deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-6679
Published: 2008-01-10
Description: Unspecified vulnerability in the Administrative Console in IBM WebSphere Application Server 6.1 before Fix Pack 13 has unknown impact and attack vectors, related to "security concerns with monitor role users."  NOTE: it was later reported that 6.0.2 before Fix Pack 25 is also affected.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/28588; http://securitytracker.com/id?1019174; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27007951
CVE: CVE-2007-6680
Published: 2008-01-10
Description: Trusted Execution in IBM AIX 6.1 uses an incorrect pathname argument in a call to the trustchk_block_write function, which might allow local users to modify trusted files, related to an error in the support for links in the TSD_FILES_LOCK policy.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/28257; http://www-1.ibm.com/support/docview.wss?uid=isg1IZ12119; http://www.securityfocus.com/bid/27177
CVE: CVE-2008-0218
Published: 2008-01-10
Description: Cross-site scripting (XSS) vulnerability in admin/index.html in Merak IceWarp Mail Server allows remote attackers to inject arbitrary web script or HTML via the message parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28460; http://www.securityfocus.com/bid/27189; http://www.securityfocus.com/data/vulnerabilities/exploits/27189.html
CVE: CVE-2008-0219
Published: 2008-01-10
Description: SQL injection vulnerability in soporte_horizontal_w.php in PHP Webquest 2.6 allows remote attackers to execute arbitrary SQL commands via the id_actividad parameter, a different vector than CVE-2007-4920.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/26821; http://www.securityfocus.com/bid/27192; https://exchange.xforce.ibmcloud.com/vulnerabilities/39560
CVE: CVE-2008-0220
Published: 2008-01-10
Description: Multiple stack-based buffer overflows in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.ocx 1.0.0.1 in Gateway Weblaunch allow remote attackers to execute arbitrary code via a long string in the (1) second or (2) fourth argument to the DoWebLaunch method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6735&w=2; http://secunia.com/advisories/28379; http://www.kb.cert.org/vuls/id/735441
CVE: CVE-2008-0221
Published: 2008-01-10
Description: Directory traversal vulnerability in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.ocx 1.0.0.1 in Gateway Weblaunch allows remote attackers to execute arbitrary programs via a ..\ (dot dot backslash) in the second argument to the DoWebLaunch method.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6735&w=2; http://secunia.com/advisories/28379; http://www.vupen.com/english/advisories/2008/0077
CVE: CVE-2008-0222
Published: 2008-01-10
Description: Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/27151; https://exchange.xforce.ibmcloud.com/vulnerabilities/39462; https://www.exploit-db.com/exploits/4844
CVE: CVE-2008-0223
Published: 2008-01-10
Description: Buffer overflow in JustSystems JSFC.DLL, as used in multiple JustSystems products such as Ichitaro, allows remote attackers to execute arbitrary code via a crafted .JTD file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/28275; http://www.fourteenforty.jp/research/advisory.cgi?FFRRA-20080107
CVE: CVE-2008-0224
Published: 2008-01-10
Description: SQL injection vulnerability in index.php in the Newbb_plus 0.92 and earlier module in RunCMS 1.6.1 allows remote attackers to execute arbitrary SQL commands via the Client-Ip parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28340; http://www.securityfocus.com/bid/27152; https://exchange.xforce.ibmcloud.com/vulnerabilities/39478
CVE: CVE-2008-0225
Published: 2008-01-10
Description: Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmff_dump_header function and related to disregarding the max field.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/xinermffhof-adv.txt; http://bugs.gentoo.org/show_bug.cgi?id=205197; http://secunia.com/advisories/28384
CVE: CVE-2008-0226
Published: 2008-01-10
Description: Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) "input_buffer& operator>>" in yassl_imp.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.mysql.com/33814; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
CVE: CVE-2008-0227
Published: 2008-01-10
Description: yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allows remote attackers to cause a denial of service (crash) via a Hello packet containing a large size value, which triggers a buffer over-read in the HASHwithTransform::Update function in hash.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.mysql.com/33814; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
CVE: CVE-2008-0228
Published: 2008-01-10
Description: Cross-site request forgery (CSRF) vulnerability in apply.cgi in the Linksys WRT54GL Wireless-G Broadband Router with firmware 4.30.9 allows remote attackers to perform actions as administrators.
CVSS Score: 9.3 (HIGH)
CWE: CWE-352
References: http://secunia.com/advisories/28364; http://securityreason.com/securityalert/3534; http://www.securityfocus.com/archive/1/485853/100/0/threaded
CVE: CVE-2008-0229
Published: 2008-01-10
Description: The telnet service in LevelOne WBR-3460 4-Port ADSL 2/2+ Wireless Modem Router with firmware 1.00.11 and 1.00.12 does not require authentication, which allows remote attackers on the local or wireless network to obtain administrative access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/28397; http://securityreason.com/securityalert/3533; http://www.securityfocus.com/archive/1/485935/100/0/threaded
CVE: CVE-2008-0230
Published: 2008-01-11
Description: PHP remote file inclusion vulnerability in php121db.php in osDate 2.0.8 and possibly earlier versions allows remote attackers to execute arbitrary PHP code via a URL in the php121dir parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/0801-exploits/osdata-lfi.txt; http://secunia.com/advisories/28420; http://www.securityfocus.com/bid/27208
CVE: CVE-2008-0231
Published: 2008-01-11
Description: Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, and (7) Music Theme webpage templates allow remote attackers to include and execute arbitrary files via ".." sequences in the page parameter.  NOTE: this can be leveraged for remote file inclusion when running in some PHP 5 environments.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3532; http://www.securityfocus.com/archive/1/485991/100/0/threaded; http://www.securityfocus.com/bid/27196
CVE: CVE-2008-0232
Published: 2008-01-11
Description: Multiple SQL injection vulnerabilities in Zero CMS 1.0 Alpha allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to index.php, or the (2) f or t parameters to forums/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0801-exploits/zerocms-sql.txt; http://www.securityfocus.com/bid/27186; https://exchange.xforce.ibmcloud.com/vulnerabilities/39530
CVE: CVE-2007-6018
Published: 2008-01-11
Description: IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://cvs.horde.org/diff.php/groupware/docs/groupware/CHANGES?r1=1.17&r2=1.17.2.1&ty=h; http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12&r2=1.12.2.1&ty=h; http://lists.horde.org/archives/announce/2008/000360.html
CVE: CVE-2008-0233
Published: 2008-01-11
Description: Unrestricted file upload vulnerability in Zero CMS 1.0 Alpha and earlier allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.org/0801-exploits/zerocms-sql.txt; https://www.exploit-db.com/exploits/4864; http://packetstormsecurity.org/0801-exploits/zerocms-sql.txt
CVE: CVE-2008-0234
Published: 2008-01-11
Description: Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allows remote attackers to execute arbitrary code via a long Reason-Phrase response to an rtsp:// request, as demonstrated using a 404 error message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2008//Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2008/Feb/msg00001.html; http://secunia.com/advisories/28423
CVE: CVE-2008-0235
Published: 2008-01-11
Description: The Microsoft VFP_OLE_Server ActiveX control allows remote attackers to execute arbitrary code by invoking the foxcommand method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/0801-exploits/msvfpole-exec.txt; http://secunia.com/advisories/28417; http://shinnai.altervista.org/exploits/txt/TXT_rNowA1916DKFNUF48NyS.html
CVE: CVE-2008-0236
Published: 2008-01-11
Description: An ActiveX control for Microsoft Visual FoxPro (vfp6r.dll 6.0.8862.0) allows remote attackers to execute arbitrary commands by invoking the DoCmd method.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/28417; http://shinnai.altervista.org/exploits/txt/TXT_DiWu9j82RCq4zpaQAoxn.html; http://www.securityfocus.com/bid/27205
CVE: CVE-2008-0237
Published: 2008-01-11
Description: The Microsoft Rich Textbox ActiveX Control (RICHTX32.OCX) 6.1.97.82 allows remote attackers to execute arbitrary commands by invoking the insecure SaveFile method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://shinnai.altervista.org/exploits/txt/TXT_DZVN8CwCha0I2fI3NeEs.html; http://www.securityfocus.com/bid/27201; https://exchange.xforce.ibmcloud.com/vulnerabilities/39557
CVE: CVE-2008-0238
Published: 2008-01-11
Description: Multiple heap-based buffer overflows in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 allow remote attackers to execute arbitrary code via the SDP (1) Title, (2) Author, or (3) Copyright attribute, related to the rmff_dump_header function, different vectors than CVE-2008-0225.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=205197; http://secunia.com/advisories/28384; http://secunia.com/advisories/28674
CVE: CVE-2008-0239
Published: 2008-01-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp, (2) resultsForm parameter to /idm/account/findForSelect.jsp, or (3) activeControl parameter to /idm/user/main.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28356; http://securityreason.com/securityalert/3535; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1
CVE: CVE-2008-0240
Published: 2008-01-11
Description: /idm/help/index.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via the helpUrl parameter, aka "frame injection."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28356; http://securityreason.com/securityalert/3535; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1
CVE: CVE-2008-0241
Published: 2008-01-11
Description: Open redirect vulnerability in /idm/user/login.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the nextPage parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/28356; http://securityreason.com/securityalert/3535; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103180-1
CVE: CVE-2007-6420
Published: 2008-01-12
Description: Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3823&w=2
CVE: CVE-2007-6423
Published: 2008-01-12
Description: Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL.  NOTE: the vendor could not reproduce this issue
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://securityreason.com/securityalert/3523; http://www.securityfocus.com/archive/1/486169/100/0/threaded; http://www.securityfocus.com/bid/27236
CVE: CVE-2008-0005
Published: 2008-01-12
Description: mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html
CVE: CVE-2008-0123
Published: 2008-01-12
Description: Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter.  NOTE: this issue only exists until the installation is complete.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-01/0202.html; http://int21.de/cve/CVE-2008-0123-moodle.html; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
CVE: CVE-2007-6284
Published: 2008-01-12
Description: The xmlCurrentChar function in libxml2 before 2.6.31 allows context-dependent attackers to cause a denial of service (infinite loop) via XML containing invalid UTF-8 sequences.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.gentoo.org/show_bug.cgi?id=202628; http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html; http://lists.vmware.com/pipermail/security-announce/2008/000009.html
CVE: CVE-2008-0242
Published: 2008-01-12
Description: Unspecified vulnerability in libdevinfo in Sun Solaris 10 allows local users to access files and gain privileges via unknown vectors, related to login device permissions.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/28493; http://sunsolve.sun.com/search/document.do?assetkey=1-26-103165-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-200641-1
CVE: CVE-2008-0243
Published: 2008-01-12
Description: Unspecified vulnerability in Lotus Domino 7.0.2 before Fix Pack 3 allows attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/28411; http://www-1.ibm.com/support/docview.wss?uid=swg27011539; http://www.securityfocus.com/bid/27215
CVE: CVE-2008-0244
Published: 2008-01-12
Description: SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/sapone-adv.txt; http://secunia.com/advisories/28409; http://securityreason.com/securityalert/3536
CVE: CVE-2008-0245
Published: 2008-01-12
Description: admin.php in UploadImage 1.0 does not check for the original password before making a change to a new password, which allows remote attackers to gain administrator privileges via the pass parameter in a nopass (Set Password) action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/27203; https://exchange.xforce.ibmcloud.com/vulnerabilities/39571; https://www.exploit-db.com/exploits/4871
CVE: CVE-2008-0246
Published: 2008-01-12
Description: admin.php in UploadScript 1.0 does not check for the original password before making a change to a new password, which allows remote attackers to gain administrator privileges via the pass parameter in a nopass (Set Password) action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/27203; https://exchange.xforce.ibmcloud.com/vulnerabilities/39570; https://www.exploit-db.com/exploits/4871
CVE: CVE-2008-0247
Published: 2008-01-12
Description: Heap-based buffer overflow in the Express Backup Server service (dsmsvc.exe) in IBM Tivoli Storage Manager (TSM) Express 5.3 before 5.3.7.3 allows remote attackers to execute arbitrary code via a packet with a large length value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28440; http://www-1.ibm.com/support/docview.wss?uid=swg21291536; http://www.securityfocus.com/archive/1/486270/100/0/threaded
CVE: CVE-2008-0248
Published: 2008-01-12
Description: Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary code via a long URL argument to the InternalTuneIn method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059572.html; http://secunia.com/advisories/28461; http://www.securityfocus.com/bid/27247
CVE: CVE-2008-0249
Published: 2008-01-12
Description: PHP Webquest 2.6 allows remote attackers to retrieve database credentials via a direct request to admin/backup_phpwebquest.php, which leaks the credentials in an error message if a call to /usr/bin/mysqldump fails.  NOTE: this might only be an issue in limited environments.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/27202; https://exchange.xforce.ibmcloud.com/vulnerabilities/39572; https://www.exploit-db.com/exploits/4872
CVE: CVE-2008-0250
Published: 2008-01-12
Description: Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN) file with a long Project line.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/28482; http://shinnai.altervista.org/exploits/txt/TXT_PoEOrFM8py30PXrDF7IY.html; http://www.securityfocus.com/bid/27250
CVE: CVE-2008-0251
Published: 2008-01-12
Description: Unrestricted file upload vulnerability in PhotoPost vBGallery before 2.4.2 allows remote attackers to upload and execute arbitrary files via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20, CWE-94
References: http://secunia.com/advisories/28430; http://www.photopost.com/forum/showthread.php?t=134909; http://www.photopost.com/forum/showthread.php?t=134910
CVE: CVE-2008-0252
Published: 2008-01-12
Description: Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/28353; http://secunia.com/advisories/28354; http://secunia.com/advisories/28611
CVE: CVE-2008-0001
Published: 2008-01-15
Description: VFS in the Linux kernel before 2.6.22.16, and 2.6.23.x before 2.6.23.14, performs tests of access mode by using the flag variable instead of the acc_mode variable, which might allow local users to bypass intended permissions and remove directories.
CVSS Score: 3.6 (LOW)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=974a9f0b47da74e28f68b9c8645c3786aa5ace1a; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.16; http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00002.html
CVE: CVE-2008-0173
Published: 2008-01-15
Description: SQL injection vulnerability in Gforge 4.6.99 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified parameters, related to RSS exports.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28395; http://secunia.com/advisories/28451; http://www.debian.org/security/2008/dsa-1459
CVE: CVE-2008-0253
Published: 2008-01-15
Description: SQL injection vulnerability in full_text.php in Binn SBuilder allows remote attackers to execute arbitrary SQL commands via the nid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/486265/100/0/threaded; http://www.securityfocus.com/bid/27264; https://exchange.xforce.ibmcloud.com/vulnerabilities/39634
CVE: CVE-2008-0254
Published: 2008-01-15
Description: SQL injection vulnerability in activate.php in TutorialCMS (aka Photoshop Tutorials) 1.02, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the userName parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/28446; http://www.securityfocus.com/bid/27263; https://exchange.xforce.ibmcloud.com/vulnerabilities/39642
CVE: CVE-2008-0255
Published: 2008-01-15
Description: SQL injection vulnerability in archive.php in iGaming 1.5, and 1.3.1 and earlier, allows remote attackers to execute arbitrary SQL commands via the section parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28426; http://www.securityfocus.com/bid/27230; https://exchange.xforce.ibmcloud.com/vulnerabilities/39598
CVE: CVE-2008-0256
Published: 2008-01-15
Description: Multiple SQL injection vulnerabilities in Matteo Binda ASP Photo Gallery 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) Imgbig.asp, (b) thumb.asp, and (c) thumbricerca.asp and the (2) ricerca parameter to (d) thumbricerca.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/28447; http://www.securityfocus.com/bid/27262; https://exchange.xforce.ibmcloud.com/vulnerabilities/39646