deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3488
Published: 2009-09-30
Description: Cross-site scripting (XSS) vulnerability in the Bibliography (aka Biblio) module 6.x-1.6 for Drupal allows remote authenticated users, with certain content-creation privileges, to inject arbitrary web script or HTML via the Title field, probably a different vulnerability than CVE-2009-3479.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2009/Sep/0373.html; http://secunia.com/advisories/36834; http://www.securityfocus.com/bid/36521
CVE: CVE-2009-3489
Published: 2009-09-30
Description: Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable, or (3) restart the service via the start command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://blogs.adobe.com/psirt/2009/09/potential_photoshop_elements_8.html; http://retrogod.altervista.org/9sg_adobe_pe_local.html; http://secunia.com/advisories/36895
CVE: CVE-2009-3490
Published: 2009-09-30
Description: GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://addictivecode.org/pipermail/wget-notify/2009-August/001808.html; http://hg.addictivecode.org/wget/mainline/rev/1eab157d3be7; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
CVE: CVE-2009-3491
Published: 2009-09-30
Description: SQL injection vulnerability in the Kinfusion SportFusion (com_sportfusion) component 0.2.2 through 0.2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a teamdetail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/joomlasportfusion-sql.txt; http://secunia.com/advisories/36844; http://www.securityfocus.com/bid/36481
CVE: CVE-2009-3492
Published: 2009-09-30
Description: Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to (1) Calendar.php, (2) Comment.php, (3) Rss.php and (4) Trackback.php in lib/Loggix/Module/; and (5) modules/downloads/lib/LM_Downloads.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9729; https://exchange.xforce.ibmcloud.com/vulnerabilities/53402; http://www.exploit-db.com/exploits/9729
CVE: CVE-2009-3493
Published: 2009-09-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zenas PaoBacheca Guestbook 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) scrivi.php and (2) index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/58163; http://osvdb.org/58164; http://packetstormsecurity.org/0909-exploits/paobacheca-xss.txt
CVE: CVE-2009-3494
Published: 2009-09-30
Description: Multiple SQL injection vulnerabilities in index.php in T-HTB Manager 0.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in a delete_category action, (2) the name parameter in an update_category action, and other vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9637; http://www.securityfocus.com/archive/1/506386/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/53145
CVE: CVE-2009-3495
Published: 2009-09-30
Description: SQL injection vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the mag_id parameter, a different vector than CVE-2008-4465.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://antisecurity.org/dvd-zone-view_mag-phpmag_id-bsqlxss-multiple-remote-vulnerabilities.antisecurity; http://secunia.com/advisories/36843; http://www.securityfocus.com/bid/36487
CVE: CVE-2009-3496
Published: 2009-09-30
Description: Cross-site scripting (XSS) vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the mag_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://antisecurity.org/dvd-zone-view_mag-phpmag_id-bsqlxss-multiple-remote-vulnerabilities.antisecurity; http://secunia.com/advisories/36843; http://www.securityfocus.com/bid/36487
CVE: CVE-2009-3497
Published: 2009-09-30
Description: SQL injection vulnerability in view_listing.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36812; http://www.packetstormsecurity.org/0909-exploits/realestaterealtors-sql.txt; http://secunia.com/advisories/36812
CVE: CVE-2009-3498
Published: 2009-09-30
Description: SQL injection vulnerability in php/update_article_hits.php in HBcms 1.7 allows remote attackers to execute arbitrary SQL commands via the article_id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/hbcms-sql.txt; http://secunia.com/advisories/36854; http://packetstormsecurity.org/0909-exploits/hbcms-sql.txt
CVE: CVE-2009-3499
Published: 2009-09-30
Description: SQL injection vulnerability in employee.aspx in BPowerHouse BPLawyerCaseDocuments 1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://antisecurity.org/bplawyercasedocument-1-0-mssql-vulnerabilities.antisecurity; http://secunia.com/advisories/36796; http://www.vupen.com/english/advisories/2009/2733
CVE: CVE-2009-3500
Published: 2009-09-30
Description: Multiple SQL injection vulnerabilities in BPowerHouse BPGames 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to main.php and (2) game_id parameter to game.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/bpgames-sql.txt; http://secunia.com/advisories/36828; http://www.vupen.com/english/advisories/2009/2742
CVE: CVE-2009-3501
Published: 2009-09-30
Description: SQL injection vulnerability in students.php in BPowerHouse BPStudents 1.0 allows remote attackers to execute arbitrary SQL commands via the test parameter in a preview action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/58293; http://packetstormsecurity.org/0909-exploits/bpstudent-sql.txt; http://secunia.com/advisories/36826
CVE: CVE-2009-3502
Published: 2009-09-30
Description: SQL injection vulnerability in music.php in BPowerHouse BPMusic 1.0 allows remote attackers to execute arbitrary SQL commands via the music_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/bpmusic-sql.txt; http://secunia.com/advisories/36824; http://www.vupen.com/english/advisories/2009/2740
CVE: CVE-2009-3503
Published: 2009-09-30
Description: Multiple SQL injection vulnerabilities in search.aspx in BPowerHouse BPHolidayLettings 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) rid and (2) tid parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/bpholidaylettings-sql.txt; http://secunia.com/advisories/36833; http://www.vupen.com/english/advisories/2009/2744
CVE: CVE-2009-3504
Published: 2009-09-30
Description: SQL injection vulnerability in offers_buy.php in Alibaba Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/alibaba30-sql.txt; http://secunia.com/advisories/36845; http://www.vupen.com/english/advisories/2009/2737
CVE: CVE-2009-3505
Published: 2009-09-30
Description: SQL injection vulnerability in view_news.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the news_id parameter.  NOTE: the game_id vector is already covered by CVE-2008-4460.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/mmorpgzone-sql.txt; http://www.securityfocus.com/bid/36483; http://www.vupen.com/english/advisories/2009/2734
CVE: CVE-2009-3506
Published: 2009-10-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in CMSphp 0.21 allow remote attackers to inject arbitrary web script or HTML via the (1) cook_user parameter to index.php and the (2) name parameter to modules.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36075; http://www.exploit-db.com/exploits/9311; http://secunia.com/advisories/36075
CVE: CVE-2009-3507
Published: 2009-10-01
Description: Directory traversal vulnerability in modules.php in CMSphp 0.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod_file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/36075; http://www.exploit-db.com/exploits/9311; http://secunia.com/advisories/36075
CVE: CVE-2009-3508
Published: 2009-10-01
Description: Multiple directory traversal vulnerabilities in MUJE CMS 1.0.4.34 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) _class parameter to admin.php and the (2) url parameter to install/install.php; and allow remote authenticated administrators to read arbitrary files via a .. (dot dot) in the (3) _htmlfile parameter to admin.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/36079; http://www.exploit-db.com/exploits/9314; http://secunia.com/advisories/36079
CVE: CVE-2009-3509
Published: 2009-10-01
Description: Cross-site scripting (XSS) vulnerability in admin/admin_index.php in CJ Dynamic Poll PRO 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/cjdynamicpoll-xss.txt; http://secunia.com/advisories/35799; http://www.osvdb.org/56181
CVE: CVE-2009-3510
Published: 2009-10-01
Description: SQL injection vulnerability in viewListing.php in linkSpheric 0.74 Beta 6 allows remote attackers to execute arbitrary SQL commands via the listID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9316; http://www.exploit-db.com/exploits/9316
CVE: CVE-2009-3511
Published: 2009-10-01
Description: Multiple PHP remote file inclusion vulnerabilities in justVisual 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the fs_jVroot parameter to (1) sites/site/pages/index.php, (2) sites/test/pages/contact.php, (3) system/pageTemplate.php, and (4) system/utilities.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9308; http://www.exploit-db.com/exploits/9308
CVE: CVE-2009-3512
Published: 2009-10-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in MyWeight 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) date parameter to user_addfood.php, info parameter to (2) user_forgot_pwd_form.php and (3) user_login.php, and (4) return parameter to user_login.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/myweight-xss.txt; http://secunia.com/advisories/35919; http://www.osvdb.org/55997
CVE: CVE-2009-3513
Published: 2009-10-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pilot Group (PG) eTraining allow remote attackers to inject arbitrary web script or HTML via (1) the cat_id parameter to courses_login.php, the id parameter to (2) news_read.php or (3) lessons_login.php, or (4) the cur parameter in a start action to lessons_login.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/etraining-xss.txt; http://www.securityfocus.com/bid/35834; https://exchange.xforce.ibmcloud.com/vulnerabilities/52072
CVE: CVE-2009-3514
Published: 2009-10-01
Description: Multiple SQL injection vulnerabilities in d.net CMS allow remote attackers to execute arbitrary SQL commands via (1) the page parameter to index.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the (2) edit_id and (3) _p parameter in a news action to dnet_admin/index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9312; http://www.exploit-db.com/exploits/9312
CVE: CVE-2009-3515
Published: 2009-10-01
Description: Directory traversal vulnerability in dnet_admin/index.php in d.net CMS allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the type parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9312; http://www.exploit-db.com/exploits/9312
CVE: CVE-2009-0209
Published: 2009-10-01
Description: PI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default authentication process, which allows remote attackers to read or modify information in databases via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/archive/1/506826/100/0/threaded; http://www.securityfocus.com/archive/1/506826/100/0/threaded
CVE: CVE-2009-2904
Published: 2009-10-01
Description: A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-16
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-March/038214.html; http://lists.vmware.com/pipermail/security-announce/2010/000082.html; http://osvdb.org/58495
CVE: CVE-2009-3516
Published: 2009-10-01
Description: gssd in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does not properly handle the NFSv4 Kerberos credential cache, which allows local users to bypass intended access restrictions for Kerberized NFSv4 shares via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-255
References: http://aix.software.ibm.com/aix/efixes/security/nfs4_advisory.asc; http://www-01.ibm.com/support/docview.wss?uid=isg1IZ49024; http://www-01.ibm.com/support/docview.wss?uid=isg1IZ49096
CVE: CVE-2009-3517
Published: 2009-10-01
Description: nfs.ext in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does not properly use the nfs_portmon setting, which allows remote attackers to bypass intended access restrictions for NFSv4 shares via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://aix.software.ibm.com/aix/efixes/security/nfs4_advisory.asc; http://www-01.ibm.com/support/docview.wss?uid=isg1IZ49024; http://www-01.ibm.com/support/docview.wss?uid=isg1IZ49096
CVE: CVE-2009-3518
Published: 2009-10-01
Description: Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://retrogod.altervista.org/9sg_ibm_uri.html; http://secunia.com/advisories/36906; http://www.vupen.com/english/advisories/2009/2792
CVE: CVE-2009-3519
Published: 2009-10-01
Description: Multiple memory leaks in the IP module in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_109, allow local users to cause a denial of service (memory consumption) via vectors related to (1) M_DATA, (2) M_PROTO, (3) M_PCPROTO, and (4) M_SIG STREAMS messages.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-772
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-122300-44-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-263388-1; http://www.securityfocus.com/bid/36562
CVE: CVE-2009-3520
Published: 2009-10-01
Description: Cross-site request forgery (CSRF) vulnerability in the Your_account module in CMSphp 0.21 allows remote attackers to hijack the authentication of administrators for requests that change an administrator password via the pseudo, pwd, and uid parameters in an admin_info_user_verif action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.org/0909-exploits/cmsphp-xsrf.txt; http://secunia.com/advisories/36075; http://packetstormsecurity.org/0909-exploits/cmsphp-xsrf.txt
CVE: CVE-2009-3521
Published: 2009-10-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Visualization Engine (VE) in IBM Tivoli Composite Application Manager for WebSphere (ITCAM) 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36901; http://www-01.ibm.com/support/docview.wss?rs=71&uid=swg1PK90126; http://www.securityfocus.com/bid/36551
CVE: CVE-2009-3522
Published: 2009-10-01
Description: Stack-based buffer overflow in aswMon2.sys in avast! Home and Professional for Windows 4.8.1351, and possibly other versions before 4.8.1356, allows local users to cause a denial of service (system crash) and possibly gain privileges via a crafted IOCTL request to IOCTL 0xb2c80018.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://osvdb.org/58402; http://secunia.com/advisories/36858; http://www.avast.com/eng/avast-4-home_pro-revision-history.html
CVE: CVE-2009-3523
Published: 2009-10-01
Description: aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption, a different vulnerability than CVE-2008-1625.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/36858; http://www.avast.com/eng/avast-4-home_pro-revision-history.html; http://www.ntinternals.org/ntiadv0904/ntiadv0904.html
CVE: CVE-2009-3524
Published: 2009-10-01
Description: Unspecified vulnerability in ashWsFtr.dll in avast! Home and Professional for Windows before 4.8.1356 has unknown impact and local attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/58403; http://secunia.com/advisories/36858; http://www.avast.com/eng/avast-4-home_pro-revision-history.html
CVE: CVE-2009-3528
Published: 2009-10-02
Description: SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows remote authenticated users to execute arbitrary SQL commands via the uid parameter in a show action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35753; http://www.exploit-db.com/exploits/9105; http://www.osvdb.org/55792
CVE: CVE-2009-3529
Published: 2009-10-02
Description: SQL injection vulnerability in index.php in RadScripts RadBids Gold 4 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a view_forum action, a different vector than CVE-2005-1074.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35827; http://www.exploit-db.com/exploits/9194; http://secunia.com/advisories/35827
CVE: CVE-2009-3530
Published: 2009-10-02
Description: Cross-site scripting (XSS) vulnerability in storefront.php in RadScripts RadBids Gold 4 allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35827; http://www.exploit-db.com/exploits/9194; https://exchange.xforce.ibmcloud.com/vulnerabilities/51837
CVE: CVE-2009-3531
Published: 2009-10-02
Description: SQL injection vulnerability in vnews.php in Universe CMS 1.0.6 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/universecms-sql.txt; http://secunia.com/advisories/35737; http://www.exploit-db.com/exploits/9099
CVE: CVE-2009-3532
Published: 2009-10-02
Description: Multiple SQL injection vulnerabilities in login.asp (aka the login screen) in LogRover 2.3 and 2.3.3 on Windows allow remote attackers to execute arbitrary SQL commands via the (1) uname and (2) pword parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35821; http://www.osvdb.org/55825; http://www.packetstormsecurity.org/0907-advisories/DDIVRT-2009-26.txt
CVE: CVE-2009-3533
Published: 2009-10-02
Description: SQL injection vulnerability in report.php in Meeting Room Booking System (MRBS) before 1.4.2 allows remote attackers to execute arbitrary SQL commands via the typematch parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://mrbs.sourceforge.net/view_text.php?section=NEWS&file=NEWS; http://osvdb.org/55872; http://secunia.com/advisories/35469
CVE: CVE-2009-3534
Published: 2009-10-02
Description: Directory traversal vulnerability in index.php in LionWiki 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/35774; http://www.exploit-db.com/exploits/9119; http://www.osvdb.org/55801
CVE: CVE-2009-3535
Published: 2009-10-02
Description: Directory traversal vulnerability in image.php in Clear Content 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.  NOTE: the researcher also suggests an analogous PHP remote file inclusion vulnerability, but this may be incorrect.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/0907-exploits/clearcontent-rfilfi.txt; http://secunia.com/advisories/35726; http://www.exploit-db.com/exploits/9089
CVE: CVE-2009-3536
Published: 2009-10-02
Description: Multiple stack-based buffer overflows in EpicDJSoftware EpicVJ 1.2.8.0 and 1.3.1.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a (1) .m3u or (2) .mpl playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/35869; http://www.exploit-db.com/exploits/9200; http://www.vupen.com/english/advisories/2009/1955
CVE: CVE-2009-3537
Published: 2009-10-02
Description: Multiple stack-based buffer overflows in EpicDJSoftware EpicDJ 1.3.9.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a (1) .m3u or (2) .mpl playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/35878; http://www.exploit-db.com/exploits/9201; http://www.vupen.com/english/advisories/2009/1956
CVE: CVE-2009-3538
Published: 2009-10-02
Description: Directory traversal vulnerability in thumb.php in Clear Content 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/35726; http://www.osvdb.org/55743; http://secunia.com/advisories/35726
CVE: CVE-2009-3539
Published: 2009-10-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Ultra Classifieds Pro allow remote attackers to inject arbitrary web script or HTML via the (1) cname parameter to subclass.php and the (2) sn parameter to listads.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/ultraclassifieds-xss.txt; http://secunia.com/advisories/35857; http://www.vupen.com/english/advisories/2009/1965