deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4456
Published: 2008-10-06
Description: Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document.  NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://bugs.mysql.com/bug.php?id=27884; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://seclists.org/bugtraq/2008/Oct/0026.html
CVE: CVE-2008-4457
Published: 2008-10-07
Description: SQL injection vulnerability in inc/inc_statistics.php in MemHT Portal 3.9.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a stats_res cookie to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31751; http://securityreason.com/securityalert/4288; http://www.memht.com/news_95_Important-fix-for-all-MemHT-Versions.html
CVE: CVE-2008-4458
Published: 2008-10-07
Description: SQL injection vulnerability in listings.php in E-Php B2B Trading Marketplace Script allows remote attackers to execute arbitrary SQL commands via the cid parameter in a product action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0809-exploits/ephpb2b-sql.txt; http://secunia.com/advisories/31795; http://www.securityfocus.com/archive/1/496186/100/0/threaded
CVE: CVE-2008-4459
Published: 2008-10-07
Description: SQL injection vulnerability in pick_users.php in the groups module in eXtrovert Thyme 1.3 allows remote attackers to execute arbitrary SQL commands via the uname_search parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31782; http://www.digitrustgroup.com/advisories/web-application-security-thyme.html; http://www.securityfocus.com/bid/31063
CVE: CVE-2008-4460
Published: 2008-10-07
Description: SQL injection vulnerability in game.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the game_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31033; https://exchange.xforce.ibmcloud.com/vulnerabilities/44951; https://www.exploit-db.com/exploits/6379
CVE: CVE-2008-4461
Published: 2008-10-07
Description: SQL injection vulnerability in advanced_search_results.php in Vastal I-Tech Dating Zone, possibly 0.9.9, allows remote attackers to execute arbitrary SQL commands via the fage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31747; http://www.securityfocus.com/bid/31043; http://z0rlu.blogspot.com/2008/09/vastal-i-tech-dating-zone-fage-sql.html
CVE: CVE-2008-4462
Published: 2008-10-07
Description: SQL injection vulnerability in view_news.php in Vastal I-Tech Visa Zone allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31033; https://exchange.xforce.ibmcloud.com/vulnerabilities/44956; https://www.exploit-db.com/exploits/6373
CVE: CVE-2008-4463
Published: 2008-10-07
Description: SQL injection vulnerability in view_news.php in Vastal I-Tech Jobs Zone allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4358; http://www.securityfocus.com/bid/31033; https://exchange.xforce.ibmcloud.com/vulnerabilities/44952
CVE: CVE-2008-4464
Published: 2008-10-07
Description: SQL injection vulnerability in view_mags.php in Vastal I-Tech Mag Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31033; https://exchange.xforce.ibmcloud.com/vulnerabilities/44949; https://www.exploit-db.com/exploits/6380
CVE: CVE-2008-4465
Published: 2008-10-07
Description: SQL injection vulnerability in view_mags.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31033; https://exchange.xforce.ibmcloud.com/vulnerabilities/44953; https://www.exploit-db.com/exploits/6376
CVE: CVE-2008-4466
Published: 2008-10-07
Description: SQL injection vulnerability in view_products_cat.php in Vastal I-Tech Cosmetics Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31718; http://www.securityfocus.com/bid/31033; https://exchange.xforce.ibmcloud.com/vulnerabilities/44948
CVE: CVE-2008-4467
Published: 2008-10-07
Description: SQL injection vulnerability in show_series_ink.php in Vastal I-Tech Toner Cart allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31033; https://exchange.xforce.ibmcloud.com/vulnerabilities/44955; https://www.exploit-db.com/exploits/6374
CVE: CVE-2008-4468
Published: 2008-10-07
Description: SQL injection vulnerability in view_news.php in Vastal I-Tech Share Zone allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31033; https://exchange.xforce.ibmcloud.com/vulnerabilities/44954; https://www.exploit-db.com/exploits/6375
CVE: CVE-2008-4469
Published: 2008-10-07
Description: SQL injection vulnerability in view_cresume.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbitrary SQL commands via the coder_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31717; http://securityreason.com/securityalert/4359; http://www.securityfocus.com/bid/31033
CVE: CVE-2008-4470
Published: 2008-10-07
Description: Stack-based buffer overflow in Numark CUE 5.0 rev2 allows user-assisted attackers to cause a denial of service (application crash) or execute arbitrary code via an M3U playlist file that contains a long absolute pathname.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4354; http://www.securityfocus.com/bid/31042; http://www.vupen.com/english/advisories/2008/2516
CVE: CVE-2008-3543
Published: 2008-10-07
Description: Unspecified vulnerability in NFS / ONCplus B.11.31_04 and earlier on HP-UX B.11.31 allows remote attackers to cause a denial of service via unknown attack vectors.
CVSS Score: 7.8 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01570585; http://secunia.com/advisories/32161; http://www.securityfocus.com/bid/31607
CVE: CVE-2008-4384
Published: 2008-10-07
Description: Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control (LPControl.dll), as acquired by Roxio and iseemedia, allow remote attackers to execute arbitrary code via the (1) url, (2) toolbar, and (3) enableZoomPastMax methods.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32140; http://www.kb.cert.org/vuls/id/848873; http://www.securityfocus.com/bid/31604
CVE: CVE-2008-4393
Published: 2008-10-07
Description: Cross-site scripting (XSS) vulnerability in VeriSign Kontiki Delivery Management System (DMS) 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to zodiac/servlet/zodiac.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2008/Oct/0054.html; http://secunia.com/advisories/32156; http://www.irmplc.com/researchlab/advisories/170
CVE: CVE-2008-4421
Published: 2008-10-07
Description: Directory traversal vulnerability in MetaGauge 1.0.0.17, and probably other versions before 1.0.3.38, allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) in the URL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32094; http://securityreason.com/securityalert/4360; http://www.securityfocus.com/archive/1/497039/100/0/threaded
CVE: CVE-2008-4471
Published: 2008-10-07
Description: Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control (AdView.dll 9.0.0.96), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via "..\" sequences in the argument to the SaveAS method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html; http://secunia.com/advisories/31989; http://securityreason.com/securityalert/4361
CVE: CVE-2008-4472
Published: 2008-10-07
Description: The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://images.autodesk.com/adsk/files/live_update_hotfix0.html; http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html; http://securityreason.com/securityalert/4361
CVE: CVE-2008-3834
Published: 2008-10-07
Description: The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature, which triggers a failed assertion error.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html; http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html
CVE: CVE-2008-4422
Published: 2008-10-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-4409.  Reason: This candidate is a duplicate of CVE-2008-4409.  Notes: All CVE users should reference CVE-2008-4409 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-4474
Published: 2008-10-07
Description: freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496389; http://dev.gentoo.org/~rbu/security/debiantemp/freeradius-dialupadmin; http://lists.debian.org/debian-devel/2008/08/msg00271.html
CVE: CVE-2008-4475
Published: 2008-10-07
Description: ibackup 2.27 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496432; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496464; http://dev.gentoo.org/~rbu/security/debiantemp/ibackup
CVE: CVE-2008-4476
Published: 2008-10-07
Description: sympa.pl in sympa 5.3.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sympa_aliases.$$ temporary file.  NOTE: wwsympa.fcgi was also reported, but the issue occurred in a dead function, so it is not a vulnerability.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496405; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494969; http://dev.gentoo.org/~rbu/security/debiantemp/sympa
CVE: CVE-2008-3060
Published: 2008-10-08
Description: V-webmail 1.5.0 allows remote attackers to obtain sensitive information via (1) malformed input in the login page (includes/local.hooks.php) and (2) an invalid session ID, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/ref/48/48-v-webmail.txt; http://www.osvdb.org/48793; http://www.osvdb.org/48794
CVE: CVE-2008-3063
Published: 2008-10-08
Description: SQL injection vulnerability in login.php in V-webmail 1.5.0 might allow remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/ref/48/48-v-webmail.txt; http://www.osvdb.org/48795; https://exchange.xforce.ibmcloud.com/vulnerabilities/45856
CVE: CVE-2008-4477
Published: 2008-10-08
Description: alert.d/test.alert in mon 0.99.2 allows local users to overwrite arbitrary files via a symlink attack on the test.alert.log temporary file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496398; http://dev.gentoo.org/~rbu/security/debiantemp/mon; http://lists.debian.org/debian-devel/2008/08/msg00312.html
CVE: CVE-2008-3061
Published: 2008-10-08
Description: Open redirect vulnerability in redirect.php in V-webmail 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the to parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/48/48-v-webmail.txt; http://www.osvdb.org/48796; https://exchange.xforce.ibmcloud.com/vulnerabilities/45855
CVE: CVE-2008-4481
Published: 2008-10-08
Description: Cross-site scripting (XSS) vulnerability in Redmine 0.7.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN00945448/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000038.html; http://www.redmine.org/wiki/redmine/Changelog
CVE: CVE-2008-4482
Published: 2008-10-08
Description: The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during validation of an XML file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://issues.apache.org/jira/browse/XERCESC-1051; http://secunia.com/advisories/32108; http://www.securityfocus.com/bid/31533
CVE: CVE-2008-4483
Published: 2008-10-08
Description: Directory traversal vulnerability in index.php in Crux Gallery 1.32 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32058; http://securityreason.com/securityalert/4366; http://www.securityfocus.com/bid/31516
CVE: CVE-2008-4484
Published: 2008-10-08
Description: main.php in Crux Gallery 1.32 and earlier allows remote attackers to gain administrative access by setting the name parameter to "users," as demonstrated via index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/32058; http://securityreason.com/securityalert/4365; http://www.attrition.org/pipermail/vim/2008-October/002083.html
CVE: CVE-2008-4485
Published: 2008-10-08
Description: Cross-site scripting (XSS) vulnerability in the ICAP patience page in Blue Coat Security Gateway OS (SGOS) 4.2 before 4.2.9, 5.2 before 5.2.5, and 5.3 before 5.3.1.7 allows remote attackers to inject arbitrary web script or HTML via the URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1789&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5313&w=2; http://secunia.com/advisories/32122
CVE: CVE-2008-4486
Published: 2008-10-08
Description: Directory traversal vulnerability in index.php in SAC.php (SACphp), as used in Yerba 6.3 and earlier, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32093; http://securityreason.com/securityalert/4368; http://www.securityfocus.com/archive/1/497103
CVE: CVE-2008-4487
Published: 2008-10-08
Description: SQL injection vulnerability in ap-save.php in Atarone CMS 1.2.0 allows remote attackers to execute arbitrary SQL commands via the (1) site_name, (2) email, (3) theme_chosen, (4) hp, (5) c_meta, (6) id, and (7) c_js parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32100; http://www.securityfocus.com/bid/31610; https://exchange.xforce.ibmcloud.com/vulnerabilities/45704
CVE: CVE-2008-4488
Published: 2008-10-08
Description: Cross-site scripting (XSS) vulnerability in ap-pages.php in Atarone CMS 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) id parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32100; http://www.securityfocus.com/bid/31610; https://exchange.xforce.ibmcloud.com/vulnerabilities/45706
CVE: CVE-2008-4489
Published: 2008-10-08
Description: Directory traversal vulnerability in ap-save.php in Atarone CMS 1.2.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the theme_chosen parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32100; http://www.securityfocus.com/bid/31610; https://exchange.xforce.ibmcloud.com/vulnerabilities/45705
CVE: CVE-2008-4490
Published: 2008-10-08
Description: Directory traversal vulnerability in config.inc.php in phpAbook 0.8.8b and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the userInfo cookie.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4364; http://www.securityfocus.com/bid/31581; https://exchange.xforce.ibmcloud.com/vulnerabilities/45680
CVE: CVE-2008-4491
Published: 2008-10-08
Description: Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://enablesecurity.com/2008/10/03/apple-mailapp-security-advisory/; http://resources.enablesecurity.com/advisories/apple-mailapp-smime.txt; http://securityreason.com/securityalert/4363
CVE: CVE-2008-4492
Published: 2008-10-08
Description: SQL injection vulnerability in referrals.php in YourOwnBux 4.0 allows remote attackers to execute arbitrary SQL commands via the usNick cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4362; http://www.securityfocus.com/bid/31624; https://exchange.xforce.ibmcloud.com/vulnerabilities/45737
CVE: CVE-2008-3814
Published: 2008-10-08
Description: Unspecified vulnerability in Cisco Unity 4.x before 4.2(1)ES161, 5.x before 5.0(1)ES53, and 7.x before 7.0(2)ES8, when using anonymous authentication (aka native Unity authentication), allows remote attackers to bypass authentication and read or modify system configuration parameters by going to a specific link more than once.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/32187; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a0d85f.shtml; http://www.cisco.com/en/US/products/products_security_response09186a0080a0d861.html
CVE: CVE-2008-3826
Published: 2008-10-08
Description: Unspecified vulnerability in Condor before 7.0.5 allows attackers to execute jobs as other users via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/32189; http://secunia.com/advisories/32193; http://secunia.com/advisories/32232
CVE: CVE-2008-3828
Published: 2008-10-08
Description: Stack-based buffer overflow in the condor_ schedd daemon in Condor before 7.0.5 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/32189; http://secunia.com/advisories/32193; http://secunia.com/advisories/32232
CVE: CVE-2008-3829
Published: 2008-10-08
Description: Unspecified vulnerability in the condor_ schedd daemon in Condor before 7.0.5 allows attackers to cause a denial of service (crash) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/32189; http://secunia.com/advisories/32193; http://secunia.com/advisories/32232
CVE: CVE-2008-3830
Published: 2008-10-08
Description: Condor before 7.0.5 does not properly handle when the configuration specifies overlapping netmasks in allow or deny rules, which causes the rule to be ignored and allows attackers to bypass intended access restrictions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32189; http://secunia.com/advisories/32193; http://secunia.com/advisories/32232
CVE: CVE-2008-4493
Published: 2008-10-08
Description: Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Edition, allows remote attackers to force the upload of arbitrary files by using the AddString and Post methods and a modified PostURL to construct an HTTP POST request.  NOTE: this issue might only be exploitable in limited environments or non-default browser settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://securityreason.com/securityalert/4376; http://www.securityfocus.com/bid/31632; http://www.securitytracker.com/id?1021018
CVE: CVE-2008-4494
Published: 2008-10-09
Description: SQL injection vulnerability in completed-advance.php in TorrentTrader Classic 1.08 and 1.04 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32118; http://securityreason.com/securityalert/4375; http://www.securityfocus.com/bid/31626
CVE: CVE-2008-4495
Published: 2008-10-09
Description: SQL injection vulnerability in view_cat.php in PHP Auto Dealer 2.7 allows remote attackers to execute arbitrary SQL commands via the v_cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32147; http://securityreason.com/securityalert/4369; http://selectdevelopment.com/products/phpautodealer/changelog.php
CVE: CVE-2008-4496
Published: 2008-10-09
Description: SQL injection vulnerability in view_cat.php in PHP Realtor 1.5 allows remote attackers to execute arbitrary SQL commands via the v_cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32149; http://securityreason.com/securityalert/4374; http://selectdevelopment.com/products/phprealtor/changelog.php
CVE: CVE-2008-4497
Published: 2008-10-09
Description: SQL injection vulnerability in event_detail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute arbitrary SQL commands via the event_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32129; http://securityreason.com/securityalert/4373; http://www.securityfocus.com/bid/31628
CVE: CVE-2008-4498
Published: 2008-10-09
Description: SQL injection vulnerability in searchresults.php in PHP Autos 2.9.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32139; http://securityreason.com/securityalert/4372; http://www.securityfocus.com/bid/31622
CVE: CVE-2008-4499
Published: 2008-10-09
Description: Multiple directory traversal vulnerabilities in PHP Web Explorer 0.99b and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) refer parameter to main.php and the (2) file parameter to edit.php.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1973&w=2; http://securityreason.com/securityalert/4371; http://www.securityfocus.com/bid/31595