deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-7202
Published: 2009-09-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in OpenWebMail before 2.53 (Stable) allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/apps/freshmeat/2008-01/0032.html; http://freshmeat.net/projects/openwebmail/releases/270453; http://osvdb.org/40581
CVE: CVE-2009-3051
Published: 2009-09-10
Description: Multiple format string vulnerabilities in lib/silcclient/client_entry.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client before 1.1.8, allow remote attackers to execute arbitrary code via format string specifiers in a nickname field, related to the (1) silc_client_add_client, (2) silc_client_update_client, and (3) silc_client_nickname_format functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html; http://secunia.com/advisories/36134; http://secunia.com/advisories/36614
CVE: CVE-2009-3146
Published: 2009-09-10
Description: Cross-site scripting (XSS) vulnerability in search_advance.php in ArticleFriend Script allows remote attackers to inject arbitrary web script or HTML via the SearchWd parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56732; http://secunia.com/advisories/36077; https://exchange.xforce.ibmcloud.com/vulnerabilities/52207
CVE: CVE-2009-3147
Published: 2009-09-10
Description: Cross-site scripting (XSS) vulnerability in showproduct.php in ReviewPost Pro vB3 allows remote attackers to inject arbitrary web script or HTML via the date parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/reviewpost-xss.txt; http://secunia.com/advisories/36029; http://www.osvdb.org/56615
CVE: CVE-2009-3148
Published: 2009-09-10
Description: Multiple SQL injection vulnerabilities in PortalXP Teacher Edition 1.2 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) calendar.php, (2) news.php, and (3) links.php; and the (4) assignment_id parameter to assignments.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9325; http://www.exploit-db.com/exploits/9325
CVE: CVE-2009-3149
Published: 2009-09-10
Description: Directory traversal vulnerability in _css/js.php in Elgg 1.5, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the js parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/36147; http://www.exploit-db.com/exploits/9355; http://secunia.com/advisories/36147
CVE: CVE-2009-3150
Published: 2009-09-10
Description: SQL injection vulnerability in index.php in Multi Website 1.5 allows remote attackers to execute arbitrary SQL commands via the Browse parameter in a vote action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36107; http://www.exploit-db.com/exploits/9344; http://www.vupen.com/english/advisories/2009/2132
CVE: CVE-2009-3151
Published: 2009-09-10
Description: Directory traversal vulnerability in actions/downloadFile.php in Ultrize TimeSheet 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9307; https://exchange.xforce.ibmcloud.com/vulnerabilities/52166; http://www.exploit-db.com/exploits/9307
CVE: CVE-2009-3152
Published: 2009-09-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in becommunity/community/index.php in NTSOFT BBS E-Market Professional allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) bt_code, and (3) b_no parameters in a board view action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/ntsoft-xss.txt; http://secunia.com/advisories/26117; http://www.securityfocus.com/bid/35893
CVE: CVE-2009-3153
Published: 2009-09-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search engine 1.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, id parameter to (3) templates/header1.php and (4) mp3/lyrics.php, key parameter to (5) video_listing.php and (6) adult/video_listing.php, and name parameter to (7) mp3/embed.php and (8) mp3/info.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/x10mp3se-xss.txt; http://secunia.com/advisories/36059; https://exchange.xforce.ibmcloud.com/vulnerabilities/52165
CVE: CVE-2009-3154
Published: 2009-09-10
Description: SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 7.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action to index.php, a different vector than CVE-2009-2567.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35998; http://www.exploit-db.com/exploits/9258; http://secunia.com/advisories/35998
CVE: CVE-2009-3155
Published: 2009-09-10
Description: Cross-site scripting (XSS) vulnerability in gmap.php in the Almond Classifieds (com_aclassf) component 7.5 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the addr parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35998; http://www.exploit-db.com/exploits/9258; http://www.osvdb.org/56561
CVE: CVE-2009-3156
Published: 2009-09-10
Description: Cross-site scripting (XSS) vulnerability in the Date Tools sub-module in the Date module 6.x before 6.x-2.3 for Drupal allows remote authenticated users, with "use date tools" or "administer content types" privileges, to inject arbitrary web script or HTML via a "Content type label" field.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/534332; http://drupal.org/node/534636; http://lampsecurity.org/drupal-date-xss-vulnerability
CVE: CVE-2009-3157
Published: 2009-09-10
Description: Cross-site scripting (XSS) vulnerability in the Calendar module 6.x before 6.x-2.2 for Drupal allows remote authenticated users, with "create new content types" privileges, to inject arbitrary web script or HTML via the title of a content type.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/534336; http://drupal.org/node/534652; http://lampsecurity.org/drupal-date-xss-vulnerability
CVE: CVE-2009-3158
Published: 2009-09-10
Description: admin/files.php in simplePHPWeb 0.2 does not require authentication, which allows remote attackers to perform unspecified administrative actions via unknown vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.exploit-db.com/exploits/9337; http://www.vupen.com/english/advisories/2009/2129; https://exchange.xforce.ibmcloud.com/vulnerabilities/52215
CVE: CVE-2009-3159
Published: 2009-09-10
Description: Unspecified vulnerability in the rriDecompress function in IBM WebSphere MQ 7.0.0.0, 7.0.0.1, and 7.0.0.2 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/36647; http://www-01.ibm.com/support/docview.wss?uid=swg24024153; http://www-1.ibm.com/support/docview.wss?uid=swg1IC62450
CVE: CVE-2009-3160
Published: 2009-09-10
Description: IBM WebSphere MQ 6.x through 6.0.2.7, 7.0.0.0, 7.0.0.1, 7.0.0.2, and 7.0.1.0, when read ahead or asynchronous message consumption is enabled, allows attackers to have an unspecified impact via unknown vectors, related to a "memory overwrite" issue.
CVSS Score: 8.8 (HIGH)
References: http://secunia.com/advisories/36647; http://www-01.ibm.com/support/docview.wss?uid=swg24024153; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ56259
CVE: CVE-2009-3161
Published: 2009-09-10
Description: The server in IBM WebSphere MQ 7.0.0.1, 7.0.0.2, and 7.0.1.0 allows attackers to cause a denial of service (trap) or possibly have unspecified other impact via malformed data.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/36647; http://www-01.ibm.com/support/docview.wss?uid=swg24024153; http://www-1.ibm.com/support/docview.wss?uid=swg1IC62164
CVE: CVE-2009-3162
Published: 2009-09-10
Description: Cross-site scripting (XSS) vulnerability in Multi Website 1.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/multiwebsite-xss.txt; http://secunia.com/advisories/36107; http://packetstormsecurity.org/0908-exploits/multiwebsite-xss.txt
CVE: CVE-2008-7159
Published: 2009-09-10
Description: The silc_asn1_encoder function in lib/silcasn1/silcasn1_encode.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.8 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted OID value, related to incorrect use of a %lu format string.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-134
References: http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html; http://secunia.com/advisories/36614; http://secunia.com/advisories/36625
CVE: CVE-2008-7160
Published: 2009-09-10
Description: The silc_http_server_parse function in lib/silchttp/silchttpserver.c in the internal HTTP server in silcd in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.9 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted Content-Length header, related to incorrect use of a %lu format string.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-134
References: http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html; http://secunia.com/advisories/36614; http://secunia.com/advisories/36625
CVE: CVE-2009-2202
Published: 2009-09-10
Description: Apple QuickTime before 7.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted H.264 movie file.
CVSS Score: 9.3 (HIGH)
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00002.html; http://support.apple.com/kb/HT3859
CVE: CVE-2009-2203
Published: 2009-09-10
Description: Buffer overflow in Apple QuickTime before 7.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG-4 video file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00002.html; http://support.apple.com/kb/HT3859
CVE: CVE-2009-2206
Published: 2009-09-10
Description: Multiple heap-based buffer overflows in the AudioCodecs library in the CoreAudio component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted (1) AAC or (2) MP3 file, as demonstrated by a ringtone with malformed entries in the sample size table.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html; http://secunia.com/advisories/36677; http://support.apple.com/kb/HT3860
CVE: CVE-2009-2207
Published: 2009-09-10
Description: The MobileMail component in Apple iPhone OS 3.0 and 3.0.1, and iPhone OS 3.0 for iPod touch, lists deleted e-mail messages in Spotlight search results, which might allow local users to obtain sensitive information by reading these messages.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html; http://secunia.com/advisories/36677; http://support.apple.com/kb/HT3860
CVE: CVE-2009-2794
Published: 2009-09-10
Description: The Exchange Support component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not properly implement the "Maximum inactivity time lock" functionality, which allows local users to bypass intended Microsoft Exchange restrictions by choosing a large Require Passcode time value.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-362
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html; http://secunia.com/advisories/36677; http://support.apple.com/kb/HT3860
CVE: CVE-2009-2795
Published: 2009-09-10
Description: Heap-based buffer overflow in the Recovery Mode component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, allows local users to bypass the passcode requirement and access arbitrary data via vectors related to "command parsing."
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html; http://secunia.com/advisories/36677; http://support.apple.com/kb/HT3860
CVE: CVE-2009-2796
Published: 2009-09-10
Description: The UIKit component in Apple iPhone OS 3.0, and iPhone OS 3.0.1 for iPod touch, allows physically proximate attackers to discover a password by watching a user undo deletions of characters in the password.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html; http://secunia.com/advisories/36677; http://support.apple.com/kb/HT3860
CVE: CVE-2009-2797
Published: 2009-09-10
Description: The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/36677
CVE: CVE-2009-2798
Published: 2009-09-10
Description: Heap-based buffer overflow in Apple QuickTime before 7.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FlashPix file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00002.html; http://support.apple.com/kb/HT3859
CVE: CVE-2009-2799
Published: 2009-09-10
Description: Heap-based buffer overflow in Apple QuickTime before 7.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted H.264 movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00002.html; http://support.apple.com/kb/HT3859
CVE: CVE-2009-2815
Published: 2009-09-10
Description: The Telephony component in Apple iPhone OS before 3.1 does not properly handle SMS arrival notifications, which allows remote attackers to cause a denial of service (NULL pointer dereference and service interruption) via a crafted SMS message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html; http://secunia.com/advisories/36677; http://support.apple.com/kb/HT3860
CVE: CVE-2009-3069
Published: 2009-09-10
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/36671; http://secunia.com/advisories/37098; http://www.mozilla.org/security/announce/2009/mfsa2009-47.html
CVE: CVE-2009-3070
Published: 2009-09-10
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/36670; http://secunia.com/advisories/36671; http://secunia.com/advisories/36692
CVE: CVE-2009-3071
Published: 2009-09-10
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.2, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/36670; http://secunia.com/advisories/36671; http://secunia.com/advisories/36692
CVE: CVE-2009-3072
Published: 2009-09-10
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.3, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the BinHex decoder in netwerk/streamconv/converters/nsBinHexDecoder.cpp, and unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://secunia.com/advisories/36669; http://secunia.com/advisories/36670
CVE: CVE-2009-3073
Published: 2009-09-10
Description: Unspecified vulnerability in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/36671; http://secunia.com/advisories/37098; http://www.mozilla.org/security/announce/2009/mfsa2009-47.html
CVE: CVE-2009-3074
Published: 2009-09-10
Description: Unspecified vulnerability in the JavaScript engine in Mozilla Firefox before 3.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/36670; http://secunia.com/advisories/36671; http://secunia.com/advisories/36692
CVE: CVE-2009-3075
Published: 2009-09-10
Description: Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.2, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to use of mutable strings in the js_StringReplaceHelper function in js/src/jsstr.cpp, and unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://secunia.com/advisories/36669; http://secunia.com/advisories/36670
CVE: CVE-2009-3076
Published: 2009-09-10
Description: Mozilla Firefox before 3.0.14 does not properly implement certain dialogs associated with the (1) pkcs11.addmodule and (2) pkcs11.deletemodule operations, which makes it easier for remote attackers to trick a user into installing or removing an arbitrary PKCS11 module.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/36669; http://secunia.com/advisories/36670; http://secunia.com/advisories/36671
CVE: CVE-2009-3077
Published: 2009-09-10
Description: Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, does not properly manage pointers for the columns (aka TreeColumns) of a XUL tree element, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to a "dangling pointer vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://secunia.com/advisories/36669; http://secunia.com/advisories/36670
CVE: CVE-2009-3078
Published: 2009-09-10
Description: Visual truncation vulnerability in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, allows remote attackers to trigger a vertical scroll and spoof URLs via unspecified Unicode characters with a tall line-height property.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/36670; http://secunia.com/advisories/36671; http://secunia.com/advisories/36692
CVE: CVE-2009-3079
Published: 2009-09-10
Description: Unspecified vulnerability in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, allows remote attackers to execute arbitrary JavaScript with chrome privileges via vectors involving an object, the FeedWriter, and the BrowserFeedWriter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/36670; http://secunia.com/advisories/36671; http://secunia.com/advisories/36757
CVE: CVE-2009-3163
Published: 2009-09-10
Description: Multiple format string vulnerabilities in lib/silcclient/command.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client 1.1.8 and earlier, allow remote attackers to execute arbitrary code via format string specifiers in a channel name, related to (1) silc_client_command_topic, (2) silc_client_command_kick, (3) silc_client_command_leave, and (4) silc_client_command_users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://secunia.com/advisories/36614; http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10; http://silcnet.org/general/news/news_toolkit.php
CVE: CVE-2009-3164
Published: 2009-09-10
Description: Unspecified vulnerability in the IPv6 networking stack in Sun Solaris 10, and OpenSolaris snv_01 through snv_82 and snv_111 through snv_122, when a Cassini GigaSwift Ethernet Adapter (aka CE) interface is used, allows remote attackers to cause a denial of service (panic) via vectors involving jumbo frames.  NOTE: this issue exists because of an incomplete fix for CVE-2009-2136.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/36616; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141414-10-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-265608-1
CVE: CVE-2008-7203
Published: 2009-09-11
Description: Valve Software Half-Life Counter-Strike 1.6 allows remote attackers to cause a denial of service (crash) via multiple crafted login packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/27159; https://exchange.xforce.ibmcloud.com/vulnerabilities/39535; https://www.exploit-db.com/exploits/4856
CVE: CVE-2008-7204
Published: 2009-09-11
Description: Cross-site request forgery (CSRF) vulnerability in VirtueMart 1.0.13a and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/41762; http://secunia.com/advisories/28722; http://virtuemart.net/index.php?option=com_content&task=view&id=276&Itemid=127
CVE: CVE-2008-7205
Published: 2009-09-11
Description: Unspecified vulnerability in the product view functionality in VirtueMart 1.0.13a and earlier allows remote attackers to read arbitrary files via vectors related to a template file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/41761; http://secunia.com/advisories/28722; http://virtuemart.net/index.php?option=com_content&task=view&id=275&Itemid=127
CVE: CVE-2008-7206
Published: 2009-09-11
Description: Unspecified vulnerability in Electronic Logbook (ELOG) before 2.7.2 has unknown impact and attack vectors when the "logbook contains HTML code," probably cross-site scripting (XSS).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/41685; http://www.securityfocus.com/bid/27526; https://exchange.xforce.ibmcloud.com/vulnerabilities/40124