deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6340
Published: 2009-02-27
Description: Cross-site scripting (XSS) vulnerability in the Vox populi (mv_vox_populi) extension 0.3.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33262; http://typo3.org/extensions/repository/view/mv_vox_populi/0.3.1/; http://typo3.org/teams/security/security-bulletins/typo3-20081222-4/
CVE: CVE-2008-6341
Published: 2009-02-27
Description: Cross-site scripting (XSS) vulnerability in the SB Universal Plugin (SBuniplug) extension 2.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-20081222-4/; http://typo3.org/teams/security/security-bulletins/typo3-20081222-4/
CVE: CVE-2008-6342
Published: 2009-02-27
Description: Unspecified vulnerability in the TYPO3 Simple File Browser (simplefilebrowser) extension 1.0.2 and earlier allows remote attackers to obtain sensitive information via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/33301; http://typo3.org/extensions/repository/view/simplefilebrowser/1.0.3/; http://typo3.org/teams/security/security-bulletins/typo3-20081222-4/
CVE: CVE-2008-6343
Published: 2009-02-27
Description: Cross-site scripting (XSS) vulnerability in the TU-Clausthal ODIN (tuc_odin) extension 0.0.1, 0.1.0, 0.1.1, and 0.2.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-20081222-4/; http://typo3.org/teams/security/security-bulletins/typo3-20081222-4/
CVE: CVE-2008-6344
Published: 2009-02-27
Description: SQL injection vulnerability in the TU-Clausthal Staff (tuc_staff) 0.3.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20081222-4; http://www.securityfocus.com/bid/32981; http://typo3.org/teams/security/security-bulletins/typo3-20081222-4
CVE: CVE-2008-6345
Published: 2009-02-27
Description: SQL injection vulnerability in Forum.php in SolarCMS 0.53.8 and 1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter to indes.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33269; http://www.securityfocus.com/bid/32974; https://www.exploit-db.com/exploits/7548
CVE: CVE-2008-6346
Published: 2009-02-27
Description: Cross-site scripting (XSS) vulnerability in the DR Wiki (dr_wiki) extension 1.7.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33256; http://typo3.org/teams/security/security-bulletins/typo3-20081222-3/; http://secunia.com/advisories/33256
CVE: CVE-2009-0028
Published: 2009-02-27
Description: The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html
CVE: CVE-2009-0743
Published: 2009-02-27
Description: Cross-site scripting (XSS) vulnerability in the edit account page in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6.0 MR4) and 7.0 before 7.0(2) (aka 7.0 MR1) allows remote authenticated users to inject arbitrary web script or HTML via the E-mail Address field.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.cisco.com/en/US/products/products_security_response09186a0080a7bc61.html; http://www.securityfocus.com/archive/1/501251/30/0/threaded; http://www.securityfocus.com/bid/33915
CVE: CVE-2009-0744
Published: 2009-02-27
Description: Apple Safari 4 Beta build 528.16 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a feeds: URI beginning with a (1) % (percent), (2) { (open curly bracket), (3) } (close curly bracket), (4) ^ (caret), (5) ` (backquote), or (6) | (pipe) character, followed by an & (ampersand) character.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/501229/100/0/threaded; http://www.securityfocus.com/bid/33909; https://exchange.xforce.ibmcloud.com/vulnerabilities/48943
CVE: CVE-2009-0745
Published: 2009-02-27
Description: The ext4_group_add function in fs/ext4/resize.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not properly initialize the group descriptor during a resize (aka resize2fs) operation, which might allow local users to cause a denial of service (OOPS) by arranging for crafted values to be present in available memory.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.kernel.org/show_bug.cgi?id=12433; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fdff73f094e7220602cc3f8959c[PII_REDACTED]412; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.19
CVE: CVE-2009-0746
Published: 2009-02-27
Description: The make_indexed_dir function in fs/ext4/namei.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate a certain rec_len field, which allows local users to cause a denial of service (OOPS) by attempting to mount a crafted ext4 filesystem.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.kernel.org/show_bug.cgi?id=12430; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e6b8bc09ba2075cd91fbffefcd2778b1a00bd76f; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.19
CVE: CVE-2009-0747
Published: 2009-02-27
Description: The ext4_isize function in fs/ext4/ext4.h in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 uses the i_size_high structure member during operations on arbitrary types of files, which allows local users to cause a denial of service (CPU consumption and error-message flood) by attempting to mount a crafted ext4 filesystem.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://bugzilla.kernel.org/show_bug.cgi?id=12375; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=06a279d636734da32bb62dd2f7b0ade666f65d7c; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.19
CVE: CVE-2009-0748
Published: 2009-02-27
Description: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate the superblock configuration, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) by attempting to mount a crafted ext4 filesystem.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.kernel.org/show_bug.cgi?id=12371; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4ec[PII_REDACTED]6c5cf6ed14735e47027c3c5765; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.19
CVE: CVE-2008-6347
Published: 2009-03-02
Description: PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com_ongumatimesheet20) 2.0 4b component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/32095; https://www.exploit-db.com/exploits/6976; http://www.securityfocus.com/bid/32095
CVE: CVE-2008-6348
Published: 2009-03-02
Description: Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to gallery_category.php, (2) photo_id parameter to gallery_photo.php, and the (3) user_name and (4) user_pass parameters to admin/index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32593; http://www.securityfocus.com/bid/32145; https://exchange.xforce.ibmcloud.com/vulnerabilities/46400
CVE: CVE-2008-6349
Published: 2009-03-02
Description: SQL injection vulnerability in survey_results_text.php in TurnkeyForms Business Survey Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32561; http://www.securityfocus.com/bid/32169; https://exchange.xforce.ibmcloud.com/vulnerabilities/46420
CVE: CVE-2008-6350
Published: 2009-03-02
Description: SQL injection vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to execute arbitrary SQL commands via the r parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32591; http://www.securityfocus.com/bid/32176; https://exchange.xforce.ibmcloud.com/vulnerabilities/46417
CVE: CVE-2008-6351
Published: 2009-03-02
Description: Cross-site scripting (XSS) vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to inject arbitrary web script or HTML via the r parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32591; http://www.securityfocus.com/bid/32176; https://exchange.xforce.ibmcloud.com/vulnerabilities/46419
CVE: CVE-2008-6352
Published: 2009-03-02
Description: SQL injection vulnerability in home.html in Xpoze Pro 4.10 allows remote attackers to execute arbitrary SQL commands via the menu parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33126; http://www.securityfocus.com/bid/32789; https://www.exploit-db.com/exploits/7432
CVE: CVE-2008-6353
Published: 2009-03-02
Description: SQL injection vulnerability in index.asp in ASP-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cha parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33128; http://www.securityfocus.com/bid/32786; https://www.exploit-db.com/exploits/7429
CVE: CVE-2008-6354
Published: 2009-03-02
Description: The Net Guys ASPired2poll stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to ASPired2poll.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33130; https://www.exploit-db.com/exploits/7427; http://secunia.com/advisories/33130
CVE: CVE-2008-6355
Published: 2009-03-02
Description: The Net Guys ASPired2Protect stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to ASPired2Protect.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33130; https://www.exploit-db.com/exploits/7428; http://secunia.com/advisories/33130
CVE: CVE-2008-6356
Published: 2009-03-02
Description: evCal Events Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to (1) evcal.mdb and (2) evcal97.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/34258; https://exchange.xforce.ibmcloud.com/vulnerabilities/47265; https://www.exploit-db.com/exploits/7419
CVE: CVE-2008-6357
Published: 2009-03-02
Description: MyCal Personal Events Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to mycal.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/34261; https://exchange.xforce.ibmcloud.com/vulnerabilities/47266; https://www.exploit-db.com/exploits/7420
CVE: CVE-2008-6358
Published: 2009-03-02
Description: SQL injection vulnerability in group_index.php in Social Groupie allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33125; http://www.securityfocus.com/bid/32787; https://www.exploit-db.com/exploits/7433
CVE: CVE-2008-6359
Published: 2009-03-02
Description: Cross-site scripting (XSS) vulnerability in index.php in Max's Guestbook allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, and (3) message parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/50654; http://packetstormsecurity.org/files/110772/Maxs-Guestbook-1.0-Local-File-Inclusion-Path-Disclosure.html; http://secunia.com/advisories/33106
CVE: CVE-2008-6360
Published: 2009-03-02
Description: Cross-site scripting (XSS) vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbitrary web script or HTML via the rank_title parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33023; http://sourceforge.net/project/shownotes.php?release_id=634159; http://www.securityfocus.com/bid/32640
CVE: CVE-2008-6361
Published: 2009-03-02
Description: Directory traversal vulnerability in index.php in InSun Feed CMS 1.7.3 19Beta allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the lang parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/32783; http://www.securityfocus.com/bid/32783/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/47276
CVE: CVE-2008-6362
Published: 2009-03-02
Description: SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33019; http://www.securityfocus.com/bid/32655; https://exchange.xforce.ibmcloud.com/vulnerabilities/47094
CVE: CVE-2008-6363
Published: 2009-03-02
Description: Stack-based buffer overflow in DesignWorks Professional 4.3.1 and 5.0.7 allows remote attackers to execute arbitrary code via a crafted .cct file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33043; http://www.securityfocus.com/bid/32667; http://www.vupen.com/english/advisories/2008/3369
CVE: CVE-2008-6364
Published: 2009-03-02
Description: SQL injection vulnerability in logon_process.jsp in Ad Server Solutions Banner Exchange Solution Java allows remote attackers to execute arbitrary SQL commands via the (1) username (uname parameter) and (2) password (pass parameter).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0812-exploits/bej-sql.txt; http://secunia.com/advisories/33072; http://www.securityfocus.com/bid/32781
CVE: CVE-2008-6365
Published: 2009-03-02
Description: SQL injection vulnerability in logon.jsp in Ad Server Solutions Ad Management Software Java allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, related to the uname or pass parameters to logon.jsp or logon_processing.jsp.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33072; http://www.securityfocus.com/bid/32790; https://exchange.xforce.ibmcloud.com/vulnerabilities/47282
CVE: CVE-2008-6366
Published: 2009-03-02
Description: SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, possibly related to the uname and pass parameters to logon_process.jsp.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0812-exploits/affiliatesj-sql.txt; http://secunia.com/advisories/33072; http://www.securityfocus.com/bid/32791
CVE: CVE-2008-6367
Published: 2009-03-02
Description: Unrestricted file upload vulnerability in Photos/create_album.php in Social Groupie allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in Member_images/.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/33125; https://www.exploit-db.com/exploits/7435; http://secunia.com/advisories/33125
CVE: CVE-2008-6368
Published: 2009-03-02
Description: SQL injection vulnerability in index.php in Chipmunk Guestbook 1.4m allows remote attackers to execute arbitrary SQL commands via the start parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50343; http://packetstorm.linuxsecurity.com/0811-exploits/chipmunkguestbook-sqlxss.txt; http://secunia.com/advisories/32907
CVE: CVE-2008-6369
Published: 2009-03-02
Description: SQL injection vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to execute arbitrary SQL commands via the Sort parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50316; http://secunia.com/advisories/32903; http://www.securityfocus.com/bid/32502
CVE: CVE-2008-6370
Published: 2009-03-02
Description: Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to inject arbitrary web script or HTML via the DisplayFormat parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/50317; http://secunia.com/advisories/32903; http://www.securityfocus.com/bid/32503
CVE: CVE-2008-6371
Published: 2009-03-02
Description: SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the username (Username parameter).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50318; http://secunia.com/advisories/32893; http://www.securityfocus.com/bid/32508
CVE: CVE-2008-6372
Published: 2009-03-02
Description: SQL injection vulnerability in default.asp in Ocean12 FAQ Manager Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a Cat action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32930; http://www.securityfocus.com/bid/32524; https://exchange.xforce.ibmcloud.com/vulnerabilities/46945
CVE: CVE-2008-6373
Published: 2009-03-02
Description: Unspecified vulnerability in Nagios before 3.0.6 has unspecified impact and remote attack vectors related to CGI programs, "adaptive external commands," and "writing newlines and submitting service comments."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8637&w=2; http://secunia.com/advisories/32909; http://secunia.com/advisories/35002
CVE: CVE-2008-6374
Published: 2009-03-02
Description: CodefixerSoftware MailingListPro Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to db/MailingList.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33000; https://exchange.xforce.ibmcloud.com/vulnerabilities/47018; https://www.exploit-db.com/exploits/7325
CVE: CVE-2008-6375
Published: 2009-03-02
Description: JBook stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to userids.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/0812-exploits/jbook-disclosesql.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/47034; http://packetstormsecurity.org/0812-exploits/jbook-disclosesql.txt
CVE: CVE-2008-6376
Published: 2009-03-02
Description: SQL injection vulnerability in main.asp in Jbook allows remote attackers to execute arbitrary SQL commands via the password (pass parameter).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0812-exploits/jbook-disclosesql.txt; http://www.securityfocus.com/bid/32599; https://exchange.xforce.ibmcloud.com/vulnerabilities/47033
CVE: CVE-2008-6377
Published: 2009-03-02
Description: PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the pfad parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32986; http://www.securityfocus.com/bid/32619; https://exchange.xforce.ibmcloud.com/vulnerabilities/47069
CVE: CVE-2008-6378
Published: 2009-03-02
Description: SQL injection vulnerability in calendar_Eventupdate.asp in Calendar Mx Professional 2.0.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32973; http://www.securityfocus.com/bid/32609; https://exchange.xforce.ibmcloud.com/vulnerabilities/47040
CVE: CVE-2008-6379
Published: 2009-03-02
Description: SQL injection vulnerability in pics_pre.asp in Gallery MX 2.0.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32976; http://www.securityfocus.com/bid/32607; https://exchange.xforce.ibmcloud.com/vulnerabilities/47039
CVE: CVE-2008-6380
Published: 2009-03-02
Description: SQL injection vulnerability in default.aspx in Active Web Helpdesk 2.0 allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32911; http://www.securityfocus.com/bid/32548; https://exchange.xforce.ibmcloud.com/vulnerabilities/46905
CVE: CVE-2008-6381
Published: 2009-03-02
Description: SQL injection vulnerability in modules/adresses/viewcat.php in bcoos 1.0.13, and possibly earlier, allows remote authenticated users with Addresses module permissions to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/50373; http://secunia.com/advisories/32870; http://www.securityfocus.com/bid/32561
CVE: CVE-2008-6382
Published: 2009-03-02
Description: ASP Portal 3.2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to ASPPortal.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/50372; http://secunia.com/advisories/32889; https://www.exploit-db.com/exploits/7316
CVE: CVE-2008-6383
Published: 2009-03-02
Description: SQL injection vulnerability in SpeedTech Organization and Resource Manager (Storm) 5.x before 5.x-1.14 and 6.x before 6.x-1.18, a module for Drupal, allows remote authenticated users with storm project access to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://drupal.org/node/342246; http://secunia.com/advisories/32978; http://www.securityfocus.com/bid/32626
CVE: CVE-2008-6384
Published: 2009-03-02
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Comment Mail 5.x before 5.x-1.1, a module for Drupal, allow remote attackers to hijack the authentication of administrators.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/339495; http://osvdb.org/50206; http://secunia.com/advisories/32905