deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1156
Published: 2009-04-09
Description: Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series devices 8.0 before 8.0(4)25 and 8.1 before 8.1(2)15, when an SSL VPN or ASDM access is configured, allows remote attackers to cause a denial of service (device reload) via a crafted (1) SSL or (2) HTTP packet.
CVSS Score: 5.7 (MEDIUM)
References: http://osvdb.org/53442; http://secunia.com/advisories/34607; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml
CVE: CVE-2009-1157
Published: 2009-04-09
Description: Memory leak on Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)6, 7.1 before 7.1(2)82, 7.2 before 7.2(4)30, 8.0 before 8.0(4)28, and 8.1 before 8.1(2)19 allows remote attackers to cause a denial of service (memory consumption or device reload) via a crafted TCP packet.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/53445; http://secunia.com/advisories/34607; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml
CVE: CVE-2009-1158
Published: 2009-04-09
Description: Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series devices 7.0 before 7.0(8)6, 7.1 before 7.1(2)82, 7.2 before 7.2(4)26, 8.0 before 8.0(4)24, and 8.1 before 8.1(2)14, when H.323 inspection is enabled, allows remote attackers to cause a denial of service (device reload) via a crafted H.323 packet.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/53444; http://secunia.com/advisories/34607; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml
CVE: CVE-2009-1159
Published: 2009-04-09
Description: Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.2 before 7.2(4)26, 8.0 before 8.0(4)22, and 8.1 before 8.1(2)12, when SQL*Net inspection is enabled, allows remote attackers to cause a denial of service (traceback and device reload) via a series of SQL*Net packets.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/53446; http://secunia.com/advisories/34607; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml
CVE: CVE-2009-1160
Published: 2009-04-09
Description: Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)1, 7.1 before 7.1(2)74, 7.2 before 7.2(4)9, and 8.0 before 8.0(4)5 do not properly implement the implicit deny statement, which might allow remote attackers to successfully send packets that bypass intended access restrictions, aka Bug ID CSCsq91277.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/34607; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml; http://www.securityfocus.com/bid/34429
CVE: CVE-2009-1275
Published: 2009-04-09
Description: Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.
CVSS Score: 6.8 (MEDIUM)
References: http://svn.apache.org/viewvc/tiles/framework/trunk/src/site/apt/security/security-bulletin-1.apt?revision=741913; http://www.securityfocus.com/bid/34657; https://issues.apache.org/struts/browse/TILES-351
CVE: CVE-2009-1276
Published: 2009-04-09
Description: XScreenSaver in Sun Solaris 10 and OpenSolaris before snv_109, and Solaris 8 and 9 with GNOME 2.0 or 2.0.2, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, as demonstrated by Thunderbird new-mail notifications.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://securitytracker.com/id?1022009; http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-22-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-255308-1
CVE: CVE-2009-1277
Published: 2009-04-09
Description: SQL injection vulnerability in index.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to execute arbitrary SQL commands via the member_id parameter in a viewprofile action.  NOTE: the board_id issue is already covered by CVE-2008-2996.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/34370; https://exchange.xforce.ibmcloud.com/vulnerabilities/49678; https://www.exploit-db.com/exploits/8350
CVE: CVE-2009-1278
Published: 2009-04-09
Description: Static code injection vulnerability in forms/ajax/configure.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to inject arbitrary PHP code into config.php via the configure action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/34370; https://exchange.xforce.ibmcloud.com/vulnerabilities/49679; https://www.exploit-db.com/exploits/8350
CVE: CVE-2009-1279
Published: 2009-04-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5 through 1.5.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) com_admin component, (2) com_search component when "Gather Search Statistics" is enabled, and (3) the category view in the com_content component.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-multiple-xsscsrf.html; http://developer.joomla.org/security/news/[PII_REDACTED]2-core-comcontent-xss.html; http://secunia.com/advisories/34551
CVE: CVE-2009-1280
Published: 2009-04-09
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the com_media component for Joomla! 1.5.x through 1.5.9 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://developer.joomla.org/security/news/[PII_REDACTED]1-core-multiple-xsscsrf.html; http://secunia.com/advisories/34551; https://exchange.xforce.ibmcloud.com/vulnerabilities/49656
CVE: CVE-2009-1281
Published: 2009-04-09
Description: Cross-site scripting (XSS) vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/53287; http://secunia.com/advisories/34575; http://www.glfusion.org/article.php/glfusion113
CVE: CVE-2009-1282
Published: 2009-04-09
Description: SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glf_session cookie parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5028&w=2; http://osvdb.org/53286; http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html
CVE: CVE-2009-1283
Published: 2009-04-09
Description: glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glf_password cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection vulnerability to steal hashes.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5028&w=2; http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html; http://secunia.com/advisories/34575
CVE: CVE-2009-1284
Published: 2009-04-09
Description: Buffer overflow in BibTeX 0.99 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a long .bib bibliography file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520920; http://secunia.com/advisories/34445; http://security.gentoo.org/glsa/glsa-201206-28.xml
CVE: CVE-2008-6683
Published: 2009-04-10
Description: Cross-site scripting (XSS) vulnerability in listtest.php in Apartment Search Script allows remote attackers to inject arbitrary web script or HTML via the r parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/32065; https://exchange.xforce.ibmcloud.com/vulnerabilities/46282; https://www.exploit-db.com/exploits/6956
CVE: CVE-2008-6684
Published: 2009-04-10
Description: Unrestricted file upload vulnerability in editimage.php in Apartment Search Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension and a GIF header, then accessing this file via a direct request to a renamed file in Member_Admin/logo/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/32065; https://exchange.xforce.ibmcloud.com/vulnerabilities/46283; https://www.exploit-db.com/exploits/6956
CVE: CVE-2008-6685
Published: 2009-04-10
Description: Unspecified vulnerability in Frontend Filemanager (air_filemanager) 0.6.1 and earlier extension for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/46382; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/; http://www.securityfocus.com/bid/29837
CVE: CVE-2008-6686
Published: 2009-04-10
Description: SQL injection vulnerability in CoolURI (cooluri) 1.0.11 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/46383; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/; http://www.securityfocus.com/bid/29821
CVE: CVE-2008-6687
Published: 2009-04-10
Description: Cross-site scripting (XSS) vulnerability in DCD GoogleMap (dcdgooglemap) 1.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/46378; http://osvdb.org/46384; http://secunia.com/advisories/30773
CVE: CVE-2008-6688
Published: 2009-04-10
Description: Cross-site scripting (XSS) vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/46385; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/; http://www.securityfocus.com/bid/29828
CVE: CVE-2008-6689
Published: 2009-04-10
Description: SQL injection vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/46386; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/; https://exchange.xforce.ibmcloud.com/vulnerabilities/43204
CVE: CVE-2008-6690
Published: 2009-04-10
Description: Unspecified vulnerability in nepa-design.de Spam Protection (nd_antispam) extension 1.0.3 for TYPO3 allows remote attackers to modify configuration via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/46387; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/; http://www.securityfocus.com/bid/29833
CVE: CVE-2008-6691
Published: 2009-04-10
Description: SQL injection vulnerability in Diocese of Portsmouth Calendar Today (pd_calendar_today) extension 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/46388; http://secunia.com/advisories/30737; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/
CVE: CVE-2008-6692
Published: 2009-04-10
Description: SQL injection vulnerability in Diocese of Portsmouth Training Courses (pd_trainingcourses) extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/46389; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/; http://www.securityfocus.com/bid/29822
CVE: CVE-2008-6693
Published: 2009-04-10
Description: SQL injection vulnerability in Download system (sb_downloader) extension 0.1.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/46390; http://secunia.com/advisories/30737; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/
CVE: CVE-2008-6694
Published: 2009-04-10
Description: SQL injection vulnerability in Random Prayer (ste_prayer) 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/46391; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/; http://www.securityfocus.com/bid/29827
CVE: CVE-2008-6695
Published: 2009-04-10
Description: SQL injection vulnerability in TIMTAB social bookmark icons (timtab_sociable) 2.0.4 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/46392; http://secunia.com/advisories/30737; http://typo3.org/extensions/repository/view/timtab_sociable/2.0.5/
CVE: CVE-2008-6696
Published: 2009-04-10
Description: SQL injection vulnerability in Fussballtippspiel (toto) 0.1.1 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/46394; http://typo3.org/extensions/repository/view/toto/0.1.2/; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/
CVE: CVE-2008-6697
Published: 2009-04-10
Description: SQL injection vulnerability in TARGET-E WorldCup Bets (worldcup) 2.0.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/46396; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/; http://www.securityfocus.com/bid/29826
CVE: CVE-2008-6698
Published: 2009-04-10
Description: Cross-site scripting (XSS) vulnerability in TARGET-E WorldCup Bets (worldcup) 2.0.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/46395; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/; http://www.securityfocus.com/bid/29826
CVE: CVE-2008-6699
Published: 2009-04-10
Description: Cross-site scripting (XSS) vulnerability in Resource Library (tjs_reslib) 0.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/46393; http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/; http://www.securityfocus.com/bid/29832
CVE: CVE-2008-6700
Published: 2009-04-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) mytable parameter to view.php, (2) mytable parameter to viewdb2.php, (3) tablehere parameter to category-rename.php, and (4) letter parameter to module-contacts.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29700; https://exchange.xforce.ibmcloud.com/vulnerabilities/43066; https://www.exploit-db.com/exploits/5797
CVE: CVE-2008-6701
Published: 2009-04-10
Description: NetScout (formerly Network General) Visualizer V2100 and InfiniStream i1730 do not restrict access to ResourceManager/en_US/domains/add_domain.jsp, which allows remote attackers to gain administrator privileges via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/46195; http://secunia.com/advisories/30514; http://www.securityfocus.com/archive/1/493171/100/0/threaded
CVE: CVE-2008-6702
Published: 2009-04-10
Description: S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (crash) via a long nickname, which triggers an exception.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/stalkerboom-adv.txt; http://osvdb.org/46432; http://secunia.com/advisories/30707
CVE: CVE-2008-6703
Published: 2009-04-10
Description: Stack-based buffer overflow in the IPureServer::_Recieve function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to execute arbitrary code via a compressed 0x39 packet, which is decompressed by the NET_Compressor::Decompress function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/stalker39x-adv.txt; http://osvdb.org/46626; http://secunia.com/advisories/30891
CVE: CVE-2008-6704
Published: 2009-04-10
Description: Integer overflow in the NET_Compressor::Decompress function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (server crash) via a crafted packet with a 0xc1 value that contains no compressed data, which triggers a copy of a large amount of memory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/stalker39x-adv.txt; http://osvdb.org/46627; http://secunia.com/advisories/30891
CVE: CVE-2008-6705
Published: 2009-04-10
Description: The MultipacketReciever::RecievePacket function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (server termination) via a crafted packet without an expected 0xe0 or 0xe1 value, which triggers the INT3 instruction.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/stalker39x-adv.txt; http://osvdb.org/46628; http://secunia.com/advisories/30891
CVE: CVE-2008-6706
Published: 2009-04-10
Description: Multiple unspecified vulnerabilities in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, allow remote attackers to obtain (1) application server configuration, (2) database server configuration including encrypted passwords, (3) a system utility that decrypts "subscriber table passwords," (4) a system utility that decrypts database passwords, and (5) a system utility that encrypts "subscriber table passwords."
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/46602; http://secunia.com/advisories/30751; http://support.avaya.com/elmodocs2/security/ASA-2008-268.htm
CVE: CVE-2008-6707
Published: 2009-04-10
Description: The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via (1) the certificate installation utility, (2) unspecified scripts in the objects folder, (3) an "unnecessary default application," (4) unspecified scripts in the states folder, (5) an unspecified "default application" that lists server configuration, and (6) "full system help."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/46598; http://osvdb.org/46599; http://osvdb.org/46600
CVE: CVE-2008-6708
Published: 2009-04-10
Description: Unspecified vulnerability in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x and 4.x, allows remote authenticated administrators to gain root privileges via unknown vectors related to configuration of "data viewing or restoring parameters."
CVSS Score: 9.0 (HIGH)
References: http://osvdb.org/46604; http://secunia.com/advisories/30751; http://support.avaya.com/elmodocs2/security/ASA-2008-268.htm
CVE: CVE-2008-6709
Published: 2009-04-10
Description: Unspecified vulnerability in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, allows remote authenticated users to execute arbitrary commands via unknown vectors related to configuration of "local data viewing or restoring parameters."
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/30751; http://support.avaya.com/elmodocs2/security/ASA-2008-268.htm; http://www.osvdb.org/46603
CVE: CVE-2008-6710
Published: 2009-04-10
Description: Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0.3 SP1 allows remote authenticated administrators to gain root privileges via unknown vectors related to "configuring data viewing or restoring credentials."
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/30799; http://support.avaya.com/elmodocs2/security/ASA-2008-270.htm; http://www.osvdb.org/46582
CVE: CVE-2008-6711
Published: 2009-04-10
Description: Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0.3 SP1 allows remote authenticated users to execute arbitrary commands via unknown vectors related to "viewing system logs."
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/30799; http://support.avaya.com/elmodocs2/security/ASA-2008-270.htm; http://www.osvdb.org/46581
CVE: CVE-2008-6712
Published: 2009-04-10
Description: The HTTP/XML-RPC service in Crysis 1.21 (game version 1.1.1.6156) and earlier allows remote attackers to cause a denial of service (crash) via a long HTTP request, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.org/poc/dontcrysis.txt; http://archives.neohapsis.com/archives/fulldisclosure/2008-06/0211.html; http://osvdb.org/46261
CVE: CVE-2008-6713
Published: 2009-04-10
Description: World in Conflict (WIC) 1.008 and earlier allows remote attackers to cause a denial of service (access violation and crash) via a zero-byte data block to TCP port 48000, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/wicboom-adv.txt; http://osvdb.org/46533; http://secunia.com/advisories/30817
CVE: CVE-2008-6714
Published: 2009-04-10
Description: admin.php in xeCMS 1.0.0 RC2 and earlier allows remote attackers to bypass authentication and access the admin panel by setting the xecms_username cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/29740; https://exchange.xforce.ibmcloud.com/vulnerabilities/43114; https://www.exploit-db.com/exploits/5818
CVE: CVE-2008-6715
Published: 2009-04-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pre ADS Portal 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) homeadmin/adminhome.php and (2) homeadmin/signinform.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/32151; https://exchange.xforce.ibmcloud.com/vulnerabilities/46398; https://www.exploit-db.com/exploits/7017
CVE: CVE-2008-6716
Published: 2009-04-13
Description: homeadmin/adminhome.php in Pre ADS Portal 2.0 and earlier does not require administrative authentication, which allows remote attackers to have an unspecified impact via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/32151; https://exchange.xforce.ibmcloud.com/vulnerabilities/46399; https://www.exploit-db.com/exploits/7017
CVE: CVE-2008-6717
Published: 2009-04-13
Description: U&M Software Signup 1.0 and 1.1 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) adminstart.php, (2) admineventtype.php, (3) admineventdetails.php, (4) admineventlist.php, (5) adminuserslist.php, (6) adminleaderslist.php, (7) admindatabase.php, and possibly (8) index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://signup.uochm.com/features.php; http://www.securityfocus.com/bid/32166; https://www.exploit-db.com/exploits/7032