deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6853
Published: 2009-07-07
Description: SQL injection vulnerability in modules/poll/index.php in AIST NetCat 3.0 and 3.12 allows remote attackers to execute arbitrary SQL commands via the PollID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33048; https://exchange.xforce.ibmcloud.com/vulnerabilities/47632; https://www.exploit-db.com/exploits/7611
CVE: CVE-2009-2337
Published: 2009-07-07
Description: SQL injection vulnerability in includes/module/book/index.inc.php in w3b|cms Gaestebuch Guestbook Module 3.0.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the spam_id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/53614; http://secunia.com/advisories/34650; http://www.exploit-db.com/exploits/8396
CVE: CVE-2009-2338
Published: 2009-07-07
Description: Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang_file parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/34707; http://www.exploit-db.com/exploits/8446; http://www.securityfocus.com/bid/34538
CVE: CVE-2009-2339
Published: 2009-07-07
Description: SQL injection vulnerability in index.php in Rentventory allows remote attackers to execute arbitrary SQL commands via the product parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55555; http://secunia.com/advisories/35676; http://www.exploit-db.com/exploits/9081
CVE: CVE-2009-2340
Published: 2009-07-07
Description: SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtUserName (aka User Name) parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55560; http://secunia.com/advisories/35677; http://www.exploit-db.com/exploits/9079
CVE: CVE-2009-2341
Published: 2009-07-07
Description: SQL injection vulnerability in albumdetail.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the albumid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55561; http://secunia.com/advisories/35677; http://www.exploit-db.com/exploits/9080
CVE: CVE-2009-2342
Published: 2009-07-07
Description: Cross-site scripting (XSS) vulnerability in admin.php (aka the login page) in Content Management Made Easy (CMME) before 1.22 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35610; http://sourceforge.net/project/shownotes.php?release_id=694724; http://sourceforge.net/tracker/?func=detail&aid=2500186&group_id=215535&atid=1034058
CVE: CVE-2009-2343
Published: 2009-07-07
Description: Cross-site scripting (XSS) vulnerability in people.php in Zoph before 0.7.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55554; http://secunia.com/advisories/35700; http://sourceforge.net/project/shownotes.php?release_id=694128
CVE: CVE-2009-2344
Published: 2009-07-07
Description: The web-based management interfaces in Sourcefire Defense Center (DC) and 3D Sensor before 4.8.2 allow remote authenticated users to gain privileges via a $admin value for the admin parameter in an edit action to admin/user/user.cgi and unspecified other components.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/35658; http://www.exploit-db.com/exploits/9074; http://www.securityfocus.com/archive/1/504694/100/0/threaded
CVE: CVE-2009-2345
Published: 2009-07-07
Description: Multiple SQL injection vulnerabilities in ClanSphere before 2009.0.1 allow remote attackers to execute arbitrary SQL commands via unknown parameters to the gbook module and unspecified other components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35694; http://www.clansphere.net/index/news/view/id/405/; http://www.securityfocus.com/bid/35576
CVE: CVE-2008-0015
Published: 2009-07-07
Description: Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx; http://isc.sans.org/diary.html?storyid=6733; http://osvdb.org/55651
CVE: CVE-2008-0020
Published: 2009-07-07
Description: Unspecified vulnerability in the Load method in the IPersistStreamInit interface in the Active Template Library (ATL), as used in the Microsoft Video ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via unknown vectors that trigger memory corruption, aka "ATL Header Memcopy Vulnerability," a different vulnerability than CVE-2008-0015.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx; http://secunia.com/advisories/36187; http://www.iss.net/threats/329.html
CVE: CVE-2009-2350
Published: 2009-07-07
Description: Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3275/; http://websecurity.com.ua/3386/; http://www.securityfocus.com/archive/1/504718/100/0/threaded
CVE: CVE-2009-2351
Published: 2009-07-07
Description: Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. NOTE: it was later reported that 10.00 Beta 3 Build 1699 is also affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3275/; http://websecurity.com.ua/3386/; http://www.securityfocus.com/archive/1/504718/100/0/threaded
CVE: CVE-2009-2352
Published: 2009-07-07
Description: Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. NOTE: it was later reported that 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta are also affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://websecurity.com.ua/3275/; http://websecurity.com.ua/3386/; http://www.securityfocus.com/archive/1/504718/100/0/threaded
CVE: CVE-2009-2353
Published: 2009-07-07
Description: encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web root via the -o option, and then making a direct request to this file, related to upload of image files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.mandriva.com/security/advisories?name=MDVSA-2009:188; http://www.securityfocus.com/archive/1/504695/100/0/threaded; http://www.mandriva.com/security/advisories?name=MDVSA-2009:188
CVE: CVE-2009-2354
Published: 2009-07-07
Description: SQL injection vulnerability in the auth_checkpass function in the login page in NullLogic Groupware 1.2.7 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.nth-dimension.org.uk/utils/get.php?downloadsid=55; http://www.securityfocus.com/archive/1/504737/100/0/threaded; http://www.vupen.com/english/advisories/2009/1817
CVE: CVE-2009-2355
Published: 2009-07-07
Description: The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service (application crash) by specifying (1) an empty string or (2) a non-numeric string when selecting a forum, related to the fmessagelist function.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-189
References: http://www.nth-dimension.org.uk/utils/get.php?downloadsid=55; http://www.securityfocus.com/archive/1/504737/100/0/threaded; http://www.vupen.com/english/advisories/2009/1817
CVE: CVE-2009-2356
Published: 2009-07-07
Description: Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7, when PostgreSQL is used, might allow remote attackers to execute arbitrary code via input to the (1) POP3, (2) SMTP, or (3) web component that triggers a long SQL query.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.nth-dimension.org.uk/utils/get.php?downloadsid=55; http://www.securityfocus.com/archive/1/504737/100/0/threaded; http://www.vupen.com/english/advisories/2009/1817
CVE: CVE-2009-2357
Published: 2009-07-07
Description: The default configuration of TekRADIUS 3.0 uses the sa account to communicate with Microsoft SQL Server, which makes it easier for remote attackers to obtain privileged access to the database and the underlying Windows operating system.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://www.nth-dimension.org.uk/utils/get.php?downloadsid=56; http://www.securityfocus.com/archive/1/504740/100/0/threaded; http://www.vupen.com/english/advisories/2009/1816
CVE: CVE-2009-2358
Published: 2009-07-07
Description: TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credentials by reading this file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-255
References: http://www.nth-dimension.org.uk/utils/get.php?downloadsid=56; http://www.securityfocus.com/archive/1/504740/100/0/threaded; http://www.vupen.com/english/advisories/2009/1816
CVE: CVE-2009-2359
Published: 2009-07-07
Description: Multiple SQL injection vulnerabilities in TekRADIUS 3.0 allow context-dependent attackers to execute arbitrary SQL commands via (1) the GUI client, as demonstrated by input to the Browse Users text box in the Users tab; or (2) the command-line client, as demonstrated by a certain trcli -r command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.nth-dimension.org.uk/utils/get.php?downloadsid=56; http://www.securityfocus.com/archive/1/504740/100/0/threaded; http://www.vupen.com/english/advisories/2009/1816
CVE: CVE-2009-2360
Published: 2009-07-08
Description: Cross-site scripting (XSS) vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.horde.org/ticket/8398; http://lists.horde.org/archives/announce/2009/000507.html; http://secunia.com/advisories/35720
CVE: CVE-2009-2361
Published: 2009-07-08
Description: SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the staff username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osticket.com/forums/project.php?issueid=118; http://secunia.com/advisories/35629; http://www.exploit-db.com/exploits/9032
CVE: CVE-2009-2362
Published: 2009-07-08
Description: Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.0.0.215 allows remote attackers to execute arbitrary code via a long string in a (1) .lst or (2) .m3u playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/55528; http://packetstormsecurity.org/0907-exploits/audioplus-overflow.txt; http://secunia.com/advisories/35673
CVE: CVE-2009-2363
Published: 2009-07-08
Description: Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.00.215 allows remote attackers to execute arbitrary code via a .pls playlist file with a playlist entry containing a long File1 argument.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.org/0907-exploits/audiopluspls-overflow.txt; http://www.exploit-db.com/exploits/9070; https://exchange.xforce.ibmcloud.com/vulnerabilities/51485
CVE: CVE-2009-2364
Published: 2009-07-08
Description: Stack-based buffer overflow in Mp3-Nator 2.0 allows remote attackers to execute arbitrary code via (1) a long string in a .plf file and (2) a long string in the listdata.dat file, possibly related to a track entry.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9060; http://www.exploit-db.com/exploits/9136; http://www.vupen.com/english/advisories/2009/1765
CVE: CVE-2009-2365
Published: 2009-07-08
Description: SQL injection vulnerability in login.asp in DataCheck Solutions GalleryPal FE 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35626; http://www.osvdb.org/55471; https://exchange.xforce.ibmcloud.com/vulnerabilities/51403
CVE: CVE-2009-2366
Published: 2009-07-08
Description: SQL injection vulnerability in login.asp in DataCheck Solutions ForumPal FE 1.1 and ForumPal 1.5 allows remote attackers to execute arbitrary SQL commands via the (1) password parameter in 1.1 and (2) p_password parameter in 1.5.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35589; http://secunia.com/advisories/35603; http://www.exploit-db.com/exploits/9024
CVE: CVE-2009-2367
Published: 2009-07-08
Description: cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessing attacks on the session_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-338
References: http://osvdb.org/55586; http://secunia.com/advisories/35666; http://trac.metasploit.com/browser/framework3/trunk/modules/auxiliary/admin/http/iomega_storcenterpro_sessionid.rb?rev=6733
CVE: CVE-2009-2368
Published: 2009-07-08
Description: Unspecified vulnerability in Socks Server 5 before 3.7.8-8 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/35718; http://sourceforge.net/project/shownotes.php?release_id=695068; http://www.vupen.com/english/advisories/2009/1806
CVE: CVE-2009-2369
Published: 2009-07-08
Description: Integer overflow in the wxImage::Create function in src/common/image.cpp in wxWidgets 2.8.10 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JPEG file, which triggers a heap-based buffer overflow.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://osvdb.org/55520; http://secunia.com/advisories/35351; http://secunia.com/advisories/35913
CVE: CVE-2009-2370
Published: 2009-07-08
Description: Cross-site scripting (XSS) vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/507526; http://drupal.org/node/507550; http://drupal.org/node/507580
CVE: CVE-2009-2371
Published: 2009-07-08
Description: Advanced Forum 6.x before 6.x-1.1, a module for Drupal, does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/507526; http://drupal.org/node/507580; http://osvdb.org/55522
CVE: CVE-2009-2372
Published: 2009-07-08
Description: Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://drupal.org/node/507572; http://osvdb.org/55525; http://secunia.com/advisories/35681
CVE: CVE-2009-2373
Published: 2009-07-08
Description: Cross-site scripting (XSS) vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/507572; http://osvdb.org/55524; http://secunia.com/advisories/35681
CVE: CVE-2009-2374
Published: 2009-07-08
Description: Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from (1) the HTTP referer header of external web sites that are visited from those links or (2) when page caching is enabled, the Drupal page cache.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://drupal.org/node/507572; http://osvdb.org/55524; http://secunia.com/advisories/35657
CVE: CVE-2009-2375
Published: 2009-07-08
Description: Stack-based buffer overflow in Photo DVD Maker 8.02, and possibly earlier versions, allows remote attackers to execute arbitrary code via a long File_Name parameter in a .pdm file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blog.bkis.com/?p=713; http://secunia.com/advisories/35709; http://www.securityfocus.com/archive/1/504738/100/0/threaded
CVE: CVE-2009-2376
Published: 2009-07-08
Description: Cross-site scripting (XSS) vulnerability in the Html::textarea function in application/libraries/Html.php in TangoCMS 2.x before 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the value parameter, related to the Contact module.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev.tangocms.org/issues/show/140; http://dev.tangocms.org/repositories/diff/tangocms?rev=2372; http://secunia.com/advisories/35642
CVE: CVE-2009-2377
Published: 2009-07-08
Description: Buffer overflow in the Avax Vector ActiveX control in avPreview.ocx in AVAX-software Avax Vector ActiveX 1.3 allows remote attackers to cause a denial of service (application crash) via a long PrinterName property.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/504729/100/0/threaded; http://www.securityfocus.com/bid/35583; http://www.securityfocus.com/archive/1/504729/100/0/threaded
CVE: CVE-2009-2378
Published: 2009-07-08
Description: PHP remote file inclusion vulnerability in formmailer.admin.inc.php in Jax FormMailer 3.0.0 allows remote attackers to execute arbitrary PHP code via a URL in the BASE_DIR[jax_formmailer] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9051; https://exchange.xforce.ibmcloud.com/vulnerabilities/51443; http://www.exploit-db.com/exploits/9051
CVE: CVE-2009-2379
Published: 2009-07-08
Description: Directory traversal vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cmd parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://forum.bigace.de/announcements/security-patch-for-bigace-2-6; http://osvdb.org/55510; http://secunia.com/advisories/35643
CVE: CVE-2009-2380
Published: 2009-07-08
Description: Cross-site scripting (XSS) vulnerability in includes/functions.php in 4images 1.7 through 1.7.7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the url variable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35639; http://www.4homepages.de/forum/index.php?topic=25057.0; http://www.osvdb.org/55508
CVE: CVE-2009-2381
Published: 2009-07-08
Description: Gizmo 3.1.0.79 on Linux does not verify a server's SSL certificate, which allows remote servers to obtain the credentials of arbitrary users via a spoofed certificate.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/35628; http://www.securityfocus.com/archive/1/504572/100/0/threaded; http://www.securityfocus.com/bid/35508
CVE: CVE-2009-2382
Published: 2009-07-08
Description: admin.php in phpMyBlockchecker 1.0.0055 allows remote attackers to bypass authentication and gain administrative access by setting the PHPMYBCAdmin cookie to LOGGEDIN.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://osvdb.org/55505; http://secunia.com/advisories/35660; http://www.exploit-db.com/exploits/9053
CVE: CVE-2009-2383
Published: 2009-07-08
Description: SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9054; http://www.securityfocus.com/bid/35538; https://exchange.xforce.ibmcloud.com/vulnerabilities/51446
CVE: CVE-2009-2384
Published: 2009-07-08
Description: Buffer overflow in amp.exe in Brothersoft PEamp 1.02b allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3u playlist file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/35663; http://www.exploit-db.com/exploits/9061; https://exchange.xforce.ibmcloud.com/vulnerabilities/51479
CVE: CVE-2009-2385
Published: 2009-07-08
Description: SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum (SMF) allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35661; http://www.exploit-db.com/exploits/9050; http://www.securityfocus.com/bid/35536
CVE: CVE-2009-2387
Published: 2009-07-09
Description: Unspecified vulnerability in the proc filesystem in Sun OpenSolaris snv_49 through snv_109 allows local users to cause a denial of service (deadlock and panic) via unknown vectors, related to the ldt_rewrite_syscall function.
CVSS Score: 4.9 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-258888-1; http://www.securityfocus.com/bid/35588; http://sunsolve.sun.com/search/document.do?assetkey=1-66-258888-1
CVE: CVE-2009-2388
Published: 2009-07-09
Description: SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtPassword parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/55560; http://secunia.com/advisories/35677; http://osvdb.org/55560