deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5046
Published: 2008-11-13
Description: SQL injection vulnerability in index.php in Mole Group Pizza Script allows remote attackers to execute arbitrary SQL commands via the manufacturers_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32613; http://securityreason.com/securityalert/4589; http://www.securityfocus.com/bid/32165
CVE: CVE-2008-5047
Published: 2008-11-13
Description: SQL injection vulnerability in admin/index.php in Mole Group Rental Script allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32646; http://securityreason.com/securityalert/4580; http://www.securityfocus.com/bid/32195
CVE: CVE-2008-5048
Published: 2008-11-13
Description: Buffer overflow in Atepmon.sys in ISecSoft Anti-Trojan Elite 4.2.1 and earlier, and possibly 4.2.2, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via long inputs to the 0x00222494 IOCTL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32669; http://www.ntinternals.org/ntiadv0802/ntiadv0802.html; http://www.securityfocus.com/bid/32202
CVE: CVE-2008-5049
Published: 2008-11-13
Description: Buffer overflow in AKEProtect.sys 3.3.3.0 in ISecSoft Anti-Keylogger Elite 3.3.0 and earlier, and possibly other versions including 3.3.3, allows local users to gain privileges via long inputs to the (1) 0x002224A4, (2) 0x002224C0, and (3) 0x002224CC IOCTL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32634; http://securityreason.com/securityalert/4582; http://www.ntinternals.org/ntiadv0802/ntiadv0802.html
CVE: CVE-2008-5050
Published: 2008-11-13
Description: Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before 0.94.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted VBA project file, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065530.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
CVE: CVE-2008-5051
Published: 2008-11-13
Description: SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the PostID parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4581; http://www.securityfocus.com/archive/1/498234/100/0/threaded; http://www.securityfocus.com/bid/32236
CVE: CVE-2008-0017
Published: 2008-11-13
Description: The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP index response with a crafted 200 header, which triggers memory corruption and a buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32684; http://secunia.com/advisories/32693
CVE: CVE-2008-5012
Published: 2008-11-13
Description: Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker.  NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://scary.beasts.org/security/CESA-2008-009.html; http://scarybeastsecurity.blogspot.com/2008/11/firefox-cross-domain-image-theft-and.html
CVE: CVE-2008-5013
Published: 2008-11-13
Description: Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32684; http://secunia.com/advisories/32693
CVE: CVE-2008-5014
Published: 2008-11-13
Description: jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32011; http://secunia.com/advisories/32684
CVE: CVE-2008-5015
Published: 2008-11-13
Description: Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrary JavaScript with chrome privileges via malicious code in a file that has already been saved on the local system.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32695; http://secunia.com/advisories/32713
CVE: CVE-2008-5016
Published: 2008-11-13
Description: The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32684; http://secunia.com/advisories/32694
CVE: CVE-2008-5017
Published: 2008-11-13
Description: Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32684; http://secunia.com/advisories/32693
CVE: CVE-2008-5018
Published: 2008-11-13
Description: The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via vectors related to "insufficient class checking" in the Date class.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32684; http://secunia.com/advisories/32693
CVE: CVE-2008-5019
Published: 2008-11-13
Description: The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18 allows remote attackers to violate the same origin policy to conduct cross-site scripting (XSS) attacks and execute arbitrary JavaScript with chrome privileges via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32684; http://secunia.com/advisories/32693
CVE: CVE-2008-5021
Published: 2008-11-13
Description: nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized, then using the blur method to access uninitialized memory.
CVSS Score: 9.3 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32684; http://secunia.com/advisories/32693
CVE: CVE-2008-5022
Published: 2008-11-13
Description: The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32684; http://secunia.com/advisories/32693
CVE: CVE-2008-5023
Published: 2008-11-13
Description: Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding CSS property in a signed JAR file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32684; http://secunia.com/advisories/32693
CVE: CVE-2008-5024
Published: 2008-11-13
Description: Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-91
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://secunia.com/advisories/32684; http://secunia.com/advisories/32693
CVE: CVE-2008-5052
Published: 2008-11-13
Description: The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html; http://www.mandriva.com/security/advisories?name=MDVSA-2008:228; http://www.mandriva.com/security/advisories?name=MDVSA-2008:235
CVE: CVE-2008-5053
Published: 2008-11-13
Description: PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/49859; http://securityreason.com/securityalert/4584; http://www.exploit-db.com/exploits/7096
CVE: CVE-2008-5054
Published: 2008-11-13
Description: Multiple SQL injection vulnerabilities in Develop It Easy Membership System 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameters to customer_login.php and the (3) user_name and (4) user_pass parameters to admin/index.php. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32594; http://www.securityfocus.com/bid/32147; https://exchange.xforce.ibmcloud.com/vulnerabilities/46396
CVE: CVE-2008-5055
Published: 2008-11-13
Description: SQL injection vulnerability in department_offline_context.php in ActiveCampaign TrioLive before 1.58.7 allows remote attackers to execute arbitrary SQL commands via the department_id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://activecampaign.com/support/forum/showthread.php?t=4554; http://holisticinfosec.org/content/view/93/45/; http://osvdb.org/49825
CVE: CVE-2008-5056
Published: 2008-11-13
Description: Cross-site scripting (XSS) vulnerability in department_offline_context.php in ActiveCampaign TrioLive before 1.58.7 allows remote attackers to inject arbitrary web script or HTML via the department_id parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://activecampaign.com/support/forum/showthread.php?t=4554; http://holisticinfosec.org/content/view/93/45/; http://osvdb.org/49858
CVE: CVE-2008-5057
Published: 2008-11-13
Description: SQL injection vulnerability in film.asp in Yigit Aybuga Dizi Portali allows remote attackers to execute arbitrary SQL commands via the film parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49803; http://secunia.com/advisories/32675; http://www.securityfocus.com/bid/32239
CVE: CVE-2008-5058
Published: 2008-11-13
Description: SQL injection vulnerability in siteadmin/loginsucess.php in Pre Simple CMS allows remote attackers to execute arbitrary SQL commands via the user parameter, as reachable from siteadmin/adminlogin.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49662; http://secunia.com/advisories/32541; http://www.securityfocus.com/bid/32132
CVE: CVE-2008-5059
Published: 2008-11-13
Description: Cross-site scripting (XSS) vulnerability in index.php in ModernBill 4.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a Javascript event in the new_language parameter in a login action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32529; http://securityreason.com/securityalert/4587; https://exchange.xforce.ibmcloud.com/vulnerabilities/46512
CVE: CVE-2008-5060
Published: 2008-11-13
Description: Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to (1) export_batch.inc.php, (2) run_auto_suspend.cron.php, and (3) send_email_cache.php in include/scripts/; (4) include/misc/mod_2checkout/2checkout_return.inc.php; and (5) include/html/nettools.popup.php, different vectors than CVE-2006-4034 and CVE-2005-1054.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32529; http://securityreason.com/securityalert/4587; https://exchange.xforce.ibmcloud.com/vulnerabilities/46513
CVE: CVE-2008-5061
Published: 2008-11-13
Description: Cross-site scripting (XSS) vulnerability in php/cal_default.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to inject arbitrary web script or HTML via the URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/49679; http://secunia.com/advisories/32640; http://securityreason.com/securityalert/4590
CVE: CVE-2008-5062
Published: 2008-11-13
Description: Directory traversal vulnerability in php/cal_pdf.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to read arbitrary files via directory traversal sequences in the thefile parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/49680; http://secunia.com/advisories/32640; http://securityreason.com/securityalert/4590
CVE: CVE-2008-5063
Published: 2008-11-13
Description: PHP remote file inclusion vulnerability in Admin/ADM_Pagina.php in OTManager 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the Tipo parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/49850; http://secunia.com/advisories/32645; http://securityreason.com/securityalert/4586
CVE: CVE-2008-5064
Published: 2008-11-13
Description: SQL injection vulnerability in liga.php in H&H WebSoccer 2.80 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0810-exploits/hhwebsoccer-sql.txt; http://secunia.com/advisories/32422; http://www.securityfocus.com/bid/31963
CVE: CVE-2008-5065
Published: 2008-11-13
Description: TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBook_login cookie to admin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/4585; http://www.securityfocus.com/bid/31958; https://www.exploit-db.com/exploits/6860
CVE: CVE-2008-5066
Published: 2008-11-13
Description: PHP remote file inclusion vulnerability in upload/admin/frontpage_right.php in Agares Media ThemeSiteScript 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4592; http://www.securityfocus.com/bid/31959; http://www.vupen.com/english/advisories/2008/2959
CVE: CVE-2008-5067
Published: 2008-11-13
Description: Cross-site scripting (XSS) vulnerability in search.php in Kmita Catalogue 2.x allows remote attackers to inject arbitrary web script or HTML via the q parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32457; http://www.osvdb.org/49441; http://www.securityfocus.com/bid/31968
CVE: CVE-2008-5068
Published: 2008-11-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Kmita Gallery allow remote attackers to inject arbitrary web script or HTML via the (1) begin parameter to index.php and the (2) searchtext parameter to search.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32445; http://www.osvdb.org/49444; http://www.osvdb.org/49445
CVE: CVE-2008-5069
Published: 2008-11-14
Description: SQL injection vulnerability in go.php in Panuwat PromoteWeb MySQL, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31425; https://exchange.xforce.ibmcloud.com/vulnerabilities/45436; https://www.exploit-db.com/exploits/6577
CVE: CVE-2008-5070
Published: 2008-11-14
Description: SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the gud parameter to (1) profiles/index.php and (2) profiles/admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31988; http://securityreason.com/securityalert/4593; http://www.securityfocus.com/bid/31463
CVE: CVE-2008-5071
Published: 2008-11-14
Description: Multiple eval injection vulnerabilities in itpm_estimate.php in Yoxel 1.23beta and earlier allow remote authenticated users to execute arbitrary PHP code via the proj_id parameter.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4591; http://www.securityfocus.com/bid/31448; https://exchange.xforce.ibmcloud.com/vulnerabilities/45488
CVE: CVE-2008-5072
Published: 2008-11-14
Description: vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash) via a malformed FLV file.
CVSS Score: 4.3 (MEDIUM)
References: http://packetstormsecurity.org/filedesc/klite-dos-tgz.html; http://securityreason.com/securityalert/4588; http://www.securityfocus.com/bid/31400
CVE: CVE-2008-5073
Published: 2008-11-14
Description: Heap-based buffer overflow in an ActiveX control in Novell ZENworks Desktop Management 6.5 allows remote attackers to execute arbitrary code via a long argument to the CanUninstall method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4595; http://www.securityfocus.com/archive/1/496786/100/0/threaded; http://www.securityfocus.com/bid/31435
CVE: CVE-2008-5074
Published: 2008-11-14
Description: SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the linkid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4594; http://www.securityfocus.com/bid/31469; https://exchange.xforce.ibmcloud.com/vulnerabilities/45504
CVE: CVE-2008-5075
Published: 2008-11-14
Description: Multiple SQL injection vulnerabilities in E-Uploader Pro 1.0 (aka Uploader PRO), when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) img.php, (b) file.php, (c) mail.php, (d) thumb.php, (e) zip.php, and (f) zipit.php, and (2) the view parameter to (g) browser.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4596; http://www.securityfocus.com/bid/31445; https://exchange.xforce.ibmcloud.com/vulnerabilities/45487
CVE: CVE-2008-5076
Published: 2008-11-14
Description: htop 0.7 writes process names to a terminal without sanitizing non-printable characters, which might allow local users to hide processes, modify arbitrary files, or have unspecified other impact via a process name with "crazy control strings."
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://bugs.debian.org/504144; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://www.openwall.com/lists/oss-security/2008/11/02/1
CVE: CVE-2008-5087
Published: 2008-11-14
Description: SQL injection vulnerability in TYPO3 Another Backend Login (wrg_anotherbelogin) extension before 0.0.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/; http://www.securityfocus.com/bid/31266; http://typo3.org/teams/security/security-bulletins/typo3-20080919-1/
CVE: CVE-2008-5088
Published: 2008-11-14
Description: Multiple SQL injection vulnerabilities in PHPKB Knowledge Base Software 1.5 Professional allow remote attackers to execute arbitrary SQL commands via the ID parameter to (1) email.php and (2) question.php, a different vector than CVE-2008-1909.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4599; http://www.securityfocus.com/bid/31279; https://www.exploit-db.com/exploits/6510
CVE: CVE-2008-5089
Published: 2008-11-14
Description: Multiple insecure method vulnerabilities in the DDActiveReportsViewer2.ARViewer2 ActiveX control (arview2.ocx) in Data Dynamics ActiveReports 2.5.0.1314 allow remote attackers to overwrite arbitrary files via a call to the (1) Pages.Save, (2) PrintReport, or (3) Canvas.Save method.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/31894; http://vuln.sg/ddarviewer2501314-en.html; http://www.securityfocus.com/bid/31227
CVE: CVE-2008-5090
Published: 2008-11-14
Description: Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the preg_replace function with the eval switch.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/31978; http://securityreason.com/securityalert/4598; http://www.anelectron.com/board/index.php?tid=3282