deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6010
Published: 2009-01-30
Description: Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) mod, (2) page, or (3) lang parameter to index.php; or the (4) action or (5) folder parameter in a security request to admin/index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/31489; https://exchange.xforce.ibmcloud.com/vulnerabilities/45569; https://www.exploit-db.com/exploits/6631
CVE: CVE-2008-6011
Published: 2009-01-30
Description: SQL injection vulnerability in index.php in SG Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31489; https://exchange.xforce.ibmcloud.com/vulnerabilities/45568; https://www.exploit-db.com/exploits/6631
CVE: CVE-2008-6012
Published: 2009-01-30
Description: Directory traversal vulnerability in index.php in Pritlog 0.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a viewEntry action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31915; http://www.securityfocus.com/bid/31503; https://exchange.xforce.ibmcloud.com/vulnerabilities/45551
CVE: CVE-2008-6013
Published: 2009-01-30
Description: Multiple SQL injection vulnerabilities in Freeway before 1.4.3.210 allow remote attackers to execute arbitrary SQL commands via unspecified vectors involving the (1) advanced search result and (2) service resource pages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32003; http://www.openfreeway.org/download/change-log.html; http://www.securityfocus.com/bid/31508
CVE: CVE-2008-6014
Published: 2009-01-30
Description: SQL injection vulnerability in scripts/links.php in Rianxosencabos CMS 0.9 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31502; https://exchange.xforce.ibmcloud.com/vulnerabilities/45552; https://www.exploit-db.com/exploits/6636
CVE: CVE-2008-6015
Published: 2009-01-30
Description: Multiple SQL injection vulnerabilities in search.php in EsFaq 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) keywords and (2) cat parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31721; https://exchange.xforce.ibmcloud.com/vulnerabilities/44979; http://secunia.com/advisories/31721
CVE: CVE-2008-6016
Published: 2009-01-30
Description: SQL injection vulnerability in questions.php in EsFaq 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2008-3952.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31721; https://exchange.xforce.ibmcloud.com/vulnerabilities/48535; http://secunia.com/advisories/31721
CVE: CVE-2008-5082
Published: 2009-01-30
Description: The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/33693; http://www.securityfocus.com/bid/33508; http://www.vupen.com/english/advisories/2009/0145
CVE: CVE-2009-0034
Published: 2009-01-30
Description: parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: http://lists.vmware.com/pipermail/security-announce/2009/000060.html; http://osvdb.org/51736; http://secunia.com/advisories/33753
CVE: CVE-2009-0204
Published: 2009-01-30
Description: Cross-site scripting (XSS) vulnerability in HP Select Access 6.1 and 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4459&w=2; http://secunia.com/advisories/33713; http://securitytracker.com/id?1021641
CVE: CVE-2009-0369
Published: 2009-01-30
Description: Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/48542; https://www.exploit-db.com/exploits/7912; https://exchange.xforce.ibmcloud.com/vulnerabilities/48542
CVE: CVE-2009-0370
Published: 2009-01-30
Description: Multiple unspecified vulnerabilities in IBM AIX 5.2.0 through 6.1.2 allow local users to append data to arbitrary files, related to (1) rmsock and (2) rmsock64 not creating "secure log files."
CVSS Score: 7.2 (HIGH)
References: http://aix.software.ibm.com/aix/efixes/security/rmsock_advisory.asc; http://www.ibm.com/support/docview.wss?uid=isg1IZ40386; http://www.ibm.com/support/docview.wss?uid=isg1IZ41510
CVE: CVE-2009-0371
Published: 2009-01-30
Description: Directory traversal vulnerability in post.php in SiteXS CMS 0.1.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the type parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/33457; http://www.vupen.com/english/advisories/2009/0247; https://exchange.xforce.ibmcloud.com/vulnerabilities/48236
CVE: CVE-2009-0372
Published: 2009-01-30
Description: Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and an image content type via a users editProfile action, then accessing this file via a direct request to the file in images/avatar/uploaded/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/33626; http://www.securityfocus.com/bid/33424; https://exchange.xforce.ibmcloud.com/vulnerabilities/48199
CVE: CVE-2009-0373
Published: 2009-01-30
Description: SQL injection vulnerability in the ElearningForce Flash Magazine Deluxe (com_flashmagazinedeluxe) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mag_id parameter in a magazine action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33646; http://www.securityfocus.com/bid/33455; http://www.vupen.com/english/advisories/2009/0249
CVE: CVE-2009-0374
Published: 2009-01-30
Description: Google Chrome 1.0.154.43 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability.  NOTE: a third party disputes the relevance of this issue, stating that "every sufficiently featured browser is and likely will remain susceptible to the behavior known as clickjacking," and adding that the exploit code "is not a valid demonstration of the issue.
CVSS Score: 4.3 (MEDIUM)
References: http://www.secniche.org/gcr_clkj/; http://www.securityfocus.com/archive/1/500499/100/0/threaded; http://www.securityfocus.com/archive/1/500533/100/0/threaded
CVE: CVE-2009-0377
Published: 2009-02-02
Description: SQL injection vulnerability in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mpid parameter in a sign action to index.php, a different vector than CVE-2008-3132.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/500250/100/0/threaded; http://www.securityfocus.com/bid/33391; https://www.exploit-db.com/exploits/7847
CVE: CVE-2009-0378
Published: 2009-02-02
Description: Cross-site scripting (XSS) vulnerability in index.php in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the pet parameter in a sign action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/500250/100/0/threaded; http://www.securityfocus.com/bid/33391; https://www.exploit-db.com/exploits/7847
CVE: CVE-2009-0379
Published: 2009-02-02
Description: SQL injection vulnerability in the Prince Clan Chess Club (com_pcchess) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the game_id parameter in a showgame action to index.php, a different vector than CVE-2008-0761.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33394; https://exchange.xforce.ibmcloud.com/vulnerabilities/48144; https://www.exploit-db.com/exploits/7846
CVE: CVE-2009-0380
Published: 2009-02-02
Description: SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) RC 2.8.2 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the bid parameter in a showbiz action to index.php, a different vector than CVE-2008-0607.  NOTE: CVE disputes this issue, since neither "showbiz" nor "bid" appears in the source code for SOBI2
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.attrition.org/pipermail/vim/2009-January/002136.html; http://www.securityfocus.com/bid/33378; https://exchange.xforce.ibmcloud.com/vulnerabilities/48131
CVE: CVE-2009-0381
Published: 2009-02-02
Description: SQL injection vulnerability in the BazaarBuilder Ecommerce Shopping Cart (com_prod) 5.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter in a products action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33612; http://www.securityfocus.com/bid/33380; https://exchange.xforce.ibmcloud.com/vulnerabilities/48141
CVE: CVE-2009-0382
Published: 2009-02-02
Description: Unspecified vulnerability in Internationalization (i18n) Translation 5.x before 5.x-2.5, a module for Drupal, allows remote attackers with "translate node" permissions to bypass intended access restrictions and read unpublished nodes via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/358958; http://secunia.com/advisories/33549; http://www.securityfocus.com/bid/33283
CVE: CVE-2009-0383
Published: 2009-02-02
Description: delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/51482; http://secunia.com/advisories/33590; http://www.mzbservices.com/show_post.php?id=72
CVE: CVE-2009-0384
Published: 2009-02-02
Description: SQL injection vulnerability in autor.php in OwnRS CMS 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/7849; https://www.exploit-db.com/exploits/7849
CVE: CVE-2009-0385
Published: 2009-02-02
Description: Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.
CVSS Score: 9.3 (HIGH)
References: http://git.ffmpeg.org/?p=ffmpeg%3Ba=commitdiff%3Bh=72e715fb798f2cb79fd24a6d2eaeafb7c6eeda17; http://osvdb.org/51643; http://secunia.com/advisories/33711
CVE: CVE-2009-0386
Published: 2009-02-02
Description: Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a[PII_REDACTED]95f8f9a92b53; http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html
CVE: CVE-2009-0387
Published: 2009-02-02
Description: Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted Sync Sample (aka stss) atom data in a malformed QuickTime media .mov file, related to "mark keyframes."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a[PII_REDACTED]95f8f9a92b53; http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html
CVE: CVE-2008-6017
Published: 2009-02-02
Description: SQL injection vulnerability in messages.php in I-Rater Basic allows remote attackers to execute arbitrary SQL commands via the idp parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33213; http://www.securityfocus.com/bid/32912; https://www.exploit-db.com/exploits/7514
CVE: CVE-2008-6018
Published: 2009-02-02
Description: Directory traversal vulnerability in index.php in MyPHPSite, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the mod parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33171; http://www.securityfocus.com/bid/32919; https://www.exploit-db.com/exploits/7519
CVE: CVE-2008-6019
Published: 2009-02-02
Description: SQL injection vulnerability in index.php in EACOMM DO-CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the p parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32906; https://exchange.xforce.ibmcloud.com/vulnerabilities/47467; http://www.securityfocus.com/bid/32906
CVE: CVE-2008-6020
Published: 2009-02-02
Description: SQL injection vulnerability in the Views module 6.x before 6.x-2.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "an exposed filter on CCK text fields."
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/347831; http://drupal.org/node/348321; http://osvdb.org/50795
CVE: CVE-2008-6021
Published: 2009-02-02
Description: Multiple unspecified vulnerabilities in Attachmate Reflection for Secure IT UNIX Client and Server before 7.0 SP1 have unknown impact and attack vectors, aka "security vulnerabilities found by 3rd party analysis."
CVSS Score: 10.0 (HIGH)
References: http://support.attachmate.com/techdocs/2374.html; http://www.securityfocus.com/bid/30723; https://exchange.xforce.ibmcloud.com/vulnerabilities/48536
CVE: CVE-2008-6022
Published: 2009-02-02
Description: PHP remote file inclusion vulnerability in includes/todofleetcontrol.php in an older version of Xnova, possibly 0.8 sp1, allows remote attackers to execute arbitrary PHP code via a URL in the ugamela_root_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/30715; https://exchange.xforce.ibmcloud.com/vulnerabilities/44513; https://www.exploit-db.com/exploits/6254
CVE: CVE-2008-6023
Published: 2009-02-02
Description: PHP remote file inclusion vulnerability in includes/todofleetcontrol.php in a newer version of Xnova, possibly 0.8 sp1, allows remote attackers to execute arbitrary PHP code via a URL in the xnova_root_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/30715; http://www.vupen.com/english/advisories/2008/2412; https://exchange.xforce.ibmcloud.com/vulnerabilities/48533
CVE: CVE-2008-6024
Published: 2009-02-02
Description: Unspecified vulnerability in the NFSv4 client module in the kernel on Sun Solaris 10 and OpenSolaris before snv_37, when automountd is used, allows user-assisted remote attackers to cause a denial of service (unresponsive NFS filesystems) via unknown vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/31517; http://securitytracker.com/id?1020716; http://sunsolve.sun.com/search/document.do?assetkey=1-26-240546-1
CVE: CVE-2009-0389
Published: 2009-02-02
Description: Multiple insecure method vulnerabilities in the Web On Windows (WOW) ActiveX control in WOW ActiveX 2 allow remote attackers to (1) create and overwrite arbitrary files via the WriteIniFileString method, (2) execute arbitrary programs via the ShellExecute method, (3) read from the registry via unspecified vectors, and (4) write to the registry via unspecified vectors.  NOTE: vectors 1 and 2 can be used together to execute arbitrary code.
CVSS Score: 9.3 (HIGH)
References: http://www.securityfocus.com/bid/33515; https://exchange.xforce.ibmcloud.com/vulnerabilities/48337; https://www.exploit-db.com/exploits/7910
CVE: CVE-2008-4990
Published: 2009-02-02
Description: Enomaly Elastic Computing Platform (ECP), formerly Enomalism, before 2.1.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/enomalism2.pid temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://groups.google.com/group/enomalism/msg/11c2f51b3734b0ab?dmode=source; http://secunia.com/advisories/33724; http://www.securityfocus.com/archive/1/500573/100/0/threaded
CVE: CVE-2009-0272
Published: 2009-02-02
Description: Cross-site request forgery (CSRF) vulnerability in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allows remote attackers to insert e-mail forwarding rules, and modify unspecified other configuration settings, as arbitrary users via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/33744; http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002319; http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr08-21
CVE: CVE-2009-0273
Published: 2009-02-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Novell GroupWise WebAccess 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) User.id and (2) Library.queryText parameters to gw/webacc, and other vectors involving (3) HTML e-mail and (4) HTML attachments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33744; http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002320; http://www.novell.com/support/search.do?usemicrosite=true&searchString=7002321
CVE: CVE-2009-0390
Published: 2009-02-02
Description: Argument injection vulnerability in Enomaly Elastic Computing Platform (ECP), formerly Enomalism, before 2.1.1 allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/500573/100/0/threaded; http://www.securityfocus.com/archive/1/500573/100/0/threaded
CVE: CVE-2009-0391
Published: 2009-02-02
Description: Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.0.1 on z/OS allows attackers to read arbitrary files via unknown vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://osvdb.org/51663; http://secunia.com/advisories/33729; http://www-01.ibm.com/support/docview.wss?uid=swg1PK72036
CVE: CVE-2009-0392
Published: 2009-02-03
Description: Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/500545/100/0/threaded; http://www.securityfocus.com/bid/33519; https://www.exploit-db.com/exploits/7915
CVE: CVE-2009-0393
Published: 2009-02-03
Description: Cross-site scripting (XSS) vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/500545/100/0/threaded; http://www.securityfocus.com/bid/33519; https://www.exploit-db.com/exploits/7915
CVE: CVE-2009-0394
Published: 2009-02-03
Description: SQL injection vulnerability in login.php in Pre Lecture Exercises (PLEs) CMS 1.0 beta 4.2 allows remote attackers to execute arbitrary SQL commands via the school parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33524; https://www.exploit-db.com/exploits/7917; http://www.securityfocus.com/bid/33524
CVE: CVE-2009-0395
Published: 2009-02-03
Description: SQL injection vulnerability in the login feature in NetArt Media Car Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33521; https://www.exploit-db.com/exploits/7916; http://www.securityfocus.com/bid/33521
CVE: CVE-2009-0396
Published: 2009-02-03
Description: The Sony Ericsson W910i, W660i, K618i, K610i, Z610i, K810i, K660i, W880i, and K530i phones allow remote attackers to cause a denial of service (device reboot or hang-up) via a malformed WAP Push packet to (1) SMS or (2) UDP port 2948.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/33616; http://www.mseclab.com/index.php?page_id=123; http://www.securityfocus.com/archive/1/500382/100/0/threaded
CVE: CVE-2008-6025
Published: 2009-02-03
Description: Directory traversal vulnerability in scr/form.php in openElec 3.01 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the obj parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31953; http://www.securityfocus.com/bid/31307; http://www.vupen.com/english/advisories/2008/2655
CVE: CVE-2008-6026
Published: 2009-02-03
Description: SQL injection vulnerability in tienda.php in BlueCUBE CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0809-exploits/bluecube.txt; http://secunia.com/advisories/31967; http://www.securityfocus.com/bid/31323
CVE: CVE-2008-6027
Published: 2009-02-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in BLUEPAGE CMS 2.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) whl, (2) var_1, and (3) search parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31968; http://www.majorsecurity.de/index_2.php?major_rls=major_rls53; http://www.securityfocus.com/archive/1/496582/100/0/threaded
CVE: CVE-2008-6028
Published: 2009-02-03
Description: SQL injection vulnerability in list.php in University of Queensland Library Fez 1.3 and 2.0 RC1 allows remote attackers to execute arbitrary SQL commands via the parent_id parameter in a subject action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31324; http://www.vupen.com/english/advisories/2008/2652; https://exchange.xforce.ibmcloud.com/vulnerabilities/45332