deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2848
Published: 2009-08-18
Description: The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-269
References: http://article.gmane.org/gmane.linux.kernel/871942; http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html
CVE: CVE-2009-2849
Published: 2009-08-18
Description: The md driver (drivers/md/md.c) in the Linux kernel before 2.6.30.2 might allow local users to cause a denial of service (NULL pointer dereference) via vectors related to "suspend_* sysfs attributes" and the (1) suspend_lo_store or (2) suspend_hi_store functions.  NOTE: this is only a vulnerability when sysfs is writable by an attacker.
CVSS Score: 4.7 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.30.y.git%3Ba=commit%3Bh=3c92900d9a4afb176d3de335dc0da0198660a244; http://lists.vmware.com/pipermail/security-announce/2010/000082.html; http://secunia.com/advisories/36501
CVE: CVE-2009-2850
Published: 2009-08-18
Description: Multiple buffer overflows in NASA Common Data Format (CDF) allow context-dependent attackers to execute arbitrary code, as demonstrated using (1) an array index error in the ReadAEDRList64 function, and other errors in the (2) SearchForRecord_r_64, (3) LastRecord64, (4) CDFsel64, and other unspecified functions.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://cdf.gsfc.nasa.gov/html/CDF_changesnote2.html; http://cdf.gsfc.nasa.gov/html/CDF_v330.html; http://www.openwall.com/lists/oss-security/2009/08/14/3
CVE: CVE-2009-2851
Published: 2009-08-18
Description: Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.gentoo.org/show_bug.cgi?id=278492; http://securitytracker.com/id?1022589; http://wordpress.org/development/2009/07/wordpress-2-8-2/
CVE: CVE-2009-2852
Published: 2009-08-18
Description: WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/9431; http://www.securityfocus.com/bid/36040; http://www.vupen.com/english/advisories/2009/2456
CVE: CVE-2009-2853
Published: 2009-08-18
Description: Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://core.trac.wordpress.org/changeset/11768; http://core.trac.wordpress.org/changeset/11769; http://wordpress.org/development/2009/08/wordpress-2-8-3-security-release/
CVE: CVE-2009-2854
Published: 2009-08-18
Description: Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5) edit-link-category-form.php, (6) edit-tag-form.php, (7) export.php, (8) import.php, or (9) link-add.php in wp-admin/.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://core.trac.wordpress.org/changeset/11765; http://core.trac.wordpress.org/changeset/11766; http://wordpress.org/development/2009/08/wordpress-2-8-3-security-release/
CVE: CVE-2009-2855
Published: 2009-08-18
Description: The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534982; http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=31%3Bfilename=diff%3Batt=1%3Bbug=534982; http://www.openwall.com/lists/oss-security/2009/07/20/10
CVE: CVE-2009-1872
Published: 2009-08-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57182; http://osvdb.org/57183; http://osvdb.org/57184
CVE: CVE-2009-1873
Published: 2009-08-18
Description: Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4 Updater 7 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the logfile parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/57186; http://www.adobe.com/support/security/bulletins/apsb09-12.html; http://www.dsecrg.com/pages/vul/show.php?id=152
CVE: CVE-2009-1874
Published: 2009-08-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Adobe JRun 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57187; http://www.adobe.com/support/security/bulletins/apsb09-12.html; http://www.dsecrg.com/pages/vul/show.php?id=151
CVE: CVE-2009-1875
Published: 2009-08-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1877.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57188; http://www.adobe.com/support/security/bulletins/apsb09-12.html; http://osvdb.org/57188
CVE: CVE-2009-1876
Published: 2009-08-18
Description: Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/57189; http://www.adobe.com/support/security/bulletins/apsb09-12.html; http://osvdb.org/57189
CVE: CVE-2009-1877
Published: 2009-08-18
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1875.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57190; http://www.adobe.com/support/security/bulletins/apsb09-12.html; http://osvdb.org/57190
CVE: CVE-2009-1878
Published: 2009-08-18
Description: Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/57191; http://www.adobe.com/support/security/bulletins/apsb09-12.html; http://osvdb.org/57191
CVE: CVE-2009-2856
Published: 2009-08-18
Description: Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous binding is enabled, does not properly handle a client's attempt to establish an authenticated and encrypted connection, which might allow remote attackers to read cleartext VDI configuration-data requests by sniffing LDAP sessions on the network.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/36330; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141481-02-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-265488-1
CVE: CVE-2008-6976
Published: 2009-08-19
Description: MikroTik RouterOS 3.x through 3.13 and 2.x through 2.9.51 allows remote attackers to modify Network Management System (NMS) settings via a crafted SNMP set request.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/31025; https://exchange.xforce.ibmcloud.com/vulnerabilities/44944; https://www.exploit-db.com/exploits/6366
CVE: CVE-2008-6977
Published: 2009-08-19
Description: Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a summary action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/47915; http://secunia.com/advisories/31649; http://www.securityfocus.com/bid/30996
CVE: CVE-2008-6978
Published: 2009-08-19
Description: Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in pics/, related to the uploadmedia action in album.asp.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/47913; http://secunia.com/advisories/31649; http://www.securityfocus.com/bid/30996
CVE: CVE-2008-6979
Published: 2009-08-19
Description: Cross-site scripting (XSS) vulnerability in as_archives.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to inject arbitrary web script or HTML via the results_per_page parameter to index.php.  NOTE: some of these details are obtained from third party information.  NOTE: this issue might be resultant from a separate SQL injection vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/47943; http://secunia.com/advisories/31793; http://www.davidsopas.com/2008/09/phpadult-cms-exploit/
CVE: CVE-2008-6980
Published: 2009-08-19
Description: SQL injection vulnerability in as_archives.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to execute arbitrary SQL commands via the results_per_page parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/47942; http://secunia.com/advisories/31793; http://www.davidsopas.com/2008/09/phpadult-cms-exploit/
CVE: CVE-2008-6981
Published: 2009-08-19
Description: index.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to obtain the full installation path via an invalid results_per_page parameter, which leaks the path in an error message.  NOTE: this issue might be resultant from a separate SQL injection vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.davidsopas.com/2008/09/phpadult-cms-exploit/; http://www.securityfocus.com/archive/1/496069/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/44924
CVE: CVE-2008-6982
Published: 2009-08-19
Description: Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote attackers to inject arbitrary web script or HTML via the currentpath parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/47971; http://sourceforge.net/projects/devalcms/files/devalcms/devalcms-1.4b/devalcms-1.4b.zip/download; http://www.securityfocus.com/bid/31037
CVE: CVE-2008-6983
Published: 2009-08-19
Description: modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gv_folder_data parameter, as demonstrated by modifying modules/tool/url2header.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/47972; http://www.securityfocus.com/bid/31037; https://exchange.xforce.ibmcloud.com/vulnerabilities/44942
CVE: CVE-2008-6984
Published: 2009-08-19
Description: Plesk 8.6.0, when short mail login names (SHORTNAMES) are enabled, allows remote attackers to bypass authentication and send spam e-mail via a message with (1) a base64-encoded username that begins with a valid shortname, or (2) a username that matches a valid password, as demonstrated using (a) SMTP and qmail, and (b) Courier IMAP and POP3.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://www.osvdb.org/51652; http://www.securityfocus.com/archive/1/495881; http://www.securityfocus.com/bid/30956
CVE: CVE-2008-6985
Published: 2009-08-19
Description: Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31758; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8; http://www.osvdb.org/48346
CVE: CVE-2008-6986
Published: 2009-08-19
Description: SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31758; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8; http://www.osvdb.org/48347
CVE: CVE-2008-6987
Published: 2009-08-19
Description: Unrestricted file upload vulnerability in eZoneScripts Dating Website script allows remote attackers to execute arbitrary code via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/31028; https://exchange.xforce.ibmcloud.com/vulnerabilities/44959; http://www.securityfocus.com/bid/31028
CVE: CVE-2008-6988
Published: 2009-08-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo Gallery (aka Ezphotogallery) 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) galleryid parameter to gallery.php, and the (2) size or (3) imageid parameters to show.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31774; http://www.osvdb.org/48313; http://www.osvdb.org/48314
CVE: CVE-2008-6989
Published: 2009-08-19
Description: SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31774; http://www.osvdb.org/48315; http://www.securityfocus.com/archive/1/496220/100/0/threaded
CVE: CVE-2008-6990
Published: 2009-08-19
Description: SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to execute arbitrary SQL commands via the password parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31774; http://www.osvdb.org/48315; http://secunia.com/advisories/31774
CVE: CVE-2008-6991
Published: 2009-08-19
Description: SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL commands via the id_rub_page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/47910; http://secunia.com/advisories/31669; http://www.securityfocus.com/bid/30946
CVE: CVE-2008-6992
Published: 2009-08-19
Description: GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.9.4, allows remote attackers to bypass the SQL injection protection mechanism via a WHERE clause containing an expression such as "x=y=z", which is successfully parsed by MySQL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.mysql.com/bug.php?id=39337; http://osvdb.org/48910; http://sla.ckers.org/forum/read.php?16%2C24367
CVE: CVE-2008-6993
Published: 2009-08-19
Description: Siemens Gigaset WLAN Camera 1.27 has an insecure default password, which allows remote attackers to conduct unauthorized activities. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://www.securityfocus.com/bid/30973; http://www.securityfocus.com/bid/30973
CVE: CVE-2008-6994
Published: 2009-08-19
Description: Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.149.27 allows user-assisted remote attackers to execute arbitrary code via a web page with a long TITLE element, which triggers the overflow when the user saves the page and a long filename is generated.  NOTE: it might be possible to exploit this issue via an HTTP response that includes a long filename in a Content-Disposition header.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=1414; http://osvdb.org/48259; http://security.bkis.vn/?p=119
CVE: CVE-2008-6995
Published: 2009-08-19
Description: Integer underflow in net/base/escape.cc in chrome.dll in Google Chrome 0.2.149.27 allows remote attackers to cause a denial of service (browser crash) via a URI with an invalid handler followed by a "%" (percent) character, which triggers a buffer over-read, as demonstrated using an "about:%" URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2008-09/0028.html; http://code.google.com/p/chromium/issues/detail?id=122; http://evilfingers.com/advisory/google_chrome_poc.php
CVE: CVE-2008-6996
Published: 2009-08-19
Description: Google Chrome BETA (0.2.149.27) does not prompt the user before saving an executable file, which makes it easier for remote attackers or malware to cause a denial of service (disk consumption) or exploit other vulnerabilities via a URL that references an executable file, possibly related to the "ask where to save each file before downloading" setting.
CVSS Score: 5.0 (MEDIUM)
References: http://codereview.chromium.org/472/diff/1/2; http://src.chromium.org/viewvc/chrome?view=rev&revision=1793; http://www.osvdb.org/48261
CVE: CVE-2008-6997
Published: 2009-08-19
Description: Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG tag with a long src attribute, which triggers the crash when the victim performs an "Inspect Element" action.
CVSS Score: 4.3 (MEDIUM)
References: http://badzmanaois.blogspot.com/2008/09/google-chrome-inspect-element-denial-of.html; http://osvdb.org/48260; http://www.securityfocus.com/bid/31038
CVE: CVE-2008-6998
Published: 2009-08-19
Description: Stack-based buffer overflow in chrome/common/gfx/url_elider.cc in Google Chrome 0.2.149.27 and other versions before 0.2.149.29 might allow user-assisted remote attackers to execute arbitrary code via a link target (href attribute) with a large number of path elements, which triggers the overflow when the status bar is updated after the user hovers over the link.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2008/09/beta-release-0214929.html; http://osvdb.org/48264; http://shinnok.evonet.ro/vulns_html/chrome.html
CVE: CVE-2008-6999
Published: 2009-08-19
Description: phpAuction 3.2, and possibly 3.3.0 GPL Basic edition, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/47939; http://packetstorm.linuxsecurity.com/0809-exploits/phpauction32-rfi.txt; http://secunia.com/advisories/31803
CVE: CVE-2008-7000
Published: 2009-08-19
Description: PHP remote file inclusion vulnerability in index.php in PHPAuction 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the lan parameter.  NOTE: this might be related to CVE-2005-2255.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstorm.linuxsecurity.com/0809-exploits/phpauction32-rfi.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/44938; http://packetstorm.linuxsecurity.com/0809-exploits/phpauction32-rfi.txt
CVE: CVE-2008-7001
Published: 2009-08-19
Description: Unrestricted file upload vulnerability in the file manager in Creative Mind Creator CMS 5.0 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/44982; https://www.exploit-db.com/exploits/6405; https://exchange.xforce.ibmcloud.com/vulnerabilities/44982
CVE: CVE-2008-7002
Published: 2009-08-19
Description: PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the (1) exec, (2) system, (3) shell_exec, (4) passthru, or (5) popen functions, possibly involving pathnames such as "C:" drive notation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://downloads.securityfocus.com/vulnerabilities/exploits/31064.php; http://www.securityfocus.com/bid/31064; http://downloads.securityfocus.com/vulnerabilities/exploits/31064.php
CVE: CVE-2008-7003
Published: 2009-08-19
Description: Multiple SQL injection vulnerabilities in login.php in The Rat CMS Alpha 2 allow remote attackers to execute arbitrary SQL commands via the (1) user_id and (2) password parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32845; https://exchange.xforce.ibmcloud.com/vulnerabilities/47335; https://www.exploit-db.com/exploits/7478
CVE: CVE-2008-7004
Published: 2009-08-19
Description: Buffer overflow in Electronic Logbook (ELOG) before 2.7.1 has unknown impact and attack vectors, possibly related to elog.c.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.osvdb.org/41684; http://www.vupen.com/english/advisories/2008/0265; https://exchange.xforce.ibmcloud.com/vulnerabilities/39903
CVE: CVE-2008-7005
Published: 2009-08-19
Description: include/modules/top/1-random_quote.php in Minb Is Not a Blog (minb) 0.1.0 allows remote attackers to execute arbitrary PHP code via the quotes_to_edit parameter.  NOTE: this issue has been reported as an unrestricted file upload by some sources, but that is a potential consequence of code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/51805; http://www.securityfocus.com/archive/1/496234/100/0/threaded; http://www.securityfocus.com/bid/31127
CVE: CVE-2008-7006
Published: 2009-08-19
Description: Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and download a backup of the database via a direct request to admin/backupdb.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/48156; http://secunia.com/advisories/31850; http://www.securityfocus.com/bid/31174
CVE: CVE-2008-7007
Published: 2009-08-19
Description: Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and gain administrative access by setting the (1) admin_name and (2) admin_pass cookie values to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/48155; http://secunia.com/advisories/31850; http://www.securityfocus.com/bid/31174
CVE: CVE-2008-7008
Published: 2009-08-19
Description: HyperStop Web Host Directory 1.2 allows remote attackers to bypass authentication and download a database backup via a direct request to admin/backup/db.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/48282; http://packetstorm.linuxsecurity.com/0809-exploits/webhost-database.txt; http://secunia.com/advisories/31922