deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2662
Published: 2008-06-24
Description: Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption, a different issue than CVE-2008-2663, CVE-2008-2664, and CVE-2008-2725.  NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. This CVE description should be regarded as authoritative, although it is likely to change.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/; http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
CVE: CVE-2008-2663
Published: 2008-06-24
Description: Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors, a different issue than CVE-2008-2662, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.
CVSS Score: 10.0 (HIGH)
CWE: CWE-190
References: http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/; http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
CVE: CVE-2008-2664
Published: 2008-06-24
Description: The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2725.  NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/; http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
CVE: CVE-2008-2725
Published: 2008-06-24
Description: Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the "REALLOC_N" variant, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2664.  NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/; http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
CVE: CVE-2008-2726
Published: 2008-06-24
Description: Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption, aka the "beg + rlen" issue.  NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/; http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
CVE: CVE-2008-2832
Published: 2008-06-24
Description: Unrestricted file upload vulnerability in calendar_admin.asp in Full Revolution aspWebCalendar 2008 allows remote attackers to upload and execute arbitrary code via the FILE1 parameter in an uploadfileprocess action, probably followed by a direct request to the file in calendar/eventimages/.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://downloads.securityfocus.com/vulnerabilities/exploits/29795.html; http://www.securityfocus.com/bid/29795; https://exchange.xforce.ibmcloud.com/vulnerabilities/43201
CVE: CVE-2008-2833
Published: 2008-06-24
Description: admin/upload.php in le.cms 1.4 and earlier allows remote attackers to bypass administrative authentication, and upload and execute arbitrary files in images/, via a nonzero value for the submit0 parameter in conjunction with filenames in the filename and upload parameters.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/30797; http://www.securityfocus.com/bid/29867; http://www.securityfocus.com/bid/29872
CVE: CVE-2008-2834
Published: 2008-06-24
Description: SQL injection vulnerability in projects.php in Scientific Image DataBase 0.41 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29862; https://exchange.xforce.ibmcloud.com/vulnerabilities/43255; https://www.exploit-db.com/exploits/5885
CVE: CVE-2008-2835
Published: 2008-06-24
Description: SQL injection vulnerability in cgi-bin/igsuite in IGSuite 3.2.4 allows remote attackers to execute arbitrary SQL commands via the formid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30756; http://www.securityfocus.com/bid/29879; https://exchange.xforce.ibmcloud.com/vulnerabilities/43248
CVE: CVE-2008-2836
Published: 2008-06-24
Description: PHP remote file inclusion vulnerability in send_reminders.php in WebCalendar 1.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter and a 0 value for the noSet parameter, a different vector than CVE-2007-1483.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://sourceforge.net/mailarchive/forum.php?thread_name=45EAF[PII_REDACTED]%40k5n.us&forum_name=webcalendar-announce; http://www.securityfocus.com/bid/29783; http://www.securitytracker.com/id?1020357
CVE: CVE-2008-2837
Published: 2008-06-24
Description: SQL injection vulnerability in index.php in CMS-BRD allows remote attackers to execute arbitrary SQL commands via the menuclick parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29816; https://exchange.xforce.ibmcloud.com/vulnerabilities/43183; https://www.exploit-db.com/exploits/5863
CVE: CVE-2008-2838
Published: 2008-06-24
Description: Directory traversal vulnerability in index.php in Traindepot 0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29790; https://exchange.xforce.ibmcloud.com/vulnerabilities/43159; https://www.exploit-db.com/exploits/5848
CVE: CVE-2008-2839
Published: 2008-06-24
Description: Cross-site scripting (XSS) vulnerability in the search module in Traindepot 0.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29790; https://exchange.xforce.ibmcloud.com/vulnerabilities/43160; https://www.exploit-db.com/exploits/5848
CVE: CVE-2008-2840
Published: 2008-06-24
Description: Multiple directory traversal vulnerabilities in Exero CMS 1.0.0 and 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter to (1) custompage.php, (2) errors/404.php, (3) members/memberslist.php, (4) members/profile.php, (5) news/fullview.php, (6) news/index.php, (7) nopermission.php, (8) usercp/avatar.php, or (9) usercp/editpassword.php in themes/Default/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30711; http://sourceforge.net/project/shownotes.php?release_id=607502; http://www.securityfocus.com/bid/29788
CVE: CVE-2008-2841
Published: 2008-06-24
Description: Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote attackers to execute arbitrary commands via the --command parameter in an ircs:// URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://forum.xchat.org/viewtopic.php?t=4218; http://secunia.com/advisories/30695; http://www.securityfocus.com/bid/29696
CVE: CVE-2008-1951
Published: 2008-06-25
Description: Untrusted search path vulnerability in a certain Red Hat build script for Standards Based Linux Instrumentation for Manageability (sblim) libraries before 1-13a.el4_6.1 in Red Hat Enterprise Linux (RHEL) 4, and before 1-31.el5_2.1 in RHEL 5, allows local users to gain privileges via a malicious library in a certain subdirectory of /var/tmp, related to an incorrect RPATH setting, as demonstrated by a malicious libc.so library for tog-pegasus.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30803; http://www.securityfocus.com/bid/29913; http://www.securitytracker.com/id?1020354
CVE: CVE-2008-2641
Published: 2008-06-25
Description: Unspecified vulnerability in Adobe Reader and Acrobat 7.0.9 and earlier, and 8.0 through 8.1.2, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors, related to an "input validation issue in a JavaScript method."
CVSS Score: 10.0 (HIGH)
References: http://isc.sans.org/diary.html?storyid=4616; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00001.html; http://secunia.com/advisories/30832
CVE: CVE-2008-2842
Published: 2008-06-25
Description: Cross-site scripting (XSS) vulnerability in edit/showmedia.asp in doITLive CMS 2.50 and earlier allows remote attackers to inject arbitrary web script or HTML via the FILE parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30705; http://www.bugreport.ir/?/43; http://www.securityfocus.com/bid/29789
CVE: CVE-2008-2843
Published: 2008-06-25
Description: Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter in an USUB action to default.asp and the (2) Licence[SpecialLicenseNumber] (aka LicenceId) cookie to edit/default.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30705; http://www.bugreport.ir/?/43; http://www.securityfocus.com/bid/29789
CVE: CVE-2008-2844
Published: 2008-06-25
Description: SQL injection vulnerability in index.php in Carscripts Classifieds allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30738; http://www.securityfocus.com/bid/29803; https://exchange.xforce.ibmcloud.com/vulnerabilities/43170
CVE: CVE-2008-2845
Published: 2008-06-25
Description: SQL injection vulnerability in index.php in MyBizz-Classifieds allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30724; http://www.securityfocus.com/bid/29798; https://exchange.xforce.ibmcloud.com/vulnerabilities/43195
CVE: CVE-2008-2846
Published: 2008-06-25
Description: SQL injection vulnerability in index.php in BoatScripts Classifieds allows remote attackers to execute arbitrary SQL commands via the type parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30743; http://www.securityfocus.com/bid/29801; https://exchange.xforce.ibmcloud.com/vulnerabilities/43182
CVE: CVE-2008-2847
Published: 2008-06-25
Description: SQL injection vulnerability in the Trade module in Maxtrade AIO 1.3.23 allows remote attackers to execute arbitrary SQL commands via the categori parameter in a pocategorisell action to modules.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30722; http://www.securityfocus.com/bid/29799; https://exchange.xforce.ibmcloud.com/vulnerabilities/43203
CVE: CVE-2008-2848
Published: 2008-06-25
Description: Cross-site scripting (XSS) vulnerability in the search functionality in MindTouch DekiWiki before 8.05.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.developer.mindtouch.com/view.php?id=4200; http://secunia.com/advisories/30758; http://www.securityfocus.com/bid/29830
CVE: CVE-2008-2849
Published: 2008-06-25
Description: Cross-site scripting (XSS) vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote authenticated users, with create post permissions, to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/272191; http://secunia.com/advisories/30764; http://www.securityfocus.com/bid/29807
CVE: CVE-2008-2850
Published: 2008-06-25
Description: SQL injection vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified cookies, related to improper use of the Drupal database API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/272191; http://secunia.com/advisories/30764; http://www.securityfocus.com/bid/29807
CVE: CVE-2008-2851
Published: 2008-06-25
Description: Multiple buffer overflows in OFF System before 0.19.14 allow remote attackers to have an unknown impact via unspecified vectors related to "parsing of http headers."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30759; http://sourceforge.net/project/shownotes.php?release_id=607827; http://www.securityfocus.com/bid/29809
CVE: CVE-2008-2852
Published: 2008-06-25
Description: Cross-site scripting (XSS) vulnerability in CGIWrap before 4.1, when an Internet Explorer based browser is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to failure to set the charset in error messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cgiwrap.sourceforge.net/changes.html; http://jvn.jp/en/jp/JVN45389864/index.html; http://secunia.com/advisories/30765
CVE: CVE-2008-2853
Published: 2008-06-25
Description: SQL injection vulnerability in index.php in Easy Webstore 1.2 allows remote attackers to execute arbitrary SQL commands via the cat_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30726; http://www.securityfocus.com/bid/29806; https://exchange.xforce.ibmcloud.com/vulnerabilities/43194
CVE: CVE-2008-2854
Published: 2008-06-25
Description: Multiple PHP remote file inclusion vulnerabilities in Orlando CMS 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[preloc] parameter to (1) modules/core/logger/init.php and (2) AJAX/newscat.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29820; https://exchange.xforce.ibmcloud.com/vulnerabilities/43181; https://www.exploit-db.com/exploits/5864
CVE: CVE-2008-2855
Published: 2008-06-25
Description: Cross-site scripting (XSS) vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29818; https://exchange.xforce.ibmcloud.com/vulnerabilities/43186; https://www.exploit-db.com/exploits/5860
CVE: CVE-2008-2856
Published: 2008-06-25
Description: SQL injection vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29818; https://exchange.xforce.ibmcloud.com/vulnerabilities/43185; https://www.exploit-db.com/exploits/5860
CVE: CVE-2008-2857
Published: 2008-06-25
Description: AlstraSoft AskMe Pro 2.1 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: https://www.exploit-db.com/exploits/5821; https://www.exploit-db.com/exploits/5821
CVE: CVE-2008-2858
Published: 2008-06-25
Description: SQL injection vulnerability in index.php in WebChamado 1.1 allows remote attackers to execute arbitrary SQL commands via the eml parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30690; http://secunia.com/advisories/30690
CVE: CVE-2008-2859
Published: 2008-06-25
Description: Unspecified vulnerability in the IMAP service in NetWin SurgeMail before 3.9g2 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors related to an "imap command."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/30739; http://www.netwinsite.com/surgemail/help/updates.htm; http://www.securityfocus.com/bid/29805
CVE: CVE-2008-2860
Published: 2008-06-25
Description: SQL injection vulnerability in category.php in AJSquare AJ Auction Pro web 2.0 allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29839; https://exchange.xforce.ibmcloud.com/vulnerabilities/43218; https://www.exploit-db.com/exploits/5867
CVE: CVE-2008-2861
Published: 2008-06-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topic and (2) button parameters to ansFAQ.asp and the (3) id and (4) txtEmail parameters to login.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30762; http://securityreason.com/securityalert/3957; http://www.securityfocus.com/archive/1/493473/100/0/threaded
CVE: CVE-2008-2862
Published: 2008-06-25
Description: Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to ansFAQ.asp and the (2) template_id parameter to preview.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/46461; http://secunia.com/advisories/30762; http://securityreason.com/securityalert/3957
CVE: CVE-2008-2863
Published: 2008-06-25
Description: Multiple absolute path traversal vulnerabilities in eLineStudio Site Composer (ESC) 2.6 allow remote attackers to create or delete arbitrary directories via a full pathname in the inpCurrFolder parameter to (1) folderdel_.asp or (2) foldernew.asp in cms/assetmanager/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30762; http://securityreason.com/securityalert/3957; http://www.bugreport.ir/?/45
CVE: CVE-2008-2864
Published: 2008-06-25
Description: eLineStudio Site Composer (ESC) 2.6 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) trigger.asp or (2) common2.asp in cms/include/, which reveals the database path.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://securityreason.com/securityalert/3957; http://www.bugreport.ir/?/45; http://www.securityfocus.com/archive/1/493473/100/0/threaded
CVE: CVE-2008-2865
Published: 2008-06-25
Description: SQL injection vulnerability in index.php in Kalptaru Infotech PHP Site Lock 2.0 allows remote attackers to execute arbitrary SQL commands via the articleid parameter in a show_article action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29777; https://exchange.xforce.ibmcloud.com/vulnerabilities/43147; https://www.exploit-db.com/exploits/5842
CVE: CVE-2008-2866
Published: 2008-06-25
Description: SQL injection vulnerability in csc_article_details.php in Caupo.net CaupoShop Classic 1.3 allows remote attackers to execute arbitrary SQL commands via the saArticle[ID] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29834; https://exchange.xforce.ibmcloud.com/vulnerabilities/43200; https://www.exploit-db.com/exploits/5865
CVE: CVE-2008-2061
Published: 2008-06-26
Description: The Computer Telephony Integration (CTI) Manager service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3c) and 6.x before 6.1(2) allows remote attackers to cause a denial of service (TSP crash) via malformed network traffic to TCP port 2748.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30848; http://www.cisco.com/en/US/products/products_security_advisory09186a00809b9011.shtml; http://www.securityfocus.com/bid/29933
CVE: CVE-2008-2062
Published: 2008-06-26
Description: The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) before 4.2(3)SR4, and 4.3 before 4.3(2)SR1, allows remote attackers to bypass authentication, and obtain cluster configuration information and statistics, via a direct TCP connection to the service port, aka Bug ID CSCsq35151.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30848; http://www.cisco.com/en/US/products/products_security_advisory09186a00809b9011.shtml; http://www.securityfocus.com/bid/29935
CVE: CVE-2008-2730
Published: 2008-06-26
Description: The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) and 6.x before 6.1(1) allows remote attackers to bypass authentication, and obtain cluster configuration information and statistics, via a direct TCP connection to the service port, aka Bug ID CSCsj90843.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/30848; http://www.cisco.com/en/US/products/products_security_advisory09186a00809b9011.shtml; http://www.securityfocus.com/bid/29935
CVE: CVE-2008-2867
Published: 2008-06-26
Description: SQL injection vulnerability in adclick.php in E-topbiz Viral DX 1 2.07 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30793; http://www.securityfocus.com/bid/29921; http://www.vupen.com/english/advisories/2008/1922/references
CVE: CVE-2008-2868
Published: 2008-06-26
Description: SQL injection vulnerability in detail.asp in DUware DUcalendar 1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the iEve parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30774; http://www.securityfocus.com/bid/29919; http://www.securitytracker.com/id?1020358
CVE: CVE-2008-2869
Published: 2008-06-26
Description: SQL injection vulnerability in out.php in E-topbiz Link ADS 1 allows remote attackers to execute arbitrary SQL commands via the linkid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30798; http://www.securityfocus.com/bid/29923; http://www.vupen.com/english/advisories/2008/1921/references