) extension 0.1.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE: CVE-2009-4399
Published: 2009-12-22
Description: SQL injection vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs_religiousartgallery) extension 0.1.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE: CVE-2009-4400
Published: 2009-12-22
Description: Cross-site scripting (XSS) vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE: CVE-2009-4401
Published: 2009-12-22
Description: SQL injection vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE: CVE-2009-3580
Published: 2009-12-23
Description: Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password via the login, new_password, and confirm_password parameters in a preferences action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/37877; http://www.securityfocus.com/archive/1/508559/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/54964
CVE: CVE-2009-3581
Published: 2009-12-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via (1) the DCN Description field in the Accounts Receivables menu item for Add Transaction, (2) the Description field in the Accounts Payable menu item for Add Transaction, or the name field in (3) the Customers menu item for Add Customer or (4) the Vendor menu item for Add Vendor.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/37877; http://www.securityfocus.com/archive/1/508559/100/0/threaded; http://www.securityfocus.com/bid/37431
CVE: CVE-2009-3582
Published: 2009-12-23
Description: Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via the (1) id and possibly (2) db parameters in a Delete action to the output of a Vendors>Reports>Search search operation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/37877; http://www.securityfocus.com/archive/1/508559/100/0/threaded; http://www.securityfocus.com/bid/37431
CVE: CVE-2009-3583
Published: 2009-12-23
Description: Directory traversal vulnerability in the Preferences menu item in SQL-Ledger 2.8.24 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the countrycode field.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/37877; http://www.securityfocus.com/archive/1/508559/100/0/threaded; http://www.securityfocus.com/bid/37431
CVE: CVE-2009-3584
Published: 2009-12-23
Description: SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://secunia.com/advisories/37877; http://www.securityfocus.com/archive/1/508559/100/0/threaded; http://www.securityfocus.com/bid/37431
CVE: CVE-2009-4133
Published: 2009-12-23
Description: Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for MRG, and Grid Execute Node for MRG, allows remote authenticated users to queue jobs as an arbitrary user, and thereby gain privileges, by using a Condor command-line tool to modify an unspecified job attribute.
CVSS Score: 6.5 (MEDIUM)
References: http://condor-wiki.cs.wisc.edu/index.cgi/tktview?tn=1018; http://secunia.com/advisories/37766; http://secunia.com/advisories/37803
CVE: CVE-2009-4402
Published: 2009-12-23
Description: The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative operations by providing an arbitrary password to the admin interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://secunia.com/advisories/37877; http://www.securityfocus.com/archive/1/508559/100/0/threaded; http://www.securityfocus.com/bid/37431
CVE: CVE-2009-4403
Published: 2009-12-23
Description: Cross-site scripting (XSS) vulnerability in index.php in Rumba XML 1.8 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/61137; http://secunia.com/advisories/37840; http://www.exploit-db.com/exploits/10534
CVE: CVE-2009-4404
Published: 2009-12-23
Description: Unspecified vulnerability in t-prot (TOFU Protection) before 2.8 allows remote attackers to cause a denial of service via unspecified vectors related to the "--maxlines" option and a crafted email message.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://freshmeat.net/projects/t-prot/releases/309781; http://osvdb.org/61235; http://secunia.com/advisories/37874
CVE: CVE-2009-4144
Published: 2009-12-23
Description: NetworkManager (NM) 0.7.2 does not ensure that the configured Certification Authority (CA) certificate file for a (1) WPA Enterprise or (2) 802.1x network remains present upon a connection attempt, which might allow remote attackers to obtain sensitive information or cause a denial of service (connectivity disruption) by spoofing the identity of a wireless network.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560067; http://git.gnome.org/browse/network-manager-applet/commit/?h=NETWORKMANAGER_APPLET_0_7&id=4020594dfbf566f1852f0acb36ad631a9e73a82b; http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00000.html
CVE: CVE-2009-4145
Published: 2009-12-23
Description: nm-connection-editor in NetworkManager (NM) 0.7.x exports connection objects over D-Bus upon actions in the connection editor GUI, which allows local users to obtain sensitive information by reading D-Bus signals, as demonstrated by using dbus-monitor to discover the password for the WiFi network.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.gnome.org/browse/network-manager-applet/commit/?h=NETWORKMANAGER_APPLET_0_7&id=56d87fcb86acb5359558e0a2ee702cfc0c3391f2; http://git.gnome.org/browse/network-manager-applet/commit/?h=NETWORKMANAGER_APPLET_0_7&id=8627880e07c8345f69ed639325280c7f62a8f894; http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00000.html
CVE: CVE-2009-4405
Published: 2009-12-23
Description: Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/37807; http://secunia.com/advisories/37901; http://trac.edgewall.org/browser/tags/trac-0.11.6/RELEASE
CVE: CVE-2009-4406
Published: 2009-12-23
Description: Cross-site scripting (XSS) vulnerability in Forms/login1 in American Power Conversion (APC) Switched Rack PDU AP7932 B2, running rpdu 3.3.3 or 3.7.0 on AOS 3.3.4, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the login_username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.packetstormsecurity.org/0912-exploits/apc-xss.txt; http://www.securityfocus.com/archive/1/508468/100/0/threaded; http://www.securityfocus.com/bid/37338
CVE: CVE-2009-4407
Published: 2009-12-23
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to hijack the authentication of victims for requests that change passwords, and other unspecified requests, via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/37764; http://www.osvdb.org/61050; http://www.securityfocus.com/archive/1/508478/100/0/threaded
CVE: CVE-2009-4408
Published: 2009-12-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in models.parser in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to inject arbitrary web script or HTML via crafted BBcode (1) img or (2) url tags, which are not properly handled when a post is viewed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37764; http://www.osvdb.org/61051; http://www.securityfocus.com/archive/1/508478/100/0/threaded
CVE: CVE-2009-4409
Published: 2009-12-23
Description: The (1) CHAP and (2) MS-CHAP-V2 authentication capabilities in the PPP Access Concentrator (PPPAC) function in Internet Initiative Japan SEIL/B1 firmware 1.00 through 2.52 use the same challenge for each authentication attempt, which allows remote attackers to bypass authentication via a replay attack.
CVSS Score: 2.6 (LOW)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN49602378/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000079.html; http://secunia.com/advisories/37628
CVE: CVE-2009-3305
Published: 2009-12-24
Description: Polipo 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a Cache-Control header that lacks a value for the max-age field, which triggers a segmentation fault in the httpParseHeaders function in http_parse.c, and possibly other unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=547047; http://groups.google.com/group/linux.debian.bugs.dist/browse_thread/thread/dca6877a8117f0df; http://secunia.com/advisories/37607
CVE: CVE-2009-4137
Published: 2009-12-24
Description: The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the __destruct function in the Piwik_Config class; php://filter URIs; the __destruct functions in Zend Framework, as demonstrated by the Zend_Log destructor; the shutdown functions in Zend Framework, as demonstrated by the Zend_Log_Writer_Mail class; the render function in the Piwik_View class; Smarty templates; and the _eval function in Smarty.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://dev.piwik.org/trac/changeset/1637; http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/; http://www.openwall.com/lists/oss-security/2009/12/09/2
CVE: CVE-2009-4410
Published: 2009-12-24
Description: The fuse_ioctl_copy_user function in the ioctl handler in fs/fuse/file.c in the Linux kernel 2.6.29-rc1 through 2.6.30.y uses the wrong variable in an argument to the kunmap function, which allows local users to cause a denial of service (panic) via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/61335; http://secunia.com/advisories/37928; http://www.openwall.com/lists/oss-security/2009/12/23/1
CVE: CVE-2009-4411
Published: 2009-12-24
Description: The (1) setfacl and (2) getfacl commands in XFS acl 2.2.47, when running in recursive (-R) mode, follow symbolic links even when the --physical (aka -P) or -L option is specified, which might allow local users to modify the ACL for arbitrary files or directories via a symlink attack.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499076; http://git.savannah.gnu.org/cgit/acl.git/commit/?id=63451a0; http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00000.html
CVE: CVE-2009-4412
Published: 2009-12-24
Description: Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified directory.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.0 (MEDIUM)
References: http://blog.s9y.org/archives/211-Serendipity-1.5-released.html; http://osvdb.org/61245; http://secunia.com/advisories/37830
CVE: CVE-2009-4413
Published: 2009-12-24
Description: The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow, a signed-to-unsigned conversion error with a negative value, and a segmentation fault.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560779; http://secunia.com/advisories/37607; http://secunia.com/advisories/38647
CVE: CVE-2009-4414
Published: 2009-12-24
Description: SQL injection vulnerability in phpgwapi /inc/class.auth_sql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the passwd parameter to login.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35519; http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware; http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/inc/class.auth_sql.inc.php?r1=14407&r2=19117&pathrev=19117&sortby=date&root=phpgroupware
CVE: CVE-2009-4415
Published: 2009-12-24
Description: Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to (1) read arbitrary files via the csvfile parameter to addressbook/csv_import.php, or (2) include and execute arbitrary local files via the conv_type parameter in addressbook/inc/class.uiXport.inc.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/35519; http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/csv_import.php?r1=15464&r2=19117&pathrev=19117&sortby=date&root=phpgroupware; http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/inc/class.uiXport.inc.php?r1=14819&r2=19117&pathrev=19117&sortby=date&root=phpgroupware
CVE: CVE-2009-4416
Published: 2009-12-24
Description: Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw_" sequence.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://kambing.ui.ac.id/gentoo-portage/www-apps/phpgroupware/files/phpgroupware-SA35519.patch; http://secunia.com/advisories/35519; http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/login.php?r1=19063&r2=19117&pathrev=19117&sortby=date&root=phpgroupware
CVE: CVE-2009-4417
Published: 2009-12-24
Description: The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to "events not yet mailed."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/; http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/; http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/
CVE: CVE-2009-4418
Published: 2009-12-24
Description: The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable, as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://www.suspekt.org/2009/11/28/shocking-news-in-php-exploitation/; http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf; http://www.suspekt.org/2009/11/28/shocking-news-in-php-exploitation/
CVE: CVE-2009-4419
Published: 2009-12-24
Description: Intel Q35, GM45, PM45 Express, Q45, and Q43 Express chipsets in the SINIT Authenticated Code Module (ACM), which allows local users to bypass the Trusted Execution Technology protection mechanism and gain privileges by modifying the MCHBAR register to point to an attacker-controlled region, which prevents the SENTER instruction from properly applying VT-d protection while an MLE is being loaded.
CVSS Score: 7.2 (HIGH)
CWE: CWE-16
References: http://invisiblethingslab.com/resources/misc09/Another%20TXT%20Attack.pdf; http://osvdb.org/61248; http://secunia.com/advisories/37900
CVE: CVE-2009-4420
Published: 2009-12-24
Description: Buffer overflow in the bd daemon in F5 Networks BIG-IP Application Security Manager (ASM) 9.4.4 through 9.4.7 and 10.0.0 through 10.0.1, and Protocol Security Manager (PSM) 9.4.5 through 9.4.7 and 10.0.0 through 10.0.1, allows remote attackers to cause a denial of service (crash) via unknown vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://osvdb.org/61297; http://secunia.com/advisories/37805; http://www.securityfocus.com/bid/37452
CVE: CVE-2009-4421
Published: 2009-12-24
Description: Directory traversal vulnerability in languages_cgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the blog_language1 parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0398.html; http://www.securityfocus.com/archive/1/508546/100/0/threaded; http://www.securityfocus.com/bid/37434
CVE: CVE-2009-4422
Published: 2009-12-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in the GetURLArguments function in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow remote attackers to inject arbitrary web script or HTML via a key to csim_in_html_ex1.php, and other unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/61268; http://secunia.com/advisories/37832; http://www.mandriva.com/security/advisories?name=MDVSA-2009:340
CVE: CVE-2009-4423
Published: 2009-12-24
Description: SQL injection vulnerability in index.php in weenCompany 4.0.0 allows remote attackers to execute arbitrary SQL commands via the moduleid parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/61264; http://packetstormsecurity.org/0912-exploits/weencompany-sql.txt; http://secunia.com/advisories/37895
CVE: CVE-2009-4424
Published: 2009-12-28
Description: SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0912-exploits/wppyrmont-sql.txt; http://www.exploit-db.com/exploits/10535; http://www.securityfocus.com/bid/37409
CVE: CVE-2009-4425
Published: 2009-12-28
Description: Cross-site scripting (XSS) vulnerability in index.php in iDevCart 1.09 allows remote attackers to inject arbitrary web script or HTML via the SEARCH parameter in a browse action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/idevcart-xss.txt; http://secunia.com/advisories/37767; http://www.exploit-db.com/exploits/10490
CVE: CVE-2009-4426
Published: 2009-12-28
Description: Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the blog parameter to (1) comment.php and (2) view.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/61225; http://osvdb.org/61226; http://packetstormsecurity.org/0912-exploits/ignition-lfi.txt
CVE: CVE-2009-4427
Published: 2009-12-28
Description: Directory traversal vulnerability in cmd.php in phpLDAPadmin 1.1.0.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cmd parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/37848; http://www.exploit-db.com/exploits/10410; http://www.mandriva.com/security/advisories?name=MDVSA-2010:023
CVE: CVE-2009-4428
Published: 2009-12-28
Description: SQL injection vulnerability in the JoomPortfolio (com_joomportfolio) component 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the secid parameter in a showcat action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/61138; http://packetstormsecurity.org/0912-exploits/joomlaportfolio-sql.txt; http://secunia.com/advisories/37838
CVE: CVE-2009-4429
Published: 2009-12-28
Description: Cross-site scripting (XSS) vulnerability in the Sections module 5.x before 5.x-1.3 and 6.x before 6.x-1.3 for Drupal allows remote authenticated users with "administer sections" privileges to inject arbitrary web script or HTML via a section name (aka the Name field).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/661404; http://secunia.com/advisories/37752; http://www.madirish.net/?article=440
CVE: CVE-2009-4430
Published: 2009-12-28
Description: SQL injection vulnerability in index.php in VirtueMart 1.0 allows remote attackers to execute arbitrary SQL commands via the product_id parameter in a shop.product_details shop.flypage action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/10533; http://www.securityfocus.com/bid/37317; http://www.exploit-db.com/exploits/10533
CVE: CVE-2009-4431
Published: 2009-12-28
Description: PHP remote file inclusion vulnerability in cal_popup.php in the Anything Digital Development JCal Pro (aka com_jcalpro or JCP) component 1.5.3.6 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/0912-exploits/joomlajcalpro-rfi.txt; http://www.securityfocus.com/bid/37438; http://packetstormsecurity.org/0912-exploits/joomlajcalpro-rfi.txt
CVE: CVE-2009-4432
Published: 2009-12-28
Description: SQL injection vulnerability in index.php in CodeMight VideoCMS 3.1 allows remote attackers to execute arbitrary SQL commands via the v parameter in a video action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0912-exploits/videocms-sql.txt; http://secunia.com/advisories/37889; http://www.exploit-db.com/exploits/10586