deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6057
Published: 2009-02-04
Description: Doug Luxem Liberum Help Desk 0.97.3 stores db/helpdesk2000.mdb under the web root with insufficient access control, which allows remote attackers to obtain passwords via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/47421; https://www.exploit-db.com/exploits/7493; https://exchange.xforce.ibmcloud.com/vulnerabilities/47421
CVE: CVE-2009-0352
Published: 2009-02-04
Description: Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the layout engine and destruction of arbitrary layout objects by the nsViewManager::Composite function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html; http://rhn.redhat.com/errata/RHSA-2009-0256.html
CVE: CVE-2009-0353
Published: 2009-02-04
Description: Unspecified vulnerability in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the JavaScript engine.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html; http://rhn.redhat.com/errata/RHSA-2009-0256.html
CVE: CVE-2009-0354
Published: 2009-02-04
Description: Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html; http://rhn.redhat.com/errata/RHSA-2009-0256.html; http://secunia.com/advisories/33799
CVE: CVE-2009-0355
Published: 2009-02-04
Description: components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary files on a client machine via a crafted INPUT element.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html; http://rhn.redhat.com/errata/RHSA-2009-0256.html; http://secunia.com/advisories/33799
CVE: CVE-2009-0356
Published: 2009-02-04
Description: Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files, which allows user-assisted remote attackers to bypass the Same Origin Policy and execute arbitrary code with chrome privileges via vectors involving the URL field in a Desktop Entry section of a .desktop file, related to representation of about: URIs as jar:file:// URIs.  NOTE: this issue exists because of an incomplete fix for CVE-2008-4582.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html; http://rhn.redhat.com/errata/RHSA-2009-0256.html; http://secunia.com/advisories/33799
CVE: CVE-2009-0357
Published: 2009-02-04
Description: Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://ha.ckers.org/blog/20070511/bluehat-errata/; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html; http://rhn.redhat.com/errata/RHSA-2009-0256.html
CVE: CVE-2009-0358
Published: 2009-02-04
Description: Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://blogs.imeta.co.uk/JDeabill/archive/2008/07/14/303.aspx; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html; http://rhn.redhat.com/errata/RHSA-2009-0256.html
CVE: CVE-2009-0388
Published: 2009-02-04
Description: Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code via a large length value in a message, related to the (a) ClientConnection::CheckBufferSize and (b) ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://forum.ultravnc.info/viewtopic.php?t=14654; http://secunia.com/advisories/33807; http://vnc-tight.svn.sourceforge.net/viewvc/vnc-tight?view=rev&revision=3564
CVE: CVE-2009-0418
Published: 2009-02-04
Description: The IPv6 Neighbor Discovery Protocol (NDP) implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity), read private network traffic, and possibly execute arbitrary code via a spoofed message that modifies the Forward Information Base (FIB), a related issue to CVE-2008-2476.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0334&w=2; http://secunia.com/advisories/33787; http://www.securitytracker.com/id?1021660
CVE: CVE-2009-0419
Published: 2009-02-04
Description: Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly restrict access from web pages to Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-4033.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://bugzilla.mozilla.org/show_bug.cgi?id=380418; https://exchange.xforce.ibmcloud.com/vulnerabilities/48815; https://bugzilla.mozilla.org/show_bug.cgi?id=380418
CVE: CVE-2008-4419
Published: 2009-02-05
Description: Directory traversal vulnerability in the HP JetDirect web administration interface in the HP-ChaiSOE 1.0 embedded web server on the LaserJet 9040mfp, LaserJet 9050mfp, and Color LaserJet 9500mfp before firmware 08.110.9; LaserJet 4345mfp and 9200C Digital Sender before firmware 09.120.9; Color LaserJet 4730mfp before firmware 46.200.9; LaserJet 2410, LaserJet 2420, and LaserJet 2430 before firmware 20080819 SPCL112A; LaserJet 4250 and LaserJet 4350 before firmware 20080819 SPCL015A; and LaserJet 9040 and LaserJet 9050 before firmware 20080819 SPCL110A allows remote attackers to read arbitrary files via directory traversal sequences in the URI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01623905; http://secunia.com/advisories/33779; http://www.securityfocus.com/archive/1/500657/100/0/threaded
CVE: CVE-2008-6058
Published: 2009-02-05
Description: Syslserve 1.058 and earlier, and probably 1.059, allows remote attackers to cause a denial of service (hang) via a crafted UDP Syslog packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/33566; http://www.princeofnigeria.org/blogs/index.php/2009/01/15/syslserve-1-058-denial-of-service-vulner; http://www.securityfocus.com/bid/33311
CVE: CVE-2008-6059
Published: 2009-02-05
Description: xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://trac.webkit.org/changeset/38566/trunk/WebCore/xml/XMLHttpRequest.cpp; http://www.securityfocus.com/bid/33804; https://bugs.webkit.org/show_bug.cgi?id=10957
CVE: CVE-2009-0058
Published: 2009-02-05
Description: The Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.x before 5.2 allow remote attackers to cause a denial of service (web authentication outage or device reload) via unspecified network traffic, as demonstrated by a vulnerability scanner.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/33749; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a6c1dd.shtml; http://www.securityfocus.com/bid/33608
CVE: CVE-2009-0059
Published: 2009-02-05
Description: The Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.2.x before 5.2.157.0 allow remote attackers to cause a denial of service (device reload) via a web authentication (aka WebAuth) session that includes a malformed POST request to login.html.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/33749; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a6c1dd.shtml; http://www.securityfocus.com/bid/33608
CVE: CVE-2009-0061
Published: 2009-02-05
Description: Unspecified vulnerability in the Wireless LAN Controller (WLC) TSEC driver in the Cisco 4400 WLC, Cisco Catalyst 6500 and 7600 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.x before 5.1 allows remote attackers to cause a denial of service (device crash or hang) via unknown IP packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/33749; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a6c1dd.shtml; http://www.securityfocus.com/bid/33608
CVE: CVE-2009-0062
Published: 2009-02-05
Description: Unspecified vulnerability in the Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.2.173.0 allows remote authenticated users to gain privileges via unknown vectors, as demonstrated by escalation from the (1) Lobby Admin and (2) Local Management User privilege levels.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/33749; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a6c1dd.shtml; http://www.securityfocus.com/bid/33608
CVE: CVE-2009-0420
Published: 2009-02-05
Description: SQL injection vulnerability in the RD-Autos (com_rdautos) 1.5.5 Stable component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33562; http://www.securityfocus.com/bid/33297; https://www.exploit-db.com/exploits/7795
CVE: CVE-2009-0421
Published: 2009-02-05
Description: SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33563; http://www.securityfocus.com/bid/33296; https://exchange.xforce.ibmcloud.com/vulnerabilities/48016
CVE: CVE-2009-0422
Published: 2009-02-05
Description: Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SERVER[ConfigFile] parameter to admin/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/33533; http://www.bugreport.ir/index_60.htm; http://www.securityfocus.com/archive/1/500057/100/0/threaded
CVE: CVE-2009-0423
Published: 2009-02-05
Description: Directory traversal vulnerability in index.php in Php Photo Album (PHPPA) 0.8 BETA allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the preview parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/33277; https://exchange.xforce.ibmcloud.com/vulnerabilities/48017; https://www.exploit-db.com/exploits/7786
CVE: CVE-2009-0424
Published: 2009-02-05
Description: Cross-site scripting (XSS) vulnerability in sign1.php in AN Guestbook (ANG) before 0.7.7 allows remote attackers to inject arbitrary web script or HTML via the country parameter, which is not properly handled in (1) administrator/manage.php or (2) administrator/trash.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33490; http://sourceforge.net/forum/forum.php?forum_id=907703; http://sourceforge.net/project/shownotes.php?release_id=653720
CVE: CVE-2009-0425
Published: 2009-02-05
Description: SQL injection vulnerability in index.php in Blue Eye CMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the clanek parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33303; https://www.exploit-db.com/exploits/7797; http://www.securityfocus.com/bid/33303
CVE: CVE-2009-0426
Published: 2009-02-05
Description: SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Classified Listings Manager 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33482; http://www.securityfocus.com/bid/33253; https://exchange.xforce.ibmcloud.com/vulnerabilities/47959
CVE: CVE-2009-0427
Published: 2009-02-05
Description: SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Member Directory Manager 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://dmxready.helpserve.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=93; http://dmxready.helpserve.com/index.php?_m=news&_a=viewnews&newsid=12; http://secunia.com/advisories/33482
CVE: CVE-2009-0428
Published: 2009-02-05
Description: SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Secure Document Library 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://dmxready.helpserve.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=93; http://dmxready.helpserve.com/index.php?_m=news&_a=viewnews&newsid=12; http://secunia.com/advisories/33482
CVE: CVE-2009-0429
Published: 2009-02-05
Description: Multiple SQL injection vulnerabilities in Active Bids allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to search.asp, (2) SortDir parameter to auctionsended.asp, and the (3) catid parameter to wishlist.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/500144/100/0/threaded; http://www.securityfocus.com/bid/33306; http://www.securityfocus.com/archive/1/500144/100/0/threaded
CVE: CVE-2009-0430
Published: 2009-02-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Active Bids allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to search.asp and the (2) URL parameter to tellafriend.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/500144/100/0/threaded; http://www.securityfocus.com/bid/33306; http://www.securityfocus.com/archive/1/500144/100/0/threaded
CVE: CVE-2009-0431
Published: 2009-02-05
Description: SQL injection vulnerability in Default.asp in LinksPro Standard Edition allows remote attackers to execute arbitrary SQL commands via the OrderDirection parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0901-exploits/linkspro-sql.txt; http://www.securityfocus.com/bid/33305; http://packetstormsecurity.org/0901-exploits/linkspro-sql.txt
CVE: CVE-2008-6060
Published: 2009-02-05
Description: Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by InfoSoft FusionCharts allows remote attackers to inject arbitrary additional SWF content via a URL in the SRC attribute of an IMG element in the dataURL parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.google.com/View?docid=ajfxntc4dmsq_14dt57ssdw; http://www.kb.cert.org/vuls/id/249337; http://www.securityfocus.com/archive/1/485722/100/100/threaded
CVE: CVE-2008-6061
Published: 2009-02-05
Description: Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) controller files created by Techsmith Camtasia Studio before 5 allows remote attackers to inject arbitrary additional SWF content via a URL in the csPreloader parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.google.com/View?docid=ajfxntc4dmsq_14dt57ssdw; http://secunia.com/advisories/28311; http://www.kb.cert.org/vuls/id/249337
CVE: CVE-2008-6062
Published: 2009-02-05
Description: Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by Adobe Dreamweaver, when the Insert Flash Video feature is used, allows remote attackers to inject arbitrary web script or HTML via an asfunction: URI in the skinName parameter.  NOTE: this may overlap CVE-2007-6242, CVE-2007-6244, or CVE-2007-6637.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.google.com/View?docid=ajfxntc4dmsq_14dt57ssdw; http://www.adobe.com/support/security/bulletins/apsb07-20.html; http://www.kb.cert.org/vuls/id/249337
CVE: CVE-2008-6063
Published: 2009-02-05
Description: Microsoft Word 2007, when the "Save as PDF" add-on is enabled, places an absolute pathname in the Subject field during an "Email as PDF" operation, which allows remote attackers to obtain sensitive information such as the sender's account name and a Temporary Internet Files subdirectory name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/486088/100/0/threaded; http://www.securityfocus.com/archive/1/486088/100/0/threaded
CVE: CVE-2008-6064
Published: 2009-02-05
Description: Multiple SQL injection vulnerabilities in DomPHP 0.81 allow remote attackers to execute arbitrary SQL commands via the cat parameter to agenda/index.php, and unspecified other vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/27233; https://www.exploit-db.com/exploits/4888; http://www.securityfocus.com/bid/27233
CVE: CVE-2008-6065
Published: 2009-02-05
Description: Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTORY statement, which allows remote authenticated users with CREATE ANY DIRECTORY privileges to gain SYSDBA privileges by aliasing the pathname of the password directory, and then overwriting the password file through UTL_FILE operations, a related issue to CVE-2006-7141.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: http://www.oracleforensics.com/wordpress/index.php/2008/10/10/create-any-directory-to-sysdba/; http://www.oracleforensics.com/wordpress/wp-content/uploads/2008/10/create-any-directory-to-sysdba.pdf; http://www.securityfocus.com/archive/1/497286/100/0/threaded
CVE: CVE-2008-6066
Published: 2009-02-05
Description: Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) modules.php, (2) ManagerResource.class.php, (3) ManagerRightsResource.class.php, (4) RegForm.class.php, (5) RegResource.class.php, and (6) RegRightsResource.class.php in classes/.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/30673; http://www.securityfocus.com/bid/30673/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/44454
CVE: CVE-2008-6067
Published: 2009-02-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-5838.  Reason: This candidate is a duplicate of CVE-2008-5838.  Notes: All CVE users should reference CVE-2008-5838 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-6074
Published: 2009-02-06
Description: Directory traversal vulnerability in frame.php in phpcrs 2.06 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the importFunction parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32379; http://www.securityfocus.com/archive/1/497742/100/0/threaded; http://www.securityfocus.com/bid/31876
CVE: CVE-2008-6075
Published: 2009-02-06
Description: SQL injection vulnerability in aspkat.asp in Bahar Download Script 2.0 allows remote attackers to execute arbitrary SQL commands via the kid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.rasihbahar.com/download/down.asp?id=479; http://www.securityfocus.com/bid/31852; https://exchange.xforce.ibmcloud.com/vulnerabilities/46032
CVE: CVE-2008-6076
Published: 2009-02-06
Description: SQL injection vulnerability in the Daily Message (com_dailymessage) 1.0.3 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31870; https://exchange.xforce.ibmcloud.com/vulnerabilities/46033; https://www.exploit-db.com/exploits/6802
CVE: CVE-2008-6077
Published: 2009-02-06
Description: SQL injection vulnerability in loudblog/ajax.php in LoudBlog 0.8.0a and earlier allows remote authenticated users to execute arbitrary SQL commands via the colpick parameter in a singleread action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32378; http://www.securityfocus.com/bid/31878; https://exchange.xforce.ibmcloud.com/vulnerabilities/46045
CVE: CVE-2008-6078
Published: 2009-02-06
Description: SQL injection vulnerability in open.php in the Private Messaging (com_privmsg) component for Limbo CMS allows remote attackers to execute arbitrary SQL commands via the id parameter in a pms action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31837; http://www.vupen.com/english/advisories/2008/2887; https://exchange.xforce.ibmcloud.com/vulnerabilities/45990
CVE: CVE-2008-6079
Published: 2009-02-06
Description: imlib2 before 1.4.2 allows context-dependent attackers to have an unspecified impact via a crafted (1) ARGB, (2) BMP, (3) JPEG, (4) LBM, (5) PNM, (6) TGA, or (7) XPM file, related to "several heap and stack based buffer overflows - partly due to integer overflows."
CVSS Score: 10.0 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576469; http://secunia.com/advisories/32354; http://secunia.com/advisories/39340