deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1643
Published: 2009-05-15
Description: Stack-based buffer overflow in Sorinara Soritong MP3 Player 1.0 allows remote attackers to execute arbitrary code via a crafted .m3u file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34863; https://exchange.xforce.ibmcloud.com/vulnerabilities/50398; https://www.exploit-db.com/exploits/8624
CVE: CVE-2009-1644
Published: 2009-05-15
Description: Stack-based buffer overflow in Sorinara Streaming Audio Player 0.9 allows remote attackers to execute arbitrary code via a crafted .pla file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34861; https://exchange.xforce.ibmcloud.com/vulnerabilities/50369; https://www.exploit-db.com/exploits/8625
CVE: CVE-2009-1645
Published: 2009-05-15
Description: Multiple stack-based buffer overflows in Mini-stream Easy RM-MP3 Converter 3.0.0.7 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34860; http://www.securityfocus.com/bid/34864; https://exchange.xforce.ibmcloud.com/vulnerabilities/50376
CVE: CVE-2009-1646
Published: 2009-05-15
Description: Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long rtsp URL in a .ram file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34860; https://www.exploit-db.com/exploits/8628; http://www.securityfocus.com/bid/34860
CVE: CVE-2009-1647
Published: 2009-05-15
Description: Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of service (application crash) via a long string in a +OK response.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34699; http://www.vupen.com/english/advisories/2009/1170; https://www.exploit-db.com/exploits/8526
CVE: CVE-2009-1649
Published: 2009-05-16
Description: Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the arch parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/35059; http://www.securityfocus.com/bid/34968; https://www.exploit-db.com/exploits/8680
CVE: CVE-2009-1650
Published: 2009-05-16
Description: Multiple SQL injection vulnerabilities in photos.php in Shutter 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) albumID, (2) tagID, and (3) photoID parameters to index.html.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35049; http://www.securityfocus.com/archive/1/503493; http://www.securityfocus.com/bid/34967
CVE: CVE-2009-1651
Published: 2009-05-16
Description: SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to execute arbitrary SQL commands via the mid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54494; http://secunia.com/advisories/35071; http://www.securityfocus.com/bid/34976
CVE: CVE-2009-1652
Published: 2009-05-16
Description: admin/adminaddeditdetails.php in Business Community Script does not properly restrict access, which allows remote attackers to gain privileges and add administrators via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/54493; http://secunia.com/advisories/35071; http://www.securityfocus.com/bid/34976
CVE: CVE-2009-1653
Published: 2009-05-16
Description: Directory traversal vulnerability in examples/tbs_us_examples_0view.php in TinyButStrong 3.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the script parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.vupen.com/english/advisories/2009/1304; https://exchange.xforce.ibmcloud.com/vulnerabilities/50506; https://www.exploit-db.com/exploits/8667
CVE: CVE-2009-1654
Published: 2009-05-16
Description: Cross-site scripting (XSS) vulnerability in questiondetail.php in Easy Scripts Answer and Question Script allows remote attackers to inject arbitrary web script or HTML via the questionid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/54501; http://secunia.com/advisories/35067; http://www.securityfocus.com/bid/34975
CVE: CVE-2009-1655
Published: 2009-05-16
Description: Multiple SQL injection vulnerabilities in myaccount.php in Easy Scripts Answer and Question Script allow remote authenticated users to execute arbitrary SQL commands via the (1) user name (userid parameter) and (2) password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/54502; http://secunia.com/advisories/35067; http://www.securityfocus.com/bid/34975
CVE: CVE-2009-1656
Published: 2009-05-16
Description: Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265, 275; and WorkCentre 5632, 5638, 5645, 5655, 5665, 5675, 5687, 7655, 7656, and 7675 allows remote attackers to execute arbitrary commands via unknown attack vectors, aka "command injection vulnerability."
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/54457; http://secunia.com/advisories/35101; http://www.securityfocus.com/bid/34984
CVE: CVE-2008-6809
Published: 2009-05-18
Description: SQL injection vulnerability in hotel_habitaciones.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allows remote attackers to execute arbitrary SQL commands via the HotelID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32430; http://www.securityfocus.com/bid/32512; https://exchange.xforce.ibmcloud.com/vulnerabilities/46913
CVE: CVE-2008-6810
Published: 2009-05-18
Description: Multiple SQL injection vulnerabilities in admin/checklogin.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allow remote attackers to execute arbitrary SQL commands via the (1) myusername (username) and (2) password parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32430; https://exchange.xforce.ibmcloud.com/vulnerabilities/46914; https://www.exploit-db.com/exploits/7263
CVE: CVE-2008-6811
Published: 2009-05-18
Description: Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/plugins/wp-shopping-cart/.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/31982; https://exchange.xforce.ibmcloud.com/vulnerabilities/46224; https://www.exploit-db.com/exploits/6867
CVE: CVE-2009-1657
Published: 2009-05-18
Description: Multiple SQL injection vulnerabilities in the Starrating plugin before 0.7.7 for b2evolution allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54369; http://secunia.com/advisories/35053; http://sourceforge.net/project/shownotes.php?release_id=681352&group_id=160495
CVE: CVE-2009-1658
Published: 2009-05-18
Description: Multiple SQL injection vulnerabilities in admin/admin.php in Realty Webware Technologies Realty Web-Base 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user (username) and (2) password parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54372; http://secunia.com/advisories/35033; http://www.securityfocus.com/bid/34886
CVE: CVE-2009-1659
Published: 2009-05-18
Description: Unrestricted file upload vulnerability in admin/uploadimage.php in eLitius 1.0 allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files via an avatar file with an accepted Content-Type such as image/gif, then requesting the file in admin/banners/.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/34813; http://www.vupen.com/english/advisories/2009/1248; https://exchange.xforce.ibmcloud.com/vulnerabilities/50305
CVE: CVE-2009-1660
Published: 2009-05-18
Description: Stack-based buffer overflow in URUWorks ViPlay3 3.0 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file entry in a .vpl file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34877; https://exchange.xforce.ibmcloud.com/vulnerabilities/50403; https://www.exploit-db.com/exploits/8644
CVE: CVE-2009-1661
Published: 2009-05-18
Description: SQL injection vulnerability in admin/utopic.php in uTopic 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the rating parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35051; http://sourceforge.net/project/shownotes.php?group_id=261386&release_id=680474; http://www.securityfocus.com/archive/1/503422/100/0/threaded
CVE: CVE-2009-1662
Published: 2009-05-18
Description: Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) Password fields, as reachable from admin/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/34885; https://exchange.xforce.ibmcloud.com/vulnerabilities/50407; https://www.exploit-db.com/exploits/8642
CVE: CVE-2009-1663
Published: 2009-05-18
Description: Unrestricted file upload vulnerability in myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads/[username] directory.
CVSS Score: 6.8 (MEDIUM)
References: https://www.exploit-db.com/exploits/8690; https://www.exploit-db.com/exploits/8690
CVE: CVE-2009-1664
Published: 2009-05-18
Description: myaccount.php in Easy Scripts Answer and Question Script does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via modified userid, txtpassword, and txtRpassword parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.exploit-db.com/exploits/8690; https://www.exploit-db.com/exploits/8690
CVE: CVE-2009-1665
Published: 2009-05-18
Description: myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a modified userid parameter without specifying any additional fields.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/54586; https://exchange.xforce.ibmcloud.com/vulnerabilities/50627; https://www.exploit-db.com/exploits/8690
CVE: CVE-2009-0721
Published: 2009-05-18
Description: Unspecified vulnerability in Easy Login in the Sender module in HP Remote Graphics Software (RGS) 4.0.0 through 5.2.4 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/35087; http://secunia.com/advisories/35089; http://securitytracker.com/id?1022221
CVE: CVE-2009-1666
Published: 2009-05-18
Description: Multiple unspecified vulnerabilities in CycloMedia CycloScopeLite 2.50.3.0 allow remote attackers to execute arbitrary code via the ReturnConnection method in (1) CM_ADOConnection.dll, (2) CM_AddressInfoDBC.dll, and (3) CM_RecordingLocationDBC.dll, related to improper dereferencing.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/35046; http://www.securityfocus.com/bid/34912; http://secunia.com/advisories/35046
CVE: CVE-2009-1667
Published: 2009-05-18
Description: Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long entry in a .m3u file, a different vector than CVE-2009-5137.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/8660; http://www.exploit-db.com/exploits/8661; http://www.exploit-db.com/exploits/8662
CVE: CVE-2009-1668
Published: 2009-05-18
Description: TYPSoft FTP Server 1.11 allows remote attackers to cause a denial of service (CPU consumption) by sending an ABOR (abort) command without an active file transfer.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/34901; http://www.securitytracker.com/id?1022202; https://www.exploit-db.com/exploits/8650
CVE: CVE-2009-1669
Published: 2009-05-18
Description: The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/54380; http://secunia.com/advisories/35072; http://secunia.com/advisories/35219
CVE: CVE-2009-1670
Published: 2009-05-18
Description: user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/54282; http://secunia.com/advisories/34966; http://www.securityfocus.com/bid/34866
CVE: CVE-2009-1671
Published: 2009-05-18
Description: Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allow remote attackers to execute arbitrary code via a long string argument to the (1) setInstallerType, (2) setAdditionalPackages, (3) compareVersion, (4) getStaticCLSID, or (5) launch method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34931; http://www.shinnai.net/xplits/TXT_mhxRKrtrPLyAHRFNm7QR.html; https://www.exploit-db.com/exploits/8665
CVE: CVE-2009-1672
Published: 2009-05-18
Description: The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allows remote attackers to (1) execute arbitrary code via a .jnlp URL in the argument to the launch method, and might allow remote attackers to launch JRE installation processes via the (2) installLatestJRE or (3) installJRE method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34931; http://www.shinnai.net/xplits/TXT_mhxRKrtrPLyAHRFNm7QR.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/50629
CVE: CVE-2009-1673
Published: 2009-05-18
Description: The kernel in Sun Solaris 9 allows local users to cause a denial of service (panic) by calling fstat with a first argument of AT_FDCWD.
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/54464; http://secunia.com/advisories/35103; http://secunia.com/advisories/35119
CVE: CVE-2009-1674
Published: 2009-05-18
Description: Stack-based buffer overflow in Microchip MPLAB IDE 8.30 allows user-assisted remote attackers to execute arbitrary code via a long .cof pathname in a [TOOL_SETTINGS] section in a .mcp file, possibly a related issue to CVE-2009-1608.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/35054; https://www.exploit-db.com/exploits/8656; http://secunia.com/advisories/35054
CVE: CVE-2009-1675
Published: 2009-05-18
Description: Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long 227 reply to a PASV command.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34838; https://exchange.xforce.ibmcloud.com/vulnerabilities/50337; https://exchange.xforce.ibmcloud.com/vulnerabilities/50644
CVE: CVE-2009-1676
Published: 2009-05-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-1535.  Reason: This candidate is a duplicate of CVE-2009-1535.  Notes: All CVE users should reference CVE-2009-1535 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-1677
Published: 2009-05-18
Description: Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking boards/boards_rss.php, and might allow (2) remote attackers to inject arbitrary PHP code into files via the HTTP Host header in a request to boards/boards_rss.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/35057; http://www.securityfocus.com/archive/1/503435; http://www.securityfocus.com/bid/34910
CVE: CVE-2009-1678
Published: 2009-05-18
Description: Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the version parameter to boards/boards_rss.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/35057; http://www.securityfocus.com/archive/1/503435; http://www.securityfocus.com/bid/34910
CVE: CVE-2009-1252
Published: 2009-05-19
Description: Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html; http://rhn.redhat.com/errata/RHSA-2009-1039.html
CVE: CVE-2009-1377
Published: 2009-05-19
Description: The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc; http://cvs.openssl.org/chngview?cn=18187; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
CVE: CVE-2009-1378
Published: 2009-05-19
Description: Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-401
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc; http://cvs.openssl.org/chngview?cn=18188; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
CVE: CVE-2009-1379
Published: 2009-05-19
Description: Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
CVE: CVE-2009-1418
Published: 2009-05-19
Description: Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 3.0.1.73 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01745065; http://jvn.jp/en/jp/JVN02331156/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000029.html
CVE: CVE-2009-1730
Published: 2009-05-20
Description: Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via directory traversal sequences in the (1) GET or (2) PUT command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/35131; http://www.princeofnigeria.org/blogs/index.php/2009/05/17/netdecision-tftp-server-4-2-tftp-directo?blog=1; http://www.securityfocus.com/bid/35002
CVE: CVE-2009-1731
Published: 2009-05-20
Description: SQL injection vulnerability in panel/index.php in MLFFAT 2.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded supervisor cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/exploitalert/6198; http://www.sebug.net/exploit/11292/; http://www.securityfocus.com/bid/34982
CVE: CVE-2009-1732
Published: 2009-05-20
Description: Cross-site scripting (XSS) vulnerability in admin/usermanager in IPplan 4.91a allows remote attackers to inject arbitrary web script or HTML via the grp parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/113/45/; http://osvdb.org/54600; http://secunia.com/advisories/34985
CVE: CVE-2009-1733
Published: 2009-05-20
Description: Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/113/45/; http://osvdb.org/54601; http://secunia.com/advisories/34985
CVE: CVE-2009-1734
Published: 2009-05-20
Description: SQL injection vulnerability in listing_video.php in VidSharePro allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54598; http://secunia.com/advisories/35149; http://www.securityfocus.com/bid/35033
CVE: CVE-2009-1735
Published: 2009-05-20
Description: Cross-site scripting (XSS) vulnerability in search.php in VidSharePro allows remote attackers to inject arbitrary web script or HTML via the searchtxt parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/54599; http://secunia.com/advisories/35149; http://www.securityfocus.com/bid/35033
CVE: CVE-2009-1736
Published: 2009-05-20
Description: SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a viewCategory action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/35025; https://exchange.xforce.ibmcloud.com/vulnerabilities/50624; https://www.exploit-db.com/exploits/8731
CVE: CVE-2009-1737
Published: 2009-05-20
Description: Directory traversal vulnerability in bom.php in MyPic 2.1 allows remote attackers to list files in arbitrary directories via a .. (dot dot) in the dir parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://hi.baidu.com/hirfire/blog/item/c3c0f6dda3ca47d18d10291a.html; http://secunia.com/advisories/35092; http://www.osvdb.org/54565