deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6080
Published: 2009-02-06
Description: Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32377; http://www.securityfocus.com/bid/31877; https://exchange.xforce.ibmcloud.com/vulnerabilities/46039
CVE: CVE-2008-6081
Published: 2009-02-06
Description: SQL injection vulnerability in contact.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28852; https://exchange.xforce.ibmcloud.com/vulnerabilities/41938; https://www.exploit-db.com/exploits/5468
CVE: CVE-2008-6082
Published: 2009-02-06
Description: Titan FTP Server 6.26 build 630 allows remote attackers to cause a denial of service (CPU consumption) via the SITE WHO command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32269; http://www.osvdb.org/49177; http://www.securityfocus.com/bid/31757
CVE: CVE-2008-6083
Published: 2009-02-06
Description: Directory traversal vulnerability in header.php in TXTshop beta 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/497752/100/0/threaded; http://www.securityfocus.com/bid/31885; https://exchange.xforce.ibmcloud.com/vulnerabilities/46063
CVE: CVE-2008-6084
Published: 2009-02-06
Description: Unrestricted file upload vulnerability in pages/download.php in Iamma Simple Gallery 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads directory.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/32380; http://www.securityfocus.com/bid/31873; https://exchange.xforce.ibmcloud.com/vulnerabilities/46041
CVE: CVE-2008-6085
Published: 2009-02-06
Description: Integer overflow in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, when configured to scan inside compressed archives, allows remote attackers to execute arbitrary code via a crafted RPM compressed archive file, which triggers a buffer overflow.
CVSS Score: 7.6 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/32352; http://www.f-secure.com/security/fsc-2008-3.shtml; http://www.securityfocus.com/bid/31846
CVE: CVE-2002-2427
Published: 2009-02-06
Description: The security handler in GoAhead WebServer before 2.1.1 allows remote attackers to bypass authentication and obtain access to protected web content via "an extra slash in a URL," a different vulnerability than CVE-2002-1603.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://data.goahead.com/Software/Webserver/2.1.8/release.htm#security-features-can-be-bypassed-by-adding-an-extra-slash-in-the-url-bug01518; http://www.kb.cert.org/vuls/id/124059; http://data.goahead.com/Software/Webserver/2.1.8/release.htm#security-features-can-be-bypassed-by-adding-an-extra-slash-in-the-url-bug01518
CVE: CVE-2002-2428
Published: 2009-02-06
Description: webs.c in GoAhead WebServer before 2.1.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an HTTP POST request that contains a Content-Length header but no body data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://data.goahead.com/Software/Webserver/2.1.8/release.htm#fixed-vulnerability-to-malicious-code-in-webs-c; http://data.goahead.com/Software/Webserver/2.1.8/release.htm#fixed-vulnerability-to-malicious-code-in-webs-c
CVE: CVE-2002-2429
Published: 2009-02-06
Description: webs.c in GoAhead WebServer before 2.1.4 allows remote attackers to cause a denial of service (daemon crash) via an HTTP POST request that contains a negative integer in the Content-Length header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://data.goahead.com/Software/Webserver/2.1.8/release.htm#fixed-vulnerability-to-malicious-code-in-webs-c; http://data.goahead.com/Software/Webserver/2.1.8/release.htm#fixed-vulnerability-to-malicious-code-in-webs-c
CVE: CVE-2002-2430
Published: 2009-02-06
Description: GoAhead WebServer before 2.1.1 allows remote attackers to cause a denial of service (CPU consumption) by performing a socket disconnect to terminate a request before it has been fully processed by the server.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://data.goahead.com/Software/Webserver/2.1.8/release.htm#cpu-utilization-hangs-at-100-on-a-socket-disconnect-bug01865; http://data.goahead.com/Software/Webserver/2.1.8/release.htm#cpu-utilization-hangs-at-100-on-a-socket-disconnect-bug01865
CVE: CVE-2002-2431
Published: 2009-02-06
Description: Unspecified vulnerability in GoAhead WebServer before 2.1.4 allows remote attackers to cause "incorrect behavior" via unknown "malicious code," related to incorrect use of the socketInputBuffered function by sockGen.c.
CVSS Score: 7.5 (HIGH)
References: http://data.goahead.com/Software/Webserver/2.1.8/release.htm#fixed-vulnerability-to-malicious-code-in-sockgen-c; http://data.goahead.com/Software/Webserver/2.1.8/release.htm#fixed-vulnerability-to-malicious-code-in-sockgen-c
CVE: CVE-2003-1568
Published: 2009-02-06
Description: GoAhead WebServer before 2.1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an invalid URL, related to the websSafeUrl function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://data.goahead.com/Software/Webserver/2.1.8/release.htm#null-pointer-crash-in-webssafeurl; http://data.goahead.com/Software/Webserver/2.1.8/release.htm#null-pointer-crash-in-webssafeurl
CVE: CVE-2003-1569
Published: 2009-02-06
Description: GoAhead WebServer before 2.1.5 on Windows 95, 98, and ME allows remote attackers to cause a denial of service (daemon crash) via an HTTP request with a (1) con, (2) nul, (3) clock$, or (4) config$ device name in a path component, different vectors than CVE-2001-0385.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://data.goahead.com/Software/Webserver/2.1.8/release.htm#windows-95-98-me-aux-denial-of-service; http://data.goahead.com/Software/Webserver/2.1.8/release.htm#windows-95-98-me-aux-denial-of-service
CVE: CVE-2008-6086
Published: 2009-02-06
Description: SQL injection vulnerability in album.php in Camera Life 2.6.2b4 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-3355.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://sourceforge.net/project/shownotes.php?group_id=70910&release_id=643552; http://www.securityfocus.com/bid/31689; https://exchange.xforce.ibmcloud.com/vulnerabilities/45803
CVE: CVE-2008-6087
Published: 2009-02-06
Description: Cross-site scripting (XSS) vulnerability in topic.php in Camera Life 2.6.2b4 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://sourceforge.net/project/shownotes.php?group_id=70910&release_id=643552; http://www.securityfocus.com/bid/31689; https://exchange.xforce.ibmcloud.com/vulnerabilities/45805
CVE: CVE-2008-6088
Published: 2009-02-06
Description: SQL injection vulnerability in the Joomtracker (com_joomtracker) 1.01 module for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a tordetails action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31676; https://exchange.xforce.ibmcloud.com/vulnerabilities/45798; https://www.exploit-db.com/exploits/6709
CVE: CVE-2008-6089
Published: 2009-02-06
Description: Directory traversal vulnerability in main.php in ScriptsEz Easy Image Downloader allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter in a download action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32210; http://www.securityfocus.com/bid/31695; https://exchange.xforce.ibmcloud.com/vulnerabilities/45795
CVE: CVE-2008-6090
Published: 2009-02-06
Description: Directory traversal vulnerability in members.php in ScriptsEz Mini Hosting Panel allows remote attackers to read arbitrary local files via a .. (dot dot) in the dir parameter in a view action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32212; http://www.securityfocus.com/bid/31701; https://exchange.xforce.ibmcloud.com/vulnerabilities/45800
CVE: CVE-2009-0470
Published: 2009-02-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 12.4(23) allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) level/15/exec/-/ or (2) exec/, a different vulnerability than CVE-2008-3821.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33844; http://www.securityfocus.com/archive/1/500674/100/0/threaded; http://www.securityfocus.com/bid/33625
CVE: CVE-2009-0471
Published: 2009-02-06
Description: Cross-site request forgery (CSRF) vulnerability in the HTTP server in Cisco IOS 12.4(23) allows remote attackers to execute arbitrary commands, as demonstrated by executing the hostname command with a level/15/configure/-/hostname request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/33844; http://www.securityfocus.com/archive/1/500674/100/0/threaded; http://secunia.com/advisories/33844
CVE: CVE-2009-0472
Published: 2009-02-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=57729; http://secunia.com/advisories/33783; http://www.kb.cert.org/vuls/id/882619
CVE: CVE-2009-0473
Published: 2009-02-06
Description: Open redirect vulnerability in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-59
References: http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=57729; http://secunia.com/advisories/33783; http://www.kb.cert.org/vuls/id/619499
CVE: CVE-2009-0474
Published: 2009-02-06
Description: The web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote attackers to obtain "internal web page information" and "internal information about the module" via unspecified vectors.  NOTE: this may overlap CVE-2002-1603.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=57729; http://secunia.com/advisories/33783; http://www.kb.cert.org/vuls/id/124059
CVE: CVE-2008-4559
Published: 2009-02-08
Description: HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via shell metacharacters in argument fields to the (1) webappmon.exe or (2) OpenView5.exe CGI program.  NOTE: this issue may be partially covered by CVE-2009-0205.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01661610; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=770; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01661610
CVE: CVE-2008-4560
Published: 2009-02-08
Description: HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to obtain sensitive information via (1) a crafted request to the nnmRptConfig.exe CGI program, which reveals the pathname of log directories; or (2) a crafted parameter in a request to the ovlaunch.exe CGI program, which reveals configuration details. NOTE: this issue may be partially covered by CVE-2009-0205.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01661610; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=771; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01661610
CVE: CVE-2008-4562
Published: 2009-02-08
Description: Buffer overflow in the ovlaunch CGI program in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 on Windows allows remote attackers to execute arbitrary code via a crafted Host parameter. NOTE: this issue may be partially covered by CVE-2009-0205.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01661610; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=772; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01661610
CVE: CVE-2009-0206
Published: 2009-02-08
Description: Unspecified vulnerability in NFS in HP ONCplus B.11.31.05 and earlier for HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5944&w=2; http://secunia.com/advisories/33860; http://www.securityfocus.com/bid/33653
CVE: CVE-2009-0375
Published: 2009-02-08
Description: Buffer overflow in a DLL file in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a crafted Internet Video Recording (IVR) file with a filename length field containing a large integer, which triggers overwrite of an arbitrary memory location with a 0x00 byte value, related to use of RealPlayer through a Windows Explorer plugin.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/33810; http://secunia.com/advisories/38218; http://service.real.com/realplayer/security/01192010_player/en/
CVE: CVE-2009-0376
Published: 2009-02-08
Description: Heap-based buffer overflow in a DLL file in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a crafted Internet Video Recording (IVR) file with a modified field that controls an unspecified structure length and triggers heap corruption, related to use of RealPlayer through a Windows Explorer plugin.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33810; http://secunia.com/advisories/38218; http://service.real.com/realplayer/security/01192010_player/en/
CVE: CVE-2009-0476
Published: 2009-02-08
Description: Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedia Soft audio components for .NET, allows remote attackers to execute arbitrary code via a long string in a playlist (.pls) file, as originally reported for Euphonics Audio Player 1.0.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33791; http://secunia.com/advisories/33817; http://www.securityfocus.com/archive/1/500652/100/0/threaded
CVE: CVE-2009-0477
Published: 2009-02-08
Description: Unspecified vulnerability in the process (aka proc) filesystem in Sun OpenSolaris snv_85 through snv_100 allows local users to gain privileges via vectors related to the contract filesystem.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-244026-1; http://www.ioactive.com/pdfs/OpenSolarisUPtrDeref.pdf; http://www.securityfocus.com/bid/33654
CVE: CVE-2009-0210
Published: 2009-02-08
Description: Buffer overflow in the MLF application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to execute arbitrary commands or cause a denial of service (system crash) via unspecified vectors, aka PD28578.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33837; http://www.kb.cert.org/vuls/id/337569; http://www.scada-security.com/vulnerabilities/areva1.html
CVE: CVE-2009-0211
Published: 2009-02-08
Description: Unspecified vulnerability in the WebFGServer application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to cause a denial of service (system crash) via unknown vectors, aka PD32018.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/33837; http://www.kb.cert.org/vuls/id/337569; http://www.scada-security.com/vulnerabilities/areva1.html
CVE: CVE-2009-0212
Published: 2009-02-08
Description: Unspecified vulnerability in the WebFGServer application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to cause a denial of service (system crash) via unknown vectors, aka PD32020.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/33837; http://www.kb.cert.org/vuls/id/337569; http://www.scada-security.com/vulnerabilities/areva1.html
CVE: CVE-2009-0213
Published: 2009-02-08
Description: Unspecified vulnerability in the NETIO application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to cause a denial of service (system crash) via unknown vectors, aka PD32021.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/33837; http://www.kb.cert.org/vuls/id/337569; http://www.scada-security.com/vulnerabilities/areva1.html
CVE: CVE-2009-0214
Published: 2009-02-08
Description: Unspecified vulnerability in the WebFGServer application in AREVA e-terrahabitat 5.7 and earlier allows remote authenticated users to gain privileges via unknown vectors, aka PD32022.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/33837; http://www.kb.cert.org/vuls/id/337569; http://www.scada-security.com/vulnerabilities/areva1.html
CVE: CVE-2009-0478
Published: 2009-02-08
Description: Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html; http://secunia.com/advisories/33731; http://secunia.com/advisories/34467
CVE: CVE-2009-0479
Published: 2009-02-09
Description: Multiple SQL injection vulnerabilities in admin/admin_login.php in Online Grades 3.2.4 allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pword parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51711; http://secunia.com/advisories/33767; http://osvdb.org/51711
CVE: CVE-2009-0480
Published: 2009-02-09
Description: The IP implementation in Sun Solaris 8 through 10, and OpenSolaris before snv_82, uses an improper arena when allocating minor numbers for sockets, which allows local users to cause a denial of service (32-bit application failure and login outage) by opening a large number of sockets.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://mail.opensolaris.org/pipermail/onnv-notify/2008-January/013262.html; http://secunia.com/advisories/33751; http://securitytracker.com/id?1021653
CVE: CVE-2008-6091
Published: 2009-02-09
Description: SQL injection vulnerability in plugins.php in BMForum 5.6, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tagname parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31522; https://exchange.xforce.ibmcloud.com/vulnerabilities/45611; https://www.exploit-db.com/exploits/6642
CVE: CVE-2008-6092
Published: 2009-02-09
Description: phpscripts Ranking Script allows remote attackers to bypass authentication and gain administrative access by sending an admin=ja cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32076; http://www.securityfocus.com/bid/31527; https://exchange.xforce.ibmcloud.com/vulnerabilities/45604
CVE: CVE-2008-6093
Published: 2009-02-09
Description: SQL injection vulnerability in index.php in Noname CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the (1) file_id parameter in a detailansicht action and the (2) kategorie parameter in a kategorien action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31519; https://exchange.xforce.ibmcloud.com/vulnerabilities/45612; https://www.exploit-db.com/exploits/6644
CVE: CVE-2008-6094
Published: 2009-02-09
Description: Cross-site scripting (XSS) vulnerability in user.do in Celoxis Technologies Celoxis allows remote attackers to inject arbitrary web script or HTML via the ni.smessage parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/064814.html; http://secunia.com/advisories/32081; http://www.securityfocus.com/bid/31514
CVE: CVE-2008-6095
Published: 2009-02-09
Description: Cross-site scripting (XSS) vulnerability in surveillanceView.htm in OpenNMS 1.5.94 allows remote attackers to inject arbitrary web script or HTML via the viewName parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugzilla.opennms.org/show_bug.cgi?id=2760; http://secunia.com/advisories/32101; http://www.opennms.org/documentation/ReleaseNotesUnStable.html
CVE: CVE-2008-6096
Published: 2009-02-09
Description: Cross-site scripting (XSS) vulnerability in Juniper NetScreen ScreenOS before 5.4r10, 6.0r6, and 6.1r2 allows remote attackers to inject arbitrary web script or HTML via the user name parameter to the (1) web interface login page or the (2) telnet login page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32078; http://www.layereddefense.com/netscreen01oct.html; http://www.securityfocus.com/bid/31528
CVE: CVE-2008-6097
Published: 2009-02-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in WikyBlog before 1.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) key parameter to index.php/Special/Main/keywordSearch, (2) revNum parameter to index.php/Edit/Main/Home, (3) to parameter to index.php/Special/Main/WhatLinksHere, (4) user parameter to index.php/Special/Main/UserEdits, and (5) the PATH_INFO to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/48790; http://secunia.com/advisories/32087; http://sourceforge.net/project/shownotes.php?group_id=148518&release_id=647444
CVE: CVE-2009-0481
Published: 2009-02-09
Description: Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting (XSS) and related attacks by uploading HTML and JavaScript attachments that are rendered by web browsers.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/34361; http://www.bugzilla.org/security/2.22.6/; http://www.securityfocus.com/bid/33580
CVE: CVE-2009-0482
Published: 2009-02-09
Description: Cross-site request forgery (CSRF) vulnerability in Bugzilla before 3.2 before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows remote attackers to perform bug updating activities as other users via a link or IMG tag to process_bug.cgi.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/34361; http://www.bugzilla.org/security/2.22.6/; http://www.securityfocus.com/bid/33580