deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3354
Published: 2009-09-24
Description: Multiple unspecified vulnerabilities in the Rest API module for Drupal have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://drupal.org/node/572852; http://www.securityfocus.com/bid/36331; http://drupal.org/node/572852
CVE: CVE-2009-3355
Published: 2009-09-24
Description: Cross-site scripting (XSS) vulnerability in profile.php in Datetopia Buy Dating Site 1.0 allows remote attackers to inject arbitrary web script or HTML via the s_r parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57967; http://packetstormsecurity.org/0909-exploits/buydatingsite-xss.txt; http://secunia.com/advisories/36662
CVE: CVE-2009-3356
Published: 2009-09-24
Description: SQL injection vulnerability in index.php in Image voting 1.0 allows remote attackers to execute arbitrary SQL commands via the show parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36705; http://www.exploit-db.com/exploits/9639; https://exchange.xforce.ibmcloud.com/vulnerabilities/53178
CVE: CVE-2009-3357
Published: 2009-09-24
Description: Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) h_id, (2) id, and (3) rid parameters to longDesc.php, and the h_id parameter to (4) detail.php, (5) detail1.php, (6) detail2.php, (7) detail3.php, (8) detail4.php, (9) detail5.php, (10) detail6.php, (11) detail7.php, and (12) detail8.php, different vectors than CVE-2008-5865, CVE-2008-5874, and CVE-2008-5875.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://e-rdc.org/v1/news.php?readmore=142; http://secunia.com/advisories/33215; http://www.exploit-db.com/exploits/9648
CVE: CVE-2009-3358
Published: 2009-09-24
Description: SQL injection vulnerability in profile.php in Tourism Scripts Adult Portal escort listing allows remote attackers to execute arbitrary SQL commands via the user_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9634; https://exchange.xforce.ibmcloud.com/vulnerabilities/53134; http://www.exploit-db.com/exploits/9634
CVE: CVE-2009-3359
Published: 2009-09-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in Match Agency BiZ 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) important parameter to edit_profile.php and (2) pid parameter to report.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57968; http://osvdb.org/57969; http://packetstormsecurity.org/0909-exploits/matchagencybiz-xss.txt
CVE: CVE-2009-3360
Published: 2009-09-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in Datemill 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) return parameter to photo_view.php, and st parameter to (2) photo_search.php and (3) search.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57989; http://osvdb.org/57991; http://packetstormsecurity.org/0909-exploits/datemill-xss.txt
CVE: CVE-2009-3361
Published: 2009-09-24
Description: SQL injection vulnerability in index.php in PHP-IPNMonitor allows remote attackers to execute arbitrary SQL commands via the maincat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9647; http://www.exploit-db.com/exploits/9647
CVE: CVE-2009-3362
Published: 2009-09-24
Description: PHP remote file inclusion vulnerability in printnews.php3 in SZNews 2.7 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/57986; http://packetstormsecurity.org/0909-exploits/sznews-rfi.txt; http://secunia.com/advisories/36699
CVE: CVE-2009-3363
Published: 2009-09-24
Description: Cross-site scripting (XSS) vulnerability in the BUEditor module 5.x before 5.x-1.2 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via input to the "plain textarea editor."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/572850; http://secunia.com/advisories/36678; http://www.osvdb.org/57870
CVE: CVE-2009-3364
Published: 2009-09-24
Description: Stack-based buffer overflow in FTPShell Client 4.1 RC2 allows remote FTP servers to execute arbitrary code via a long response to a PASV command.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/36628; http://www.exploit-db.com/exploits/9613; http://www.osvdb.org/57899
CVE: CVE-2009-3365
Published: 2009-09-24
Description: PHP remote file inclusion vulnerability in add-ons/modules/sysmanager/plugins/install.plugin.php in Aurora CMS 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the AURORA_MODULES_FOLDER parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9656; http://www.exploit-db.com/exploits/9656
CVE: CVE-2009-3366
Published: 2009-09-24
Description: Directory traversal vulnerability in navigation.php in An image gallery 1.0 allows remote attackers to list arbitrary directories via a .. (dot dot) in the path parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/57943; http://secunia.com/advisories/36680; http://www.exploit-db.com/exploits/9636
CVE: CVE-2009-3367
Published: 2009-09-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in An image gallery 1.0 allow remote attackers to inject arbitrary web script or HTML via the path parameter to (1) index.php and (2) main.php, and the (3) show parameter to main.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57944; http://osvdb.org/57945; http://secunia.com/advisories/36680
CVE: CVE-2009-3368
Published: 2009-09-24
Description: Cross-site scripting (XSS) vulnerability in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the adult parameter in a showhoteldetails action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://e-rdc.org/v1/news.php?readmore=142; http://secunia.com/advisories/33215; http://www.exploit-db.com/exploits/9648
CVE: CVE-2009-3369
Published: 2009-09-24
Description: CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another system, then initiating a backup or restore.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542218; http://osvdb.org/57236; http://secunia.com/advisories/36393
CVE: CVE-2009-2682
Published: 2009-09-24
Description: Unspecified vulnerability in Role-Based Access Control (RBAC) in HP HP-UX B.11.23 and B.11.31 allows local users to bypass intended access restrictions via unknown vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0838&w=2; http://secunia.com/advisories/36850; http://www.securityfocus.com/bid/36476
CVE: CVE-2009-2817
Published: 2009-09-24
Description: Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted .pls file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Sep/msg00006.html; http://support.apple.com/kb/HT3884; http://www.securityfocus.com/bid/36478
CVE: CVE-2009-3390
Published: 2009-09-24
Description: Multiple unspecified vulnerabilities in the (1) iscsiadm and (2) iscsitadm programs in Sun Solaris 10, and OpenSolaris snv_28 through snv_109, allow local users with certain RBAC execution profiles to gain privileges via unknown vectors related to the libima library.
CVSS Score: 7.2 (HIGH)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-119090-33-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-261849-1; http://sunsolve.sun.com/search/document.do?assetkey=1-21-119090-33-1
CVE: CVE-2009-3417
Published: 2009-09-25
Description: SQL injection vulnerability in the IDoBlog (com_idoblog) component 1.1 build 30 for Joomla! allows remote attackers to execute arbitrary SQL commands via the userid parameter in a profile action to index.php, a different vector than CVE-2008-2627.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36243; http://www.exploit-db.com/exploits/9413; http://secunia.com/advisories/36243
CVE: CVE-2009-3418
Published: 2009-09-25
Description: Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow (1) remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and (2) remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit_link action to manager/tools.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/36277; http://www.senseofsecurity.com.au/advisories/SOS-09-006.pdf; http://secunia.com/advisories/36277
CVE: CVE-2009-3419
Published: 2009-09-25
Description: SQL injection vulnerability in index.php in the Publisher module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL commands via the historymonth parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9338; http://www.securityfocus.com/bid/35869; http://www.exploit-db.com/exploits/9338
CVE: CVE-2009-3420
Published: 2009-09-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in the Publisher module 2.0 for Miniweb allow remote attackers to inject arbitrary web script or HTML via the (1) begin parameter and the (2) PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/9338; http://www.securityfocus.com/bid/35869; http://www.exploit-db.com/exploits/9338
CVE: CVE-2009-3421
Published: 2009-09-25
Description: login.php in Zenas PaoBacheca Guestbook 2.1, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the login_ok parameter to 1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://secunia.com/advisories/36023; http://www.exploit-db.com/exploits/9293; http://www.osvdb.org/56757
CVE: CVE-2009-3422
Published: 2009-09-25
Description: login.php in Zenas PaoLiber 1.1, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the login_ok parameter to 1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/36023; http://www.exploit-db.com/exploits/9294; http://www.osvdb.org/56758
CVE: CVE-2009-3423
Published: 2009-09-25
Description: login.php in Zenas PaoLink 1.0, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the login_ok parameter to 1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/36023; http://www.exploit-db.com/exploits/9292; http://www.osvdb.org/56756
CVE: CVE-2009-3424
Published: 2009-09-25
Description: Multiple PHP remote file inclusion vulnerabilities in MaxCMS 3.11.20b, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) is_projectPath parameter to includes/InstantSite/inc.is_root.php; GLOBALS[thCMS_root] parameter to (2) classes/class.Tree.php, (3) includes/inc.thcms_admin_mediamanager.php, and (4) modul/mod.rssreader.php; is_path parameter to (5) class.tasklist.php, (6) class.thcms.php, (7) class.thcms_content.php, (8) class.thcms_modul_parent.php, (9) class.thcms_page.php, and (10) class.thcsm_user.php in classes/; and (11) includes/InstantSite/class.Tree.php; and thCMS_root parameter to (12) classes/class.thcms_modul.php; (13) inc.page_edit_tasklist.php, (14) inc.thcms_admin_overview_backup.php, and (15) inc.thcms_edit_content.php in includes/; and (16) class.thcms_modul_parent_xml.php, (17) mod.cmstranslator.php, (18) mod.download.php, (19) mod.faq.php, (20) mod.guestbook.php, (21) mod.html.php, (22) mod.menu.php, (23) mod.news.php, (24) mod.newsticker.php, (25) mod.rss.php, (26) mod.search.php, (27) mod.sendtofriend.php, (28) mod.sitemap.php, (29) mod.tagdoc.php, (30) mod.template.php, (31) mod.test.php, (32) mod.text.php, (33) mod.upload.php, and (34) mod.users.php in modul/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/36105; http://www.exploit-db.com/exploits/9322; http://www.vupen.com/english/advisories/2009/2136
CVE: CVE-2009-3425
Published: 2009-09-25
Description: Directory traversal vulnerability in includes/inc.thcms_admin_dirtree.php in MaxCMS 3.11.20b allows remote attackers to read arbitrary files via directory traversal sequences in the thCMS_root parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/36105; http://www.exploit-db.com/exploits/9350; http://www.vupen.com/english/advisories/2009/2136
CVE: CVE-2009-3426
Published: 2009-09-25
Description: PHP remote file inclusion vulnerability in includes/file_manager/special.php in MaxCMS 3.11.20b allows remote attackers to execute arbitrary PHP code via a URL in the fm_includes_special parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/36105; http://www.exploit-db.com/exploits/9350; http://www.vupen.com/english/advisories/2009/2136
CVE: CVE-2009-3427
Published: 2009-09-25
Description: Cross-site scripting (XSS) vulnerability in Kayako SupportSuite 3.50.06 allows remote attackers to inject arbitrary web script or HTML via the subject field in a ticket.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36253; http://www.ngenuity.org/wordpress/2009/08/08/ngenuity-ticket-subject-persistent-xss-in-kayako-supportsuite/; http://www.securityfocus.com/archive/1/505637/100/0/threaded
CVE: CVE-2009-3428
Published: 2009-09-25
Description: Stack-based buffer overflow in Easy Music Player 1.0.0.2 allows remote attackers to execute arbitrary code via a crafted .wav file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/36267; http://www.exploit-db.com/exploits/9412; http://www.exploit-db.com/exploits/9418
CVE: CVE-2009-3429
Published: 2009-09-25
Description: Stack-based buffer overflow in Pirate Radio Destiny Media Player 1.61 allows remote attackers to execute arbitrary code via a long string in a .pls playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9321; http://www.exploit-db.com/exploits/9321
CVE: CVE-2009-3430
Published: 2009-09-25
Description: SQL injection vulnerability in login.php in Allomani Mobile 2.5 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9273; http://www.vupen.com/english/advisories/2009/2029; https://exchange.xforce.ibmcloud.com/vulnerabilities/52012
CVE: CVE-2009-3431
Published: 2009-09-25
Description: Stack consumption vulnerability in Adobe Reader and Acrobat 9.1.3, 9.1.2, 9.1.1, and earlier 9.x versions; 8.1.6 and earlier 8.x versions; and possibly 7.1.4 and earlier 7.x versions allows remote attackers to cause a denial of service (application crash) via a PDF file with a large number of [ (open square bracket) characters in the argument to the alert method. NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://securitytracker.com/id?1023007; http://www.adobe.com/support/security/bulletins/apsb09-15.html; http://www.securityfocus.com/bid/35148
CVE: CVE-2009-2862
Published: 2009-09-28
Description: The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to bypass intended access restrictions via crafted requests, aka Bug IDs CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603, CSCsy54122, and CSCsu50252.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/58338; http://tools.cisco.com/security/center/viewAlert.x?alertId=18876; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8119.shtml
CVE: CVE-2009-2863
Published: 2009-09-28
Description: Race condition in the Firewall Authentication Proxy feature in Cisco IOS 12.0 through 12.4 allows remote attackers to bypass authentication, or bypass the consent web page, via a crafted request, aka Bug ID CSCsy15227.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: http://osvdb.org/58340; http://tools.cisco.com/security/center/viewAlert.x?alertId=18882; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8132.shtml
CVE: CVE-2009-2864
Published: 2009-09-28
Description: Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 5.x before 5.1(3g), 6.x before 6.1(4), 7.0.x before 7.0(2a)su1, and 7.1.x before 7.1(2) allows remote attackers to cause a denial of service (service restart) via malformed SIP messages, aka Bug ID CSCsz95423.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/58344; http://secunia.com/advisories/36836; http://tools.cisco.com/security/center/viewAlert.x?alertId=18883
CVE: CVE-2009-2865
Published: 2009-09-28
Description: Buffer overflow in the login implementation in the Extension Mobility feature in the Unified Communications Manager Express (CME) component in Cisco IOS 12.4XW, 12.4XY, 12.4XZ, and 12.4YA allows remote attackers to execute arbitrary code or cause a denial of service via crafted HTTP requests, aka Bug ID CSCsq58779.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://osvdb.org/58335; http://tools.cisco.com/security/center/viewAlert.x?alertId=18884; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8116.shtml
CVE: CVE-2009-2866
Published: 2009-09-28
Description: Unspecified vulnerability in Cisco IOS 12.2 through 12.4 allows remote attackers to cause a denial of service (device reload) via a crafted H.323 packet, aka Bug ID CSCsz38104.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/58337; http://tools.cisco.com/security/center/viewAlert.x?alertId=18885; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af811a.shtml
CVE: CVE-2009-2867
Published: 2009-09-28
Description: Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4T, 12.4XZ, and 12.4YA, when Zone-Based Policy Firewall SIP Inspection is enabled, allows remote attackers to cause a denial of service (device reload) via a crafted SIP transit packet, aka Bug ID CSCsr18691.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=18886; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8130.shtml; http://www.securitytracker.com/id?1022930
CVE: CVE-2009-2868
Published: 2009-09-28
Description: Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when certificate-based authentication is enabled for IKE, allows remote attackers to cause a denial of service (Phase 1 SA exhaustion) via crafted requests, aka Bug IDs CSCsy07555 and CSCee72997.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=18887; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8117.shtml; http://www.vupen.com/english/advisories/2009/2759
CVE: CVE-2009-2869
Published: 2009-09-28
Description: Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to cause a denial of service (device reload) via a crafted NTPv4 packet, aka Bug IDs CSCsu24505 and CSCsv75948.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/58342; http://tools.cisco.com/security/center/viewAlert.x?alertId=18889; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8131.shtml
CVE: CVE-2009-2870
Published: 2009-09-28
Description: Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when the Cisco Unified Border Element feature is enabled, allows remote attackers to cause a denial of service (device reload) via crafted SIP messages, aka Bug ID CSCsx25880.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=18891; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af811b.shtml; http://www.securitytracker.com/id?1022930
CVE: CVE-2009-2871
Published: 2009-09-28
Description: Unspecified vulnerability in Cisco IOS 12.2 and 12.4, when SSLVPN sessions, SSH sessions, or IKE encrypted nonces are enabled, allows remote attackers to cause a denial of service (device reload) via a crafted encrypted packet, aka Bug ID CSCsq24002.
CVSS Score: 7.8 (HIGH)
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=18892; http://www.cisco.com/en/US/products/products_security_advisory09186a0080af811c.shtml; http://www.securitytracker.com/id?1022930
CVE: CVE-2009-2872
Published: 2009-09-28
Description: Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco Express Forwarding feature are enabled, allows remote attackers to cause a denial of service (device reload) via a malformed packet that is not properly handled during switching from one tunnel to a second tunnel, aka Bug IDs CSCsh97579 and CSCsq31776.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/58333; http://tools.cisco.com/security/center/viewAlert.x?alertId=18893; http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080af8113.html
CVE: CVE-2009-2873
Published: 2009-09-28
Description: Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco Express Forwarding feature are enabled, allows remote attackers to cause a denial of service (device reload) via malformed packets, aka Bug ID CSCsx70889.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/58334; http://tools.cisco.com/security/center/viewAlert.x?alertId=18895; http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080af8113.html
CVE: CVE-2009-3432
Published: 2009-09-28
Description: Unspecified vulnerability in xscreensaver in Sun Solaris 10, and OpenSolaris before snv_112, when Xorg or Xnewt is used and RandR is enabled, allows physically proximate attackers to read a locked screen via unknown vectors related to XRandR resize events.
CVSS Score: 1.9 (LOW)
References: http://osvdb.org/58278; http://secunia.com/advisories/36830; http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-26-1
CVE: CVE-2009-3433
Published: 2009-09-28
Description: Unspecified vulnerability in clsetup in the configuration utility in Sun Solaris Cluster 3.2 allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://osvdb.org/58277; http://secunia.com/advisories/36816; http://sunsolve.sun.com/search/document.do?assetkey=1-66-267148-1
CVE: CVE-2009-3434
Published: 2009-09-28
Description: SQL injection vulnerability in the Tupinambis (com_tupinambis) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the proyecto parameter in a verproyecto action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/mambojoomlatupinambis-sql.txt; http://secunia.com/advisories/36848; http://www.securityfocus.com/bid/36511
CVE: CVE-2009-3435
Published: 2009-09-28
Description: Cross-site scripting (XSS) vulnerability in the variable editor in the Devel module 5.x before 5.x-1.2 and 6.x before 6.x-1.18, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a variable name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/585952; http://osvdb.org/58313; http://secunia.com/advisories/36859