deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4792
Published: 2010-04-22
Description: SQL injection vulnerability in includes/content/member_content.php in BandSite CMS 1.1.4 allows remote attackers to execute arbitrary SQL commands via the memid parameter to members.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/21992; http://www.exploit-db.com/exploits/8309; http://www.securityfocus.com/bid/34292
CVE: CVE-2009-4793
Published: 2010-04-22
Description: Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension via an addphotos action to adminpanel/index.php, and then accessing the file via a direct request with an images/gallery/ directory name.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21992; http://www.exploit-db.com/exploits/8309; http://secunia.com/advisories/21992
CVE: CVE-2009-4794
Published: 2010-04-22
Description: Multiple SQL injection vulnerabilities in Community CMS 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to view.php and the (2) a parameter in an event action to calendar.php, reachable through index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/502276/100/0/threaded; http://www.securityfocus.com/bid/34303; http://www.securityfocus.com/archive/1/502276/100/0/threaded
CVE: CVE-2009-4795
Published: 2010-04-22
Description: Multiple SQL injection vulnerabilities in Xlight FTP Server before 3.2.1, when ODBC authentication is enabled, allow remote attackers to execute arbitrary SQL commands via the (1) USER (aka username) or (2) PASS (aka password) command.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/34513; http://www.securityfocus.com/bid/34288; http://www.xlightftpd.com/forum/viewtopic.php?t=1042
CVE: CVE-2009-4796
Published: 2010-04-22
Description: Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) order and (2) direction parameters to search.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52984; http://secunia.com/advisories/34519; http://www.exploit-db.com/exploits/8302
CVE: CVE-2009-4797
Published: 2010-04-22
Description: SQL injection vulnerability in browse.php in JobHut 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pk parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://e-rdc.org/v1/news.php?readmore=132; http://secunia.com/advisories/34532; http://www.exploit-db.com/exploits/8318
CVE: CVE-2009-4798
Published: 2010-04-22
Description: Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the (1) kat parameter to side.asp, and the (2) brugerid and (3) password fields to the administration login feature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34540; http://www.exploit-db.com/exploits/8307; http://www.securityfocus.com/bid/34289
CVE: CVE-2009-4799
Published: 2010-04-22
Description: Diskos CMS 6.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) artikler_prod.mdb or (2) medlemmer.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/34540; http://www.exploit-db.com/exploits/8307; https://exchange.xforce.ibmcloud.com/vulnerabilities/49511
CVE: CVE-2009-4800
Published: 2010-04-22
Description: Directory traversal vulnerability in Sysax Multi Server 4.3 and 4.5 allows remote authenticated users to delete arbitrary files via a ..// (dot dot slash slash) in a DELE command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/52959; http://secunia.com/advisories/34433; http://www.exploit-db.com/exploits/8256
CVE: CVE-2010-0593
Published: 2010-04-22
Description: The Cisco RVS4000 4-port Gigabit Security Router before 1.3.2.0, PVC2300 Business Internet Video Camera before 1.1.2.6, WVC200 Wireless-G PTZ Internet Video Camera before 1.1.1.15, WVC210 Wireless-G PTZ Internet Video Camera before 1.1.1.15, and WVC2300 Wireless-G Business Internet Video Camera before 1.1.2.6 do not properly restrict read access to passwords, which allows context-dependent attackers to obtain sensitive information, related to (1) access by remote authenticated users to a PVC2300 or WVC2300 via a crafted URL, (2) leveraging setup privileges on a WVC200 or WVC210, and (3) leveraging administrative privileges on an RVS4000, aka Bug ID CSCte64726.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://osvdb.org/63978; http://secunia.com/advisories/39510; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b27511.shtml
CVE: CVE-2010-0991
Published: 2010-04-22
Description: Multiple heap-based buffer overflows in imlib2 1.4.3 allow context-dependent attackers to execute arbitrary code via a crafted (1) ARGB, (2) XPM, or (3) BMP file, related to the IMAGE_DIMENSIONS_OK macro in lib/image.h.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/39354; http://secunia.com/secunia_research/2010-54/; http://www.securityfocus.com/archive/1/510866/100/0/threaded
CVE: CVE-2010-1278
Published: 2010-04-22
Description: Buffer overflow in the Atlcom.get_atlcom ActiveX control in gp.ocx in Adobe Download Manager, as used in Adobe Reader and Acrobat 8.x before 8.2 and 9.x before 9.3, allows remote attackers to execute arbitrary code via unspecified parameters.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb10-02.html; http://www.securityfocus.com/archive/1/510868/100/0/threaded; http://www.securitytracker.com/id?1023908
CVE: CVE-2010-1320
Published: 2010-04-22
Description: Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a request associated with (1) renewal or (2) validation.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577490; http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html
CVE: CVE-2010-1486
Published: 2010-04-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in _invoice.asp in CactuShop before 6.155 allow remote attackers to inject arbitrary web script or HTML via the (1) billing address or (2) shipping address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.coresecurity.com/content/cactushop-xss-persistent-vulnerability; http://www.securityfocus.com/bid/39587; http://www.coresecurity.com/content/cactushop-xss-persistent-vulnerability
CVE: CVE-2009-4801
Published: 2010-04-23
Description: EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP scripts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.exploit-db.com/exploits/8128; http://www.securityfocus.com/archive/1/501352/100/0/threaded; http://www.exploit-db.com/exploits/8128
CVE: CVE-2009-4802
Published: 2010-04-23
Description: SQL injection vulnerability in the Flat Manager (flatmgr) extension before 1.9.16 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34158; http://typo3.org/extensions/repository/view/flatmgr/1.9.16/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-003/
CVE: CVE-2009-4803
Published: 2010-04-23
Description: SQL injection vulnerability in the Accessibility Glossary (a21glossary) extension 0.4.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-003/; http://www.securityfocus.com/bid/33997; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-003/
CVE: CVE-2009-4804
Published: 2010-04-23
Description: Cross-site scripting (XSS) vulnerability in the Calendar Base (cal) extension before 1.1.1 for TYPO3, when Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via "search parameters."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34155; http://typo3.org/extensions/repository/view/cal/1.1.1/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-003/
CVE: CVE-2009-4805
Published: 2010-04-23
Description: Multiple SQL injection vulnerabilities in EZ-Blog Beta 1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the storyid parameter to public/view.php or (2) the kill parameter to admin/remove.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8128; http://www.securityfocus.com/archive/1/501352/100/0/threaded; http://www.securityfocus.com/bid/33947
CVE: CVE-2009-4806
Published: 2010-04-23
Description: admin/save_user.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which allows remote attackers to read or modify the administrator's credentials via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/34129; http://www.exploit-db.com/exploits/8130; http://www.securityfocus.com/bid/33983
CVE: CVE-2009-4807
Published: 2010-04-23
Description: Multiple SQL injection vulnerabilities in Graugon PHP Article Publisher 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) c parameter to index.php and the (2) id parameter to view.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34126; http://www.exploit-db.com/exploits/8133; http://www.securityfocus.com/bid/33952
CVE: CVE-2009-4808
Published: 2010-04-23
Description: admin.php in Graugon PHP Article Publisher 1.0 allows remote attackers to bypass authentication and obtain administrative access by setting the g_admin cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/34126; http://www.exploit-db.com/exploits/8133; http://www.securityfocus.com/bid/33952
CVE: CVE-2009-4809
Published: 2010-04-23
Description: Directory traversal vulnerability in thumbnail.ghp in Easy File Sharing (EFS) Web Server 4.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the vfolder parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/34121; http://www.exploit-db.com/exploits/8155; http://www.securityfocus.com/bid/33973
CVE: CVE-2009-4810
Published: 2010-04-23
Description: The Secure Remote Password (SRP) implementation in Samhain before 2.5.4 does not check for a certain zero value where required by the protocol, which allows remote attackers to bypass authentication via crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/34104; http://trac.la-samhna.de/samhain/changeset/225; http://trac.la-samhna.de/samhain/ticket/150
CVE: CVE-2010-1034
Published: 2010-04-23
Description: Unspecified vulnerability in HP System Management Homepage (SMH) 6.0 before 6.0.0-95 on Linux, and 6.0 before 6.0.0.96 on Windows, allows remote authenticated users to obtain sensitive information, modify data, and cause a denial of service via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444; http://securitytracker.com/id?1023909; http://www.osvdb.org/64089
CVE: CVE-2010-1035
Published: 2010-04-23
Description: Multiple unspecified vulnerabilities in HP Virtual Machine Manager (VMM) before 6.0 allow remote authenticated users to execute arbitrary code via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/39583; http://www.securityfocus.com/archive/1/510881/100/0/threaded; http://www.securityfocus.com/bid/39637
CVE: CVE-2010-1157
Published: 2010-04-23
Description: Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6557&w=2
CVE: CVE-2010-1491
Published: 2010-04-23
Description: Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlammsblog-lfi.txt; http://secunia.com/advisories/39533; http://www.exploit-db.com/exploits/12318
CVE: CVE-2010-1492
Published: 2010-04-23
Description: Directory traversal vulnerability in help/frameRight.php in Elastix 1.6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id_nodo parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63936; http://secunia.com/advisories/39164; http://www.securityfocus.com/bid/39610
CVE: CVE-2010-1493
Published: 2010-04-23
Description: SQL injection vulnerability in the AWDwall (com_awdwall) component before 1.5.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cbuser parameter in an awdwall action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/joomlaawdwall-lfisql.txt; http://secunia.com/advisories/39553; http://www.awdwall.com/index.php/awdwall-updates-logs-
CVE: CVE-2010-1494
Published: 2010-04-23
Description: Directory traversal vulnerability in the AWDwall (com_awdwall) component 1.5.4 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaawdwall-lfisql.txt; http://secunia.com/advisories/39553; http://www.awdwall.com/index.php/awdwall-updates-logs-
CVE: CVE-2010-1495
Published: 2010-04-23
Description: Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://osvdb.org/63918; http://packetstormsecurity.org/1004-exploits/joomlamatamko-lfi.txt; http://secunia.com/advisories/39523
CVE: CVE-2010-1496
Published: 2010-04-23
Description: SQL injection vulnerability in the JoltCard (com_joltcard) component 1.2.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cardID parameter in a view action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/joomlajoltcard-sql.txt; http://secunia.com/advisories/39520; http://www.exploit-db.com/exploits/12269
CVE: CVE-2010-1497
Published: 2010-04-23
Description: Cross-site scripting (XSS) vulnerability in download_proc.php in dl_stats before 2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1004-exploits/dlstats-sqlxssadmin.txt; http://secunia.com/advisories/39496; http://www.exploit-db.com/exploits/12280
CVE: CVE-2010-1498
Published: 2010-04-23
Description: Multiple SQL injection vulnerabilities in dl_stats before 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) download.php and (2) view_file.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/dlstats-sqlxssadmin.txt; http://secunia.com/advisories/39496; http://www.exploit-db.com/exploits/12280
CVE: CVE-2010-1499
Published: 2010-04-23
Description: SQL injection vulnerability in genre_artists.php in MusicBox 3.3 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63927; http://packetstormsecurity.org/1004-exploits/musicbox33-sql.txt; http://secunia.com/advisories/39476
CVE: CVE-2010-1500
Published: 2010-04-23
Description: Google Chrome before 4.1.249.1059 does not properly support forms, which has unknown impact and attack vectors, related to a "type confusion error."
CVSS Score: 7.5 (HIGH)
References: http://bugs.chromium.org/39443; http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html; http://secunia.com/advisories/39544
CVE: CVE-2010-1501
Published: 2010-04-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-1767.  Reason: This candidate is a duplicate of CVE-2010-1767.  Notes: All CVE users should reference CVE-2010-1767 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-1502
Published: 2010-04-23
Description: Unspecified vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to access local files via vectors related to "developer tools."
CVSS Score: 9.3 (HIGH)
References: http://bugs.chromium.org/40136; http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html; http://secunia.com/advisories/39544
CVE: CVE-2010-1503
Published: 2010-04-23
Description: Cross-site scripting (XSS) vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to inject arbitrary web script or HTML via vectors related to a chrome://net-internals URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.chromium.org/40137; http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html; http://osvdb.org/63999
CVE: CVE-2010-1504
Published: 2010-04-23
Description: Cross-site scripting (XSS) vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to inject arbitrary web script or HTML via vectors related to a chrome://downloads URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.chromium.org/40138; http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html; http://osvdb.org/63998
CVE: CVE-2010-1505
Published: 2010-04-23
Description: Google Chrome before 4.1.249.1059 does not prevent pages from loading with the New Tab page's privileges, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://bugs.chromium.org/40575; http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html; http://osvdb.org/63997
CVE: CVE-2010-1506
Published: 2010-04-23
Description: The Google V8 bindings in Google Chrome before 4.1.249.1059 allow attackers to cause a denial of service (memory corruption) via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://bugs.chromium.org/40635; http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html; http://osvdb.org/63996
CVE: CVE-2010-1528
Published: 2010-04-26
Description: PHP remote file inclusion vulnerability in include/template.php in Uiga Proxy, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/39313; http://www.exploit-db.com/exploits/12049; http://www.osvdb.org/63528
CVE: CVE-2010-1529
Published: 2010-04-26
Description: SQL injection vulnerability in the Freestyle FAQs Lite (com_fsf) component, possibly 1.3, for Joomla! allows remote attackers to execute arbitrary SQL commands via the faqid parameter in an faq action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/joomlafreestyle-sql.txt; http://secunia.com/advisories/39288; http://www.exploit-db.com/exploits/12078
CVE: CVE-2010-1530
Published: 2010-04-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Internationalization module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with translate interface or administer blocks privileges, to inject arbitrary web script or HTML via (1) strings used in block translation or (2) the untranslated input.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/764906; http://drupal.org/node/764998; http://osvdb.org/63589
CVE: CVE-2010-1531
Published: 2010-04-26
Description: Directory traversal vulnerability in the redSHOP (com_redshop) component 1.0.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaredshop-lfi.txt; http://redcomponent.com/redshop/redshop-changelog; http://secunia.com/advisories/39343
CVE: CVE-2010-1532
Published: 2010-04-26
Description: Directory traversal vulnerability in the givesight PowerMail Pro (com_powermail) component 1.5.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlapowermail-lfi.txt; http://secunia.com/advisories/39226; http://www.exploit-db.com/exploits/12118
CVE: CVE-2010-1533
Published: 2010-04-26
Description: Directory traversal vulnerability in the TweetLA (com_tweetla) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/39258; http://www.exploit-db.com/exploits/12142; http://secunia.com/advisories/39258
CVE: CVE-2010-1534
Published: 2010-04-26
Description: Directory traversal vulnerability in the Shoutbox Pro (com_shoutbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63562; http://secunia.com/advisories/39352; http://www.exploit-db.com/exploits/12067
CVE: CVE-2010-1535
Published: 2010-04-26
Description: Directory traversal vulnerability in the TRAVELbook (com_travelbook) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/39254; http://www.exploit-db.com/exploits/12151; http://secunia.com/advisories/39254
CVE: CVE-2010-1536
Published: 2010-04-26
Description: Cross-site scripting (XSS) vulnerability in the AddThis Button module 5.x before 5.x-2.2 and 6.x before 6.x-2.9 for Drupal allows remote authenticated users, with administer addthis privileges, to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/731568; http://drupal.org/node/731576; http://drupal.org/node/731578