deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6614
Published: 2009-04-06
Description: Multiple SQL injection vulnerabilities in microcms-admin-login.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) allow remote attackers to execute arbitrary SQL commands via (1) the administrators_username parameter (aka the Username field) or (2) the administrators_pass parameter (aka the Password field).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0344.html; http://osvdb.org/51298; http://wired-security.net/texts/advisories/IBD_Micro_CMS_3.5_SQL_Injection_Login_Bypass_Advisory.txt
CVE: CVE-2008-6615
Published: 2009-04-06
Description: SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the advanced_search_result page.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://downloads.securityfocus.com/vulnerabilities/exploits/29020.html; http://www.securityfocus.com/bid/29020; https://exchange.xforce.ibmcloud.com/vulnerabilities/42161
CVE: CVE-2008-6616
Published: 2009-04-06
Description: Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/29020.html; http://www.securityfocus.com/bid/29020; https://exchange.xforce.ibmcloud.com/vulnerabilities/42162
CVE: CVE-2008-6617
Published: 2009-04-06
Description: Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/491578/100/0/threaded; http://www.securityfocus.com/bid/29029; https://exchange.xforce.ibmcloud.com/vulnerabilities/42250
CVE: CVE-2008-6618
Published: 2009-04-06
Description: Multiple SQL injection vulnerabilities in ClassSystem 2.3 allow remote attackers to execute arbitrary SQL commands via the teacher_id parameter in (1) class/HomepageMain.php and (2) class/HomepageTop.php, and (3) the message_id parameter in class/MessageReply.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45639; http://osvdb.org/45640; http://osvdb.org/45641
CVE: CVE-2008-6619
Published: 2009-04-06
Description: Unrestricted file upload vulnerability in class/ApplyDB.php in ClassSystem 2.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in class/UploadHomepage/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30365; http://www.chroot.org/exploits/chroot_uu_005; http://www.securityfocus.com/archive/1/492583/100/0/threaded
CVE: CVE-2008-6620
Published: 2009-04-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php in GraFX miniCWB 2.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) errcontext, (2) _GET, (3) _POST, (4) _SESSION, (5) _SERVER, and (6) fckphp_config[Debug_SERVER] parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9047&w=2; http://osvdb.org/45647; http://secunia.com/advisories/30390
CVE: CVE-2008-6621
Published: 2009-04-06
Description: Unspecified vulnerability in GraphicsMagick before 1.2.3 allows remote attackers to cause a denial of service (crash) via unspecified vectors in DPX images.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.8 (HIGH)
References: http://cvs.graphicsmagick.org/cgi-bin/cvsweb.cgi/GraphicsMagick/coders/dpx.c; http://osvdb.org/46258; http://secunia.com/advisories/30549
CVE: CVE-2008-6622
Published: 2009-04-06
Description: SQL injection vulnerability in choosecard.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02, 1.01, and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49823; http://secunia.com/advisories/32494; http://www.securityfocus.com/bid/32097
CVE: CVE-2008-6623
Published: 2009-04-06
Description: SQL injection vulnerability in getin.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49824; http://secunia.com/advisories/32494; http://www.securityfocus.com/bid/32108
CVE: CVE-2008-6624
Published: 2009-04-06
Description: SQL injection vulnerability in getin.php in WEBBDOMAIN Petition 1.02, 2.0, and 3.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49759; http://www.securityfocus.com/bid/32108; https://exchange.xforce.ibmcloud.com/vulnerabilities/46362
CVE: CVE-2008-6625
Published: 2009-04-06
Description: SQL injection vulnerability in getin.php in WEBBDOMAIN Polls (aka Poll) 1.0 and 1.01 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49760; http://secunia.com/advisories/32508; http://www.securityfocus.com/bid/32108
CVE: CVE-2008-6626
Published: 2009-04-06
Description: SQL injection vulnerability in getin.php in WEBBDOMAIN Quiz 1.02 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49761; http://secunia.com/advisories/32508; http://www.securityfocus.com/bid/32108
CVE: CVE-2008-6627
Published: 2009-04-06
Description: SQL injection vulnerability in getin.php in WEBBDOMAIN WebShop 1.2, 1.1, 1.02, and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49720; http://secunia.com/advisories/32499; http://www.securityfocus.com/bid/32108
CVE: CVE-2008-6628
Published: 2009-04-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-6268.  Reason: This candidate is a duplicate of CVE-2008-6268.  Notes: All CVE users should reference CVE-2008-6268 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-6629
Published: 2009-04-06
Description: Cross-site scripting (XSS) vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/49719; http://secunia.com/advisories/32499; https://www.exploit-db.com/exploits/6974
CVE: CVE-2008-6630
Published: 2009-04-07
Description: Directory traversal vulnerability in the wt_gallery extension 2.5.0 and earlier for TYPO3 allows remote attackers to read arbitrary image files and determine directory structure via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://osvdb.org/45050; http://secunia.com/advisories/30217; http://typo3.org/teams/security/security-bulletins/typo3-20080513-1/
CVE: CVE-2008-6631
Published: 2009-04-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) user parameter in a sendmessage action and the (2) username parameter when registering a new user, different vectors than CVE-2008-0679.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/45038; http://secunia.com/advisories/30165; http://www.davidsopas.com/soapbox/blogphp.txt
CVE: CVE-2008-6632
Published: 2009-04-07
Description: SQL injection vulnerability in func/login.php in MercuryBoard 1.1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header ($_SERVER['HTTP_USER_AGENT']).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29280; https://exchange.xforce.ibmcloud.com/vulnerabilities/42519; https://www.exploit-db.com/exploits/5653
CVE: CVE-2008-6633
Published: 2009-04-07
Description: SQL injection vulnerability in RoomPHPlanning 1.5 allows remote attackers to execute arbitrary SQL commands via the idresa parameter to resaopen.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45604; http://secunia.com/advisories/30376; http://www.securityfocus.com/bid/29354
CVE: CVE-2008-6634
Published: 2009-04-07
Description: SQL injection vulnerability in RoomPHPlanning 1.5 allows remote attackers to execute arbitrary SQL commands via the idroom parameter to weekview.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30376; http://www.securityfocus.com/bid/29380; https://exchange.xforce.ibmcloud.com/vulnerabilities/42626
CVE: CVE-2008-6635
Published: 2009-04-07
Description: PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir_inc parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/30771; http://sourceforge.net/project/shownotes.php?group_id=79973&release_id=668019; http://www.securityfocus.com/bid/29906
CVE: CVE-2008-6636
Published: 2009-04-07
Description: PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir_edge_skins parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/30771; http://sourceforge.net/project/shownotes.php?group_id=79973&release_id=668019; https://www.exploit-db.com/exploits/5916
CVE: CVE-2008-6637
Published: 2009-04-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in forgotPW.php in Library Video Company SAFARI Montage 3.1.x allow remote attackers to inject arbitrary web script or HTML via the (1) school and (2) email parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/45646; http://secunia.com/advisories/30363; http://www.digitrustgroup.com/advisories/web-application-security-safari-montage.html
CVE: CVE-2008-6638
Published: 2009-04-07
Description: Insecure method vulnerability in the Versalsoft HTTP Image Uploader ActiveX control (UUploaderSvrD.dll 6.0.0.35) allows remote attackers to delete arbitrary files via the RemoveFileOrDir method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-16
References: http://www.securityfocus.com/bid/28301; https://exchange.xforce.ibmcloud.com/vulnerabilities/41258; https://www.exploit-db.com/exploits/5272
CVE: CVE-2008-6639
Published: 2009-04-07
Description: Cross-site request forgery (CSRF) vulnerability in admin.php in AjaXplorer 2.3.3 and 2.3.4 allows remote attackers to hijack the authentication of administrators for requests that modify passwords via the update_user_pwd action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://gmda.altervista.org/AjaXplorer-2.3.3/cka.txt; http://secunia.com/advisories/30383; http://www.osvdb.org/45656
CVE: CVE-2008-6640
Published: 2009-04-07
Description: Multiple SQL injection vulnerabilities in BatmanPorTaL allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) uyeadmin.asp and (2) profil.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29057; http://www.securityfocus.com/bid/29057/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/42231
CVE: CVE-2008-6641
Published: 2009-04-07
Description: Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrary SQL commands via the sid parameter to (1) kanal.asp, (2) google.asp, and (3) hakk.asp in yonet/; and allow remote attackers to execute arbitrary SQL commands via the (4) username or (5) password fields to yonet/default.asp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29091; https://exchange.xforce.ibmcloud.com/vulnerabilities/42261; https://www.exploit-db.com/exploits/5564
CVE: CVE-2008-6642
Published: 2009-04-07
Description: SQL injection vulnerability in view.php in DotContent FluentCMS 4.x allows remote attackers to execute arbitrary SQL commands via the sid parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/44831; http://secunia.com/advisories/29970; http://www.securityfocus.com/bid/28965
CVE: CVE-2008-6643
Published: 2009-04-07
Description: LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows remote attackers to bypass intended restrictions and modify configuration settings via the LokiACTION parameter in a direct request to admin.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/45866; http://www.securityfocus.com/archive/1/492877/100/0/threaded; http://www.securityfocus.com/bid/29448
CVE: CVE-2008-6644
Published: 2009-04-07
Description: Cross-site scripting (XSS) vulnerability in Default.aspx in DotNetNuke 4.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30617; http://www.dotnetnuke.com/News/SecurityPolicy/SecurityBulletinno19/tabid/1166/Default.aspx; http://www.securityfocus.com/archive/1/492793/100/0/threaded
CVE: CVE-2008-6645
Published: 2009-04-07
Description: Cross-site scripting (XSS) vulnerability in Opencosmo VisualSentinel 0.7 allows remote attackers to inject arbitrary web script or HTML via the User-Agent header ($_SERVER ['HTTP_USER_AGENT']), which is not properly handled when displaying log files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51439; http://www.securityfocus.com/archive/1/492876/100/0/threaded; http://www.securityfocus.com/archive/1/492879/100/0/threaded
CVE: CVE-2008-6646
Published: 2009-04-07
Description: Cross-site scripting (XSS) vulnerability in index.php in CoronaMatrix phpAddressBook 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/491525/100/0/threaded; http://www.securityfocus.com/bid/29005; https://exchange.xforce.ibmcloud.com/vulnerabilities/42140
CVE: CVE-2008-6647
Published: 2009-04-07
Description: SQL injection vulnerability in gallery.php in Ktools PhotoStore 3.4.3 allows remote attackers to execute arbitrary SQL commands via the gid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45140; http://secunia.com/advisories/30194; http://www.securityfocus.com/bid/29132
CVE: CVE-2008-6648
Published: 2009-04-07
Description: SQL injection vulnerability in crumbs.php in Ktools PhotoStore 3.4.3 and 3.5.2 allows remote attackers to execute arbitrary SQL commands via the gid parameter to about_us.php.  NOTE: this might be the same issue as CVE-2008-6647.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45141; http://secunia.com/advisories/30194; http://www.securityfocus.com/bid/29136
CVE: CVE-2008-6649
Published: 2009-04-07
Description: SQL injection vulnerability in manager/image_details_editor.php in Ktools PhotoStore 2.5, 2.9.8, 3.1.0, and other versions through 3.5.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45142; http://secunia.com/advisories/30194; http://www.securityfocus.com/bid/29136
CVE: CVE-2008-6650
Published: 2009-04-07
Description: del.php in miniBloggie 1.0 allows remote attackers to delete arbitrary posts via a direct request with a modified post_id parameter, a different vulnerability than CVE-2008-4628.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/29115; https://exchange.xforce.ibmcloud.com/vulnerabilities/42300; https://www.exploit-db.com/exploits/5568
CVE: CVE-2008-6651
Published: 2009-04-07
Description: Static code injection vulnerability in edithistory.php in OxYProject OxYBox 0.85 allows remote attackers to inject arbitrary PHP code into oxyhistory.php via the oxymsg parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28992; https://exchange.xforce.ibmcloud.com/vulnerabilities/42110; https://www.exploit-db.com/exploits/5524
CVE: CVE-2008-6652
Published: 2009-04-07
Description: SQL injection vulnerability in asd.php in OneCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the sitename parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29102; https://exchange.xforce.ibmcloud.com/vulnerabilities/42255; https://www.exploit-db.com/exploits/5557
CVE: CVE-2008-6653
Published: 2009-04-07
Description: SQL injection vulnerability in webhosting.php in the Webhosting Component (com_webhosting) module before 1.1 RC7 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forum.wh-com.de/index.php?topic=497.0; http://osvdb.org/50423; http://www.securityfocus.com/bid/29000
CVE: CVE-2008-6654
Published: 2009-04-07
Description: Cross-site scripting (XSS) vulnerability in search_results.php in InfoBiz Server allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/63/45/; http://secunia.com/advisories/30120; http://www.osvdb.org/44876
CVE: CVE-2008-6655
Published: 2009-04-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in GEDCOM_TO_MYSQL 2 allow remote attackers to inject arbitrary web script or HTML via the (1) nom_branche and (2) nom parameters to php/prenom.php; the (3) nom_branche parameter to php/index.php; and the (4) nom_branche, (5) nom, and (6) prenom parameters to php/info.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29048; http://www.securityfocus.com/bid/29048/exploit; http://www.z0rlu.ownspace.org/index.php?/archives/75-GEDCOM_to_MySQL2-XSS.html
CVE: CVE-2008-6656
Published: 2009-04-07
Description: Multiple SQL injection vulnerabilities in Open Auto Classifieds 1.4.3b allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to listings.php and (2) the username field to login.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://freshmeat.net/projects/openauto/releases/277061; http://osvdb.org/50255; http://osvdb.org/50256
CVE: CVE-2008-6657
Published: 2009-04-07
Description: Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/50071; http://secunia.com/advisories/32516; http://www.securityfocus.com/bid/32119
CVE: CVE-2008-6658
Published: 2009-04-07
Description: Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. (dot dot) in the package parameter during an install2 action, as demonstrated by a predictable package filename in attachments/ that was uploaded through a post2 action to index.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/50070; http://www.simplemachines.org/community/index.php?topic=272861.0; https://www.exploit-db.com/exploits/6993
CVE: CVE-2008-6659
Published: 2009-04-07
Description: Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated users to configure arbitrary local files for execution via directory traversal sequences in the value of the theme_dir field during a jsoption action, related to Sources/QueryString.php and Sources/Themes.php, as demonstrated by a local .gif file in attachments/ with PHP code that was uploaded through a profile2 action to index.php.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/50072; http://secunia.com/advisories/32516; http://www.securityfocus.com/bid/32139
CVE: CVE-2008-6660
Published: 2009-04-07
Description: Unrestricted file upload vulnerability in bigdump.php in Alexey Ozerov BigDump 0.29b allows remote attackers to execute arbitrary code by uploading a file with an executable extension followed by a .sql extension, then accessing this file via a direct request.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/498093/100/0/threaded; http://www.securityfocus.com/bid/32152; https://exchange.xforce.ibmcloud.com/vulnerabilities/46539
CVE: CVE-2008-6661
Published: 2009-04-07
Description: Multiple integer overflows in the scanning engine in Bitdefender for Linux 7.60825 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed (1) NeoLite and (2) ASProtect packed PE file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2987&w=2; http://secunia.com/advisories/33240; http://www.ivizsecurity.com/security-advisory-iviz-sr-08012.html
CVE: CVE-2008-6662
Published: 2009-04-07
Description: AVG Anti-Virus for Linux 7.5.51, and possibly earlier, allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via a malformed UPX compressed file, which triggers memory corruption.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5523&w=2; http://www.ivizsecurity.com/security-advisory-iviz-sr-08014.html; http://www.osvdb.org/51962
CVE: CVE-2009-0796
Published: 2009-04-07
Description: Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://secunia.com/advisories/34597; http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021508.1-1
CVE: CVE-2009-1256
Published: 2009-04-07
Description: SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/34394; https://exchange.xforce.ibmcloud.com/vulnerabilities/49680; https://www.exploit-db.com/exploits/8355
CVE: CVE-2009-1257
Published: 2009-04-07
Description: Heap-based buffer overflow in Magic ISO Maker 5.5 build 0274 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted CCD file.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/53262; http://secunia.com/advisories/34595; http://www.securityfocus.com/bid/34574