deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3703
Published: 2008-08-18
Description: The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to execute arbitrary code via requests to the service socket that create "snapshots schedules" registry values specifying future command execution.  NOTE: this issue exists because of an incomplete fix for CVE-2007-2279.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31486; http://securityreason.com/securityalert/4161; http://securitytracker.com/id?1020699
CVE: CVE-2008-2936
Published: 2008-08-18
Description: Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message.  NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-2.6-20080814.HISTORY; ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.3.15.HISTORY; ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.4.8.HISTORY
CVE: CVE-2008-2937
Published: 2008-08-18
Description: Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-2.6-20080814.HISTORY; ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.5.4.HISTORY; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
CVE: CVE-2008-3704
Published: 2008-08-18
Description: Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31498; http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm; http://www.securityfocus.com/bid/30674
CVE: CVE-2008-2737
Published: 2008-08-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-3558.  Reason: This candidate is a duplicate of CVE-2008-3558.  Notes: All CVE users should reference CVE-2008-3558 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-3705
Published: 2008-08-19
Description: Stack-based buffer overflow in the CLogger::WriteFormated function in echoware/Logger.cpp in EchoVNC Linux before 1.1.2 allows remote echoServers to execute arbitrary code via a large (1) group or (2) user list, aka a "very crowded echoServer" attack.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31526; http://sourceforge.net/project/shownotes.php?release_id=620019&group_id=133100; http://www.securityfocus.com/bid/30722
CVE: CVE-2008-3706
Published: 2008-08-19
Description: SQL injection vulnerability in bannerclick.php in ZEEJOBSITE 2.0 allows remote attackers to execute arbitrary SQL commands via the adid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31515; http://securityreason.com/securityalert/4162; http://www.securityfocus.com/bid/30711
CVE: CVE-2008-3707
Published: 2008-08-19
Description: Multiple PHP remote file inclusion vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to execute arbitrary PHP code via a URL in the script_path parameter to (1) flat_read.php, (2) post.php, (3) process_post.php, (4) process_search.php, (5) forum.php, (6) process_subscribe.php, (7) read.php, (8) search.php, (9) subscribe.php in path/; and (10) add_ban.php, (11) add_ban_form.php, (12) add_board.php, (13) add_vip.php, (14) add_vip_form.php, (15) copy_ban.php, (16) copy_vip.php, (17) delete_ban.php, (18) delete_board.php, (19) delete_messages.php, (20) delete_vip.php, (21) edit_ban.php, (22) edit_board.php, (23) edit_vip.php, (24) index.php, (25) lock_messages.php, (26) login.php, (27) modify_ban_list.php, (28) modify_vip_list.php, (29) move_messages.php, (30) process_add_board.php, (31) process_ban.php, (32) process_delete_ban.php, (33) process_delete_board.php, (34) process_delete_messages.php, (35) process_delete_vip.php, (36) process_edit_board.php, (37) process_lock_messages.php, (38) process_login.php, (39) process_move_messages.php, (40) process_sticky_messages.php, (41) process_vip.php, and (42) sticky_messages.php in path/adminopts.  NOTE: the include/common.php vector is covered by CVE-2006-2871.  NOTE: some of these vectors might not be vulnerabilities under proper installation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/0808-exploits/cyboards-rfilfixss.txt; http://www.attrition.org/pipermail/vim/2008-August/002052.html; http://www.securityfocus.com/bid/30688
CVE: CVE-2008-3708
Published: 2008-08-19
Description: Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. (dot dot) in the id parameter to (1) news/index.dot and (2) getting_started/macros/macros_detail.dot.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31516; http://securityreason.com/securityalert/4163; http://www.securityfocus.com/bid/30703
CVE: CVE-2008-3709
Published: 2008-08-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to inject arbitrary web script or HTML via the (1) lOptionsOptions, (2) lNavAdminOptions, or (3) lNavReturn parameter to options.php; or the (4) lNavReturn parameter to subscribe.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0808-exploits/cyboards-rfilfixss.txt; http://www.attrition.org/pipermail/vim/2008-August/002052.html; http://www.securityfocus.com/bid/30688
CVE: CVE-2008-3710
Published: 2008-08-19
Description: Multiple directory traversal vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) script_path parameter to (a) options.php and the (2) lang_code parameter to (b) copy_vip.php and (c) process_edit_board.php in adminopts/.  NOTE: some of these vectors might not be vulnerabilities under proper installation.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/0808-exploits/cyboards-rfilfixss.txt; http://www.attrition.org/pipermail/vim/2008-August/002052.html; http://www.securityfocus.com/bid/30688
CVE: CVE-2008-3711
Published: 2008-08-19
Description: SQL injection vulnerability in index.php in PHPArcadeScript (PHP Arcade Script) 4.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter in a browse action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4167; http://www.securityfocus.com/bid/30714; http://www.vupen.com/english/advisories/2008/2413
CVE: CVE-2008-3712
Published: 2008-08-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) query string to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php and the (2) mosConfig_sitename parameter to administrator/popups/index3pop.php.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/31528; http://securityreason.com/securityalert/4164; http://www.securityfocus.com/archive/1/495507/100/0/threaded
CVE: CVE-2008-3713
Published: 2008-08-19
Description: SQL injection vulnerability in product.php in PHPBasket allows remote attackers to execute arbitrary SQL commands via the pro_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4165; http://www.securityfocus.com/bid/30726; http://www.vupen.com/english/advisories/2008/2414
CVE: CVE-2008-3714
Published: 2008-08-19
Description: Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a different vulnerability than CVE-2006-3681 and CVE-2006-1945.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://awstats.sourceforge.net/docs/awstats_changelog.txt; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495432; http://secunia.com/advisories/31519
CVE: CVE-2008-3715
Published: 2008-08-19
Description: Cross-site scripting (XSS) vulnerability in inc-core-admin-editor-previouscolorsjs.php in the FlexCMS 2.5 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the PreviousColorsString parameter.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/31532; http://securityreason.com/securityalert/4166; http://www.securityfocus.com/archive/1/495508/100/0/threaded
CVE: CVE-2008-3716
Published: 2008-08-19
Description: Cross-site request forgery (CSRF) vulnerability in Harmoni before 1.6.0 allows remote attackers to make administrative modifications via a (1) save or (2) delete action to an unspecified component.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/31503; http://sourceforge.net/project/shownotes.php?release_id=619864; http://sourceforge.net/tracker/index.php?func=detail&aid=2040513&group_id=82171&atid=1098812
CVE: CVE-2008-3717
Published: 2008-08-19
Description: Harmoni before 1.6.0 does not require administrative privileges to list (1) user names or (2) asset ids, which allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/31503; http://sourceforge.net/project/shownotes.php?release_id=619864; http://sourceforge.net/tracker/index.php?func=detail&aid=2040324&group_id=82171&atid=1098812
CVE: CVE-2008-3718
Published: 2008-08-20
Description: Multiple SQL injection vulnerabilities in cyberBB 0.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) id parameter to show_topic.php and the (2) user parameter to profile.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4168; http://www.securityfocus.com/bid/30734; https://exchange.xforce.ibmcloud.com/vulnerabilities/44526
CVE: CVE-2008-3719
Published: 2008-08-20
Description: SQL injection vulnerability in directory.php in SFS Affiliate Directory allows remote attackers to execute arbitrary SQL commands via the id parameter in a deadlink action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0808-exploits/affildir-sql.txt; http://secunia.com/advisories/31537; http://www.securityfocus.com/bid/30741
CVE: CVE-2008-3720
Published: 2008-08-20
Description: SQL injection vulnerability in index.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary SQL commands via the page parameter.  NOTE: the id vector is already covered by CVE-2007-5679.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4169; http://www.vupen.com/english/advisories/2008/2411; https://exchange.xforce.ibmcloud.com/vulnerabilities/44506
CVE: CVE-2008-3721
Published: 2008-08-20
Description: PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the language_dir parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4169; http://www.vupen.com/english/advisories/2008/2411; https://exchange.xforce.ibmcloud.com/vulnerabilities/44505
CVE: CVE-2008-3722
Published: 2008-08-20
Description: SQL injection vulnerability in forum/neu.asp in fipsCMS 2.1 allows remote attackers to execute arbitrary SQL commands via the kat parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30712; http://www.securityfocus.com/bid/30712/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/44522
CVE: CVE-2008-3723
Published: 2008-08-20
Description: Directory traversal vulnerability in index.php in PHPizabi 0.848b C1 HFP3 allows remote authenticated administrators to read arbitrary files via (1) a .. (dot dot), (2) a URL, or possibly (3) a full pathname in the id parameter in an admin.templates.edittemplate action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: http://lostmon.blogspot.com/2008/08/phpizabi-v0848b-traversal-file-access.html; http://packetstormsecurity.org/0808-exploits/phpizabi-traverse.txt; http://secunia.com/advisories/31533
CVE: CVE-2008-3724
Published: 2008-08-20
Description: SQL injection vulnerability in index.php in Papoo before 3.7.2 allows remote attackers to execute arbitrary SQL commands via the suchanzahl parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://holisticinfosec.org/content/view/80/45/; http://secunia.com/advisories/31520; http://www.osvdb.org/47554
CVE: CVE-2008-3725
Published: 2008-08-20
Description: SQL injection vulnerability in trr.php in YourFreeWorld Ad Board Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0808-exploits/adboard-sql.txt; http://secunia.com/advisories/31491; http://www.securityfocus.com/bid/30742
CVE: CVE-2008-3726
Published: 2008-08-20
Description: Cross-site scripting (XSS) vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4635&w=2; http://secunia.com/advisories/31534; http://securityreason.com/securityalert/4172
CVE: CVE-2008-3727
Published: 2008-08-20
Description: Directory traversal vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4635&w=2; http://secunia.com/advisories/31534; http://securityreason.com/securityalert/4172
CVE: CVE-2008-3728
Published: 2008-08-20
Description: Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to determine the installation path, IP addresses, and error messages via direct requests to files under LOG/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4635&w=2; http://secunia.com/advisories/31534; http://securityreason.com/securityalert/4172
CVE: CVE-2008-3729
Published: 2008-08-20
Description: Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to bypass authentication and obtain administrative access via a direct request with (1) an IsAdmin=true cookie value or (2) no cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4635&w=2; http://securityreason.com/securityalert/4172; http://www.oliverkarow.de/research/mailscan.txt
CVE: CVE-2008-3730
Published: 2008-08-20
Description: Cross-site scripting (XSS) vulnerability in Nordicwind Document Management System (NOAH) before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/47558; http://secunia.com/advisories/31543; http://www.nordicwind.ca/noah/bugs/inputval.html
CVE: CVE-2008-3731
Published: 2008-08-20
Description: Unspecified vulnerability in Serv-U File Server 7.0.0.1, and other versions before 7.2.0.1, allows remote authenticated users to cause a denial of service (daemon crash) via an SSH session with SFTP commands for directory creation and logging.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/31461; http://www.securityfocus.com/bid/30739; http://www.serv-u.com/releasenotes/
CVE: CVE-2008-3732
Published: 2008-08-20
Description: Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TTA file, which triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/31512; http://security.gentoo.org/glsa/glsa-200809-06.xml; http://securityreason.com/securityalert/4170
CVE: CVE-2008-3733
Published: 2008-08-20
Description: Stack-based buffer overflow in EO Video (eo-video) 1.36 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a .eop (aka playlist) file with a ProjectElement element that contains a long Name element.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31511; http://securityreason.com/securityalert/4171; http://www.securityfocus.com/bid/30717
CVE: CVE-2008-3734
Published: 2008-08-20
Description: Format string vulnerability in Ipswitch WS_FTP Home 2007.0.0.2 and WS_FTP Professional 2007.1.0.0 allows remote FTP servers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in a connection greeting (response).
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://secunia.com/advisories/31504; http://securityreason.com/securityalert/4173; http://www.securityfocus.com/bid/30720
CVE: CVE-2008-3735
Published: 2008-08-20
Description: Cross-site scripting (XSS) vulnerability in index.php in PHPizabi before 848 Core HotFix Pack 3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a blogs.search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2008/08/phpizabi-v0848b-traversal-file-access.html; http://packetstormsecurity.org/0808-exploits/phpizabi-traverse.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/44691
CVE: CVE-2008-3748
Published: 2008-08-21
Description: SQL injection vulnerability in view_group.php in Active PHP Bookmarks (APB) 1.1.02 and 1.2.06 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31544; http://securityreason.com/securityalert/4174; http://www.securityfocus.com/bid/30757
CVE: CVE-2008-3749
Published: 2008-08-21
Description: SQL injection vulnerability in tr.php in YourFreeWorld Banner Management Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31542; http://securityreason.com/securityalert/4175; http://www.securityfocus.com/bid/30756
CVE: CVE-2008-3750
Published: 2008-08-21
Description: SQL injection vulnerability in tr.php in YourFreeWorld URL Rotator Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0808-exploits/urlrotator-sql.txt; http://secunia.com/advisories/31546; http://www.securityfocus.com/bid/30765
CVE: CVE-2008-3751
Published: 2008-08-21
Description: SQL injection vulnerability in tr.php in YourFreeWorld Short Url & Url Tracker Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0808-exploits/shorturl-sql.txt; http://secunia.com/advisories/31547; http://www.securityfocus.com/bid/30767
CVE: CVE-2008-3752
Published: 2008-08-21
Description: SQL injection vulnerability in tr.php in YourFreeWorld Ad-Exchange Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31529; http://www.packetstormsecurity.org/0808-exploits/adexchange-sql.txt; http://www.securityfocus.com/bid/30762
CVE: CVE-2008-3753
Published: 2008-08-21
Description: SQL injection vulnerability in details.php in YourFreeWorld Programs Rating Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31550; http://www.packetstormsecurity.org/0808-exploits/prograte-sql.txt; http://www.securityfocus.com/bid/30759
CVE: CVE-2008-3754
Published: 2008-08-21
Description: SQL injection vulnerability in trl.php in YourFreeWorld Stylish Text Ads Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.packetstormsecurity.org/0808-exploits/stylishtextads-sql.txt; http://www.securityfocus.com/bid/30766; http://www.packetstormsecurity.org/0808-exploits/stylishtextads-sql.txt
CVE: CVE-2008-3755
Published: 2008-08-21
Description: SQL injection vulnerability in view.php in YourFreeWorld Classifieds Script allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0808-exploits/classifieds-sql.txt; http://secunia.com/advisories/31513; http://www.securityfocus.com/bid/30761
CVE: CVE-2008-3756
Published: 2008-08-21
Description: SQL injection vulnerability in tr.php in YourFreeWorld Viral Marketing Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0808-exploits/viral-sql.txt; http://secunia.com/advisories/31541; http://www.securityfocus.com/bid/30764
CVE: CVE-2008-3757
Published: 2008-08-21
Description: SQL injection vulnerability in tr1.php in YourFreeWorld Forced Matrix Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31510; http://www.packetstormsecurity.org/0808-exploits/forcedmatrix-sql.txt; http://www.securityfocus.com/bid/30760
CVE: CVE-2008-3758
Published: 2008-08-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to people.php, and allow remote authenticated users to inject arbitrary web script or HTML via the (2) Account picture and (3) Icon fields in account.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lussumo.com/community/discussion/8559/vanilla-115-release-candidate-1/; http://lussumo.com/docs/doku.php?id=vanilla:releasenotes; http://secunia.com/advisories/31527
CVE: CVE-2008-3759
Published: 2008-08-21
Description: Cross-site request forgery (CSRF) vulnerability in ajax/UpdateCheck.php in Vanilla 1.1.4 and earlier has unknown impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://lussumo.com/bugs/discussion/91/ajaxupdatecheckphp-csrf-vulnerability/; http://lussumo.com/community/discussion/8559/vanilla-115-release-candidate-1/; http://lussumo.com/docs/doku.php?id=vanilla:releasenotes