deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4609
Published: 2010-01-13
Description: The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt; http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt
CVE: CVE-2009-4610
Published: 2010-01-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to jsp/dump.jsp in the JSP Dump feature, or the (2) Name or (3) Value parameter to the default URI for the Session Dump Servlet under session/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt; http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt
CVE: CVE-2009-4611
Published: 2010-01-13
Description: Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/508830/100/0/threaded; http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt; http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
CVE: CVE-2009-4612
Published: 2010-01-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/, (2) jspsnoop/ERROR/, and (3) jspsnoop/IOException/, and possibly the PATH_INFO to (4) snoop.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt; http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt
CVE: CVE-2009-4182
Published: 2010-01-14
Description: Multiple unspecified vulnerabilities in HP Web Jetadmin 10.2, when a remote SQL server is used, allow remote attackers to obtain access to data or cause a denial of service, possibly by leveraging authentication and encryption weaknesses on the SQL server.
CVSS Score: 9.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1108&w=2; http://www.securityfocus.com/bid/37787; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1108&w=2
CVE: CVE-2010-0002
Published: 2010-01-14
Description: The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://www.mandriva.com/security/advisories?name=MDVSA-2010:004; https://qa.mandriva.com/show_bug.cgi?id=56882; http://www.mandriva.com/security/advisories?name=MDVSA-2010:004
CVE: CVE-2010-0014
Published: 2010-01-14
Description: System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting ticket (TGT); and might allow remote attackers to bypass intended access restrictions via vectors involving an arbitrary password in conjunction with a valid TGT.
CVSS Score: 3.7 (LOW)
CWE: CWE-287
References: http://secunia.com/advisories/38160; http://www.securityfocus.com/bid/37747; https://bugzilla.redhat.com/show_bug.cgi?id=553233
CVE: CVE-2010-0015
Published: 2010-01-14
Description: nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the getpwnam function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560333; http://marc.info/?l=oss-security&m=[PII_REDACTED]3425&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]5651&w=2
CVE: CVE-2009-4355
Published: 2010-01-14
Description: Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cvs.openssl.org/chngview?cn=19068; http://cvs.openssl.org/chngview?cn=19069; http://cvs.openssl.org/chngview?cn=19167
CVE: CVE-2009-4613
Published: 2010-01-14
Description: SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the Password parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/60866; http://secunia.com/advisories/37633; http://osvdb.org/60866
CVE: CVE-2010-0184
Published: 2010-01-14
Description: The (1) domainutility and (2) domainutilitycmd components in TIBCO Domain Utility in TIBCO Runtime Agent (TRA) before 5.6.2, as used in TIBCO ActiveMatrix BusinessWorks and other products, set weak permissions on domain properties files, which allows local users to obtain domain administrator credentials, and gain privileges on all domain systems, via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/38191; http://www.securityfocus.com/bid/37805; http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2010-0310
Published: 2010-01-14
Description: Trusted Extensions in Sun Solaris 10 allows local users to gain privileges via vectors related to omission of unspecified libraries from software updates.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/38129; http://securitytracker.com/id?1023448; http://sunsolve.sun.com/search/document.do?assetkey=1-21-143502-01-1
CVE: CVE-2010-0311
Published: 2010-01-14
Description: Unspecified vulnerability in Sun Java System Identity Manager (aka IdM) 8.1.0.5 and 8.1.0.6, when Sun Java System Access Manager, OpenSSO Enterprise 8.0, or IBM Tivoli Access Manager is used, allows remote attackers to obtain administrative access via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/61658; http://secunia.com/advisories/38130; http://securitytracker.com/id?1023447
CVE: CVE-2010-0312
Published: 2010-01-14
Description: The do_extendedOp function in ibmslapd in IBM Tivoli Directory Server (TDS) 6.2 on Linux allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SecureWay 3.2 Event Registration Request (aka a 1.3.18.0.2.12.1 request).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://intevydis.blogspot.com/2010/01/tivoli-directory-server-62-doextendedop.html; http://securitytracker.com/id?1023433; http://intevydis.blogspot.com/2010/01/tivoli-directory-server-62-doextendedop.html
CVE: CVE-2010-0313
Published: 2010-01-14
Description: The core_get_proxyauth_dn function in ns-slapd in Sun Java System Directory Server Enterprise Edition 7.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted LDAP Search Request message.
CVSS Score: 5.0 (MEDIUM)
References: http://intevydis.blogspot.com/2010/01/sun-directory-server-70.html; http://secunia.com/advisories/37978; http://securitytracker.com/id?1023431
CVE: CVE-2010-0314
Published: 2010-01-14
Description: Apple Safari allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value.
CVSS Score: 5.0 (MEDIUM)
References: http://nomoreroot.blogspot.com/2010/01/little-bug-in-safari-and-google-chrome.html; http://secunia.com/advisories/41856; http://www.mandriva.com/security/advisories?name=MDVSA-2011:039
CVE: CVE-2010-0315
Published: 2010-01-14
Description: WebKit before r53607, as used in Google Chrome before 4.0.249.89, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value, related to an IFRAME element.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=32309; http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-0249
Published: 2010-01-15
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka "HTML Object Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx; http://news.cnet.com/8301-27080_3-10435232-245.html; http://osvdb.org/61697
CVE: CVE-2010-0280
Published: 2010-01-15
Description: Array index error in Jan Eric Kyprianidis lib3ds 1.x, as used in Google SketchUp 7.x before 7.1 M2, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted structures in a 3DS file, probably related to mesh.c.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/38185; http://secunia.com/advisories/38187; http://sketchup.google.com/support/bin/answer.py?hl=en&answer=141303
CVE: CVE-2010-0316
Published: 2010-01-15
Description: Integer overflow in Google SketchUp before 7.1 M2 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a crafted SKP file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/38187; http://sketchup.google.com/support/bin/answer.py?hl=en&answer=141303; http://www.vupen.com/english/advisories/2010/0133
CVE: CVE-2010-0317
Published: 2010-01-15
Description: Novell Netware 6.5 SP8 allows remote attackers to cause a denial of service (NULL pointer dereference, memory consumption, ABEND, and crash) via a large number of malformed or AFP requests that are not properly handled by (1) the CIFS functionality in CIFS.nlm Semantic Agent (Build 163 MP) 3.27 or (2) the AFP functionality in AFPTCP.nlm Build 163 SP 3.27.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://protekresearch.blogspot.com/2010/01/prl-cifsnlm-memory-consumption-denial.html; http://secunia.com/advisories/38114; http://www.exploit-db.com/exploits/11009
CVE: CVE-2010-0318
Published: 2010-01-15
Description: The replay functionality for ZFS Intent Log (ZIL) in FreeBSD 7.1, 7.2, and 8.0, when creating files during replay of a setattr transaction, uses 7777 permissions instead of the original permissions, which might allow local users to read or modify unauthorized files in opportunistic circumstances after a system crash or power failure.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/38124; http://security.FreeBSD.org/advisories/FreeBSD-SA-10:03.zfs.asc; http://www.securityfocus.com/bid/37657
CVE: CVE-2010-0319
Published: 2010-01-15
Description: Cross-site scripting (XSS) vulnerability in index.php in Docmint 1.0 and 2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/docmintcms-xss.txt; http://secunia.com/advisories/38149; http://www.exploit-db.com/exploits/11119
CVE: CVE-2010-0320
Published: 2010-01-15
Description: Cross-site scripting (XSS) vulnerability in submitlink.php in Glitter Central Script allows remote attackers to inject arbitrary web script or HTML via the catid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/glittercentral-xss.txt; http://secunia.com/advisories/38146; http://www.exploit-db.com/exploits/11108
CVE: CVE-2010-0321
Published: 2010-01-15
Description: Cross-site scripting (XSS) vulnerability in jobs/index.php in Jamit Job Board 3.0 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/jamitjobboard-xss.txt; http://secunia.com/advisories/32797; http://www.exploit-db.com/exploits/11073
CVE: CVE-2010-0322
Published: 2010-01-15
Description: SQL injection vulnerability in the init function in MK-AnydropdownMenu (mk_anydropdownmenu) extension 0.3.28 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/mk_anydropdownmenu/0.4.0/; http://typo3.org/extensions/repository/view/mk_anydropdownmenu/0.4.0/info/ChangeLog/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0323
Published: 2010-01-15
Description: Unspecified vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
CVSS Score: 7.8 (HIGH)
References: http://typo3.org/extensions/repository/view/goof_fotoboek/1.7.15/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/extensions/repository/view/goof_fotoboek/1.7.15/
CVE: CVE-2010-0324
Published: 2010-01-15
Description: SQL injection vulnerability in the Customer Reference List (ref_list) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/ref_list/1.0.2/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/extensions/repository/view/ref_list/1.0.2/
CVE: CVE-2010-0325
Published: 2010-01-15
Description: Unspecified vulnerability in the SB Folderdownload (sb_folderdownload) extension 0.2.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://typo3.org/extensions/repository/view/sb_folderdownload/0.2.3/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/extensions/repository/view/sb_folderdownload/0.2.3/
CVE: CVE-2010-0326
Published: 2010-01-15
Description: Cross-site scripting (XSS) vulnerability in the Developer log (devlog) extension 2.9.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38164; http://typo3.org/extensions/repository/view/devlog/2.9.2/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0327
Published: 2010-01-15
Description: Cross-site scripting (XSS) vulnerability in the KJ: Imagelightbox (kj_imagelightbox2) extension 2.0.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2008-2490.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38165; http://typo3.org/extensions/repository/view/kj_imagelightbox2/2.0.2/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0328
Published: 2010-01-15
Description: Cross-site scripting (XSS) vulnerability in the Unit Converter (cs2_unitconv) extension 1.0.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38166; http://typo3.org/extensions/repository/view/cs2_unitconv/1.0.5/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0329
Published: 2010-01-15
Description: SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the "SQL selection field" and "typoscript."
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/38167; http://typo3.org/extensions/repository/view/powermail/1.5.2/; http://typo3.org/extensions/repository/view/powermail/1.5.2/info/changelog.txt/
CVE: CVE-2010-0330
Published: 2010-01-15
Description: SQL injection vulnerability in the Googlemaps for tt_news (jf_easymaps) extension 1.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/jf_easymaps/1.0.3/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/extensions/repository/view/jf_easymaps/1.0.3/
CVE: CVE-2010-0331
Published: 2010-01-15
Description: Cross-site scripting (XSS) vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0332
Published: 2010-01-15
Description: SQL injection vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0333
Published: 2010-01-15
Description: SQL injection vulnerability in the Helpdesk (mg_help) extension 1.1.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0334
Published: 2010-01-15
Description: SQL injection vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0335
Published: 2010-01-15
Description: Cross-site scripting (XSS) vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0336
Published: 2010-01-15
Description: Unspecified vulnerability in the kiddog_mysqldumper (kiddog_mysqldumper) extension 0.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0337
Published: 2010-01-15
Description: SQL injection vulnerability in the tt_news Mail alert (dl3_tt_news_alerts) extension 0.2.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0338
Published: 2010-01-15
Description: SQL injection vulnerability in the TT_Products editor (ttpedit) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0339
Published: 2010-01-15
Description: SQL injection vulnerability in the User Links (vm19_userlinks) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0340
Published: 2010-01-15
Description: SQL injection vulnerability in the MJS Event Pro (mjseventpro) extension 0.2.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0341
Published: 2010-01-15
Description: SQL injection vulnerability in the BB Simple Jobs (bb_simplejobs) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0342
Published: 2010-01-15
Description: SQL injection vulnerability in the Reports for Job (job_reports) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0343
Published: 2010-01-15
Description: SQL injection vulnerability in the Clan Users List (pb_clanlist) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/
CVE: CVE-2010-0344
Published: 2010-01-15
Description: SQL injection vulnerability in the zak_store_management extension 1.0.0 and earlier TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/