deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2389
Published: 2009-07-09
Description: Multiple SQL injection vulnerabilities in newsscript.php in USOLVED NEWSolved 1.1.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) jahr or (2) idneu parameter in an archive action, or (3) the newsid parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35611; http://www.exploit-db.com/exploits/9042; http://secunia.com/advisories/35611
CVE: CVE-2009-2390
Published: 2009-07-09
Description: SQL injection vulnerability in the BookFlip (com_bookflip) component 2.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35608; http://www.exploit-db.com/exploits/9040; http://www.securityfocus.com/bid/35519
CVE: CVE-2009-2391
Published: 2009-07-09
Description: Cross-site scripting (XSS) vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers to inject arbitrary web script or HTML via the tid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35591; http://www.exploit-db.com/exploits/9022; https://exchange.xforce.ibmcloud.com/vulnerabilities/51388
CVE: CVE-2009-2392
Published: 2009-07-09
Description: SQL injection vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers to execute arbitrary SQL commands via the tid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35591; http://www.exploit-db.com/exploits/9022; https://exchange.xforce.ibmcloud.com/vulnerabilities/51387
CVE: CVE-2009-2393
Published: 2009-07-09
Description: admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows remote authenticated users to have an unknown impact via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/35591; http://www.exploit-db.com/exploits/9022; https://exchange.xforce.ibmcloud.com/vulnerabilities/51386
CVE: CVE-2009-2394
Published: 2009-07-09
Description: SQL injection vulnerability in cat.php in SMSPages 1.0 in Mr.Saphp Arabic Script Mobile (aka Messages Library) 2.0 allows remote attackers to execute arbitrary SQL commands via the CatID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9027; http://www.exploit-db.com/exploits/9027
CVE: CVE-2009-2395
Published: 2009-07-09
Description: SQL injection vulnerability in the K2 (com_k2) component 1.0.1 Beta and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the category parameter in an itemlist action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9030; http://www.securityfocus.com/bid/35517; http://www.vupen.com/english/advisories/2009/1733
CVE: CVE-2009-2396
Published: 2009-07-09
Description: PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/35619; http://www.exploit-db.com/exploits/9043; http://www.securityfocus.com/bid/35521
CVE: CVE-2009-2397
Published: 2009-07-09
Description: Directory traversal vulnerability in download.php in Audio Article Directory allows remote attackers to read arbitrary files via directory traversal sequences in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/35609; http://www.exploit-db.com/exploits/9041; http://www.vupen.com/english/advisories/2009/1738
CVE: CVE-2009-2398
Published: 2009-07-09
Description: Directory traversal vulnerability in test/index.php in PHP-Sugar 0.80 allows remote attackers to read arbitrary files via a ..// (dot dot slash slash) in the t parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9036; http://www.vupen.com/english/advisories/2009/1735; http://www.exploit-db.com/exploits/9036
CVE: CVE-2009-2399
Published: 2009-07-09
Description: PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/35622; http://www.exploit-db.com/exploits/9044; http://secunia.com/advisories/35622
CVE: CVE-2009-2400
Published: 2009-07-09
Description: SQL injection vulnerability in the PHP (com_php) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9028; http://www.securityfocus.com/bid/35515; http://www.vupen.com/english/advisories/2009/1732
CVE: CVE-2009-2401
Published: 2009-07-09
Description: Cross-site scripting (XSS) vulnerability in PHPEcho CMS 2.0-rc3 allows remote attackers to inject arbitrary web script or HTML via a forum post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/9014; http://www.securityfocus.com/bid/35488; https://exchange.xforce.ibmcloud.com/vulnerabilities/51360
CVE: CVE-2009-2402
Published: 2009-07-09
Description: SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a thread action, a different vector than CVE-2008-0355.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9014; http://www.securityfocus.com/bid/35488; http://www.exploit-db.com/exploits/9014
CVE: CVE-2009-2403
Published: 2009-07-09
Description: Heap-based buffer overflow in SCMPX 1.5.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long string in a .m3u playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://secunia.com/advisories/35596; http://www.exploit-db.com/exploits/9033; http://www.vupen.com/english/advisories/2009/1729
CVE: CVE-2009-2419
Published: 2009-07-09
Description: Use-after-free vulnerability in the servePendingRequests function in WebCore in WebKit in Apple Safari 4.0 and 4.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted HTML document that references a zero-length .js file and the JavaScript reload function.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://marcell-dietl.de/index/adv_safari_4_x_js_reload_dos.php; http://secunia.com/advisories/33495
CVE: CVE-2009-2420
Published: 2009-07-09
Description: Apple Safari 3.2.3 does not properly implement the file: protocol handler, which allows remote attackers to read arbitrary files or cause a denial of service (launch of multiple Windows Explorer instances) via vectors involving an unspecified HTML tag, possibly a related issue to CVE-2009-1703.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/504480/100/0/threaded; http://www.securityfocus.com/bid/35482; http://www.securityfocus.com/archive/1/504480/100/0/threaded
CVE: CVE-2009-2421
Published: 2009-07-09
Description: The CFCharacterSetInitInlineBuffer method in CoreFoundation.dll in Apple Safari 3.2.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a "high-bit character" in a URL fragment for an unspecified protocol.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/504479/100/0/threaded; http://www.securityfocus.com/bid/35481; http://www.securityfocus.com/archive/1/504479/100/0/threaded
CVE: CVE-2009-0667
Published: 2009-07-09
Description: Untrusted search path vulnerability in Agent/Backend.pm in Ocsinventory-Agent before 0.0.9.3, and 1.x before 1.0.1, in OCS Inventory allows local users to gain privileges via a Trojan horse Perl module in an arbitrary directory.
CVSS Score: 7.2 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506416; http://nana.rulezlan.org/~goneri/ocsinventory-agent/Ocsinventory-Agent-0.0.9.3.tar.gz; http://osvdb.org/55718
CVE: CVE-2009-1724
Published: 2009-07-09
Description: Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2009/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2009-1725
Published: 2009-07-09
Description: WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Jul/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2009-1891
Published: 2009-07-10
Description: The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
CVSS Score: 7.1 (HIGH)
CWE: CWE-400
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712; http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html
CVE: CVE-2009-2386
Published: 2009-07-10
Description: Insecure method vulnerability in Awingsoft Awakening Winds3D Viewer plugin 3.5.0.0, 3.0.0.5, and possibly other versions allows remote attackers to force the download and execution of arbitrary files via the GetURL method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/35764; http://www.coresecurity.com/content/winds3d-viewer-advisory; http://www.securityfocus.com/bid/35595
CVE: CVE-2009-2422
Published: 2009-07-10
Description: The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s; http://secunia.com/advisories/35702
CVE: CVE-2009-2423
Published: 2009-07-10
Description: SQL injection vulnerability in category.php in Ebay Clone 2009 allows remote attackers to execute arbitrary SQL commands via the cate_id parameter in a list action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0907-exploits/ebayclone2009-sqlxss.txt; http://secunia.com/advisories/35713; http://packetstorm.linuxsecurity.com/0907-exploits/ebayclone2009-sqlxss.txt
CVE: CVE-2009-2424
Published: 2009-07-10
Description: Cross-site scripting (XSS) vulnerability in search.php in Ebay Clone 2009 allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0907-exploits/ebayclone2009-sqlxss.txt; http://secunia.com/advisories/35713; http://packetstorm.linuxsecurity.com/0907-exploits/ebayclone2009-sqlxss.txt
CVE: CVE-2009-2425
Published: 2009-07-10
Description: Tor before 0.2.0.35 allows remote attackers to cause a denial of service (application crash) via a malformed router descriptor.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.seul.org/or/announce/Jun-2009/msg00000.html; http://secunia.com/advisories/35546; http://www.osvdb.org/55340
CVE: CVE-2009-2426
Published: 2009-07-10
Description: The connection_edge_process_relay_cell_not_open function in src/or/relay.c in Tor 0.2.x before 0.2.0.35 and 0.1.x before 0.1.2.8-beta allows exit relays to have an unspecified impact by causing controllers to accept DNS responses that redirect to an internal IP address via unknown vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.seul.org/or/announce/Jun-2009/msg00000.html; http://secunia.com/advisories/35546; http://www.osvdb.org/55341
CVE: CVE-2009-2427
Published: 2009-07-10
Description: SQL injection vulnerability in co-profile.php in Jobbr 2.2.7 allows remote attackers to execute arbitrary SQL commands via the emp_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0907-exploits/jobbr-sql.txt; http://secunia.com/advisories/35722; http://packetstorm.linuxsecurity.com/0907-exploits/jobbr-sql.txt
CVE: CVE-2009-2428
Published: 2009-07-10
Description: Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL commands via the (1) userid parameter to suchauftraege_user.php and the (2) descr parameter to vote.php; and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0907-exploits/tausch-sql.txt; http://secunia.com/advisories/35725; http://www.vupen.com/english/advisories/2009/1823
CVE: CVE-2009-2429
Published: 2009-07-10
Description: SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in admin_backup.xml files and uses insecure permissions for these files, which allows local users to gain privileges.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0314.html; http://secunia.com/advisories/34390; https://exchange.xforce.ibmcloud.com/vulnerabilities/49338
CVE: CVE-2009-2430
Published: 2009-07-10
Description: Unspecified vulnerability in auditconfig in Sun Solaris 8, 9, 10, and OpenSolaris snv_01 through snv_58, when Solaris Auditing is enabled, allows local users with an RBAC execution profile for auditconfig to gain privileges via unknown attack vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/35580; http://sunsolve.sun.com/search/document.do?assetkey=1-26-262088-1; http://www.securityfocus.com/bid/35501
CVE: CVE-2009-2334
Published: 2009-07-10
Description: wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-287
References: http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked; http://securitytracker.com/id?1022528; http://wordpress.org/development/2009/07/wordpress-2-8-1/
CVE: CVE-2009-2335
Published: 2009-07-10
Description: WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.  NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked; http://securitytracker.com/id?1022528; http://www.exploit-db.com/exploits/9110
CVE: CVE-2009-2336
Published: 2009-07-10
Description: The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.  NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked; http://securitytracker.com/id?1022528; http://www.exploit-db.com/exploits/9110
CVE: CVE-2009-2431
Published: 2009-07-10
Description: WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked; http://securitytracker.com/id?1022528; http://www.osvdb.org/55716
CVE: CVE-2009-2432
Published: 2009-07-10
Description: WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked; http://securitytracker.com/id?1022528; http://www.osvdb.org/55717
CVE: CVE-2009-2433
Published: 2009-07-10
Description: Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a long URL in the first argument.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9100; http://www.securityfocus.com/bid/35620; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12829
CVE: CVE-2009-2434
Published: 2009-07-13
Description: Buffer overflow in the syscall implementation in IBM AIX 5.3 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/35754; http://securitytracker.com/id?1022530; http://www-01.ibm.com/support/docview.wss?uid=isg1IZ54713
CVE: CVE-2009-2435
Published: 2009-07-13
Description: The Sametime server in IBM Lotus Instant Messaging and Web Conferencing 6.5.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.securityfocus.com/bid/35614; http://www.senseofsecurity.com.au/advisories/SOS-09-004.pdf; http://www.securityfocus.com/bid/35614
CVE: CVE-2009-2436
Published: 2009-07-13
Description: SQL injection vulnerability in page.php in Online Dating Software MyPHPDating 1.0 allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/myphpdating10-sql.txt; http://secunia.com/advisories/32268; http://www.securityfocus.com/bid/35603
CVE: CVE-2009-2437
Published: 2009-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Rentventory 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka Login) and (2) password parameters in a login action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/rentventory-xss.txt; http://secunia.com/advisories/35749; http://www.vupen.com/english/advisories/2009/1835
CVE: CVE-2009-2438
Published: 2009-07-13
Description: Cross-site scripting (XSS) vulnerability in index.php in the search module in ClanSphere 2009.0 and 2009.0.2 allows remote attackers to inject arbitrary web script or HTML via the text parameter in a list action.  NOTE: this might overlap CVE-2008-1399.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/clansphere-xss.txt; http://secunia.com/advisories/35744; http://www.securityfocus.com/bid/35605
CVE: CVE-2009-2439
Published: 2009-07-13
Description: Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrary SQL commands via the (1) IndustryID parameter to category.php and the (2) SellerID parameter to supplier/view_contact_details.php.  NOTE: this is a product that was developed by a third party; it is not associated with alibaba.com or the Alibaba Group.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/alibabaclone-sql.txt; http://secunia.com/advisories/35741; http://www.vupen.com/english/advisories/2009/1838
CVE: CVE-2009-2440
Published: 2009-07-13
Description: Cross-site scripting (XSS) vulnerability in index.php in JNM Guestbook 3.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0907-exploits/jnm-xss.txt; http://secunia.com/advisories/35760; http://www.vupen.com/english/advisories/2009/1831
CVE: CVE-2009-2441
Published: 2009-07-13
Description: Cross-site scripting (XSS) vulnerability in ogp_show.php in Online Guestbook Pro 5.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35762; http://www.packetstormsecurity.com/0907-exploits/ogp51-xss.txt; http://www.vupen.com/english/advisories/2009/1830
CVE: CVE-2009-2442
Published: 2009-07-13
Description: Cross-site scripting (XSS) vulnerability in public/index.php in Linea21 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the search parameter in a resultats-recherche action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35745; http://www.packetstormsecurity.com/0907-exploits/linea-xss.txt; http://www.vupen.com/english/advisories/2009/1837
CVE: CVE-2009-2443
Published: 2009-07-13
Description: Siteframe 3.2.3, and other 3.2.x versions, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/55683; http://secunia.com/advisories/35761; http://www.packetstormsecurity.org/0907-exploits/siteframe-sqlphpinfo.txt
CVE: CVE-2009-2444
Published: 2009-07-13
Description: Directory traversal vulnerability in maillinglist/setup/step1.php.inc in ADbNewsSender before 1.5.6, and 2.0 before RC2, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path_to_lang parameter to setup/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://r00tsecurity.org/forums/index.php?showtopic=9460; http://secunia.com/advisories/35845; http://sourceforge.net/apps/mantisbt/adbnewssender/view.php?id=22