deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1431
Published: 2010-05-04
Description: SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578909; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html; http://seclists.org/fulldisclosure/2010/Apr/272
CVE: CVE-2010-1685
Published: 2010-05-04
Description: Stack-based buffer overflow in CursorArts ZipWrangler 1.20 allows user-assisted remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/64079; http://secunia.com/advisories/39575; http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-031-zip-wrangler-1-20-buffer-overflow/
CVE: CVE-2010-1687
Published: 2010-05-04
Description: Stack-based buffer overflow in lpd.exe in Mocha W32 LPD 1.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted "recieve jobs" request.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/39394; http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-023-mocha-lpd-remote-buffer-overflow/; http://www.corelan.be:8800/wp-content/forum-file-uploads/mr_me/mochalpd.py_.txt
CVE: CVE-2010-1701
Published: 2010-05-04
Description: SQL injection vulnerability in browse.html in PHP Video Battle Script allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/39647; http://www.exploit-db.com/exploits/12444; http://www.vupen.com/english/advisories/2010/1027
CVE: CVE-2010-1702
Published: 2010-05-04
Description: SQL injection vulnerability in submitticket.php in WHMCompleteSolution (WHMCS) 4.2 allows remote attackers to execute arbitrary SQL commands via the deptid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/whmcs-sql.txt; http://www.exploit-db.com/exploits/12371; http://www.securityfocus.com/bid/39681
CVE: CVE-2010-1703
Published: 2010-05-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in index_search.php in 2daybiz Polls (aka Advanced Poll) Script allow remote attackers to inject arbitrary web script or HTML via the (1) category parameter or (2) search field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1004-exploits/aps-sqlxss.txt; http://secunia.com/advisories/39622; http://www.exploit-db.com/exploits/12395
CVE: CVE-2010-1704
Published: 2010-05-04
Description: Multiple SQL injection vulnerabilities in 2daybiz Polls (aka Advanced Poll) Script allow remote attackers to execute arbitrary SQL commands via (1) the password field to login.php, (2) the login field (aka email parameter) to login.php, (3) the password field (aka pass parameter) to the default URI under admin/, and possibly (4) the login field to the default URI under admin/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/aps-sqlxss.txt; http://secunia.com/advisories/39622; http://www.exploit-db.com/exploits/12395
CVE: CVE-2010-1705
Published: 2010-05-04
Description: SQL injection vulnerability in casting_view.php in Modelbook allows remote attackers to execute arbitrary SQL commands via the adnum parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/39646; http://www.exploit-db.com/exploits/12443; http://www.vupen.com/english/advisories/2010/1028
CVE: CVE-2010-1706
Published: 2010-05-04
Description: Multiple SQL injection vulnerabilities in login.php in 2daybiz Auction Script allow remote attackers to execute arbitrary SQL commands via (1) the login field (aka the username parameter), and possibly (2) the password field, to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/64097; http://packetstormsecurity.org/1004-exploits/2daybizauctionscript-sql.txt; http://secunia.com/advisories/39621
CVE: CVE-2010-1707
Published: 2010-05-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in register.php in Piwigo 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) login and (2) mail_address parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://piwigo.org/code/wsvn/Piwigo?op=revision&rev=5936; http://www.vupen.com/english/advisories/2010/1034; http://piwigo.org/code/wsvn/Piwigo?op=revision&rev=5936
CVE: CVE-2010-1708
Published: 2010-05-04
Description: Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL commands via the (1) login field (aka agentname parameter) or (2) password field (aka agentpassword parameter).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/freerealty-sql.txt; http://www.exploit-db.com/exploits/12411; http://www.securityfocus.com/bid/39712
CVE: CVE-2010-1709
Published: 2010-05-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in upload.cgi in G5-Scripts Auto-Img-Gallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) user and (2) pass parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39599; http://www.securityfocus.com/bid/39714; http://www.xenuser.org/documents/security/auto-img-gallery_xss.txt
CVE: CVE-2010-1710
Published: 2010-05-04
Description: Directory traversal vulnerability in login.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the idioma parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/siestta-lfixss.txt; http://secunia.com/advisories/39453; http://www.exploit-db.com/exploits/12260
CVE: CVE-2010-1711
Published: 2010-05-04
Description: Cross-site scripting (XSS) vulnerability in carga_foto_al.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the usuario parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1004-exploits/siestta-lfixss.txt; http://secunia.com/advisories/39453; http://www.exploit-db.com/exploits/12260
CVE: CVE-2010-1712
Published: 2010-05-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in base/Comments.php in Webmobo WB News 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name and possibly (2) message parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://inj3ct0r.com/exploits/11914; http://secunia.com/advisories/39516; http://www.exploit-db.com/exploits/12323
CVE: CVE-2010-1713
Published: 2010-05-04
Description: SQL injection vulnerability in modules.php in PostNuke 0.764 allows remote attackers to execute arbitrary SQL commands via the sid parameter in a News article modload action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/postnukemodload-sql.txt; http://www.exploit-db.com/exploits/12410; http://www.securityfocus.com/bid/39713
CVE: CVE-2010-1714
Published: 2010-05-04
Description: Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaarcadegames-lfi.txt; http://secunia.com/advisories/39413; http://www.exploit-db.com/exploits/12168
CVE: CVE-2010-1715
Published: 2010-05-04
Description: Directory traversal vulnerability in the Online Examination (aka Online Exam or com_onlineexam) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaonlineexam-lfi.txt; http://secunia.com/advisories/39414; http://www.exploit-db.com/exploits/12174
CVE: CVE-2010-1716
Published: 2010-05-04
Description: SQL injection vulnerability in the Agenda Address Book (com_agenda) component 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/39238; http://www.exploit-db.com/exploits/12132; http://www.joomlanetprojects.com/index.php/en/joomla-projects-downloads/joomla-1/joomla-1/42-comagenda.html
CVE: CVE-2010-1717
Published: 2010-05-04
Description: Directory traversal vulnerability in the iF surfALERT (com_if_surfalert) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/39526; http://www.exploit-db.com/exploits/12291; http://www.vupen.com/english/advisories/2010/0924
CVE: CVE-2010-1718
Published: 2010-05-04
Description: Directory traversal vulnerability in archeryscores.php in the Archery Scores (com_archeryscores) component 1.0.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/39521; http://www.exploit-db.com/exploits/12282; http://www.securityfocus.com/bid/39545
CVE: CVE-2010-1719
Published: 2010-05-04
Description: Directory traversal vulnerability in the MT Fire Eagle (com_mtfireeagle) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/63806; http://packetstormsecurity.org/1004-exploits/joomlamtfireeagle-lfi.txt; http://secunia.com/advisories/39470
CVE: CVE-2010-1720
Published: 2010-05-04
Description: SQL injection vulnerability in the Q-Personel (com_qpersonel) component 1.0.2 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the katid parameter in a qpListele action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/63894; http://secunia.com/advisories/39445; http://www.exploit-db.com/exploits/12200
CVE: CVE-2010-1721
Published: 2010-05-04
Description: SQL injection vulnerability in the Intellectual Property (aka IProperty or com_iproperty) component 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an agentproperties action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://extensions.thethinkery.net/; http://osvdb.org/63750; http://secunia.com/advisories/39427
CVE: CVE-2010-1722
Published: 2010-05-04
Description: Directory traversal vulnerability in the Online Market (com_market) component 2.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1004-exploits/joomlaonlinemarket-lfi.txt; http://secunia.com/advisories/39409; http://www.exploit-db.com/exploits/12177
CVE: CVE-2010-1723
Published: 2010-05-04
Description: Directory traversal vulnerability in the iNetLanka Contact Us Draw Root Map (com_drawroot) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/39524; http://www.exploit-db.com/exploits/12289; http://www.vupen.com/english/advisories/2010/0926
CVE: CVE-2010-0401
Published: 2010-05-05
Description: OpenTTD before 1.0.1 accepts a company password for authentication in response to a request for the server password, which allows remote authenticated users to bypass intended access restrictions or cause a denial of service (daemon crash) by sending a company password packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://bugs.openttd.org/task/3754; http://secunia.com/advisories/39669; http://security.openttd.org/en/CVE-2010-0401
CVE: CVE-2010-0402
Published: 2010-05-05
Description: OpenTTD before 1.0.1 does not properly validate index values of certain items, which allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted in-game command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/39669; http://security.openttd.org/en/CVE-2010-0402; http://secunia.com/advisories/39669
CVE: CVE-2010-0406
Published: 2010-05-05
Description: OpenTTD before 1.0.1 allows remote attackers to cause a denial of service (file-descriptor exhaustion and daemon crash) by performing incomplete downloads of the map.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.openttd.org/task/3785; http://secunia.com/advisories/39669; http://security.openttd.org/en/CVE-2010-0406
CVE: CVE-2010-1279
Published: 2010-05-05
Description: Multiple unspecified vulnerabilities in Adobe Photoshop CS4 11.x before 11.0.1 allow user-assisted remote attackers to execute arbitrary code via a crafted TIFF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/39711; http://www.adobe.com/support/security/bulletins/apsb10-10.html; http://www.securityfocus.com/bid/39849
CVE: CVE-2010-1686
Published: 2010-05-05
Description: Stack-based buffer overflow in (1) Urgent Backup 3.20, and (2) ABC Backup Pro 5.20 and ABC Backup 5.50, allows user-assisted remote attackers to execute arbitrary code via a crafted ZIP archive.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/39699; http://secunia.com/advisories/39701; http://www.corelan.be:8800/advisories.php?id=CORELAN-10-034
CVE: CVE-2009-4835
Published: 2010-05-06
Description: The (1) htk_read_header, (2) alaw_init, (3) ulaw_init, (4) pcm_init, (5) float32_init, and (6) sds_read_header functions in libsndfile 1.0.20 allow context-dependent attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted audio file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530831; http://secunia.com/advisories/35266; http://www.securityfocus.com/bid/35126
CVE: CVE-2009-4836
Published: 2010-05-06
Description: Eval injection vulnerability in system/services/init.php in Movie PHP Script 2.0 allows remote attackers to execute arbitrary PHP code via the anticode parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/54883; http://secunia.com/advisories/35283; http://www.exploit-db.com/exploits/8871
CVE: CVE-2009-4837
Published: 2010-05-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sig[1] parameter to base/base_qry_main.php, or the time[0][1] parameter to (2) base/base_stat_alerts.php or (3) base/base_stat_uaddr.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://base.secureideas.net/news.php; http://secunia.com/advisories/35222; http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/base_ag_common.php?sortby=date&view
CVE: CVE-2009-4838
Published: 2010-05-06
Description: SQL injection vulnerability in base_ag_common.php in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://base.secureideas.net/news.php; http://secunia.com/advisories/35222; http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/base_ag_common.php?sortby=date&view
CVE: CVE-2009-4839
Published: 2010-05-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE), possibly 1.4.4 and earlier, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) admin/base_roleadmin.php, (2) admin/base_useradmin.php, (3) base_conf_contents.php, (4) base_qry_sqlcalls.php, and (5) base_ag_main.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/admin/base_roleadmin.php?view=log; http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/admin/base_useradmin.php?view=log; http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/base_ag_main.php?view=log
CVE: CVE-2009-4840
Published: 2010-05-06
Description: Heap-based buffer overflow in the IAManager ActiveX control in IAManager.dll in Roxio CinePlayer 3.2 allows remote attackers to execute arbitrary code via a long argument to the SetIAPlayerName method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/8835; https://exchange.xforce.ibmcloud.com/vulnerabilities/50868; http://www.exploit-db.com/exploits/8835
CVE: CVE-2009-4841
Published: 2010-05-06
Description: Heap-based buffer overflow in the SonicMediaPlayer ActiveX control in SonicMediaPlayer.dll in Roxio CinePlayer 3.2 allows remote attackers to execute arbitrary code via a long argument to the DiskType method. NOTE: this might overlap CVE-2007-1559.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/8824; http://www.exploit-db.com/exploits/8824
CVE: CVE-2010-1583
Published: 2010-05-06
Description: SQL injection vulnerability in the loadByKey function in the TznDbConnection class in tzn_mysql.php in Tirzen (aka TZN) Framework 1.5, as used in TaskFreak! before 0.6.3, allows remote attackers to execute arbitrary SQL commands via the username field in a login action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/12452; http://www.madirish.net/?article=456; http://www.securityfocus.com/bid/39793
CVE: CVE-2010-1681
Published: 2010-05-06
Description: Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code via a crafted DXF file, a different vulnerability than CVE-2010-0254 and CVE-2010-0256.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://www.coresecurity.com/content/ms-visio-dxf-buffer-overflow; http://www.exploit-db.com/exploits/14944; http://www.securityfocus.com/archive/1/511121/100/0/threaded
CVE: CVE-2010-1732
Published: 2010-05-06
Description: Cross-site request forgery (CSRF) vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authentication of administrators for requests that change the administrator email address (updateemail action).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://community.zikula.org/index.php?module=News&func=display&sid=3012&title=zikula-1.2.3-release-announcement; http://www.htbridge.ch/advisory/xsrf_csrf_in_zikula_application_framework.html; http://community.zikula.org/index.php?module=News&func=display&sid=3012&title=zikula-1.2.3-release-announcement
CVE: CVE-2010-1733
Published: 2010-05-06
Description: Multiple SQL injection vulnerabilities in OCS Inventory NG before 1.02.3 allow remote attackers to execute arbitrary SQL commands via (1) multiple inventory fields to the search form, reachable through index.php; or (2) the "Software name" field to the "All softwares" search form, reachable through index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/61942; http://secunia.com/advisories/38311; http://www.mandriva.com/security/advisories?name=MDVSA-2010:178
CVE: CVE-2010-1734
Published: 2010-05-06
Description: The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x18d value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/39456; http://vigilance.fr/vulnerability/Windows-denials-of-service-of-win32k-sys-9607; http://www.securityfocus.com/archive/1/510886/100/0/threaded
CVE: CVE-2010-1735
Published: 2010-05-06
Description: The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/39456; http://vigilance.fr/vulnerability/Windows-denials-of-service-of-win32k-sys-9607; http://www.securityfocus.com/archive/1/510884/100/0/threaded
CVE: CVE-2010-0995
Published: 2010-05-06
Description: Stack-based buffer overflow in Internet Download Manager (IDM) before 5.19 allows remote attackers to execute arbitrary code via a crafted FTP URI that causes unspecified "test sequences" to be sent from client to server.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/39446; http://secunia.com/secunia_research/2010-62/; http://www.internetdownloadmanager.com/news.html
CVE: CVE-2010-1438
Published: 2010-05-06
Description: Web Application Finger Printer (WAFP) 0.01-26c3 uses fixed pathnames under /tmp for temporary files and directories, which (1) allows local users to cause a denial of service (application outage) by creating a file with a pathname that the product expects is available for its own internal use, (2) allows local users to overwrite arbitrary files via symlink attacks on certain files in /tmp, (3) might allow local users to delete arbitrary files and directories via a symlink attack on a directory under /tmp, and (4) might make it easier for local users to obtain sensitive information by reading files in a directory under /tmp, related to (a) lib/wafp_pidify.rb, (b) utils/generate_wafp_fingerprint.sh, (c) utils/online_update.sh, and (d) utils/extract_from_db.sh.
CVSS Score: 4.4 (MEDIUM)
References: http://code.google.com/p/webapplicationfingerprinter/issues/detail?id=8; http://www.openwall.com/lists/oss-security/2010/04/27/6; http://www.openwall.com/lists/oss-security/2010/04/28/3
CVE: CVE-2010-1724
Published: 2010-05-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) func parameter to index.php, or the (2) lang parameter to index.php, which is not properly handled by ZLanguage.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.zikula.org/index.php?module=News&func=display&sid=3012&title=zikula-1.2.3-release-announcement; http://osvdb.org/64096; http://secunia.com/advisories/39614
CVE: CVE-2010-1725
Published: 2010-05-06
Description: SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1004-exploits/alibabacloneplatinum-sql.txt; http://www.exploit-db.com/exploits/12468; http://www.securityfocus.com/bid/39846