deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1811
Published: 2009-05-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to inject arbitrary web script or HTML via (1) the Page parameter in a List action to modules/ereignis.php, (2) the Kontext parameter in a Search action to modules/kategorie.php, (3) the image parameter to modules/image.php, or (4) the ID parameter in a Detail action to modules/sitzung.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35136; http://www.securityfocus.com/bid/34998; http://www.vupen.com/english/advisories/2009/1345
CVE: CVE-2009-1812
Published: 2009-05-29
Description: Multiple SQL injection vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to execute arbitrary SQL commands via (1) the formUser parameter (aka the Name field) to common/login.php, and allow remote authenticated users to execute arbitrary SQL commands via the ID parameter in a Detail action to (2) kategorie.php, (3) budget.php, (4) zahlung.php, or (5) adresse.php in modules/, related to classes/class.perform.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35110; http://www.collector.ch/drupal5/?q=node/39; http://www.securityfocus.com/bid/34998
CVE: CVE-2009-1813
Published: 2009-05-29
Description: Multiple SQL injection vulnerabilities in admin/index.php in Submitter Script 2 allow remote attackers to execute arbitrary SQL commands via (1) the uNev parameter (aka the username field) or (2) the uJelszo parameter (aka the Password field).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54475; http://secunia.com/advisories/35088; http://www.securityfocus.com/bid/34970
CVE: CVE-2009-1814
Published: 2009-05-29
Description: SQL injection vulnerability in mail.php in PHPenpals 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.  NOTE: the profile.php vector is already covered by CVE-2006-0074.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/18269; http://www.securityfocus.com/bid/34996; http://www.vupen.com/english/advisories/2009/1342
CVE: CVE-2009-1815
Published: 2009-05-29
Description: Stack-based buffer overflow in Sonic Spot Audioactive Player 1.93b allows remote attackers to execute arbitrary code via a long string in a playlist file, as demonstrated by a long .mp3 URL in a .m3u file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34987; http://www.vupen.com/english/advisories/2009/1339; https://www.exploit-db.com/exploits/8698
CVE: CVE-2009-1816
Published: 2009-05-29
Description: SQL injection vulnerability in admin.php in My Game Script 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka the username field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/54459; http://secunia.com/advisories/35085; http://www.securityfocus.com/bid/34963
CVE: CVE-2009-1817
Published: 2009-05-29
Description: Multiple buffer overflows in DigiMode Maya 1.0.2 allow remote attackers to execute arbitrary code via a long string in a malformed (1) .m3u or (2) .m3l playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34960; https://exchange.xforce.ibmcloud.com/vulnerabilities/50533; https://www.exploit-db.com/exploits/8677
CVE: CVE-2009-1818
Published: 2009-05-29
Description: SQL injection vulnerability in admin/admin_manager.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL commands via an m_username cookie in an add action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.vupen.com/english/advisories/2009/1307; https://exchange.xforce.ibmcloud.com/vulnerabilities/50513; https://www.exploit-db.com/exploits/8672
CVE: CVE-2009-1819
Published: 2009-05-29
Description: SQL injection vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35114; http://www.securityfocus.com/bid/34992; http://www.vupen.com/english/advisories/2009/1341
CVE: CVE-2009-1820
Published: 2009-05-29
Description: Cross-site scripting (XSS) vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/34992; http://www.vupen.com/english/advisories/2009/1341; https://www.exploit-db.com/exploits/8702
CVE: CVE-2009-1821
Published: 2009-05-29
Description: DMXReady Registration Manager 1.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for databases/webblogmanager.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.vupen.com/english/advisories/2009/1347; https://exchange.xforce.ibmcloud.com/vulnerabilities/50915; https://www.exploit-db.com/exploits/8705
CVE: CVE-2009-1822
Published: 2009-05-29
Description: Multiple PHP remote file inclusion vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) imgcaptcha.php or (2) mp3captcha.php in assets/captcha/includes/captchaform/, or (3) assets/captcha/includes/captchatalk/swfmovie.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/34986; https://www.exploit-db.com/exploits/8697; http://www.securityfocus.com/bid/34986
CVE: CVE-2009-1823
Published: 2009-05-29
Description: Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.7 and 6.x before 6.x-1.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML by modifying a document head, before the Content-Type META element, to contain crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, a related issue to CVE-2009-1575.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/461674; http://osvdb.org/54427; http://secunia.com/advisories/35040
CVE: CVE-2009-1537
Published: 2009-05-29
Description: Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsoft-directshow-released.aspx; http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx; http://isc.sans.org/diary.html?storyid=6481
CVE: CVE-2009-1792
Published: 2009-05-29
Description: The system.openURL function in StoneTrip Ston3D StandalonePlayer (aka S3DPlayer StandAlone) 1.6.2.4 and 1.7.0.1 and WebPlayer (aka S3DPlayer Web) 1.6.0.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the first argument (the sURL argument).
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://secunia.com/advisories/35256; http://www.coresecurity.com/content/StoneTrip-S3DPlayers; http://www.securityfocus.com/archive/1/503887/100/0/threaded
CVE: CVE-2009-1824
Published: 2009-05-29
Description: The ps_drv.sys kernel driver in ArcaBit ArcaVir 2009 Antivirus Protection 9.4.3201.9 and earlier, ArcaVir 2009 Internet Security 9.4.3202.9 and earlier, ArcaVir 2009 System Protection 9.4.3203.9 and earlier, and ArcaBit 2009 Home Protection 9.4.3204.9 and earlier, allows local users to gain privileges via crafted METHOD_NEITHER IOCTL requests to \Device\ps_drv containing arbitrary kernel addresses, as demonstrated using the (1) 0x2A7B802B and possibly (2) 0x2A7B8004 and (3) 0x2A7B802F IOCTLs.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://ntinternals.org/ntiadv0814/PsDrv_Exp.zip; http://ntinternals.org/ntiadv0814/ntiadv0814.html; http://secunia.com/advisories/35260
CVE: CVE-2009-1825
Published: 2009-05-29
Description: modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://www.collector.ch/drupal5/?q=node/39; http://www.vupen.com/english/advisories/2009/1344; https://www.exploit-db.com/exploits/8707
CVE: CVE-2009-1826
Published: 2009-05-29
Description: modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://www.collector.ch/download/mygesuad-0.9.zip; http://www.collector.ch/drupal5/?q=node/39; http://www.vupen.com/english/advisories/2009/1345
CVE: CVE-2009-1827
Published: 2009-05-29
Description: The SVG component in Mozilla Firefox 3.0.4 allows remote attackers to cause a denial of service (application hang) via a large value in the r (aka Radius) attribute of a circle element, related to an "unclamped loop."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2009-05/0270.html; http://archives.neohapsis.com/archives/bugtraq/2009-05/0271.html; http://archives.neohapsis.com/archives/bugtraq/2009-05/0272.html
CVE: CVE-2009-1828
Published: 2009-05-29
Description: Mozilla Firefox 3.0.10 allows remote attackers to cause a denial of service (infinite loop, application hang, and memory consumption) via a KEYGEN element in conjunction with (1) a META element specifying automatic page refresh or (2) a JavaScript onLoad event handler for a BODY element. NOTE: it was later reported that earlier versions are also affected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0247.html; http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0263.html; http://blog.zoller.lu/2009/04/advisory-firefox-denial-of-service.html
CVE: CVE-2009-1829
Published: 2009-05-29
Description: Unspecified vulnerability in the PCNFSD dissector in Wireshark 0.8.20 through 1.0.7 allows remote attackers to cause a denial of service (crash) via crafted PCNFSD packets.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/54629; http://secunia.com/advisories/35201; http://secunia.com/advisories/35224
CVE: CVE-2009-1830
Published: 2009-05-29
Description: Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long search query.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0210.html; http://secunia.com/advisories/35186; http://www.securityfocus.com/bid/35091
CVE: CVE-2009-1831
Published: 2009-05-29
Description: The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute arbitrary code via a crafted MAKI file, which triggers an incorrect sign extension, an integer overflow, and a stack-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://vrt-sourcefire.blogspot.com/2009/05/winamp-maki-parsing-vulnerability.html; http://www.securityfocus.com/bid/35052; https://exchange.xforce.ibmcloud.com/vulnerabilities/50664
CVE: CVE-2008-6817
Published: 2009-06-01
Description: Mole Group Lastminute Script 4.0 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/43646; https://exchange.xforce.ibmcloud.com/vulnerabilities/43646
CVE: CVE-2008-6818
Published: 2009-06-01
Description: Mole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/43645; https://exchange.xforce.ibmcloud.com/vulnerabilities/43645
CVE: CVE-2009-1842
Published: 2009-06-01
Description: SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://gsasec.blogspot.com/2009/05/php-nuke-v80-referer-sql-injection.html; http://www.securityfocus.com/bid/35117; https://exchange.xforce.ibmcloud.com/vulnerabilities/50818
CVE: CVE-2009-1843
Published: 2009-06-01
Description: Multiple SQL injection vulnerabilities in Flash Quiz Beta 2 allow remote attackers to execute arbitrary SQL commands via the (1) quiz parameter to (a) num_questions.php, (b) answers.php, (c) high_score.php, (d) high_score_web.php, (e) results_table_web.php, and (f) question.php; and the (2) order_number parameter to (g) answers.php and (h) question.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/503701/100/0/threaded; http://www.securityfocus.com/bid/35060; https://exchange.xforce.ibmcloud.com/vulnerabilities/50668
CVE: CVE-2009-1844
Published: 2009-06-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow (1) remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not properly handled in the "HTML exports of books" feature; and (2) allow remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via the help text of an arbitrary vocabulary.  NOTE: vector 1 exists because of an incomplete fix for CVE-2009-1575.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/461886; http://secunia.com/advisories/35282; http://www.debian.org/security/2009/dsa-1808
CVE: CVE-2008-6819
Published: 2009-06-01
Description: win32k.sys in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (system crash) via vectors related to CreateWindow, TranslateMessage, and DispatchMessage, possibly a race condition between threads, a different vulnerability than CVE-2008-1084.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://bugtraq.ru/cgi-bin/forum.mcgi?type=sb&b=2&m=152274; http://www.securityfocus.com/bid/35121; http://www.securityfocus.com/data/vulnerabilities/exploits/35121.c
CVE: CVE-2009-1805
Published: 2009-06-01
Description: Unspecified vulnerability in the VMware Descheduled Time Accounting driver in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745, VMware Fusion 2.x before 2.0.2 build 147997, VMware ESXi 3.5, and VMware ESX 3.0.2, 3.0.3, and 3.5, when the Descheduled Time Accounting Service is not running, allows guest OS users on Windows to cause a denial of service via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/35269; http://www.securityfocus.com/archive/1/503912/100/0/threaded; http://www.securityfocus.com/bid/35141
CVE: CVE-2009-1845
Published: 2009-06-01
Description: Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5 and 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the RequestName parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://gsasec.blogspot.com/2009/05/vanilla-v117-cross-site-scripting.html; http://lussumo.com/community/discussion/9524/vanilla-118-released/#Item_0; http://secunia.com/advisories/35234
CVE: CVE-2009-1846
Published: 2009-06-01
Description: Multiple directory traversal vulnerabilities in SiteX 0.7.4 Build 418 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the THEME_FOLDER parameter to (1) Corporate/homepage.php, (2) Fusion/homepage.php, (3) Joombo/homepage.php, (4) Streamline/homepage.php, and (5) Structure/homepage.php in themes/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/35122; https://www.exploit-db.com/exploits/8816; http://www.securityfocus.com/bid/35122
CVE: CVE-2009-1847
Published: 2009-06-01
Description: Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the fiche parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/35252; http://www.securityfocus.com/bid/35119; https://www.exploit-db.com/exploits/8815
CVE: CVE-2009-1848
Published: 2009-06-01
Description: SQL injection vulnerability in the JoomlaMe AgoraGroups (aka AG or com_agoragroup) component 0.3.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a groupdetail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/35118; https://www.exploit-db.com/exploits/8814; http://www.securityfocus.com/bid/35118
CVE: CVE-2009-1849
Published: 2009-06-01
Description: Cross-site scripting (XSS) vulnerability in the Monitor_Bandwidth function in PRTG Traffic Grapher 6.2.2.977 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.bkis.com/?p=704; http://secunia.com/advisories/35249; http://www.paessler.com/support/kb/questions/prtg6history
CVE: CVE-2009-1850
Published: 2009-06-01
Description: SQL injection vulnerability in index.php in phpBugTracker 1.0.3 allows remote attackers to execute arbitrary SQL commands via the password parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/35101; https://exchange.xforce.ibmcloud.com/vulnerabilities/50752; https://www.exploit-db.com/exploits/8808
CVE: CVE-2009-1851
Published: 2009-06-01
Description: SQL injection vulnerability in include.php in phpBugTracker 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/35125; http://www.vupen.com/english/advisories/2009/1432; http://www.securityfocus.com/bid/35125
CVE: CVE-2009-1852
Published: 2009-06-01
Description: Multiple SQL injection vulnerabilities in Graphiks MyForum 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/35096; https://exchange.xforce.ibmcloud.com/vulnerabilities/50749; https://www.exploit-db.com/exploits/8803
CVE: CVE-2009-1853
Published: 2009-06-01
Description: Multiple SQL injection vulnerabilities in index.php in Kensei Board 2.0 BETA (aka 2.0.0b) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) f and (2) t parameters in a showforum action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/50747; https://www.exploit-db.com/exploits/8802; https://exchange.xforce.ibmcloud.com/vulnerabilities/50747
CVE: CVE-2009-1854
Published: 2009-06-01
Description: Million Dollar Text Links 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the userid cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.exploit-db.com/exploits/8813; https://www.exploit-db.com/exploits/8813
CVE: CVE-2009-3870
Published: 2009-06-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-3870.  Reason: This candidate is a duplicate of CVE-2008-3870.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2008-3870 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-1572
Published: 2009-06-01
Description: Sun Java Media Framework (JMF) 2.1.1 through 2.1.1c allows unsigned applets to cause a denial of service (JVM crash) and read or write unauthorized memory locations via the ReadEnv class, as demonstrated by reading environment variables using modified .data and .size fields.
CVSS Score: 9.3 (HIGH)
References: http://archive.cert.uni-stuttgart.de/bugtraq/2003/06/msg00219.html; http://securitytracker.com/id?1006777; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F54760
CVE: CVE-2003-1573
Published: 2009-06-01
Description: The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive information via a crafted SQL statement, related to "inadequate security settings and library bugs in sun.* and org.apache.* packages."
CVSS Score: 10.0 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2004-01/0148.html; http://archives.neohapsis.com/archives/fulldisclosure/2004-01/0675.html; http://seclists.org/bugtraq/2003/Dec/0249.html
CVE: CVE-2004-2763
Published: 2009-06-01
Description: The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-16
References: http://archive.cert.uni-stuttgart.de/uniras/2004/02/msg00007.html; http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf; http://www.kb.cert.org/vuls/id/867593
CVE: CVE-2004-2764
Published: 2009-06-02
Description: Sun SDK and Java Runtime Environment (JRE) 1.4.2 through 1.4.2_04, 1.4.1 through 1.4.1_07, and 1.4.0 through 1.4.0_04 allows untrusted applets and unprivileged servlets to gain privileges and read data from other applets via unspecified vectors related to classes in the XSLT processor, aka "XML sniffing."
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://archive.cert.uni-stuttgart.de/uniras/2004/08/msg00007.html; http://groups.google.com/group/comp.security.unix/tree/browse_frm/month/2004-10/fe63f1daa9689d50?rnum=161&_done=%2Fgroup%2Fcomp.security.unix%2Fbrowse_frm%2Fmonth%2F2004-10%3Ffwc%3D1%26#doc_[PII_REDACTED]2c690d; http://secunia.com/advisories/12206
CVE: CVE-2009-1880
Published: 2009-06-02
Description: Cross-site scripting (XSS) vulnerability in MT312 REP-BBS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) model.php and (2) config.php with timestamps before 20090521.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN01115659/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000033.html; http://secunia.com/advisories/35251
CVE: CVE-2009-1881
Published: 2009-06-02
Description: Cross-site scripting (XSS) vulnerability in MT312 IMG-BBS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to model.php with a timestamp before 20090521.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN70836284/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000034.html; http://osvdb.org/54782