deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-2700
Published: 2011-09-06
Description: Multiple buffer overflows in the si4713_write_econtrol_string function in drivers/media/radio/si4713-i2c.c in the Linux kernel before 2.6.39.4 on the N900 platform might allow local users to cause a denial of service or have unspecified other impact via a crafted s_ext_ctrls operation with a (1) V4L2_CID_RDS_TX_PS_NAME or (2) V4L2_CID_RDS_TX_RADIO_TEXT control ID.
CVSS Score: 2.1 (LOW)
CWE: CWE-120
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=dc6b845044ccb7e9e6f3b7e71bd179b3cf0223b6; http://openwall.com/lists/oss-security/2011/07/20/4; http://openwall.com/lists/oss-security/2011/07/20/6
CVE: CVE-2011-2723
Published: 2011-09-06
Description: The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel before 2.6.39.4, when Generic Receive Offload (GRO) is enabled, resets certain fields in incorrect situations, which allows remote attackers to cause a denial of service (system crash) via crafted network traffic.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=17dd759c67f21e34f2156abcf415e1f60605a188; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2; http://openwall.com/lists/oss-security/2011/07/28/13
CVE: CVE-2011-3205
Published: 2011-09-06
Description: Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response.  NOTE: This issue exists because of a CVE-2005-0094 regression.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html; http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html
CVE: CVE-2011-3390
Published: 2011-09-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in IBM OpenAdmin Tool (OAT) before 2.72 for Informix allow remote attackers to inject arbitrary web script or HTML via the (1) informixserver, (2) host, or (3) port parameter in a login action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8370; http://voidroot.blogspot.com/2011/08/xss-in-ibm-open-admin-tool.html; http://www.securityfocus.com/archive/1/519468/100/0/threaded
CVE: CVE-2011-1771
Published: 2011-09-06
Description: The cifs_close function in fs/cifs/file.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact by setting the O_DIRECT flag during an attempt to open a file on a CIFS filesystem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=[PII_REDACTED]d13252fd66cf722aa8f2cbeb3c95cd; http://marc.info/?l=linux-cifs&m=[PII_REDACTED]1849&w=2; http://marc.info/?l=linux-cifs&m=[PII_REDACTED]6155&w=2
CVE: CVE-2011-1776
Published: 2011-09-06
Description: The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fa039d5f6b126fbd65eefa05db2f67e44df8f121; http://openwall.com/lists/oss-security/2011/05/10/4; http://rhn.redhat.com/errata/RHSA-2011-0927.html
CVE: CVE-2011-2184
Published: 2011-09-06
Description: The key_replace_session_keyring function in security/keys/process_keys.c in the Linux kernel before 2.6.39.1 does not initialize a certain structure member, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a KEYCTL_SESSION_TO_PARENT argument to the keyctl function, a different vulnerability than CVE-2010-2960.
CVSS Score: 7.2 (HIGH)
CWE: CWE-476
References: http://alt.swiecki.net/linux_kernel/sys_open-kmem_cache_alloc-2.6.39-rc4.txt; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f7285b5d631fd6096b11c6af0058ed3a2b30ef4e; http://securityreason.com/securityalert/8371
CVE: CVE-2011-2660
Published: 2011-09-06
Description: The modify_resolvconf_suse script in the vpnc package before 0.5.1-55.10.1 in SUSE Linux Enterprise Desktop 11 SP1 might allow remote attackers to execute arbitrary commands via a crafted DNS domain name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00029.html; http://www.securityfocus.com/bid/49391
CVE: CVE-2011-2724
Published: 2011-09-06
Description: The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547.
CVSS Score: 1.2 (LOW)
CWE: CWE-20
References: http://comments.gmane.org/gmane.linux.kernel.cifs/3827; http://git.samba.org/?p=cifs-utils.git%3Ba=commit%3Bh=1e7a32924b22d1f786b6f490ce8590656f578f91; http://openwall.com/lists/oss-security/2011/07/29/9
CVE: CVE-2011-3200
Published: 2011-09-06
Description: Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through 5.8.4 might allow remote attackers to cause a denial of service (application exit) via a long TAG in a legacy syslog message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://git.adiscon.com/?p=rsyslog.git%3Ba=commit%3Bh=1ca6cc236d1dabf1633238b873fb1c057e52f95e; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065837.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065941.html
CVE: CVE-2011-3204
Published: 2011-09-06
Description: hammerhead.cc in Hammerhead 2.1.4 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/hammer.log (aka the HH_LOG file) or (2) the REPORT_LOG file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2011/08/26/9; http://www.openwall.com/lists/oss-security/2011/08/30/7; http://www.securityfocus.com/bid/49548
CVE: CVE-2011-3388
Published: 2011-09-06
Description: Opera before 11.51 allows remote attackers to cause an insecure site to appear secure or trusted via unspecified actions related to Extended Validation and loading content from trusted sources in an unspecified sequence that causes the address field and page information dialog to contain security information based on the trusted site, instead of the insecure site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/74828; http://secunia.com/advisories/45791; http://www.opera.com/docs/changelogs/mac/1151/
CVE: CVE-2011-3389
Published: 2011-09-06
Description: The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-326
References: http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/; http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx; http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx
CVE: CVE-2011-3341
Published: 2011-09-08
Description: Multiple off-by-one errors in order_cmd.cpp in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted CMD_INSERT_ORDER command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://bugs.openttd.org/task/4745; http://bugs.openttd.org/task/4745/getfile/7707/fixcmds.diff; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066128.html
CVE: CVE-2011-3342
Published: 2011-09-08
Description: Multiple buffer overflows in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors related to (1) NAME, (2) PLYR, (3) CHTS, or (4) AIPL (aka AI config) chunk loading from a savegame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.openttd.org/task/4717; http://bugs.openttd.org/task/4748; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066128.html
CVE: CVE-2011-3343
Published: 2011-09-08
Description: Multiple buffer overflows in OpenTTD before 1.1.3 allow local users to cause a denial of service (daemon crash) or possibly gain privileges via (1) a crafted BMP file with RLE compression or (2) crafted dimensions in a BMP file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://bugs.openttd.org/task/4746; http://bugs.openttd.org/task/4747; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066128.html
CVE: CVE-2011-3381
Published: 2011-09-08
Description: Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN71435255/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068; http://www.phorum.org/phorum5/read.php?64%2C147504
CVE: CVE-2011-3382
Published: 2011-09-08
Description: Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN71435255/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068; http://www.phorum.org/phorum5/read.php?64%2C147504
CVE: CVE-2011-3384
Published: 2011-09-08
Description: Cross-site scripting (XSS) vulnerability in the Sage add-on 1.3.10 and earlier for Firefox allows remote attackers to inject arbitrary web script or HTML via a crafted feed, a different vulnerability than CVE-2009-4102.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN30221194/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000069; http://jvn.jp/en/jp/JVN30221194/index.html
CVE: CVE-2011-3391
Published: 2011-09-08
Description: IBM Rational Build Forge 7.1.2 relies on client-side JavaScript code to enforce the EditSecurity permission requirement for the Export Key File function, which allows remote authenticated users to read a key file by removing a disable attribute in the Security sub-menu.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/45871; http://securitytracker.com/id?1026004; http://www.ibm.com/support/docview.wss?uid=swg1PM38058
CVE: CVE-2011-3392
Published: 2011-09-08
Description: Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the real_name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/184/45/; http://secunia.com/advisories/45787; http://www.phorum.org/phorum5/read.php?64%2C149490%2C149490#msg-149490
CVE: CVE-2009-5087
Published: 2011-09-12
Description: Directory traversal vulnerability in geohttpserver in Geovision Digital Video Surveillance System 8.2 allows remote attackers to read arbitrary files via a .. (dot dot) in a GET request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/51886; http://secunia.com/advisories/33924; http://securityreason.com/securityalert/8372
CVE: CVE-2009-5088
Published: 2011-09-12
Description: SQL injection vulnerability in secure/index.php in IdeaCart 0.02 allows remote attackers to execute arbitrary SQL commands via the cID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8049; http://www.securityfocus.com/bid/33765; https://exchange.xforce.ibmcloud.com/vulnerabilities/48730
CVE: CVE-2009-5089
Published: 2011-09-12
Description: Directory traversal vulnerability in index.php in IdeaCart 0.02 and 0.02a allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33941; http://www.exploit-db.com/exploits/8049; http://www.securityfocus.com/bid/33765
CVE: CVE-2009-5090
Published: 2011-09-12
Description: SQL injection vulnerability in editcomments.php in Bloggeruniverse Beta 2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter and possibly other unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8043; http://www.securityfocus.com/bid/33744; https://exchange.xforce.ibmcloud.com/vulnerabilities/48697
CVE: CVE-2009-5091
Published: 2011-09-12
Description: SQL injection vulnerability in page.php in Vlinks 1.0.3 and 1.1.6 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33931; http://www.exploit-db.com/exploits/8050; http://www.securityfocus.com/bid/33766
CVE: CVE-2009-5092
Published: 2011-09-12
Description: Cross-site scripting (XSS) vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN45184501/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000009.html; http://secunia.com/advisories/33803
CVE: CVE-2009-5093
Published: 2011-09-12
Description: Directory traversal vulnerability in gastbuch.php in Gästebuch (Gastebuch) 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the start parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/8027; http://www.securityfocus.com/bid/33707; https://exchange.xforce.ibmcloud.com/vulnerabilities/48644
CVE: CVE-2009-5094
Published: 2011-09-12
Description: SQL injection vulnerability in info.php in CMS Faethon 2.2.0 Ultimate allows remote attackers to execute arbitrary SQL commands via the item parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30098; http://www.exploit-db.com/exploits/8054; http://www.securityfocus.com/bid/33775
CVE: CVE-2009-5095
Published: 2011-09-12
Description: PHP remote file inclusion vulnerability in index_inc.php in ea gBook 0.1 and 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_ordner parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/33927; http://www.exploit-db.com/exploits/8052; http://www.securityfocus.com/bid/33774
CVE: CVE-2011-3420
Published: 2011-09-12
Description: Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.157 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2011/09/beta-channel-update-for-chromebooks_06.html; http://osvdb.org/75377; https://exchange.xforce.ibmcloud.com/vulnerabilities/69729
CVE: CVE-2011-3421
Published: 2011-09-12
Description: Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.125 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2011/09/beta-channel-update-for-chromebooks.html; http://osvdb.org/75378; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13853
CVE: CVE-2011-3422
Published: 2011-09-12
Description: The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html; http://support.apple.com/kb/HT5130; http://www.computerworld.com/s/article/9219669/Mac_OS_X_can_t_properly_revoke_dodgy_digital_certificates
CVE: CVE-2010-4340
Published: 2011-09-12
Description: libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598463; http://mail-archives.apache.org/mod_mbox/incubator-libcloud/201009.mbox/%3C5[PII_REDACTED][PII_REDACTED]3273.JavaMail.jira%40thor%3E; http://mail-archives.apache.org/mod_mbox/incubator-libcloud/201011.mbox/browser
CVE: CVE-2009-5096
Published: 2011-09-13
Description: Cross-site scripting (XSS) vulnerability in the Flag Content module 5.x-2.x before 5.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via the Reason parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/610868; http://drupal.org/node/610870; http://osvdb.org/59119
CVE: CVE-2009-5097
Published: 2011-09-13
Description: Palm Pre WebOS 1.1 and earlier processes JavaScript in email messages, which allows remote attackers to execute arbitrary JavaScript, as demonstrated by reading PalmDatabase.db3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94
References: http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#12; http://secunia.com/advisories/36936; http://tlhsecurity.blogspot.com/2009/10/palm-pre-webos-11-remote-file-access.html
CVE: CVE-2009-5098
Published: 2011-09-13
Description: The LunaSysMgr process in Palm Pre WebOS 1.1 and earlier, when not viewing web pages in landscape mode, allows remote attackers to cause a denial of service (crash) via a web page containing a long string following a refresh tag, which triggers a floating point exception.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-399
References: http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#12; http://secunia.com/advisories/36936; http://securityreason.com/securityalert/8373
CVE: CVE-2009-5099
Published: 2011-09-13
Description: Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/; http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel; http://secunia.com/advisories/37024
CVE: CVE-2009-5100
Published: 2011-09-13
Description: Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/; http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel; http://www.securityfocus.com/archive/1/507168/100/0/threaded
CVE: CVE-2009-5101
Published: 2011-09-13
Description: Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/; http://jira.pentaho.com/browse/BISERVER-3245; http://www.securityfocus.com/archive/1/507168/100/0/threaded
CVE: CVE-2010-4834
Published: 2011-09-14
Description: Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticated users to execute arbitrary SQL commands via the (1) id parameter in a saved_search action and (2) item_types parameter in a show_item_search action in the search_management_manage subcontroller. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/95814/oneorzeroaims-lfisql.txt; http://secunia.com/advisories/42251; http://securityreason.com/securityalert/8375
CVE: CVE-2010-4835
Published: 2011-09-14
Description: Directory traversal vulnerability in index.php in OneOrZero AIMS 2.6.0 Members Edition allows remote authenticated users to read arbitrary files via directory traversal sequences in the controller parameter in a show_report action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/files/view/95814/oneorzeroaims-lfisql.txt; http://securityreason.com/securityalert/8375; http://www.exploit-db.com/exploits/15519
CVE: CVE-2010-4836
Published: 2011-09-14
Description: Cross-site scripting (XSS) vulnerability in register.html in PHPShop 2.1 EE and earlier allows remote attackers to inject arbitrary web script or HTML via the name_new parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/69101; http://secunia.com/advisories/42132; http://securityreason.com/securityalert/8381
CVE: CVE-2010-4837
Published: 2011-09-14
Description: Cross-site scripting (XSS) vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the subject parameter (title field) in a saveTicket action to index2.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/95796/joomlajsupport-xss.txt; http://secunia.com/advisories/42262; http://securityreason.com/securityalert/8377
CVE: CVE-2010-4838
Published: 2011-09-14
Description: SQL injection vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote authenticated users, with Public Back-end permissions, to execute arbitrary SQL commands via the alpha parameter in a (1) listTickets or (2) listFaqs action to administrator/index.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/95797/joomlajsupport-sql.txt; http://secunia.com/advisories/42262; http://securityreason.com/securityalert/8379
CVE: CVE-2010-4839
Published: 2011-09-14
Description: SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the event_id parameter in a register action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/42265; http://www.exploit-db.com/exploits/15513; http://secunia.com/advisories/42265