deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2633
Published: 2008-06-10
Description: Multiple SQL injection vulnerabilities in the EXP JoomRadio (com_joomradio) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) show_radio or (2) show_video action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0806-exploits/joomlajoomradio-sql.txt; http://secunia.com/advisories/30513; http://www.securityfocus.com/archive/1/501069/100/0/threaded
CVE: CVE-2008-2634
Published: 2008-06-10
Description: SQL injection vulnerability in index.asp in I-Pos Internet Pay Online Store 1.3 Beta and earlier allows remote attackers to execute arbitrary SQL commands via the item parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/42786; https://www.exploit-db.com/exploits/5717; https://exchange.xforce.ibmcloud.com/vulnerabilities/42786
CVE: CVE-2008-2635
Published: 2008-06-10
Description: Multiple directory traversal vulnerabilities in BitKinex 2.9.3 allow remote FTP and WebDAV servers to create or overwrite arbitrary files via a .. (dot dot) in (1) a response to a LIST command from the BitKinex FTP client and (2) a response to a PROPFIND command from the BitKinex WebDAV client.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30532; http://vuln.sg/bitkinex293-en.html; http://www.vupen.com/english/advisories/2008/1738/references
CVE: CVE-2008-2636
Published: 2008-06-10
Description: The HTTP service on the Cisco Linksys WRH54G with firmware 1.01.03 allows remote attackers to cause a denial of service (management interface outage) or possibly execute arbitrary code via a URI that begins with a "/./" sequence, contains many instances of a "front_page" sequence, and ends with a ".asp" sequence.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30562; http://securityreason.com/securityalert/3929; http://www.securityfocus.com/archive/1/493129/100/0/threaded
CVE: CVE-2008-2637
Published: 2008-06-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in (1) the css_exceptions parameter in vdesk/admincon/webyfiers.php and (2) the sql_matchscope parameter in vdesk/admincon/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30550; http://securityreason.com/securityalert/3931; http://www.securityfocus.com/archive/1/493149/100/0/threaded
CVE: CVE-2008-2638
Published: 2008-06-10
Description: Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://1scripts.net/php-scripts/index.php?p=16; http://secunia.com/advisories/30146; http://www.vupen.com/english/advisories/2008/1735/references
CVE: CVE-2008-0960
Published: 2008-06-10
Description: SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://lists.ingate.com/pipermail/productinfo/2008/000021.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00000.html
CVE: CVE-2008-1581
Published: 2008-06-10
Description: Heap-based buffer overflow in Apple QuickTime before 7.5 on Windows allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted packed scanlines in PixData structures in a PICT image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2008/Jun/msg00000.html; http://secunia.com/advisories/29293; http://secunia.com/secunia_research/2008-9/advisory/
CVE: CVE-2008-1582
Published: 2008-06-10
Description: Unspecified vulnerability in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted AAC-encoded file that triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2008/Jun/msg00000.html; http://secunia.com/advisories/29293; http://support.apple.com/kb/HT1991
CVE: CVE-2008-1583
Published: 2008-06-10
Description: Heap-based buffer overflow in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PICT image, a different vulnerability than CVE-2008-1581.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2008/Jun/msg00000.html; http://secunia.com/advisories/29293; http://support.apple.com/kb/HT1991
CVE: CVE-2008-1584
Published: 2008-06-10
Description: Stack-based buffer overflow in Indeo.qtx in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via crafted Indeo video codec content in a movie file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2008/Jun/msg00000.html; http://secunia.com/advisories/29293; http://support.apple.com/kb/HT1991
CVE: CVE-2008-1585
Published: 2008-06-10
Description: Apple QuickTime before 7.5 uses the url.dll!FileProtocolHandler handler for unrecognized URIs in qt:next attributes within SMIL text in video files, which sends these URIs to explorer.exe and thereby allows remote attackers to execute arbitrary programs, as originally demonstrated by crafted file: URLs.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2008//Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2008/Jun/msg00000.html; http://secunia.com/advisories/29293
CVE: CVE-2008-2152
Published: 2008-06-10
Description: Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in OpenOffice.org (OOo) 2.0 through 2.4 allows remote attackers to execute arbitrary code via a crafted file that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=714; http://secunia.com/advisories/30599; http://secunia.com/advisories/30633
CVE: CVE-2008-2642
Published: 2008-06-10
Description: SQL injection vulnerability in login.php in OtomiGenX 2.2 allows remote attackers to execute arbitrary SQL commands via the userAccount parameter (aka the User Name field) to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30504; http://securityreason.com/securityalert/3932; http://www.securityfocus.com/archive/1/492914/100/0/threaded
CVE: CVE-2008-2643
Published: 2008-06-10
Description: SQL injection vulnerability in the Bible Study (com_biblestudy) component before 6.0.7c for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a mediaplayer action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://joomlacode.org/gf/project/biblestudy/news/?action=NewsThreadView&id=1454; http://secunia.com/advisories/30492; https://exchange.xforce.ibmcloud.com/vulnerabilities/42788
CVE: CVE-2008-2644
Published: 2008-06-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in SMEWeb 1.4b and 1.4f allow remote attackers to inject arbitrary web script or HTML via the (1) data parameter to catalog.php, the (2) keyword parameter to search.php, the (3) page parameter to bb.php, and the (4) new_s parameter to order.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30477; http://www.securityfocus.com/archive/1/493130/100/0/threaded; http://www.securityfocus.com/bid/29496
CVE: CVE-2008-2645
Published: 2008-06-10
Description: Multiple PHP remote file inclusion vulnerabilities in Brim (formerly Booby) 1.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the renderer parameter to template.tpl.php in (1) barrel/, (2) barry/, (3) mylook/, (4) oerdec/, (5) penguin/, (6) sidebar/, (7) slashdot/, and (8) text-only/ in templates/.  NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29469; http://www.vupen.com/english/advisories/2008/1718/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/42784
CVE: CVE-2008-2646
Published: 2008-06-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in meBiblio 0.4.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sql parameter to dbadd.inc.php, (2) InsertJournal parameter to add_journal_mask.inc.php, (3) InsertBibliography parameter to insert_mask.inc.php, and (4) LabelYear parameter to search_mask.inc.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30488; http://www.securityfocus.com/bid/29465; https://exchange.xforce.ibmcloud.com/vulnerabilities/42760
CVE: CVE-2008-2647
Published: 2008-06-10
Description: SQL injection vulnerability in admin/journal_change_mask.inc.php in meBiblio 0.4.7 allows remote attackers to execute arbitrary SQL commands via the JID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29465; https://exchange.xforce.ibmcloud.com/vulnerabilities/42759; https://www.exploit-db.com/exploits/5716
CVE: CVE-2008-2648
Published: 2008-06-10
Description: Unrestricted file upload vulnerability in upload/uploader.html in meBiblio 0.4.7 allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the files/ directory.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/29465; https://exchange.xforce.ibmcloud.com/vulnerabilities/42761; https://www.exploit-db.com/exploits/5716
CVE: CVE-2008-2649
Published: 2008-06-10
Description: Multiple PHP remote file inclusion vulnerabilities in DesktopOnNet 3 Beta allow remote attackers to execute arbitrary PHP code via a URL in the app_path parameter to (1) don3_requiem.don3app/don3_requiem.php and (2) frontpage.don3app/frontpage.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/42790; https://www.exploit-db.com/exploits/5715; https://exchange.xforce.ibmcloud.com/vulnerabilities/42790
CVE: CVE-2008-2650
Published: 2008-06-10
Description: Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php.  NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/45881; http://secunia.com/advisories/30463; http://www.cmsimple.com/forum/viewtopic.php?f=2&t=17
CVE: CVE-2008-2651
Published: 2008-06-10
Description: SQL injection vulnerability in the Joomla! Bulletin Board (aka Joo!BB or com_joobb) component 0.5.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the forum parameter in a forum action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/42791; https://www.exploit-db.com/exploits/5719; https://exchange.xforce.ibmcloud.com/vulnerabilities/42791
CVE: CVE-2008-2652
Published: 2008-06-10
Description: Multiple SQL injection vulnerabilities in catalog.php in SMEWeb 1.4b and 1.4f allow remote attackers to execute arbitrary SQL commands via the (1) idp and (2) category parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30477; http://www.securityfocus.com/archive/1/493130/100/0/threaded; http://www.securityfocus.com/bid/29496
CVE: CVE-2008-2230
Published: 2008-06-11
Description: Untrusted search path vulnerability in (1) reportbug 3.8 and 3.31, and (2) reportbug-ng before 0.2008.06.04, allows local users to execute arbitrary code via a malicious module file in the current working directory.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484311; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484474; https://exchange.xforce.ibmcloud.com/vulnerabilities/43001
CVE: CVE-2008-0011
Published: 2008-06-12
Description: Microsoft DirectX 8.1 through 9.0c, and DirectX on Microsoft XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, does not properly perform MJPEG error checking, which allows remote attackers to execute arbitrary code via a crafted MJPEG stream in a (1) AVI or (2) ASF file, aka the "MJPEG Decoder Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3597&w=2; http://secunia.com/advisories/30579; http://securitytracker.com/id?1020222
CVE: CVE-2008-0956
Published: 2008-06-12
Description: Multiple stack-based buffer overflows in the BackWeb Lite Install Runner ActiveX control in the BackWeb Web Package ActiveX object in LiteInstActivator.dll in BackWeb before 8.1.1.87, as used in Logitech Desktop Manager (LDM) before 2.56, allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://backweb.com/news_events/press_releases/051608.php; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3597&w=2; http://secunia.com/advisories/30598
CVE: CVE-2008-1440
Published: 2008-06-12
Description: Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted PGM packet, aka the "PGM Invalid Length Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-1284
References: http://secunia.com/advisories/30587; http://securitytracker.com/id?1020230; http://www.securityfocus.com/bid/29508
CVE: CVE-2008-1441
Published: 2008-06-12
Description: Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of service (system hang) via a series of Pragmatic General Multicast (PGM) packets with invalid fragment options, aka the "PGM Malformed Fragment Vulnerability."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/30587; http://securitytracker.com/id?1020231; http://www.securityfocus.com/bid/29509
CVE: CVE-2008-1442
Published: 2008-06-12
Description: Heap-based buffer overflow in the substringData method in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code, related to an unspecified manipulation of a DOM object before a call to this method, aka the "HTML Objects Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3597&w=2; http://secunia.com/advisories/30575; http://securityreason.com/securityalert/3934
CVE: CVE-2008-1444
Published: 2008-06-12
Description: Stack-based buffer overflow in Microsoft DirectX 7.0 and 8.1 on Windows 2000 SP4 allows remote attackers to execute arbitrary code via a Synchronized Accessible Media Interchange (SAMI) file with crafted parameters for a Class Name variable, aka the "SAMI Format Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3597&w=2; http://secunia.com/advisories/30579; http://securityreason.com/securityalert/3937
CVE: CVE-2008-1445
Published: 2008-06-12
Description: Active Directory on Microsoft Windows 2000 Server SP4, XP Professional SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to cause a denial of service (system hang or reboot) via a crafted LDAP request.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30586; http://securitytracker.com/id?1020229; http://www.securityfocus.com/archive/1/493338/100/0/threaded
CVE: CVE-2008-1451
Published: 2008-06-12
Description: The WINS service on Microsoft Windows 2000 SP4, and Server 2003 SP1 and SP2, does not properly validate data structures in WINS network packets, which allows local users to gain privileges via a crafted packet, aka "Memory Overwrite Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30584; http://securitytracker.com/id?1020228; http://www.securityfocus.com/bid/29588
CVE: CVE-2008-1453
Published: 2008-06-12
Description: The Bluetooth stack in Microsoft Windows XP SP2 and SP3, and Vista Gold and SP1, allows physically proximate attackers to execute arbitrary code via a large series of Service Discovery Protocol (SDP) packets.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/30051; http://securitytracker.com/id?1020221; http://www.securityfocus.com/bid/29522
CVE: CVE-2008-2668
Published: 2008-06-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in yBlog 0.2.2.2 allow remote attackers to inject arbitrary web script or HTML via (1) the q parameter to search.php, or the n parameter to (2) user.php or (3) uss.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://chroot.org/exploits/chroot_uu_009; http://secunia.com/advisories/30607; http://securityreason.com/securityalert/3935
CVE: CVE-2008-2669
Published: 2008-06-12
Description: Multiple SQL injection vulnerabilities in yBlog 0.2.2.2 allow remote attackers to execute arbitrary SQL commands via (1) the q parameter to search.php, or the n parameter to (2) user.php or (3) uss.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://chroot.org/exploits/chroot_uu_009; http://secunia.com/advisories/30607; http://securityreason.com/securityalert/3935
CVE: CVE-2008-2670
Published: 2008-06-12
Description: Multiple SQL injection vulnerabilities in index.php in Insanely Simple Blog 0.5 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter, or (2) the term parameter in a search action. NOTE: the current_subsection parameter is already covered by CVE-2007-3889.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://chroot.org/exploits/chroot_uu_010; http://securityreason.com/securityalert/3938; http://www.securityfocus.com/archive/1/493224/100/0/threaded
CVE: CVE-2008-2671
Published: 2008-06-12
Description: SQL injection vulnerability in comments.php in DCFM Blog 0.9.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://chroot.org/exploits/chroot_uu_008; http://securityreason.com/securityalert/3939; http://www.securityfocus.com/archive/1/493220/100/0/threaded
CVE: CVE-2008-2672
Published: 2008-06-12
Description: Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) ewiki_id and (2) ewiki_action parameters to fragments/css.php, and possibly the (3) id parameter to the default URI.  NOTE: the default URI is site-specific but often performs an include_once of ewiki.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://chroot.org/exploits/chroot_uu_007; http://securityreason.com/securityalert/3936; http://www.securityfocus.com/archive/1/493219/100/0/threaded
CVE: CVE-2008-2673
Published: 2008-06-12
Description: SQL injection vulnerability in index.php in Powie pNews 2.08 and 2.10, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the shownews parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30577; http://www.securityfocus.com/bid/29617; https://exchange.xforce.ibmcloud.com/vulnerabilities/42951
CVE: CVE-2008-2674
Published: 2008-06-12
Description: Unspecified vulnerability in the Interstage Management Console, as used in Fujitsu Interstage Application Server 6.0 through 9.0.0A, Apworks Modelers-J 6.0 through 7.0, and Studio 8.0.1 and 9.0.0, allows remote attackers to read or delete arbitrary files via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/30589; http://www.fujitsu.com/global/support/software/security/products-f/interstage-200805e.html; http://www.securityfocus.com/bid/29624
CVE: CVE-2008-2675
Published: 2008-06-12
Description: Cross-site scripting (XSS) vulnerability in index.php in PHP Image Gallery allows remote attackers to inject arbitrary web script or HTML via the action parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30573; http://www.securityfocus.com/bid/29643; https://exchange.xforce.ibmcloud.com/vulnerabilities/42955
CVE: CVE-2008-2676
Published: 2008-06-12
Description: SQL injection vulnerability in the iJoomla News Portal (com_news_portal) component 1.0 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/42936; https://www.exploit-db.com/exploits/5761; https://exchange.xforce.ibmcloud.com/vulnerabilities/42936
CVE: CVE-2008-2677
Published: 2008-06-12
Description: Cross-site scripting (XSS) vulnerability in edit1.php in Telephone Directory 2008 allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29614; https://exchange.xforce.ibmcloud.com/vulnerabilities/42972; https://www.exploit-db.com/exploits/5764
CVE: CVE-2008-2678
Published: 2008-06-12
Description: Multiple SQL injection vulnerabilities in Telephone Directory 2008, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) code parameter in a confirm_data action to edit1.php and the (2) id parameter to view_more.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29614; https://exchange.xforce.ibmcloud.com/vulnerabilities/42971; https://www.exploit-db.com/exploits/5764
CVE: CVE-2008-2679
Published: 2008-06-12
Description: SQL injection vulnerability in the KeyWordsList function in _includes/inc_routines.asp in Realm CMS 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the kwrd parameter in a kwl action to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugreport.ir/index.php?/40; http://secunia.com/advisories/30583; http://www.securityfocus.com/bid/29616
CVE: CVE-2008-2680
Published: 2008-06-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in _db/compact.asp in Realm CMS 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) CmpctedDB and (2) Boyut parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugreport.ir/index.php?/40; http://secunia.com/advisories/30583; http://www.securityfocus.com/bid/29616