deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2975
Published: 2008-07-02
Description: Cross-site scripting (XSS) vulnerability in admin/objects/obj_image.php in TinX/cms 1.1 allows remote attackers to inject arbitrary web script or HTML via the language parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29907; https://exchange.xforce.ibmcloud.com/vulnerabilities/43306; https://www.exploit-db.com/exploits/5917
CVE: CVE-2008-2976
Published: 2008-07-02
Description: Multiple directory traversal vulnerabilities in TinX/cms 1.1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) language parameter to (a) include_me.php, (b) admin/ajax.php, and (c) admin/objects/catalog.ajaxhandler.php; and the (2) prefix parameter to (d) admin/inc/config.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29907; https://exchange.xforce.ibmcloud.com/vulnerabilities/43305; https://www.exploit-db.com/exploits/5917
CVE: CVE-2008-2977
Published: 2008-07-02
Description: Multiple PHP remote file inclusion vulnerabilities in Ourvideo CMS 9.5 allow remote attackers to execute arbitrary PHP code via a URL in the include_connection parameter to (1) edit_top_feature.php and (2) edit_topics_feature.php in phpi/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29909; https://exchange.xforce.ibmcloud.com/vulnerabilities/43311; https://www.exploit-db.com/exploits/5920
CVE: CVE-2008-2978
Published: 2008-07-02
Description: Directory traversal vulnerability in phpi/rss.php in Ourvideo CMS 9.5, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the prefix parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29909; https://exchange.xforce.ibmcloud.com/vulnerabilities/43312; https://www.exploit-db.com/exploits/5920
CVE: CVE-2008-2979
Published: 2008-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpi/login.php in Ourvideo CMS 9.5 allow remote attackers to inject arbitrary web script or HTML via the (1) top_page and (2) end_page parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3968; http://www.securityfocus.com/bid/29909; https://exchange.xforce.ibmcloud.com/vulnerabilities/43313
CVE: CVE-2008-2980
Published: 2008-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in HomePH Design 2.10 RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) error_meldung parameter to admin/features/register/register.php, the (2) feature_language[ueberschrift] parameter to admin/features/memberlist/memberlist.php, the (3) language_array[ueberschrift] parameter to admin/features/lostpassword/lostpassword.php, the (4) language_feature[titel] parameter to admin/features/kalender/eingabe.php, and the (5) language_feature[bildmenu] parameter to admin/features/fotogalerie/eingabe.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/43260; https://www.exploit-db.com/exploits/5903; https://exchange.xforce.ibmcloud.com/vulnerabilities/43260
CVE: CVE-2008-2981
Published: 2008-07-02
Description: PHP remote file inclusion vulnerability in admin/templates/template_thumbnail.php in HomePH Design 2.10 RC2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the thumb_template parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/43256; https://www.exploit-db.com/exploits/5903; https://exchange.xforce.ibmcloud.com/vulnerabilities/43256
CVE: CVE-2008-2982
Published: 2008-07-02
Description: Multiple directory traversal vulnerabilities in HomePH Design 2.10 RC2, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) thumb_template parameter to (a) admin/templates/template_thumbnail.php, and the (2) language parameter to (b) account/account.php, (c) downloads/downloads.php, (d) forum/forum.php, (e) fotogalerie/delete.php, and (f) fotogalerie/fotogalerie.php in admin/features/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/43258; https://www.exploit-db.com/exploits/5903; https://exchange.xforce.ibmcloud.com/vulnerabilities/43258
CVE: CVE-2008-2983
Published: 2008-07-02
Description: SQL injection vulnerability in index.php in Demo4 CMS 01 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/43291; https://www.exploit-db.com/exploits/5914; https://exchange.xforce.ibmcloud.com/vulnerabilities/43291
CVE: CVE-2008-2984
Published: 2008-07-02
Description: Cross-site scripting (XSS) vulnerability in backend/umleitung.php in CMReams CMS 1.3.1.1 Beta 2 allows remote attackers to inject arbitrary web script or HTML via the lang[be_red_text] parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29891; https://exchange.xforce.ibmcloud.com/vulnerabilities/43266; https://www.exploit-db.com/exploits/5905
CVE: CVE-2008-2985
Published: 2008-07-02
Description: Directory traversal vulnerability in load_language.php in CMReams CMS 1.3.1.1 Beta 2, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page_language parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29891; https://exchange.xforce.ibmcloud.com/vulnerabilities/43265; https://www.exploit-db.com/exploits/5905
CVE: CVE-2008-2986
Published: 2008-07-02
Description: Multiple PHP remote file inclusion vulnerabilities in phpDMCA 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the ourlinux_root_path parameter to (1) adodb-errorpear.inc.php and (2) adodb-pear.inc.php in adodb/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29880; https://exchange.xforce.ibmcloud.com/vulnerabilities/43253; https://www.exploit-db.com/exploits/5897
CVE: CVE-2008-2987
Published: 2008-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Benja CMS 0.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin_edit_submenu.php, (2) admin_new_submenu.php, and (3) admin_edit_topmenu.php in admin/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30834; http://securityreason.com/securityalert/3958; http://www.securityfocus.com/archive/1/493568/100/0/threaded
CVE: CVE-2008-2988
Published: 2008-07-02
Description: Unrestricted file upload vulnerability in admin/upload.php in Benja CMS 0.1 allows remote attackers to upload and execute arbitrary PHP files via unspecified vectors, followed by a direct request to the file in billeder/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30834; http://securityreason.com/securityalert/3958; http://www.securityfocus.com/archive/1/493568/100/0/threaded
CVE: CVE-2008-2989
Published: 2008-07-02
Description: SQL injection vulnerability in index.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary SQL commands via the go parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29897; https://exchange.xforce.ibmcloud.com/vulnerabilities/43257; https://www.exploit-db.com/exploits/5908
CVE: CVE-2008-2990
Published: 2008-07-02
Description: PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) component 1.4.4 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the ff_compath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/3967; http://www.securityfocus.com/bid/29904; https://exchange.xforce.ibmcloud.com/vulnerabilities/43290
CVE: CVE-2008-2993
Published: 2008-07-03
Description: Multiple directory traversal vulnerabilities in index.php in FOG Forum 0.8.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) fog_lang and (2) fog_skin parameters, probably related to libs/required/share.inc; and possibly the (3) fog_pseudo, (4) fog_posted, (5) fog_password, and (6) fog_cook parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30613; http://securityreason.com/securityalert/3971; http://www.securityfocus.com/bid/29651
CVE: CVE-2008-2994
Published: 2008-07-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHPEasyData 1.5.4 allow remote attackers to inject arbitrary web script or HTML via the (1) annuaire parameter to (a) last_records.php and (b) annuaire.php and the (2) by and (3) cat_id parameters to annuaire.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3969; http://www.securityfocus.com/archive/1/493273/100/0/threaded; http://www.securityfocus.com/bid/29659
CVE: CVE-2008-2995
Published: 2008-07-03
Description: Multiple SQL injection vulnerabilities in PHPEasyData 1.5.4 allow remote attackers to execute arbitrary SQL commands via (1) the annuaire parameter to annuaire.php or (2) the username field in admin/login.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3969; http://www.securityfocus.com/archive/1/493273/100/0/threaded; http://www.securityfocus.com/bid/29659
CVE: CVE-2008-2996
Published: 2008-07-03
Description: Multiple SQL injection vulnerabilities in index.php in Gravity Board X (GBX) 2.0 Beta, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) searchquery parameter in a getsearch action, and the (2) board_id parameter in a viewboard action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/3970; http://www.securityfocus.com/bid/29685; https://exchange.xforce.ibmcloud.com/vulnerabilities/43022
CVE: CVE-2008-2997
Published: 2008-07-03
Description: Cross-site scripting (XSS) vulnerability in index.php in Gravity Board X (GBX) 2.0 Beta allows remote attackers to inject arbitrary web script or HTML via the subject parameter in a postnewsubmit (aka create new thread) action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3970; http://www.securityfocus.com/bid/29685; https://exchange.xforce.ibmcloud.com/vulnerabilities/43021
CVE: CVE-2008-2998
Published: 2008-07-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/269479; http://secunia.com/advisories/30618; http://www.securityfocus.com/bid/29677
CVE: CVE-2008-2999
Published: 2008-07-03
Description: Multiple SQL injection vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/269479; http://secunia.com/advisories/30618; http://www.securityfocus.com/bid/29677
CVE: CVE-2008-3000
Published: 2008-07-03
Description: The Aggregation module 5.x before 5.x-4.4 for Drupal, when node access modules are used, does not properly implement access control, which allows remote attackers to bypass intended restrictions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/269479; http://secunia.com/advisories/30618; http://www.securityfocus.com/bid/29677
CVE: CVE-2008-3001
Published: 2008-07-03
Description: The Aggregation module 5.x before 5.x-4.4 for Drupal allows remote attackers to upload files with arbitrary extensions, and possibly execute arbitrary code, via a crafted feed that allows upload of files with arbitrary extensions.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://drupal.org/node/269479; http://secunia.com/advisories/30618; http://www.securityfocus.com/bid/29677
CVE: CVE-2008-3022
Published: 2008-07-07
Description: Multiple PHP remote file inclusion vulnerabilities in sablonlar/gunaysoft/gunaysoft.php in PHPortal 1.2 Beta allow remote attackers to execute arbitrary PHP code via a URL in (1) icerikyolu, (2) sayfaid, and (3) uzanti parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/3972; http://www.securityfocus.com/bid/30064; https://exchange.xforce.ibmcloud.com/vulnerabilities/43569
CVE: CVE-2008-3023
Published: 2008-07-07
Description: Cross-site scripting (XSS) vulnerability in FreeStyle Wiki 3.6.2 and earlier, and 3.6.3 dev3 and earlier development versions, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2005-1799.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://fswiki.org/wiki.pl?page=%CD%FA%CE%F2%2F2008-7-3; http://jvn.jp/en/jp/JVN77432756/index.html; http://jvn.jp/jp/JVN77432756/index.html
CVE: CVE-2008-3024
Published: 2008-07-07
Description: Stack-based buffer overflow in phgrafx in QNX Momentics (aka RTOS) 6.3.2 and earlier allows local users to gain privileges via a long .pal filename in palette/.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://secunia.com/advisories/30808; http://securityreason.com/securityalert/3974; http://www.scanit.net/rd/advisories/adv01
CVE: CVE-2008-3025
Published: 2008-07-07
Description: SQL injection vulnerability in ad.php in plx Ad Trader 3.2 allows remote attackers to execute arbitrary SQL commands via the adid parameter in a redir action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30897; http://www.securityfocus.com/bid/30046; https://exchange.xforce.ibmcloud.com/vulnerabilities/43525
CVE: CVE-2008-3026
Published: 2008-07-07
Description: SQL injection vulnerability in index.php in OneClick CMS (aka Sisplet CMS) 2008-01-24 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30032; https://exchange.xforce.ibmcloud.com/vulnerabilities/43544; https://www.exploit-db.com/exploits/5984
CVE: CVE-2008-3027
Published: 2008-07-07
Description: SQL injection vulnerability in get_article.php in VanGogh Web CMS 0.9 allows remote attackers to execute arbitrary SQL commands via the article_ID parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30033; https://exchange.xforce.ibmcloud.com/vulnerabilities/43534; https://www.exploit-db.com/exploits/5985
CVE: CVE-2008-3028
Published: 2008-07-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Send-A-Card (sr_sendcard) extension 2.2.2 and earlier for TYPO3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/46624; http://secunia.com/advisories/30906; http://typo3.org/teams/security/security-bulletins/typo3-20080701-3/
CVE: CVE-2008-3029
Published: 2008-07-07
Description: Cross-site scripting (XSS) vulnerability in the WEC Discussion Forum (wec_discussion) extension 1.6.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30905; http://typo3.org/teams/security/security-bulletins/typo3-20080701-4/; http://www.securityfocus.com/bid/30026
CVE: CVE-2008-3030
Published: 2008-07-07
Description: SQL injection vulnerability in default.asp in EfesTECH Shop 2.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in an urunler action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30896; http://www.securityfocus.com/bid/30044; https://exchange.xforce.ibmcloud.com/vulnerabilities/43531
CVE: CVE-2008-3031
Published: 2008-07-07
Description: Directory traversal vulnerability in index.php in Simple PHP Agenda 2.2.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30909; http://www.securityfocus.com/bid/30034; https://exchange.xforce.ibmcloud.com/vulnerabilities/43540
CVE: CVE-2008-3032
Published: 2008-07-07
Description: Cross-site scripting (XSS) vulnerability in the phpMyAdmin (phpmyadmin) extension 3.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30884; http://typo3.org/teams/security/security-bulletins/typo3-20080701-2/; http://www.securityfocus.com/bid/30039
CVE: CVE-2008-3033
Published: 2008-07-07
Description: RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by (1) an IdFlux request to supprimer_flux.php and (2) a TpsRafraich request to modifier_tps_rafraich.php.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/3975; http://www.securityfocus.com/archive/1/493783/100/0/threaded; http://www.securityfocus.com/bid/30016
CVE: CVE-2008-3034
Published: 2008-07-07
Description: Multiple SQL injection vulnerabilities in RSS-aggregator 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) IdFlux parameter to admin/fonctions/supprimer_flux.php and the (2) IdTag parameter to admin/fonctions/supprimer_tag.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3975; http://www.securityfocus.com/archive/1/493783/100/0/threaded; http://www.securityfocus.com/bid/30016
CVE: CVE-2008-3035
Published: 2008-07-07
Description: SQL injection vulnerability in newThread.php in XchangeBoard 1.70 Final and earlier allows remote authenticated users to execute arbitrary SQL commands via the boardID parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30919; http://www.securityfocus.com/bid/30059; https://exchange.xforce.ibmcloud.com/vulnerabilities/43529
CVE: CVE-2008-3036
Published: 2008-07-07
Description: Directory traversal vulnerability in index.php in CMS little 0.0.1 allows remote attackers to include and execute arbitrary local files, and probably remote files, via a .. (dot dot) in the template parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/30061; https://exchange.xforce.ibmcloud.com/vulnerabilities/43539; https://www.exploit-db.com/exploits/5992
CVE: CVE-2008-3037
Published: 2008-07-07
Description: Cross-site scripting (XSS) vulnerability in the Address Directory (sp_directory) extension 0.2.10 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30048; https://exchange.xforce.ibmcloud.com/vulnerabilities/43491
CVE: CVE-2008-3038
Published: 2008-07-07
Description: SQL injection vulnerability in the Address Directory (sp_directory) extension 0.2.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30049; https://exchange.xforce.ibmcloud.com/vulnerabilities/43492
CVE: CVE-2008-3039
Published: 2008-07-07
Description: SQL injection vulnerability in the DAM Frontend (dam_frontend) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30054; https://exchange.xforce.ibmcloud.com/vulnerabilities/43477
CVE: CVE-2008-3040
Published: 2008-07-07
Description: Unspecified vulnerability in the DAM Frontend (dam_frontend) extension 0.1.0 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30054; https://exchange.xforce.ibmcloud.com/vulnerabilities/43478
CVE: CVE-2008-3041
Published: 2008-07-07
Description: Unspecified vulnerability in the DAM Frontend (dam_frontend) extension 0.1.0 and earlier for TYPO3 has unknown impact and attack vectors related to "broken access control."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30054; https://exchange.xforce.ibmcloud.com/vulnerabilities/43476
CVE: CVE-2008-3042
Published: 2008-07-07
Description: Unspecified vulnerability in the DAM Frontend (dam_frontend) extension 0.1.0 and earlier for TYPO3 has unknown impact and attack vectors related to "Improper Error Handling."
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30054; https://exchange.xforce.ibmcloud.com/vulnerabilities/43476
CVE: CVE-2008-3043
Published: 2008-07-07
Description: Unspecified vulnerability in the WEC Discussion Forum (wec_discussion) extension 1.6.2 and earlier for TYPO3 allows attackers to execute arbitrary code via vectors related to "certain file types."
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30905; http://typo3.org/teams/security/security-bulletins/typo3-20080701-4/; http://www.securityfocus.com/bid/30026
CVE: CVE-2008-3044
Published: 2008-07-07
Description: SQL injection vulnerability in the News Calendar (newscalendar) extension 1.0.7 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30885; http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30056
CVE: CVE-2008-3045
Published: 2008-07-07
Description: Unspecified vulnerability in the Industry Database (aka Branchendatenbank pro_industrydb) extension 1.0.0 and earlier for TYPO3 has unknown impact and attack vectors related to "Insufficient Verification of Data Authenticity."
CVSS Score: 7.5 (HIGH)
References: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-20080701-1/; http://www.securityfocus.com/bid/30047; https://exchange.xforce.ibmcloud.com/vulnerabilities/43490
CVE: CVE-2008-3046
Published: 2008-07-07
Description: Incomplete blacklist vulnerability in the Packman (kb_packman) extension 0.2.1 and earlier for TYPO3 has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30885; http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30052
CVE: CVE-2008-3047
Published: 2008-07-07
Description: Incomplete blacklist vulnerability in the KB Unpack (kb_unpack) extension 0.1.0 and earlier for TYPO3 has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30885; http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30053
CVE: CVE-2008-3048
Published: 2008-07-07
Description: Unspecified vulnerability in the PDF Generator 2 (pdf_generator2) extension 0.5.0 and earlier for TYPO3 has unknown impact and attack vectors related to "Unprotected test functionality."
CVSS Score: 7.5 (HIGH)
References: http://typo3.org/teams/security/security-bulletins/typo3-20080701-1/; http://www.securityfocus.com/bid/30057; https://exchange.xforce.ibmcloud.com/vulnerabilities/43487