deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2214
Published: 2008-05-14
Description: Stack-based buffer overflow in the Network Manager in Castle Rock Computing SNMPc 7.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long community string in an SNMP TRAP packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30036; http://securityreason.com/securityalert/3886; http://www.ngssoftware.com/advisories/critical-vulnerability-in-snmpc/
CVE: CVE-2008-2215
Published: 2008-05-14
Description: Multiple directory traversal vulnerabilities in Project-Based Calendaring System (PBCS) 0.7.1-1 allow remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to (1) src/yopy_sync.php and (2) system-logger/print_logs.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30015; http://www.securityfocus.com/bid/28991; https://exchange.xforce.ibmcloud.com/vulnerabilities/42106
CVE: CVE-2008-2216
Published: 2008-05-14
Description: Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows remote authenticated users to upload arbitrary files to tmp/uploads.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/28991; https://exchange.xforce.ibmcloud.com/vulnerabilities/42105; https://www.exploit-db.com/exploits/5523
CVE: CVE-2008-2217
Published: 2008-05-14
Description: Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cm_imgpath parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28958; https://exchange.xforce.ibmcloud.com/vulnerabilities/42510; https://www.exploit-db.com/exploits/5510
CVE: CVE-2008-2218
Published: 2008-05-14
Description: Buffer overflow in the Multimedia PC Client in Nortel Multimedia Communication Server (MCS) before Maintenance Release 3.5.8.3 and 4.0.25.3 allows remote attackers to cause a denial of service (crash) via a flood of "extraneous" messages, as demonstrated by the Nessus "Generic flood" denial of service plugin.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/30038; http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=719698; http://www.securityfocus.com/bid/28994
CVE: CVE-2008-2219
Published: 2008-05-14
Description: Cross-site scripting (XSS) vulnerability in install.php in C-News.fr C-News 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the etape parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28989; http://www.z0rlu.ownspace.org/index.php?/archives/70-cnews-1.0.1-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/42509
CVE: CVE-2008-2220
Published: 2008-05-14
Description: Multiple PHP remote file inclusion vulnerabilities in Interact Learning Community Environment Interact 2.4.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[LANGUAGE_CPATH] parameter to modules/forum/embedforum.php and the (2) CONFIG[BASE_PATH] parameter to modules/scorm/lib.inc.php, different vectors than CVE-2006-4448.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28996; https://exchange.xforce.ibmcloud.com/vulnerabilities/42113; https://www.exploit-db.com/exploits/5526
CVE: CVE-2008-2221
Published: 2008-05-14
Description: Unspecified vulnerability in the Java plugin in IBM WebSphere Application Server 5.0.2 allows untrusted applets to gain privileges via unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29976; http://www-1.ibm.com/support/docview.wss?uid=swg1PK65161; http://www.securityfocus.com/bid/28997
CVE: CVE-2008-2222
Published: 2008-05-14
Description: SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via the user_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30206; http://www.securityfocus.com/bid/29184; https://exchange.xforce.ibmcloud.com/vulnerabilities/42381
CVE: CVE-2008-2223
Published: 2008-05-14
Description: SQL injection vulnerability in group_posts.php in vShare YouTube Clone 2.6 allows remote attackers to execute arbitrary SQL commands via the tid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forums.buyscripts.in/viewtopic.php?f=7&t=3389; http://secunia.com/advisories/30144; http://www.securityfocus.com/bid/29114
CVE: CVE-2008-2224
Published: 2008-05-14
Description: Multiple PHP remote file inclusion vulnerabilities in SazCart 1.5.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) _saz[settings][site_dir] parameter to layouts/default/header.saz.php and the (2) _saz[settings][site_url] parameter to admin/alayouts/default/pages/login.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/30148; http://www.securityfocus.com/bid/29113; https://exchange.xforce.ibmcloud.com/vulnerabilities/42289
CVE: CVE-2008-2225
Published: 2008-05-14
Description: SQL injection vulnerability in index.php in gameCMS Lite 1.0 allows remote attackers to execute arbitrary SQL commands via the systemId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29093; https://exchange.xforce.ibmcloud.com/vulnerabilities/42251; https://www.exploit-db.com/exploits/5555
CVE: CVE-2008-2226
Published: 2008-05-14
Description: Unspecified vulnerability in the export feature in OpenKM before 2.0 allows remote attackers to export arbitrary documents via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30137; http://sourceforge.net/project/shownotes.php?release_id=597940; http://www.securityfocus.com/bid/29117
CVE: CVE-2008-2227
Published: 2008-05-14
Description: Multiple directory traversal vulnerabilities in PHP-Fusion Forum Rank System 6 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the settings[locale] parameter to (1) forum.php and (2) profile.php in infusions/rank_system/.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30304; http://www.securityfocus.com/bid/29077; http://www.securityfocus.com/bid/29077/exploit
CVE: CVE-2008-2228
Published: 2008-05-14
Description: PHP remote file inclusion vulnerability in portfolio/commentaires/derniers_commentaires.php in Cyberfolio 7.12, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rep parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30154; http://www.securityfocus.com/bid/29124; https://exchange.xforce.ibmcloud.com/vulnerabilities/42286
CVE: CVE-2008-1158
Published: 2008-05-16
Description: The Presence Engine (PE) service in Cisco Unified Presence before 6.0(1) allows remote attackers to cause a denial of service (core dump and service interruption) via malformed packets, aka Bug ID CSCsh50164.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30240; http://securitytracker.com/id?1020023; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1419
Published: 2008-05-16
Description: Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html; http://secunia.com/advisories/30234; http://secunia.com/advisories/30237
CVE: CVE-2008-1420
Published: 2008-05-16
Description: Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html; http://secunia.com/advisories/30234; http://secunia.com/advisories/30237
CVE: CVE-2008-1423
Published: 2008-05-16
Description: Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html; http://secunia.com/advisories/30234; http://secunia.com/advisories/30237
CVE: CVE-2008-1740
Published: 2008-05-16
Description: The Presence Engine (PE) service in Cisco Unified Presence before 6.0(1) allows remote attackers to cause a denial of service (core dump and service interruption) via an unspecified "stress test," aka Bug ID CSCsh20972.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30240; http://securitytracker.com/id?1020023; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1741
Published: 2008-05-16
Description: The SIP Proxy (SIPD) service in Cisco Unified Presence before 6.0(3) allows remote attackers to cause a denial of service (core dump and service interruption) via a TCP port scan, aka Bug ID CSCsj64533.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30269; http://securitytracker.com/id?1020023; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1742
Published: 2008-05-16
Description: Memory leak in the Certificate Trust List (CTL) Provider service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) allows remote attackers to cause a denial of service (memory consumption and service interruption) via a series of malformed TCP packets, as demonstrated by TCPFUZZ, aka Bug ID CSCsj80609.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/30238; http://securitytracker.com/id?1020022; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1743
Published: 2008-05-16
Description: Memory leak in the Certificate Trust List (CTL) Provider service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) and 6.x before 6.1(1) allows remote attackers to cause a denial of service (memory consumption and service interruption) via a series of malformed TCP packets, aka Bug ID CSCsi98433.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/30238; http://securitytracker.com/id?1020022; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1744
Published: 2008-05-16
Description: The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, and 4.3 before 4.3(2) allows remote attackers to cause a denial of service (service crash) via malformed network traffic, aka Bug ID CSCsk46770.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30238; http://securitytracker.com/id?1020022; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1745
Published: 2008-05-16
Description: Cisco Unified Communications Manager (CUCM) 5.x before 5.1(2) and 6.x before 6.1(1) allows remote attackers to cause a denial of service (service interruption) via a SIP JOIN message with a malformed header, aka Bug ID CSCsi48115.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30238; http://securitytracker.com/id?1020022; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1746
Published: 2008-05-16
Description: The SNMP Trap Agent service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (core dump and service restart) via a series of malformed UDP packets, as demonstrated by the IP Stack Integrity Checker (ISIC), aka Bug ID CSCsj24113.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30238; http://securitytracker.com/id?1020022; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1747
Published: 2008-05-16
Description: Unspecified vulnerability in Cisco Unified Communications Manager 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (CCM service restart) via an unspecified SIP INVITE message, aka Bug ID CSCsk46944.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30238; http://securitytracker.com/id?1020022; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1748
Published: 2008-05-16
Description: Cisco Unified Communications Manager 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) does not properly validate SIP URLs, which allows remote attackers to cause a denial of service (service interruption) via a SIP INVITE message, aka Bug ID CSCsl22355.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30238; http://securitytracker.com/id?1020022; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-2009
Published: 2008-05-16
Description: Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/30247; http://www.redhat.com/support/errata/RHSA-2008-0271.html; http://www.securitytracker.com/id?1020029
CVE: CVE-2008-2136
Published: 2008-05-16
Description: Memory leak in the ipip6_rcv function in net/ipv6/sit.c in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3 allows remote attackers to cause a denial of service (memory consumption) via network traffic to a Simple Internet Transition (SIT) tunnel interface, related to the pskb_may_pull and kfree_skb functions, and management of an skb reference count.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.3; http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00002.html
CVE: CVE-2008-2165
Published: 2008-05-16
Description: Cross-site scripting (XSS) vulnerability in AccessCodeStart.asp in Cisco Building Broadband Service Manager (BBSM) Captive Portal 5.3 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30222; http://securityreason.com/securityalert/3895; http://securitytracker.com/id?1020018
CVE: CVE-2008-2263
Published: 2008-05-16
Description: SQL injection vulnerability in linking.page.php in Automated Link Exchange Portal allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.  NOTE: linking.page.php is commonly renamed to link.php, links.php, etc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30243; http://www.securityfocus.com/bid/29205; https://exchange.xforce.ibmcloud.com/vulnerabilities/42401
CVE: CVE-2008-2264
Published: 2008-05-16
Description: Cross-site scripting (XSS) vulnerability in index.php in CyrixMED 1.4 allows remote attackers to inject arbitrary web script or HTML via the msg_erreur parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29153; https://exchange.xforce.ibmcloud.com/vulnerabilities/42353; http://www.securityfocus.com/bid/29153
CVE: CVE-2008-2265
Published: 2008-05-16
Description: SQL injection vulnerability in news.php in EMO Realty Manager allows remote attackers to execute arbitrary SQL commands via the ida parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30245; http://www.securityfocus.com/bid/29202; http://www.vupen.com/english/advisories/2008/1525/references
CVE: CVE-2008-2266
Published: 2008-05-16
Description: uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on a temporary filename generated by the tempnam function.  NOTE: this may be a CVE-2004-2265 regression.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480972; http://secunia.com/advisories/30171; http://secunia.com/advisories/31420
CVE: CVE-2008-2267
Published: 2008-05-16
Description: Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://blog.cmsmadesimple.org/2008/05/12/announcing-cms-made-simple-125/; http://secunia.com/advisories/30208; http://www.attrition.org/pipermail/vim/2008-May/001978.html
CVE: CVE-2008-2268
Published: 2008-05-16
Description: Open redirect vulnerability in interface/redirect.htm.php in Mjguest 6.7 GT Rev.01 allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter in a redirect action to mjguest.php.  NOTE: this is user-assisted because there is a delay and a notification before redirection occurs.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/3872; http://www.mdsjack.bo.it/public/phpBB3/viewtopic.php?t=2049; http://www.securityfocus.com/archive/1/491523/100/0/threaded
CVE: CVE-2008-2269
Published: 2008-05-16
Description: AustinSmoke GasTracker (AS-GasTracker) 1.0.0 allows remote attackers to bypass authentication and gain privileges by setting the gastracker_admin cookie to TRUE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/30266; http://www.securityfocus.com/bid/29224; https://exchange.xforce.ibmcloud.com/vulnerabilities/42435
CVE: CVE-2008-2270
Published: 2008-05-16
Description: Multiple PHP remote file inclusion vulnerabilities in PHPWAY Kostenloses Linkmanagementscript allow remote attackers to execute arbitrary PHP code via a URL in the (1) main_page_directory and (2) page_to_include parameters in template\index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29234; https://exchange.xforce.ibmcloud.com/vulnerabilities/42446; https://www.exploit-db.com/exploits/5621
CVE: CVE-2008-2271
Published: 2008-05-16
Description: The Site Documentation Drupal module 5.x before 5.x-1.8 and 6.x before 6.x-1.1 allows remote authenticated users to gain privileges of other users by leveraging the "access content" permission to list tables and obtain session IDs from the database.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-269
References: http://drupal.org/node/258547; http://secunia.com/advisories/30257; http://www.securityfocus.com/bid/29242
CVE: CVE-2008-2272
Published: 2008-05-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Aruba Mobility Controller 2.4.8.x-FIPS, 2.5.5.x, 2.5.6.x, 3.1.1.x, 3.2.0.x, and 3.3.1.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30262; http://www.arubanetworks.com/support/alerts/aid-051408.asc; http://www.securityfocus.com/archive/1/492113/100/0/threaded
CVE: CVE-2008-2273
Published: 2008-05-16
Description: Unspecified vulnerability in the TACACS authentication component in Aruba Mobility Controller 3.1.x, 3.2.x, and 3.3.x allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/30262; http://www.arubanetworks.com/support/alerts/aid-051408.asc; http://www.securityfocus.com/archive/1/492113/100/0/threaded
CVE: CVE-2008-2274
Published: 2008-05-16
Description: Cross-site scripting (XSS) vulnerability in the sr_feuser_register 1.4.0, 1.6.0, 2.2.1 to 2.2.7, 2.3.0 to 2.3.6, 2.4.0, and 2.5.0 to 2.5.9 extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30275; http://typo3.org/teams/security/security-bulletins/typo3-20080515-1/; http://www.securityfocus.com/bid/29239
CVE: CVE-2008-2275
Published: 2008-05-16
Description: Unspecified vulnerability in sr_feuser_register 1.4.0, 1.6.0, 2.2.1 to 2.2.7, 2.3.0 to 2.3.6, 2.4.0, and 2.5.0 to 2.5.9 extension for TYPO3 allows remote attackers to execute arbitrary code and delete arbitrary files via unspecified attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30275; http://typo3.org/teams/security/security-bulletins/typo3-20080515-1/; http://www.securityfocus.com/bid/29239
CVE: CVE-2008-2276
Published: 2008-05-16
Description: Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to create new administrative users via a crafted link.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7956&w=4; http://secunia.com/advisories/30270; http://secunia.com/advisories/31171
CVE: CVE-2008-2277
Published: 2008-05-16
Description: SQL injection vulnerability in detail.php in Feedback and Rating Script 1.0 allows remote attackers to execute arbitrary SQL commands via the listingid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30267; http://www.securityfocus.com/bid/29228; https://exchange.xforce.ibmcloud.com/vulnerabilities/42428
CVE: CVE-2008-2278
Published: 2008-05-16
Description: SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a pdetails action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30268; http://www.securityfocus.com/bid/29225; https://exchange.xforce.ibmcloud.com/vulnerabilities/42424
CVE: CVE-2008-2279
Published: 2008-05-16
Description: Freelance Auction Script 1.0 stores user passwords in plaintext in the tbl_users table, which allows attackers to gain privileges by reading the table.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/42426; https://www.exploit-db.com/exploits/5613; https://exchange.xforce.ibmcloud.com/vulnerabilities/42426
CVE: CVE-2008-2280
Published: 2008-05-16
Description: Cross-site scripting (XSS) vulnerability in admin/index.php in Script PHP PicEngine 1.0 allows remote attackers to inject arbitrary web script or HTML via the l parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29214; http://www.securityfocus.com/bid/29214/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/42421