deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1860
Published: 2009-06-25
Description: Unspecified vulnerability in Adobe Shockwave Player before 11.5.0.600 allows remote attackers to execute arbitrary code via crafted Shockwave Player 10 content.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/35544; http://www.adobe.com/support/security/bulletins/apsb09-08.html; http://www.securityfocus.com/bid/35469
CVE: CVE-2009-1886
Published: 2009-06-25
Description: Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://secunia.com/advisories/35539; http://secunia.com/advisories/35573; http://secunia.com/advisories/35606
CVE: CVE-2009-1888
Published: 2009-06-25
Description: The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/35539; http://secunia.com/advisories/35573; http://secunia.com/advisories/35606
CVE: CVE-2009-2045
Published: 2009-06-25
Description: The Cisco Video Surveillance Stream Manager firmware before 5.3, as used on Cisco Video Surveillance Services Platforms and Video Surveillance Integrated Services Platforms, allows remote attackers to cause a denial of service (reboot) via a malformed payload in a UDP packet to port 37000, related to the xvcrman process, aka Bug ID CSCsj47924.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080ad1002.html; http://www.cisco.com/en/US/products/products_security_advisory09186a0080ad0f8f.shtml; http://www.securitytracker.com/id?1022446
CVE: CVE-2009-2046
Published: 2009-06-25
Description: The embedded web server on the Cisco Video Surveillance 2500 Series IP Camera with firmware before 2.1 allows remote attackers to read arbitrary files via a (1) http or (2) https request, related to the (a) SD Camera Web Server and the (b) Wireless Camera HTTP Server, aka Bug IDs CSCsu05515 and CSCsr96497.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080ad1002.html; http://www.cisco.com/en/US/products/products_security_advisory09186a0080ad0f8f.shtml; http://www.securityfocus.com/bid/35478
CVE: CVE-2009-2186
Published: 2009-06-25
Description: Unspecified vulnerability in Adobe Shockwave Player before 11.0.0.465 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2009-1860, related to an older issue that "was previously resolved in Shockwave Player 11.0.0.465."
CVSS Score: 9.3 (HIGH)
References: http://www.adobe.com/support/security/bulletins/apsb09-08.html; http://www.adobe.com/support/security/bulletins/apsb09-08.html
CVE: CVE-2009-2187
Published: 2009-06-25
Description: Multiple memory leaks in the (1) IP and (2) IPv6 multicast implementation in the kernel in Sun Solaris 10, and OpenSolaris snv_67 through snv_93, allow local users to cause a denial of service (memory consumption) via vectors related to the association of (a) DL_ENABMULTI_REQ and (b) DL_DISABMULTI_REQ messages with ARP messages.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://bugs.opensolaris.org/view_bug.do?bug_id=6709252; http://bugs.opensolaris.org/view_bug.do?bug_id=6731600; http://secunia.com/advisories/35552
CVE: CVE-2009-2185
Published: 2009-06-25
Description: The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://download.strongswan.org/CHANGES2.txt; http://download.strongswan.org/CHANGES4.txt; http://download.strongswan.org/CHANGES42.txt
CVE: CVE-2009-2208
Published: 2009-06-25
Description: FreeBSD 6.3, 6.4, 7.1, and 7.2 does not enforce permissions on the SIOCSIFINFO_IN6 IOCTL, which allows local users to modify or disable IPv6 network interfaces, as demonstrated by modifying the MTU.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/35410; http://security.FreeBSD.org/advisories/FreeBSD-SA-09:10.ipv6.asc; http://www.securityfocus.com/bid/35285
CVE: CVE-2009-2209
Published: 2009-06-25
Description: SQL injection vulnerability in rscms_mod_newsview.php in RS-CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the key parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55325; http://www.vupen.com/english/advisories/2009/1658; https://exchange.xforce.ibmcloud.com/vulnerabilities/51304
CVE: CVE-2009-1201
Published: 2009-06-25
Description: Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35511; http://www.securityfocus.com/archive/1/504516/100/0/threaded; http://www.securityfocus.com/bid/35476
CVE: CVE-2009-1202
Published: 2009-06-25
Description: WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass certain protection mechanisms involving URL rewriting and HTML rewriting, and conduct cross-site scripting (XSS) attacks, by modifying the first hex-encoded character in a /+CSCO+ URI, aka Bug ID CSCsy80705.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35511; http://www.securityfocus.com/archive/1/504516/100/0/threaded; http://www.securityfocus.com/bid/35480
CVE: CVE-2009-1203
Published: 2009-06-25
Description: WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 does not properly distinguish its own login screen from the login screens it produces for third-party (1) FTP and (2) CIFS servers, which makes it easier for remote attackers to trick a user into sending WebVPN credentials to an arbitrary server via a URL associated with that server, aka Bug ID CSCsy80709.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/35511; http://www.securityfocus.com/archive/1/504516/100/0/threaded; http://www.securityfocus.com/bid/35475
CVE: CVE-2009-2210
Published: 2009-06-25
Description: Mozilla Thunderbird before 2.0.0.22 and SeaMonkey before 1.1.17 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a multipart/alternative e-mail message containing a text/enhanced part that triggers access to an incorrect object type.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/35561; http://secunia.com/advisories/35602; http://secunia.com/advisories/35633
CVE: CVE-2009-2211
Published: 2009-06-25
Description: Cross-site scripting (XSS) vulnerability in the CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0.0.6 and 7.0.1 before 7.0.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35564; http://www-01.ibm.com/support/docview.wss?uid=swg1PK77030; http://www.securitytracker.com/id?1022456
CVE: CVE-2009-2212
Published: 2009-06-25
Description: The CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0.0.6 and 7.0.1 before 7.0.1.5 allows attackers to discover a (1) username or (2) password via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/35564; http://www-01.ibm.com/support/docview.wss?uid=swg1PK77030; http://www.securitytracker.com/id?1022456
CVE: CVE-2009-2213
Published: 2009-06-25
Description: The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticated users to bypass intended access restrictions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://support.citrix.com/article/CTX118770; http://www.securityfocus.com/bid/35422; http://www.vupen.com/english/advisories/2009/1641
CVE: CVE-2009-2214
Published: 2009-06-25
Description: The Secure Gateway service in Citrix Secure Gateway 3.1 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an unspecified request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/35503; http://support.citrix.com/article/CTX121172; http://www.securityfocus.com/bid/35421
CVE: CVE-2009-2215
Published: 2009-06-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in URD before 0.6.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the fatal_error page and unspecified other components.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35540; http://sourceforge.net/project/shownotes.php?release_id=692011; http://secunia.com/advisories/35540
CVE: CVE-2009-2216
Published: 2009-06-25
Description: Cross-site scripting (XSS) vulnerability in CMD_REDIRECT in DirectAdmin 1.33.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the URI in a view=advanced request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://pridels-team.blogspot.com/2009/06/directadmin-v1336-xss-vuln.html; http://secunia.com/advisories/35525; http://www.securityfocus.com/bid/35450
CVE: CVE-2009-2217
Published: 2009-06-25
Description: Cross-site scripting (XSS) vulnerability in NBBC before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via an invalid URL in a BBCode img tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55266; http://secunia.com/advisories/35520; http://sourceforge.net/forum/message.php?msg_id=7455625
CVE: CVE-2009-2218
Published: 2009-06-25
Description: Multiple PHP remote file inclusion vulnerabilities in phpCollegeExchange 0.1.5c, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the home parameter to (1) i_head.php, (2) i_nav.php, (3) user_new_2.php, or (4) house/myrents.php; or (5) allbooks.php, (6) home.php, or (7) mybooks.php in books/.  NOTE: house/myrents.php was also separately reported as a local file inclusion issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/35452; http://www.exploit-db.com/exploits/9008; http://secunia.com/advisories/35452
CVE: CVE-2009-2219
Published: 2009-06-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpCollegeExchange 0.1.5c allow remote attackers to inject arbitrary web script or HTML via the (1) _SESSION[handle] parameter to (a) home.php, (b) books/allbooks.php, or (c) books/home.php; or the (2) home parameter to (d) i_head.php or (e) i_nav.php, or (f) allbooks.php, (g) home.php, or (h) i_nav.php in books/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35452; http://www.exploit-db.com/exploits/9008; http://secunia.com/advisories/35452
CVE: CVE-2009-2220
Published: 2009-06-26
Description: Multiple directory traversal vulnerabilities in Tribiq CMS 5.0.12c, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include and possibly execute arbitrary files via directory traversal sequences in the template_path parameter to (1) masthead.inc.php, (2) toppanel.inc.php, and (3) contact.inc.php in templates/mytribiqsite/tribiq-CL-9000/includes; and the use_template_family parameter to (4) templates/mytribiqsite/tribiq-CL-9000/includes/nlarlist_content.inc.php. NOTE: the tribal-GPL-1066/includes/header.inc.php vector is already covered by CVE-2008-4894.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/35535; http://www.exploit-db.com/exploits/9012; http://www.securityfocus.com/bid/35484
CVE: CVE-2009-2221
Published: 2009-06-26
Description: Cross-site scripting (XSS) vulnerability in PHP-I-BOARD 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN20219071/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000045.html; http://php.s3.to/bbs/bbs8.php
CVE: CVE-2009-2222
Published: 2009-06-26
Description: Directory traversal vulnerability in PHP-I-BOARD 1.2 and earlier allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors, probably related to mail.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/jp/JVN32788272/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000046.html; http://php.s3.to/bbs/bbs8.php
CVE: CVE-2009-2223
Published: 2009-06-26
Description: Directory traversal vulnerability in locms/smarty.php in LightOpenCMS 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cwd parameter.  NOTE: remote file inclusion attacks may be possible.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9015; http://www.exploit-db.com/exploits/9015
CVE: CVE-2009-2224
Published: 2009-06-26
Description: Directory traversal vulnerability in ang/shared/flags.php in AN Guestbook 0.7.8, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the g_lang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.attrition.org/pipermail/vim/2009-June/002196.html; http://www.exploit-db.com/exploits/9013; http://www.securityfocus.com/bid/35486
CVE: CVE-2009-2225
Published: 2009-06-26
Description: Stack-based buffer overflow in SureThing CD/DVD Labeler 5.1.616 trial version allows user-assisted remote attackers to execute arbitrary code via a crafted (1) m3u or (2) pls playlist file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/55297; http://secunia.com/advisories/35361; http://www.securityfocus.com/bid/43852
CVE: CVE-2009-2226
Published: 2009-06-26
Description: Cross-site scripting (XSS) vulnerability in Let's PHP! Tree BBS 2004/11/23 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN93827000/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000044.html; http://php.s3.to/bbs/bbs6.php
CVE: CVE-2009-1394
Published: 2009-06-26
Description: Stack-based buffer overflow in Motorola Timbuktu Pro 8.6.5 on Windows allows remote attackers to execute arbitrary code by sending a long malformed string over the PlughNTCommand named pipe.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=809; http://secunia.com/advisories/35533; http://www.netopia.com/software/products/tb2/
CVE: CVE-2009-1628
Published: 2009-06-26
Description: Stack-based buffer overflow in mnet.exe in Unisys Business Information Server (BIS) 10 and 10.1 on Windows allows remote attackers to execute arbitrary code via a crafted TCP packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: ftp://ftp.support.unisys.com/pub/mapper/NT/BIS10.1/Readme.txt; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=808; ftp://ftp.support.unisys.com/pub/mapper/NT/BIS10.1/Readme.txt
CVE: CVE-2009-1887
Published: 2009-06-26
Description: agent/snmp_agent.c in snmpd in net-snmp 5.0.9 in Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP GETBULK request that triggers a divide-by-zero error.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-4309.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-369
References: http://www.mandriva.com/security/advisories?name=MDVSA-2009:156; http://www.redhat.com/support/errata/RHSA-2009-1124.html; https://bugzilla.redhat.com/show_bug.cgi?id=506903
CVE: CVE-2009-2227
Published: 2009-06-26
Description: Stack-based buffer overflow in B Labs Bopup Communication Server 3.2.26.5460 allows remote attackers to execute arbitrary code via a crafted request to TCP port 19810.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/55275; http://secunia.com/advisories/35516; http://www.exploit-db.com/exploits/9002
CVE: CVE-2009-2228
Published: 2009-06-26
Description: Cross-site scripting (XSS) vulnerability in engine.php in Kasseler CMS allows remote attackers to inject arbitrary web script or HTML via the url parameter in a redirect action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/8997; http://www.securityfocus.com/bid/35457; http://www.vupen.com/english/advisories/2009/1652
CVE: CVE-2009-2229
Published: 2009-06-26
Description: Directory traversal vulnerability in engine.php in Kasseler CMS 1.3.5 lite allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter during a download action, a different vector than CVE-2008-3087.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/35523; http://www.exploit-db.com/exploits/8997; http://www.kasseler-cms.net/engine.php?do=attach&file=uploads/forum/17555/1.3.5_to_1.3.6.zip
CVE: CVE-2009-2230
Published: 2009-06-26
Description: SQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.mybboard.net/2009/06/15/mybb-147-released-security-update/; http://mybboard.net/download/104; http://secunia.com/advisories/35517
CVE: CVE-2009-2231
Published: 2009-06-26
Description: MIDAS 1.43 allows remote attackers to bypass authentication and obtain administrative access via an admin account record in a MIDAS cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.exploit-db.com/exploits/8987; http://www.vupen.com/english/advisories/2009/1646; https://exchange.xforce.ibmcloud.com/vulnerabilities/51281
CVE: CVE-2009-2232
Published: 2009-06-26
Description: SQL injection vulnerability in image.php in Softbiz Banner Ad Management Script allows remote attackers to execute arbitrary SQL commands via the size_id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35549; http://www.securityfocus.com/bid/35453; https://exchange.xforce.ibmcloud.com/vulnerabilities/51277
CVE: CVE-2009-2233
Published: 2009-06-26
Description: The admin interface in AWScripts.com Gallery Search Engine 1.5 allows remote attackers to bypass authentication and gain administrative access by setting the awse_logged cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/35513; http://www.exploit-db.com/exploits/8994; http://www.vupen.com/english/advisories/2009/1649
CVE: CVE-2008-6835
Published: 2009-06-27
Description: Cross-site scripting (XSS) vulnerability in OpenID 5.x before 5.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/280592; http://drupal.org/node/280593; http://osvdb.org/46938
CVE: CVE-2008-6836
Published: 2009-06-27
Description: Cross-site request forgery (CSRF) vulnerability in OpenID 5.x before 5x.-1.2, a module for Drupal, allows remote attackers to hijack the authentication of unspecified victims to delete OpenID identities via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/280592; http://drupal.org/node/280593; http://osvdb.org/46939
CVE: CVE-2008-6837
Published: 2009-06-27
Description: SQL injection vulnerability in Zoph 0.7.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different issue than CVE-2008-3258.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30116; http://www.securityfocus.com/bid/30116/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/43693
CVE: CVE-2008-6838
Published: 2009-06-27
Description: Cross-site scripting (XSS) vulnerability in search.php in Zoph 0.7.2.1 allows remote attackers to inject arbitrary web script or HTML via the _off parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/30116; http://www.securityfocus.com/bid/30116/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/43691
CVE: CVE-2008-6839
Published: 2009-06-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in TGS Content Management 0.3.2r2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg and (2) goodmsg parameters to (a) login.php and (b) index.php, and the (3) dir and (4) id parameters to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/30157.html; http://www.securityfocus.com/bid/30157; https://exchange.xforce.ibmcloud.com/vulnerabilities/43708
CVE: CVE-2009-2234
Published: 2009-06-27
Description: Multiple SQL injection vulnerabilities in admin.php in VICIDIAL Call Center Suite 2.0.5-173 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter ($PHP_AUTH_USER) and (2) Password parameter ($PHP_AUTH_PW).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.eflo.net/vicidial/security_fix_admin_20090522.patch; http://www.exploit-db.com/exploits/8755; http://www.securityfocus.com/bid/35056
CVE: CVE-2009-2235
Published: 2009-06-27
Description: SQL injection vulnerability in page.php in Your Articles Directory allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35192; http://www.exploit-db.com/exploits/8762; http://www.securityfocus.com/bid/35062
CVE: CVE-2009-2236
Published: 2009-06-27
Description: SQL injection vulnerability in yad-admin/login.php in Your Article Directory allows remote attackers to execute arbitrary SQL commands via the txtAdminEmail parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35192; http://www.exploit-db.com/exploits/8761; http://www.securityfocus.com/bid/35059
CVE: CVE-2009-2237
Published: 2009-06-27
Description: Unspecified vulnerability in Views Bulk Operations 5.x-1.x before 5.x-1.4 and 6.x-1.x before 6.x-1.7, a module for Drupal, allows remote attackers to bypass intended access restrictions and modify "nodes or classes of nodes" via unknown vectors, probably related to registered procedures (aka actions).
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/468450; http://secunia.com/advisories/35117; http://www.securityfocus.com/bid/35051