deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2713
Published: 2008-06-16
Description: libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://kolab.org/security/kolab-vendor-notice-21.txt; http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
CVE: CVE-2008-2714
Published: 2008-06-16
Description: Opera before 9.26 allows remote attackers to misrepresent web page addresses using "certain characters" that "cause the page address text to be misplaced."
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00005.html; http://secunia.com/advisories/30636; http://secunia.com/advisories/30682
CVE: CVE-2008-2715
Published: 2008-06-16
Description: Unspecified vulnerability in Opera before 9.5 allows remote attackers to read cross-domain images via HTML CANVAS elements that use the images as patterns.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00005.html; http://secunia.com/advisories/30636; http://secunia.com/advisories/30682
CVE: CVE-2008-2716
Published: 2008-06-16
Description: Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location, which can facilitate phishing attacks.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-1021
References: http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00005.html; http://secunia.com/advisories/30636; http://secunia.com/advisories/30682
CVE: CVE-2008-2717
Published: 2008-06-16
Description: TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/; http://secunia.com/advisories/30619; http://secunia.com/advisories/30660
CVE: CVE-2008-2718
Published: 2008-06-16
Description: Cross-site scripting (XSS) vulnerability in fe_adminlib.inc in TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, as used in extensions such as (1) direct_mail_subscription, (2) feuser_admin, and (3) kb_md5fepw, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30619; http://secunia.com/advisories/30660; http://securityreason.com/securityalert/3945
CVE: CVE-2008-2719
Published: 2008-06-16
Description: Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted file that triggers a stack-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://repo.or.cz/w/nasm.git?a=commit%3Bh=76ec8e73db16f4cf1453a142d03bcc74d528f72f; http://secunia.com/advisories/30594; http://secunia.com/advisories/32059
CVE: CVE-2008-2720
Published: 2008-06-16
Description: Cross-site scripting (XSS) vulnerability in Menalto Gallery before 2.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) host and (2) path components of a URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://gallery.menalto.com/gallery_2.2.5_released; http://secunia.com/advisories/30650; http://secunia.com/advisories/30826
CVE: CVE-2008-2721
Published: 2008-06-16
Description: Unspecified vulnerability in the album-select module in Menalto Gallery before 2.2.5 allows remote attackers to obtain titles of hidden albums by attempting to add a new album to a hidden album.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://gallery.menalto.com/gallery_2.2.5_released; http://secunia.com/advisories/30650; http://secunia.com/advisories/30826
CVE: CVE-2008-2722
Published: 2008-06-16
Description: Menalto Gallery before 2.2.5 allows remote attackers to bypass permissions for sub-albums via a ZIP archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://gallery.menalto.com/gallery_2.2.5_released; http://secunia.com/advisories/30650; http://secunia.com/advisories/30826
CVE: CVE-2008-2723
Published: 2008-06-16
Description: embed.php in Menalto Gallery before 2.2.5 allows remote attackers to obtain the full path via unknown vectors related to "spoofing the remote address."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://gallery.menalto.com/gallery_2.2.5_released; http://secunia.com/advisories/30650; http://secunia.com/advisories/30826
CVE: CVE-2008-2724
Published: 2008-06-16
Description: Menalto Gallery before 2.2.5 does not enforce permissions for non-album items that have been protected by a password, which might allow remote attackers to bypass intended access restrictions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://gallery.menalto.com/gallery_2.2.5_released; http://secunia.com/advisories/30650; http://secunia.com/advisories/30826
CVE: CVE-2008-2742
Published: 2008-06-17
Description: Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by uploading a file with .php followed by a safe extension, then accessing it via a direct request to the file in the Achievo root directory.  NOTE: this is only a vulnerability in environments that support multiple extensions, such as Apache with the mod_mime module enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30597; http://www.achievo.org/blog/archives/631-Achievo-1.3.3-Security-Release.html; http://www.securityfocus.com/bid/29621
CVE: CVE-2008-2743
Published: 2008-06-17
Description: Cross-site scripting (XSS) vulnerability in the embedded web server in Xerox 4110, 4590, and 4595 Copier/Printers allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30639; http://www.securityfocus.com/bid/29690; http://www.securitytracker.com/id?1020282
CVE: CVE-2008-2744
Published: 2008-06-17
Description: Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an "obscure method." NOTE: the vector is probably in the redirect parameter to the Admin Control Panel (admincp/index.php).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30733; http://securityreason.com/securityalert/3946; http://www.securityfocus.com/archive/1/493340/100/0/threaded
CVE: CVE-2008-2745
Published: 2008-06-17
Description: Stack-based buffer overflow in BiAnno ActiveX Control (BiAnno.ocx) in Black Ice Software Annotation Plugin 10.95 allows remote attackers to execute arbitrary code via a long parameter to the AnnoSaveToTiff method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30603; http://www.securityfocus.com/bid/29635; http://www.vupen.com/english/advisories/2008/1795/references
CVE: CVE-2008-2746
Published: 2008-06-17
Description: SQL injection vulnerability in login.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL commands via the detail parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29697; https://exchange.xforce.ibmcloud.com/vulnerabilities/43057; https://www.exploit-db.com/exploits/5796
CVE: CVE-2008-0925
Published: 2008-06-18
Description: Cross-site scripting (XSS) vulnerability in the iMonitor interface in Novell eDirectory 8.7.3.x before 8.7.3 sp10, and 8.8.x before 8.8.2 ftf2, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters that are used within "error messages of the HTTP stack."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30748; http://securitytracker.com/id?1020321; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5037180.html
CVE: CVE-2008-2060
Published: 2008-06-18
Description: Unspecified vulnerability in Cisco Intrusion Prevention System (IPS) 5.x before 5.1(8)E2 and 6.x before 6.0(5)E2, when inline mode and jumbo Ethernet support are enabled, allows remote attackers to cause a denial of service (panic), and possibly bypass intended restrictions on network traffic, via a "specific series of jumbo Ethernet frames."
CVSS Score: 7.8 (HIGH)
CWE: CWE-16
References: http://secunia.com/advisories/30767; http://www.cisco.com/en/US/products/products_security_advisory09186a00809b3842.shtml; http://www.securityfocus.com/bid/29791
CVE: CVE-2008-2428
Published: 2008-06-18
Description: Multiple SQL injection vulnerabilities in TorrentTrader 1.08 Classic allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) wantusername parameter to account-signup.php, or the (3) receiver parameter to account-inbox.php in a msg action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30565; http://secunia.com/secunia_research/2008-15/advisory/; http://sourceforge.net/project/shownotes.php?group_id=98584&release_id=545219
CVE: CVE-2008-2640
Published: 2008-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1) client-side-detection-with-history/history/historyFrame.html, (2) express-installation-with-history/history/historyFrame.html, or (3) no-player-detection-with-history/history/historyFrame.html in templates/html-templates/.  NOTE: Firefox 2.0 and possibly other browsers prevent exploitation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.watchfire.com/wfblog/2008/06/javascript-code.html; http://secunia.com/advisories/30746; http://securitytracker.com/id?1020301
CVE: CVE-2008-2747
Published: 2008-06-18
Description: No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\SOFTWARE\Vitalwerks\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and (4) Hosts registry values.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/30714; http://securityreason.com/securityalert/3952; http://www.securityfocus.com/archive/1/493367/100/0/threaded
CVE: CVE-2008-2748
Published: 2008-06-18
Description: Skulltag 0.97d2-RC2 and earlier allows remote attackers to cause a denial of service (daemon hang) via a series of long, malformed connect packets, related to these packets being "parsed multiple times."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.org/poc/skulltagloop.zip; http://secunia.com/advisories/30668; http://securityreason.com/securityalert/3953
CVE: CVE-2008-2749
Published: 2008-06-18
Description: Unspecified vulnerability in cshttpd in Sun Java System Calendar Server 6 and 6.3, and Sun ONE Calendar Server 6.0, when access logging (aka service.http.commandlog.all) is enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/30694; http://sunsolve.sun.com/search/document.do?assetkey=1-66-235521-1; http://www.securityfocus.com/bid/29763
CVE: CVE-2008-2750
Published: 2008-06-18
Description: The pppol2tp_recvmsg function in drivers/net/pppol2tp.c in the Linux kernel 2.6 before 2.6.26-rc6 allows remote attackers to cause a denial of service (kernel heap memory corruption and system crash) and possibly have unspecified other impact via a crafted PPPOL2TP packet that results in a large value for a certain length variable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6b6707a50c7598a[PII_REDACTED]3f8823ab791abf8; http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.26-rc6; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00009.html
CVE: CVE-2008-2751
Published: 2008-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, or (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (a) resourceNode/customResourceNew.jsf; the (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, or (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (b) resourceNode/externalResourceNew.jsf; the (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, or (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (c) resourceNode/jmsDestinationNew.jsf; the (13) propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi or (14) propertyForm:propertySheet:generalPropertySheet:descProp:cd parameter to (d) resourceNode/jmsConnectionNew.jsf; the (15) propertyForm:propertySheet:propertSectionTextField:jndiProp:jnditext or (16) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (e) resourceNode/jdbcResourceNew.jsf; the (17) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name, (18) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname, or (19) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder parameter to (f) applications/lifecycleModulesNew.jsf; or the (20) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name, (21) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType, or (22) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db parameter to (g) resourceNode/jdbcConnectionPoolNew1.jsf.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3949; http://www.securityfocus.com/archive/1/493370/100/0/threaded; http://www.securityfocus.com/bid/29751
CVE: CVE-2008-2752
Published: 2008-06-18
Description: Microsoft Word 2000 9.0.2812 and 2003 11.8106.8172 does not properly handle unordered lists, which allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .doc file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://www.nullcode.com.ar/ncs/crash/video.htm; http://www.nullcode.com.ar/ncs/crash/video2.htm; http://www.securityfocus.com/bid/29769
CVE: CVE-2008-2753
Published: 2008-06-18
Description: Multiple SQL injection vulnerabilities in Pooya Site Builder (PSB) 6.0 allow remote attackers to execute arbitrary SQL commands via the (1) xslIdn parameter to (a) utils/getXsl.aspx, and the (2) part parameter to (b) getXml.aspx and (c) getXls.aspx in utils/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugreport.ir/index.php?/42; http://seclists.org/bugtraq/2008/Jun/0115.html; http://secunia.com/advisories/30610
CVE: CVE-2008-2754
Published: 2008-06-18
Description: SQL injection vulnerability in toplists.php in eFiction 3.0 and 3.4.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the list parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30606; http://www.securityfocus.com/bid/29658; https://exchange.xforce.ibmcloud.com/vulnerabilities/42998
CVE: CVE-2008-2755
Published: 2008-06-18
Description: SQL injection vulnerability in index.php in JAMM CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30614; http://www.securityfocus.com/bid/29674; https://exchange.xforce.ibmcloud.com/vulnerabilities/43023
CVE: CVE-2008-2756
Published: 2008-06-18
Description: Cross-site scripting (XSS) vulnerability in admin/users.asp in Xigla Absolute Control Panel XE 1.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter and other unspecified parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://secunia.com/advisories/30609
CVE: CVE-2008-2757
Published: 2008-06-18
Description: SQL injection vulnerability in search.asp in Xigla Absolute News Manager XE 3.2 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://secunia.com/advisories/30643
CVE: CVE-2008-2758
Published: 2008-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Xigla Absolute News Manager XE 3.2 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) pblname and (2) text parameters to (a) admin/search.asp, (3) name parameter to (b) admin/publishers.asp, and other unspecified vectors to (c) anmviewer.asp and (d) editarticleX.asp in admin/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://secunia.com/advisories/30643
CVE: CVE-2008-2759
Published: 2008-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Xigla Absolute Form Processor XE 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) showfields, (2) text, and (3) submissions parameters to search.asp and the (4) name parameter to users.asp. NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://secunia.com/advisories/30640
CVE: CVE-2008-2760
Published: 2008-06-18
Description: SQL injection vulnerability in searchbanners.asp in Xigla Absolute Banner Manager XE 2.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://secunia.com/advisories/30641
CVE: CVE-2008-2761
Published: 2008-06-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Xigla Absolute Banner Manager XE 2.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the text parameter in (1) searchbanners.asp and (2) listadvertisers.asp, and other unspecified fields.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://secunia.com/advisories/30641
CVE: CVE-2008-2762
Published: 2008-06-18
Description: SQL injection vulnerability in search.asp in Xigla Absolute Form Processor XE 4.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://securityreason.com/securityalert/3950
CVE: CVE-2008-2763
Published: 2008-06-18
Description: SQL injection vulnerability in search.asp in Xigla Absolute Live Support XE 5.1 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://securityreason.com/securityalert/3950
CVE: CVE-2008-2764
Published: 2008-06-18
Description: Cross-site scripting (XSS) vulnerability in admin/search.asp in Xigla Absolute Live Support XE 5.1 allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors ("all fields").
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://securityreason.com/securityalert/3950
CVE: CVE-2008-2765
Published: 2008-06-18
Description: SQL injection vulnerability in gallery.asp in Xigla Absolute Image Gallery XE allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a viewimage action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://securityreason.com/securityalert/3950
CVE: CVE-2008-2766
Published: 2008-06-18
Description: Cross-site scripting (XSS) vulnerability in Xigla Absolute Image Gallery XE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1) admin/search.asp and (2) gallery.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://securityreason.com/securityalert/3950
CVE: CVE-2008-2767
Published: 2008-06-18
Description: SQL injection vulnerability in search.asp in Xigla Poll Manager XE allows remote authenticated users with administrator role privileges to execute arbitrary SQL commands via the orderby parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://securityreason.com/securityalert/3950
CVE: CVE-2008-2768
Published: 2008-06-18
Description: Cross-site scripting (XSS) vulnerability in admin/search.asp in Xigla Poll Manager XE allows remote authenticated users with administrator role privileges to inject arbitrary web script or HTML via unspecified vectors ("all fields").
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://bugreport.ir/index.php?/41; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://securityreason.com/securityalert/3950
CVE: CVE-2008-2769
Published: 2008-06-18
Description: PHP remote file inclusion vulnerability in authentication/smf/smf.functions.php in Simple Machines phpRaider 1.0.6 and 1.0.7 allows remote attackers to execute arbitrary PHP code via a URL in the pConfig_auth[smf_path] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://forums.phpraider.com/showthread.php?t=1087#v1_0_7b_-_May_29__2008; http://securityreason.com/securityalert/3947; http://www.securityfocus.com/archive/1/493275/100/0/threaded
CVE: CVE-2008-2770
Published: 2008-06-18
Description: SQL injection vulnerability in index.php in MycroCMS 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the entry_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29671; https://exchange.xforce.ibmcloud.com/vulnerabilities/43002; https://www.exploit-db.com/exploits/5787