deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4363
Published: 2012-10-07
Description: ProcessTable.pm in the Proc::ProcessTable module 0.45 for Perl, when TTY information caching is enabled, allows local users to overwrite arbitrary files via a symlink attack on /tmp/TTYDEVS.
CVSS Score: 2.6 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=650500; http://secunia.com/advisories/47015; http://www.openwall.com/lists/oss-security/2011/11/30/2
CVE: CVE-2011-4909
Published: 2012-10-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.5.12 allow remote attackers to inject arbitrary web script or HTML via the HTTP_REFERER header to (1) components/com_content/views/article/tmpl/form.php, (2) components/com_user/controller.php, (3) plugins/system/legacy/html.php, or (4) templates/beez/html/com_content/article/form.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2009-07/0012.html; http://developer.joomla.org/security/news/[PII_REDACTED]4-core-frontend-xss-httpreferer-not-properly-filtered.html; http://secunia.com/advisories/35668
CVE: CVE-2011-4910
Published: 2012-10-07
Description: Cross-site scripting (XSS) vulnerability in Joomla! before 1.5.12 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]5-core-frontend-xss-phpself-not-properly-filtered.html; http://secunia.com/advisories/35668; http://www.openwall.com/lists/oss-security/2011/12/25/3
CVE: CVE-2011-4911
Published: 2012-10-07
Description: Joomla! before 1.5.12 does not perform a JEXEC check in unspecified files, which allows remote attackers to obtain the installation path via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://developer.joomla.org/security/news/[PII_REDACTED]6-core-missing-jexec-check.html; http://secunia.com/advisories/35668; http://www.openwall.com/lists/oss-security/2011/12/25/3
CVE: CVE-2012-1414
Published: 2012-10-07
Description: Cross-site request forgery (CSRF) vulnerability in manager/news.php in Plume CMS 1.2.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that create News pages via a publish action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/18502; https://exchange.xforce.ibmcloud.com/vulnerabilities/73317; http://www.exploit-db.com/exploits/18502
CVE: CVE-2010-5063
Published: 2012-10-08
Description: SQL injection vulnerability in article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via the ratearticleselect parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://dmcdonald.net/vwar.txt; http://seclists.org/fulldisclosure/2010/Aug/235; http://www.securityfocus.com/bid/29001
CVE: CVE-2010-5064
Published: 2012-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Virtual War (aka VWar) 1.6.1 R2 allow remote attackers to inject arbitrary web script or HTML via (1) the Additional Information field to challenge.php, the (2) Additional Information or (3) Contact information field to joinus.php, (4) the War Report field to admin/admin.php in a finishwar action, or (5) the Nick field to profile.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dmcdonald.net/vwar.txt; http://seclists.org/fulldisclosure/2010/Aug/235; http://dmcdonald.net/vwar.txt
CVE: CVE-2010-5065
Published: 2012-10-08
Description: popup.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to bypass intended member restrictions and read news posts via a modified newsid parameter in a printnews action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://dmcdonald.net/vwar.txt; http://seclists.org/fulldisclosure/2010/Aug/235; http://dmcdonald.net/vwar.txt
CVE: CVE-2010-5066
Published: 2012-10-08
Description: The createRandomPassword function in includes/functions_common.php in Virtual War (aka VWar) 1.6.1 R2 uses a small range of values to select the seed argument for the PHP mt_srand function, which makes it easier for remote attackers to determine randomly generated passwords via a brute-force attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://dmcdonald.net/vwar.txt; http://seclists.org/fulldisclosure/2010/Aug/235; http://dmcdonald.net/vwar.txt
CVE: CVE-2010-5067
Published: 2012-10-08
Description: Virtual War (aka VWar) 1.6.1 R2 uses static session cookies that depend only on a user's password, which makes it easier for remote attackers to bypass timeout and logout actions, and retain access for a long period of time, by leveraging knowledge of a session cookie.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-255
References: http://dmcdonald.net/vwar.txt; http://seclists.org/fulldisclosure/2010/Aug/235; http://dmcdonald.net/vwar.txt
CVE: CVE-2010-5279
Published: 2012-10-08
Description: article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to cause a denial of service (memory consumption) via a large integer in the ratearticleselect parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://dmcdonald.net/vwar.txt; http://seclists.org/fulldisclosure/2010/Aug/235; http://dmcdonald.net/vwar.txt
CVE: CVE-2011-4638
Published: 2012-10-08
Description: Multiple SQL injection vulnerabilities in SpamTitan WebTitan before 3.60 allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to login-x.php, and allow remote authenticated users to execute arbitrary SQL commands via the (2) bldomain, (3) wldomain, or (4) temid parameter to urls-x.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.sec-1.com/blog/?p=211; http://www.sec-1.com/blog/?p=211
CVE: CVE-2011-4639
Published: 2012-10-08
Description: The (1) Traceroute and (2) Ping implementations in tools.php in SpamTitan WebTitan before 3.60 allow remote authenticated users to execute arbitrary commands via shell metacharacters in an argument, as demonstrated by an && (ampersand ampersand) sequence.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://www.sec-1.com/blog/?p=211; http://www.sec-1.com/blog/?p=211
CVE: CVE-2011-4640
Published: 2012-10-08
Description: Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the fname parameter in a view action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www.sec-1.com/blog/?p=211; http://www.sec-1.com/blog/?p=211
CVE: CVE-2012-4824
Published: 2012-10-08
Description: Open redirect vulnerability in servlet/traveler in IBM Lotus Notes Traveler 8.5.3 before 8.5.3.3 Interim Fix 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirectURL parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0001.html; http://www-01.ibm.com/support/docview.wss?uid=swg21612229; http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0001.html
CVE: CVE-2012-4825
Published: 2012-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in servlet/traveler/ILNT.mobileconfig in IBM Lotus Notes Traveler before 8.5.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) userId or (2) address parameter in a getClientConfigFile action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0001.html; http://www-01.ibm.com/support/docview.wss?uid=swg21612229; http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0001.html
CVE: CVE-2012-5307
Published: 2012-10-08
Description: Cross-site scripting (XSS) vulnerability in servlet/traveler in IBM Lotus Notes Traveler before 8.5.3.3 Interim Fix 1, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via the redirectURL parameter, a different vulnerability than CVE-2012-4824 and CVE-2012-4825.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0001.html; http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0001.html
CVE: CVE-2012-5308
Published: 2012-10-08
Description: Cross-site request forgery (CSRF) vulnerability in servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 allows remote attackers to hijack the authentication of arbitrary users for requests that create problem reports via a getReportProblem upload action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0001.html; http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0001.html
CVE: CVE-2012-5309
Published: 2012-10-08
Description: servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 does not properly restrict invalid authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0001.html; http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0001.html
CVE: CVE-2012-1125
Published: 2012-10-08
Description: Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0145.html; http://plugins.svn.wordpress.org/kish-guest-posting/trunk/readme.txt; http://plugins.trac.wordpress.org/changeset/403694/kish-guest-posting/trunk/uploadify/scripts/uploadify.php
CVE: CVE-2012-5310
Published: 2012-10-08
Description: SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/47627; http://wordpress.org/extend/plugins/wp-e-commerce/changelog/; http://www.securityfocus.com/bid/51637
CVE: CVE-2012-5311
Published: 2012-10-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-0227.  Reason: This candidate is a duplicate of CVE-2012-0227.  Notes: All CVE users should reference CVE-2012-0227 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-5312
Published: 2012-10-08
Description: SQL injection vulnerability in Tribiq CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/108888/tribiq-sql.txt; http://www.securityfocus.com/bid/51614; https://exchange.xforce.ibmcloud.com/vulnerabilities/72613
CVE: CVE-2012-5313
Published: 2012-10-08
Description: SQL injection vulnerability in forum.asp in Snitz Forums 2000 allows remote attackers to execute arbitrary SQL commands via the TOPIC_ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0193&w=2; http://www.securityfocus.com/bid/51596; http://www.vulnerability-lab.com/get_content.php?id=384
CVE: CVE-2012-5314
Published: 2012-10-08
Description: Cross-site scripting (XSS) vulnerability in ViewGit 0.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the f parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/108910/viewgit-xss.txt; http://st2tea.blogspot.com/2012/01/viewgit-cross-site-scripting.html; http://www.securityfocus.com/bid/51624
CVE: CVE-2012-5315
Published: 2012-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in php ireport 1.0 allow remote attackers to inject arbitrary web script or HTML via the message parameter to (1) messages_viewer.php, (2) home.php, or (3) history.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/18402; http://www.securityfocus.com/bid/51609; https://exchange.xforce.ibmcloud.com/vulnerabilities/72610
CVE: CVE-2012-5316
Published: 2012-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Barracuda Spam & Virus Firewall 600 Firmware 4.0.1.009 and earlier allow remote authenticated users to inject arbitrary web script or HTML via (1) Troubleshooting in the Trace route Device module or (2) LDAP Username in the LDAP Configuration module.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0130.html; http://www.securityfocus.com/bid/51599; http://www.vulnerability-lab.com/get_content.php?id=28
CVE: CVE-2012-5317
Published: 2012-10-08
Description: SQL injection vulnerability in main_bigware_43.php in Bigware Shop before 2.1.5 allows remote attackers to execute arbitrary SQL commands via the lastname parameter in a process action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0143.html; http://secunia.com/advisories/47713; http://www.bigware.de/12_18_2011-20_40/sicherheit-update-2-1-5-zur-bigware-shopsoftware-2-1
CVE: CVE-2012-5318
Published: 2012-10-08
Description: Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1125.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/47688; http://www.openwall.com/lists/oss-security/2012/03/08/1; http://secunia.com/advisories/47688
CVE: CVE-2011-4342
Published: 2012-10-08
Description: PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/files/view/99799/SOS-11-003.txt; http://seclists.org/fulldisclosure/2011/Mar/328; http://secunia.com/advisories/43565
CVE: CVE-2011-4927
Published: 2012-10-08
Description: Unspecified vulnerability in the bazaar repository adapter in Redmine 1.0.x before 1.0.5 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://www.debian.org/security/2011/dsa-2261; http://www.openwall.com/lists/oss-security/2012/01/06/5; http://www.openwall.com/lists/oss-security/2012/01/06/7
CVE: CVE-2011-4928
Published: 2012-10-08
Description: Cross-site scripting (XSS) vulnerability in the textile formatter in Redmine before 1.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2011/dsa-2261; http://www.openwall.com/lists/oss-security/2012/01/06/5; http://www.openwall.com/lists/oss-security/2012/01/06/7
CVE: CVE-2011-4929
Published: 2012-10-08
Description: Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2011/dsa-2261; http://www.openwall.com/lists/oss-security/2012/01/06/5; http://www.openwall.com/lists/oss-security/2012/01/06/7
CVE: CVE-2011-5208
Published: 2012-10-08
Description: Multiple directory traversal vulnerabilities in the BackWPup plugin before 1.4.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the wpabs parameter to (1) app/options-view_log-iframe.php or (2) app/options-runnow-iframe.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0663.html; http://secunia.com/advisories/43565; http://wordpress.org/extend/plugins/backwpup/changelog/
CVE: CVE-2012-1189
Published: 2012-10-08
Description: Stack-based buffer overflow in modules/graphic/ssgraph/grsound.cpp in The Open Racing Car Simulator (TORCS) before 1.3.3 and Speed Dreams allows user-assisted remote attackers to execute arbitrary code via a long file name in an engine sample attribute in an xml configuration file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://freecode.com/projects/torcs/releases/341672; http://torcs.sourceforge.net/index.php?name=News&file=article&sid=79; http://www.exploit-db.com/exploits/18471
CVE: CVE-2012-1308
Published: 2012-10-08
Description: Cross-site request forgery (CSRF) vulnerability in redpass.cgi in D-Link DSL-2640B Firmware EU_4.00 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/18499; http://www.securityfocus.com/bid/52096; https://exchange.xforce.ibmcloud.com/vulnerabilities/73316
CVE: CVE-2012-1416
Published: 2012-10-08
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in SocialCMS 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrator accounts via a member_new action to my_admin/admin1_members.php or (2) modify the default site title via a save action to my_admin/admin1_configuration.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/44313; http://www.exploit-db.com/exploits/17193; http://www.exploit-db.com/exploits/18487
CVE: CVE-2012-5319
Published: 2012-10-08
Description: Cross-site request forgery (CSRF) vulnerability in setup/security.cgi in D-Link DCS-900, DCS-2000, and DCS-5300 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the rootpass parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/18509; https://exchange.xforce.ibmcloud.com/vulnerabilities/73387; http://www.exploit-db.com/exploits/18509
CVE: CVE-2012-5320
Published: 2012-10-08
Description: Cross-site request forgery (CSRF) vulnerability in password.cgi in Sagem F@ST 2[PII_REDACTED]72B allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/48088; http://www.exploit-db.com/exploits/18504; http://www.osvdb.org/79649
CVE: CVE-2012-5321
Published: 2012-10-08
Description: tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/79409; http://secunia.com/advisories/48102; http://st2tea.blogspot.com/2012/02/tiki-wiki-cms-groupware-frame-injection.html
CVE: CVE-2012-5322
Published: 2012-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Xavi X7968 allow remote attackers to inject arbitrary web script or HTML via the (1) pvcName parameter to webconfig/wan/confirm.html/confirm or (2) host_name_txtbox parameter to webconfig/lan/lan_config.html/local_lan_config.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/109987/Xavi-7968-ADSL-Router-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://secunia.com/advisories/48050; http://www.securityfocus.com/bid/52098
CVE: CVE-2012-5323
Published: 2012-10-08
Description: Cross-site request forgery (CSRF) vulnerability in webconfig/admin_passwd/passwd.html/admin_passwd in Xavi X7968 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysUserName, sysPassword, and sysCfmPwd parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.org/files/109987/Xavi-7968-ADSL-Router-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://secunia.com/advisories/48050; http://www.securityfocus.com/bid/52098
CVE: CVE-2012-0846
Published: 2012-10-08
Description: Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the Location variable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-01/0129.html; http://sourceforge.net/tracker/?func=detail&aid=3472745&group_id=3870&atid=103870; http://sourceforge.net/tracker/?func=detail&aid=3488543&group_id=3870&atid=303870
CVE: CVE-2012-5324
Published: 2012-10-08
Description: Multiple buffer overflows in the Pdf Printer Preferences ActiveX Control in pdfxctrl.dll in Tracker Software PDF-XChange 3.60.0128 allow remote attackers to execute arbitrary code via a long string in the (1) sub_path parameter to the StoreInRegistry function or (2) sub_key parameter to the InitFromRegistry function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/18427; http://www.securityfocus.com/bid/51712; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5067.php
CVE: CVE-2012-5325
Published: 2012-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the scr_do_redirect function in scr.php in the Shortcode Redirect plugin 1.0.01 and earlier for WordPress allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (1) url or (2) sec attributes in a redirect tag.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/108914/wpshortcoderedirect-xss.txt; http://www.securityfocus.com/bid/51626; https://exchange.xforce.ibmcloud.com/vulnerabilities/72620
CVE: CVE-2012-5326
Published: 2012-10-08
Description: Cross-site request forgery (CSRF) vulnerability in admin/function.php in IDevSpot iSupport 1.x allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via an administrators action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/18404; https://exchange.xforce.ibmcloud.com/vulnerabilities/72611; http://www.exploit-db.com/exploits/18404
CVE: CVE-2012-5327
Published: 2012-10-08
Description: Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) delete_usrgrp[] parameter in a delete_usergroups action, (2) usergroup parameter in an add_user_togroup action, or (3) add_forum_group_id parameter in an add_forum_submit action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/108915/wpmingleforum-sqlxss.txt; http://plugins.trac.wordpress.org/changeset?reponame=&new=492859%40mingle-forum&old=487353%40mingle-forum; http://wordpress.org/extend/plugins/mingle-forum/changelog/
CVE: CVE-2012-5328
Published: 2012-10-08
Description: Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated users to execute arbitrary SQL commands via the (1) memberid or (2) groupid parameters in a removemember action or (3) id parameter to fs-admin/fs-admin.php, or (4) edit_forum_id parameter in an edit_save_forum action to fs-admin/wpf-edit-forum-group.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://plugins.trac.wordpress.org/changeset?reponame=&new=492859%40mingle-forum&old=487353%40mingle-forum; http://wordpress.org/extend/plugins/mingle-forum/changelog/; http://plugins.trac.wordpress.org/changeset?reponame=&new=492859%40mingle-forum&old=487353%40mingle-forum