deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1971
Published: 2010-07-15
Description: Cross-site request forgery (CSRF) vulnerability in HP Insight Software Installer for Windows before 6.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, a different vulnerability than CVE-2010-1968.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02282388; http://secunia.com/advisories/40553; http://securitytracker.com/id?1024186
CVE: CVE-2009-4897
Published: 2010-07-22
Description: Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document containing a long name.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://bugs.ghostscript.com/show_bug.cgi?id=690523; http://secunia.com/advisories/40580; http://security.gentoo.org/glsa/glsa-201412-17.xml
CVE: CVE-2009-4936
Published: 2010-07-22
Description: Multiple SQL injection vulnerabilities in Small Pirate (SPirate) 2.1 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to the default URI in an rss .xml action, or the id parameter to (2) pag1.php, (3) pag1-guest.php, (4) rss-comment_post.php (aka rss-coment_post.php), or (5) rss-pic-comment.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54784; http://osvdb.org/54785; http://osvdb.org/54786
CVE: CVE-2009-4937
Published: 2010-07-22
Description: Cross-site scripting (XSS) vulnerability in Small Pirate (SPirate) 2.1 allows remote attackers to inject arbitrary web script or HTML via an onmouseover action in an img BBCode tag within a url BBCode tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/54783; http://secunia.com/advisories/35272; http://www.exploit-db.com/exploits/8819
CVE: CVE-2009-4938
Published: 2010-07-22
Description: SQL injection vulnerability in the JVideo! (com_jvideo) component 0.3.11c Beta and 0.3.x for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter in a user action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8821; http://www.securityfocus.com/bid/35146; http://www.exploit-db.com/exploits/8821
CVE: CVE-2009-4939
Published: 2010-07-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the (1) uid parameter, (2) uid parameter in a login_lookup action, (3) uid parameter in an adminlogin action, (4) campaignid parameter in a createcampaign action, (5) type parameter in a view_account_stats action, (6) period parameter in a view_account_stats action, (7) uid parameter in a view_adrates action, (8) accname parameter in an account_confirmation action, (9) loginpass parameter in an account_confirmation action, (10) e9 parameter in a setup_account action, (11) from parameter in an email_advertisers action, (12) message parameter in an email_advertisers action, (13) idno parameter in an edit_ad_package action, (14) Advertiser Name field, (15) First Name field, (16) Last Name field, (17) Address field, (18) Phone Number field, (19) Password Hint field, or (20) URL field; and (21) allow remote authenticated users to inject arbitrary web script or HTML via an unspecified form associated with a view_adrates action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.intern0t.net/exploits-vulnerabilities-pocs/1049-intern0t-adpeeps-8-5d1-cross-site-scripting-html-injection-vulnerabilities.html; http://osvdb.org/54790; http://secunia.com/advisories/35262
CVE: CVE-2009-4940
Published: 2010-07-22
Description: SQL injection vulnerability in index.php in Zeus Cart 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the maincatid parameter in a showmaincatlanding action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8829; http://www.exploit-db.com/exploits/8829
CVE: CVE-2009-4941
Published: 2010-07-22
Description: Cross-site scripting (XSS) vulnerability in sign_in.php in ATRC ACollab 1.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/115/45/; http://secunia.com/advisories/35173; http://www.osvdb.org/54798
CVE: CVE-2009-4942
Published: 2010-07-22
Description: Cross-site request forgery (CSRF) vulnerability in ACollab 1.2 allows remote attackers to hijack the authentication of arbitrary users for requests that add personal agenda items.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/115/45/; http://secunia.com/advisories/35173; https://exchange.xforce.ibmcloud.com/vulnerabilities/50835
CVE: CVE-2009-4943
Published: 2010-07-22
Description: index.php in AdPeeps 8.5d1 allows remote attackers to obtain sensitive information via (1) a view_adrates action with an invalid uid parameter, which reveals the installation path in an error message; or (2) an adminlogin action with a crafted uid parameter, which reveals the version number.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://forum.intern0t.net/exploits-vulnerabilities-pocs/1049-intern0t-adpeeps-8-5d1-cross-site-scripting-html-injection-vulnerabilities.html; http://www.securityfocus.com/archive/1/503855/100/0/threaded; http://www.securityfocus.com/archive/1/503911/100/0/threaded
CVE: CVE-2009-4944
Published: 2010-07-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in ATRC ACollab 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) address parameter to profile.php or the (2) description parameter to events/add_event.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35173; http://www.osvdb.org/54799; http://www.osvdb.org/54800
CVE: CVE-2009-4945
Published: 2010-07-22
Description: AdPeeps 8.5d1 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via requests to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://forum.intern0t.net/intern0t-advisories/1049-intern0t-adpeeps-8-5d1-cross-site-scripting-html-injection-vulnerabilities.html; http://www.securityfocus.com/archive/1/503855/100/0/threaded; http://www.securityfocus.com/archive/1/503911/100/0/threaded
CVE: CVE-2010-1766
Published: 2010-07-22
Description: Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore in WebKit before r56380, as used in Qt and other products, allows remote websockets servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an upgrade header that is long and invalid.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044023.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044031.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1969
Published: 2010-07-22
Description: Cross-site scripting (XSS) vulnerability in HP Virtual Connect Enterprise Manager for Windows before 6.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40552; http://www.securitytracker.com/id?1024181; http://www.vupen.com/english/advisories/2010/1797
CVE: CVE-2010-1972
Published: 2010-07-22
Description: The default configuration of HP Client Automation (HPCA) Enterprise Infrastructure (aka Radia) allows remote attackers to read log files, and consequently cause a denial of service or have unspecified other impact, via web requests.
CVSS Score: 9.0 (HIGH)
CWE: CWE-16
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2098&w=2; http://secunia.com/advisories/40592; http://securitytracker.com/id?1024191
CVE: CVE-2010-1973
Published: 2010-07-22
Description: Unspecified vulnerability in the Auditing subsystem in HP OpenVMS 8.3, 8.2, 7.3-2, and earlier on the ALPHA platform, and 8.3-1H1, 8.3, 8.2-1, and earlier on the Itanium platform, allows local users to gain privileges or obtain sensitive information via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0687&w=2; http://securitytracker.com/id?1024190; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0687&w=2
CVE: CVE-2010-2055
Published: 2010-07-22
Description: Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.
CVSS Score: 7.2 (HIGH)
CWE: CWE-17
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583183; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583316; http://bugs.ghostscript.com/show_bug.cgi?id=691339
CVE: CVE-2010-2056
Published: 2010-07-22
Description: GNU gv before 3.7.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043913.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043948.html; http://savannah.gnu.org/forum/forum.php?forum_id=6368
CVE: CVE-2010-2427
Published: 2010-07-22
Description: VMware Studio 2.0 does not properly write to temporary files, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://lists.vmware.com/pipermail/security-announce/2010/000101.html; http://secunia.com/advisories/40507; http://securitytracker.com/id?1024187
CVE: CVE-2010-2568
Published: 2010-07-22
Description: Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
CVSS Score: 7.8 (HIGH)
References: http://isc.sans.edu/diary.html?storyid=9181; http://isc.sans.edu/diary.html?storyid=9190; http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/
CVE: CVE-2010-2667
Published: 2010-07-22
Description: Multiple unspecified vulnerabilities in the Virtual Appliance Management Infrastructure (VAMI) in VMware Studio 2.0 allow remote authenticated users to execute arbitrary commands via vectors involving (1) the Studio virtual appliance or (2) a virtual appliance created by the Studio virtual appliance.
CVSS Score: 6.0 (MEDIUM)
References: http://lists.vmware.com/pipermail/security-announce/2010/000101.html; http://secunia.com/advisories/40507; http://securitytracker.com/id?1024187
CVE: CVE-2010-2771
Published: 2010-07-22
Description: solid.exe in IBM solidDB before 6.5 FP2 allows remote attackers to execute arbitrary code via a long username field in the first handshake packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://publib.boulder.ibm.com/infocenter/soliddb/v6r5/index.jsp?topic=/com.ibm.swg.im.soliddb.common.doc/doc/detailed.list.fixes.html; http://securitytracker.com/id?1024203; http://www.securityfocus.com/bid/41653
CVE: CVE-2010-2772
Published: 2010-07-22
Description: Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain privileges, as demonstrated in the wild in July 2010 by the Stuxnet worm, a different vulnerability than CVE-2010-2568.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: http://ics-cert.us-cert.gov/advisories/ICSA-12-205-01; http://infoworld.com/d/security-central/new-weaponized-virus-targets-industrial-secrets-725; http://infoworld.com/d/security-central/siemens-warns-users-dont-change-passwords-after-worm-attack-915?sourcefssr
CVE: CVE-2010-0099
Published: 2010-07-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-0092.  Reason: This candidate is a duplicate of CVE-2010-0092.  Notes: All CVE users should reference CVE-2010-0092 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-4946
Published: 2010-07-22
Description: Directory traversal vulnerability in the Messaging (com_messaging) component before 1.5.1 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter in a messages action to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/53195; http://secunia.com/advisories/34562; http://www.securityfocus.com/bid/34365
CVE: CVE-2009-4947
Published: 2010-07-22
Description: SQL injection vulnerability in frmLoginPwdReminderPopup.aspx in Q2 Solutions ConnX 4.0.20080606 allows remote attackers to execute arbitrary SQL commands via the txtEmail parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34541; http://www.aushack.com/200904-q2solutions.txt; http://www.securityfocus.com/archive/1/502360/100/0/threaded
CVE: CVE-2009-4948
Published: 2010-07-22
Description: Cross-site scripting (XSS) vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34573; http://typo3.org/extensions/repository/view/locator/1.2.8/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/
CVE: CVE-2009-4949
Published: 2010-07-22
Description: SQL injection vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34573; http://typo3.org/extensions/repository/view/locator/1.2.8/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/
CVE: CVE-2009-4950
Published: 2010-07-22
Description: SQL injection vulnerability in the A21glossary Advanced Output (a21glossary_advanced_output) extension before 0.1.12 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/a21glossary_advanced_output/0.1.12/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/; http://typo3.org/extensions/repository/view/a21glossary_advanced_output/0.1.12/
CVE: CVE-2009-4951
Published: 2010-07-22
Description: Unspecified vulnerability in the ClickStream Analyzer [output] (alternet_csa_out) extension 0.3.0 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/
CVE: CVE-2009-4952
Published: 2010-07-22
Description: Directory traversal vulnerability in the Directory Listing (dir_listing) extension 1.1.0 and earlier for TYPO3 allows remote attackers to have an unspecified impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/
CVE: CVE-2009-4953
Published: 2010-07-22
Description: Cross-site scripting (XSS) vulnerability in the Userdata Create/Edit (sg_userdata) extension before 0.91.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/
CVE: CVE-2009-4954
Published: 2010-07-22
Description: SQL injection vulnerability in the Versatile Calendar Extension [VCE] (sk_calendar) extension before 0.3.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/sk_calendar/0.3.4/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/; http://typo3.org/extensions/repository/view/sk_calendar/0.3.4/
CVE: CVE-2009-4955
Published: 2010-07-22
Description: SQL injection vulnerability in the ultraCards (th_ultracards) extension before 0.5.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/th_ultracards/0.5.1/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/; http://typo3.org/extensions/repository/view/th_ultracards/0.5.1/
CVE: CVE-2009-4956
Published: 2010-07-22
Description: Cross-site scripting (XSS) vulnerability in the Visitor Tracking (ws_stats) extension before 0.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/extensions/repository/view/ws_stats/0.1.2/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-005/; http://typo3.org/extensions/repository/view/ws_stats/0.1.2/
CVE: CVE-2009-4957
Published: 2010-07-22
Description: Directory traversal vulnerability in loadpanel.php in Interspire ActiveKB allows remote attackers to read arbitrary files and possibly have unspecified other impact via directory traversal sequences in the Panel parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/8346; http://www.securityfocus.com/bid/34362; https://exchange.xforce.ibmcloud.com/vulnerabilities/49646
CVE: CVE-2010-2844
Published: 2010-07-25
Description: Cross-site scripting (XSS) vulnerability in news_show.php in Newanz NewsOffice 2.0.18 allows remote attackers to inject arbitrary web script or HTML via the n-cat parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cross-site-scripting.blogspot.com/2010/07/news-office-2018-reflected-xss.html; http://packetstormsecurity.org/1007-exploits/newsoffice-xss.txt; http://www.securityfocus.com/bid/41419
CVE: CVE-2010-2845
Published: 2010-07-25
Description: SQL injection vulnerability in the QuickFAQ (com_quickfaq) component 1.0.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a category action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/joomlaquickfaq-sql.txt; http://www.exploit-db.com/exploits/14296; http://www.securityfocus.com/bid/41508
CVE: CVE-2010-2846
Published: 2010-07-25
Description: Cross-site scripting (XSS) vulnerability in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the afmsg parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1007-exploits/joomlaartforms-sqltraversalxss.txt; http://www.exploit-db.com/exploits/14263; http://www.securityfocus.com/archive/1/512215/100/0/threaded
CVE: CVE-2010-2847
Published: 2010-07-25
Description: Multiple SQL injection vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allow remote attackers to execute arbitrary SQL commands via the viewform parameter in a (1) ferforms or (2) tferforms action to index.php, and the (3) id parameter in a vferforms action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/joomlaartforms-sqltraversalxss.txt; http://www.exploit-db.com/exploits/14263; http://www.securityfocus.com/archive/1/512215/100/0/threaded
CVE: CVE-2010-2848
Published: 2010-07-25
Description: Directory traversal vulnerability in assets/captcha/includes/alikon/playcode.php in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the l parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1007-exploits/joomlaartforms-sqltraversalxss.txt; http://www.exploit-db.com/exploits/14263; http://www.securityfocus.com/archive/1/512215/100/0/threaded
CVE: CVE-2010-2849
Published: 2010-07-25
Description: Cross-site scripting (XSS) vulnerability in productionnu2/nuedit.php in nuBuilder 10.04.20, and possibly other versions before 10.07.12, allows remote attackers to inject arbitrary web script or HTML via the f parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cross-site-scripting.blogspot.com/2010/07/nubuilder-100420-reflected-xss.html; http://packetstormsecurity.org/1007-exploits/nubuilder-xss.txt; http://secunia.com/advisories/40483
CVE: CVE-2010-2850
Published: 2010-07-25
Description: Directory traversal vulnerability in productionnu2/fileuploader.php in nuBuilder 10.04.20, and possibly other versions before 10.07.12, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the dir parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://cross-site-scripting.blogspot.com/2010/07/nubuilder-100420-local-file-inclusion.html; http://packetstormsecurity.org/1007-exploits/nubuilder-lfi.txt; http://secunia.com/advisories/40483
CVE: CVE-2010-2851
Published: 2010-07-25
Description: SQL injection vulnerability in the BookLibrary From Same Author (com_booklibrary) module 1.5 and possibly earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40130; http://secunia.com/secunia_research/2010-83/; http://www.osvdb.org/65996
CVE: CVE-2010-2852
Published: 2010-07-25
Description: Cross-site scripting (XSS) vulnerability in modules/headlines/magpierss/scripts/magpie_debug.php in RunCms 2.1, when the Headlines module is enabled, allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://cross-site-scripting.blogspot.com/2010/07/runcms-21-magpie-rss-module-reflected.html; http://osvdb.org/66244; http://secunia.com/advisories/40521
CVE: CVE-2010-2853
Published: 2010-07-25
Description: SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arbitrary SQL commands via the product_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/iscriptsvisualcaster-sql.txt; http://secunia.com/advisories/40416; http://www.exploit-db.com/exploits/12451
CVE: CVE-2010-2854
Published: 2010-07-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in modfile.php in Event Horizon (EVH) 1.1.10, when magic_quotes_gpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) YourEmail and (2) VerificationNumber parameters, which are not properly handled in a forced SQL error message.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://freshmeat.net/projects/eventh/; http://secunia.com/advisories/40517; http://freshmeat.net/projects/eventh/