deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0614
Published: 2009-02-26
Description: Unspecified vulnerability in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6.0 MR4) and 7.0 before 7.0(2) (aka 7.0 MR1) allows remote attackers to bypass authentication and obtain administrative access via a crafted URL.
CVSS Score: 9.0 (HIGH)
CWE: CWE-287
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc86.shtml; http://www.securityfocus.com/bid/33901; https://exchange.xforce.ibmcloud.com/vulnerabilities/48888
CVE: CVE-2009-0615
Published: 2009-02-26
Description: Directory traversal vulnerability in Cisco Application Networking Manager (ANM) before 2.0 and Application Control Engine (ACE) Device Manager before A3(2.1) allows remote authenticated users to read or modify arbitrary files via unspecified vectors, related to "invalid directory permissions."
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml; http://www.securityfocus.com/bid/33903; http://www.securitytracker.com/id?1021770
CVE: CVE-2009-0616
Published: 2009-02-26
Description: Cisco Application Networking Manager (ANM) before 2.0 uses default usernames and passwords, which makes it easier for remote attackers to access the application, or cause a denial of service via configuration changes, related to "default user credentials during installation."
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml; http://www.securityfocus.com/bid/33903; http://www.securitytracker.com/id?1021771
CVE: CVE-2009-0617
Published: 2009-02-26
Description: Cisco Application Networking Manager (ANM) before 2.0 uses a default MySQL root password, which makes it easier for remote attackers to execute arbitrary operating-system commands or change system files.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml; http://www.securityfocus.com/bid/33903; http://www.securitytracker.com/id?1021771
CVE: CVE-2009-0618
Published: 2009-02-26
Description: Unspecified vulnerability in the Java agent in Cisco Application Networking Manager (ANM) before 2.0 Update A allows remote attackers to gain privileges, and cause a denial of service (service outage) by stopping processes, or obtain sensitive information by reading configuration files.
CVSS Score: 8.5 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml; http://www.securityfocus.com/bid/33903; http://www.securitytracker.com/id?1021772
CVE: CVE-2009-0620
Published: 2009-02-26
Description: Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.1) uses default (1) usernames and (2) passwords for (a) the administrator and (b) web management, which makes it easier for remote attackers to perform configuration changes or obtain operating-system access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml; http://www.securityfocus.com/bid/33900; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml
CVE: CVE-2009-0621
Published: 2009-02-26
Description: Cisco ACE 4710 Application Control Engine Appliance before A1(8a) uses default (1) usernames and (2) passwords for (a) the administrator, (b) web management, and (c) device management, which makes it easier for remote attackers to perform configuration changes to the Device Manager and other components, or obtain operating-system access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml; http://www.securityfocus.com/bid/33900; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml
CVE: CVE-2009-0622
Published: 2009-02-26
Description: Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8a) allows remote authenticated users to execute arbitrary operating-system commands through a command line interface (CLI).
CVSS Score: 9.0 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml; http://www.securityfocus.com/bid/33900; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml
CVE: CVE-2009-0623
Published: 2009-02-26
Description: Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SSH packet.
CVSS Score: 7.8 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml; http://www.securityfocus.com/bid/33900; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml
CVE: CVE-2009-0624
Published: 2009-02-26
Description: Unspecified vulnerability in the SNMPv2c implementation in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv1 packet.
CVSS Score: 6.8 (MEDIUM)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml; http://www.securityfocus.com/bid/33900; http://www.securitytracker.com/id?1021769
CVE: CVE-2009-0625
Published: 2009-02-26
Description: Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8.0) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv3 packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml; http://www.securityfocus.com/bid/33900; http://www.securitytracker.com/id?1021769
CVE: CVE-2009-0742
Published: 2009-02-26
Description: The username command in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers and Cisco ACE 4710 Application Control Engine Appliance stores a cleartext password by default, which allows context-dependent attackers to obtain sensitive information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml; http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml
CVE: CVE-2008-4308
Published: 2009-02-26
Description: The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN66905322/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000010.html; http://secunia.com/advisories/34057
CVE: CVE-2008-6302
Published: 2009-02-26
Description: TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a direct request to Site_Admin/admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32591; http://www.vupen.com/english/advisories/2008/3142; https://exchange.xforce.ibmcloud.com/vulnerabilities/46589
CVE: CVE-2008-6303
Published: 2009-02-26
Description: SQL injection vulnerability in tourview.php in ToursManager allows remote attackers to execute arbitrary SQL commands via the tourid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32503; http://www.securityfocus.com/bid/32397; https://exchange.xforce.ibmcloud.com/vulnerabilities/46765
CVE: CVE-2008-6304
Published: 2009-02-26
Description: SQL injection vulnerability in xt:Commerce before 3.0.4 Sp2.1, when magic_quotes_gpc is enabled and the SEO URLs are activated, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32830; http://www.securityfocus.com/bid/32398; http://www.xt-commerce.com/blog/xtcommerce-news/sicherheitspatch-fuer-version-304-sp21.html
CVE: CVE-2008-6305
Published: 2009-02-26
Description: PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the API_HOME_DIR parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/49923; http://secunia.com/advisories/32745; https://exchange.xforce.ibmcloud.com/vulnerabilities/46699
CVE: CVE-2008-6306
Published: 2009-02-26
Description: Cross-site scripting (XSS) vulnerability in signinform.php in Softbiz Classifieds Script allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32828; http://www.securityfocus.com/bid/32375; https://exchange.xforce.ibmcloud.com/vulnerabilities/46743
CVE: CVE-2008-6307
Published: 2009-02-26
Description: E-topbiz Link Back Checker 1 allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "admin."
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/49924; http://secunia.com/advisories/32659; http://www.securityfocus.com/bid/32354
CVE: CVE-2009-0208
Published: 2009-02-26
Description: Unspecified vulnerability in HP Virtual Rooms Client before 7.0.1, when running on Windows, allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2181&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2181&w=2
CVE: CVE-2008-6308
Published: 2009-02-27
Description: Multiple directory traversal vulnerabilities in Private Messaging System (PMS) 1.2.3 and earlier for PunBB allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the pun_user[language] parameter to (1) functions_navlinks.php, (2) header_new_messages.php, (3) profile_send.php, and (4) viewtopic_PM-link.php in include/pms/.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/13201; http://www.securityfocus.com/bid/32360; http://www.vupen.com/english/advisories/2008/3214
CVE: CVE-2008-6309
Published: 2009-02-27
Description: SQL injection vulnerability in index.php in W3matter AskPert allows remote attackers to execute arbitrary SQL commands via the f[password] parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32783; http://www.securityfocus.com/bid/32368; http://www.vupen.com/english/advisories/2008/3217
CVE: CVE-2008-6310
Published: 2009-02-27
Description: SQL injection vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to execute arbitrary SQL commands via the f[password] parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32783; http://www.securityfocus.com/bid/32365; http://www.vupen.com/english/advisories/2008/3217
CVE: CVE-2008-6311
Published: 2009-02-27
Description: SQL injection vulnerability in view.php in Butterfly Organizer 2.0.1 allows remote attackers to execute arbitrary SQL commands via the mytable parameter.  NOTE: the id vector is covered by another CVE name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33086; https://exchange.xforce.ibmcloud.com/vulnerabilities/49012; https://www.exploit-db.com/exploits/7411
CVE: CVE-2008-6312
Published: 2009-02-27
Description: SQL injection vulnerability in index.php in ProQuiz 1.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32724; https://exchange.xforce.ibmcloud.com/vulnerabilities/47196; https://www.exploit-db.com/exploits/7397
CVE: CVE-2008-6313
Published: 2009-02-27
Description: Directory traversal vulnerability in addedit-render.php in phpAddEdit 1.3, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a URL in the editform parameter.  NOTE: PHP remote file inclusion attacks are also likely.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33027; http://www.securityfocus.com/bid/32774; https://exchange.xforce.ibmcloud.com/vulnerabilities/47262
CVE: CVE-2008-6314
Published: 2009-02-27
Description: SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50600; http://secunia.com/advisories/33031; http://www.securityfocus.com/bid/32701
CVE: CVE-2008-6315
Published: 2009-02-27
Description: PHP remote file inclusion vulnerability in _conf/core/common-tpl-vars.php in PHPmyGallery 1.0 beta2 allows remote attackers to execute arbitrary PHP code via a URL in the confdir parameter, a different issue than CVE-2008-6316.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/32705; https://www.exploit-db.com/exploits/7392; http://www.securityfocus.com/bid/32705
CVE: CVE-2008-6316
Published: 2009-02-27
Description: Directory traversal vulnerability in _conf/core/common-tpl-vars.php in PHPmyGallery 1.0 beta2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter, a different issue than CVE-2008-6316 and a different vector than CVE-2008-6318.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/32705; https://exchange.xforce.ibmcloud.com/vulnerabilities/47171; https://www.exploit-db.com/exploits/7392
CVE: CVE-2008-6317
Published: 2009-02-27
Description: Directory traversal vulnerability in _conf/_php-core/common-tpl-vars.php in PHPmyGallery 1.5 beta allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conf[lang] parameter, a different issue than CVE-2008-6318.  NOTE: this might be the same issue as CVE-2008-6316.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/32723; https://exchange.xforce.ibmcloud.com/vulnerabilities/47171; https://www.exploit-db.com/exploits/7399
CVE: CVE-2008-6318
Published: 2009-02-27
Description: PHP remote file inclusion vulnerability in _conf/_php-core/common-tpl-vars.php in PHPmyGallery 1.5 beta allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter, a different vector than CVE-2008-6317.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/32723; https://www.exploit-db.com/exploits/7399; http://www.securityfocus.com/bid/32723
CVE: CVE-2008-6319
Published: 2009-02-27
Description: SQL injection vulnerability in calendarevent.cfm in CF_Calendar allows remote attackers to execute arbitrary SQL commands via the calid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33074; http://www.securityfocus.com/bid/32766; https://www.exploit-db.com/exploits/7413
CVE: CVE-2008-6320
Published: 2009-02-27
Description: SQL injection vulnerability in index.cfm in CF Shopkart 5.2.2 allows remote attackers to execute arbitrary SQL commands via the Category parameter in a ViewCategory action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33080; http://www.securityfocus.com/bid/32765; https://www.exploit-db.com/exploits/7412
CVE: CVE-2008-6321
Published: 2009-02-27
Description: CF Shopkart 5.2.2 stores cfshopkart52.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive information, such as usernames and passwords, via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33080; https://www.exploit-db.com/exploits/7412; http://secunia.com/advisories/33080
CVE: CVE-2008-6322
Published: 2009-02-27
Description: SQL injection vulnerability in index.cfm in CFMSource CFMBlog allows remote attackers to execute arbitrary SQL commands via the categorynbr parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33070; http://www.securityfocus.com/bid/32768; https://www.exploit-db.com/exploits/7415
CVE: CVE-2008-6323
Published: 2009-02-27
Description: SQL injection vulnerability in forummessages.cfm in CFMSource CF_Auction allows remote attackers to execute arbitrary SQL commands via the categorynbr parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32767; https://www.exploit-db.com/exploits/7414; http://www.securityfocus.com/bid/32767
CVE: CVE-2008-6324
Published: 2009-02-27
Description: SQL injection vulnerability in forummessages.cfm in CF_Forum allows remote attackers to execute arbitrary SQL commands via the categorynbr parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33064; http://www.securityfocus.com/bid/32767; https://www.exploit-db.com/exploits/7416
CVE: CVE-2008-6325
Published: 2009-02-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbitrary web script or HTML via the (1) radio parameter to showcategory.php, (2) msg parameter to advertisers/signinform.php, (3) radio parameter to gallery.php, (4) msg parameter to lostpassword.php, (5) radio parameter to showcategory.php, (6) msg parameter to admin/adminhome.php, and (7) msg parameter to admin/index.php.  NOTE: a different signinform.php file is already covered by CVE-2008-6306.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0812-exploits/classifieds-xss.txt; http://secunia.com/advisories/32828; http://www.securityfocus.com/bid/32569
CVE: CVE-2008-6326
Published: 2009-02-27
Description: SQL injection vulnerability in login.php in Simple Customer as downloaded on 20081118 allows remote attackers to execute arbitrary SQL commands via the email parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32727; http://www.osvdb.org/49916; https://exchange.xforce.ibmcloud.com/vulnerabilities/46675
CVE: CVE-2008-6327
Published: 2009-02-27
Description: SQL injection vulnerability in index.php in ProQuiz 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter, a different vector than CVE-2008-6312.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/47196; https://exchange.xforce.ibmcloud.com/vulnerabilities/49020; https://www.exploit-db.com/exploits/7397
CVE: CVE-2008-6328
Published: 2009-02-27
Description: SQL injection vulnerability in view.php in Butterfly Organizer 2.0.0 and 2.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33086; http://www.securityfocus.com/bid/29700; https://www.exploit-db.com/exploits/5797
CVE: CVE-2008-6329
Published: 2009-02-27
Description: SQL injection vulnerability in Employee/login.asp in Pre ASP Job Board allows remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password parameters, as reachable from Employee/emp_login.asp.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32785; http://www.securityfocus.com/bid/32366; http://www.vupen.com/english/advisories/2008/3218
CVE: CVE-2008-6330
Published: 2009-02-27
Description: SQL injection vulnerability in index.php in MyTopix 1.3.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the send parameter in a notes action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32788; http://www.securityfocus.com/bid/32362; http://www.vupen.com/english/advisories/2008/3215
CVE: CVE-2008-6331
Published: 2009-02-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Streber before 0.08093 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/49893; http://secunia.com/advisories/32739; http://sourceforge.net/project/shownotes.php?group_id=145255&release_id=640914
CVE: CVE-2008-6332
Published: 2009-02-27
Description: SQL injection vulnerability in login.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL commands via the password parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49916; http://secunia.com/advisories/32727; http://www.securityfocus.com/bid/32339
CVE: CVE-2008-6333
Published: 2009-02-27
Description: SQL injection vulnerability in news.php in RSS Simple News (RSSSN), when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32962; https://www.exploit-db.com/exploits/7541; http://www.securityfocus.com/bid/32962
CVE: CVE-2008-6334
Published: 2009-02-27
Description: Directory traversal vulnerability in download.php in eMetrix Extract Website allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/33255; http://www.securityfocus.com/bid/32936; https://exchange.xforce.ibmcloud.com/vulnerabilities/47517
CVE: CVE-2008-6335
Published: 2009-02-27
Description: Directory traversal vulnerability in download.php in eMetrix Online Keyword Research Tool allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/33255; http://www.securityfocus.com/bid/32932; https://exchange.xforce.ibmcloud.com/vulnerabilities/47516
CVE: CVE-2008-6336
Published: 2009-02-27
Description: Directory traversal vulnerability in download.php in Text Lines Rearrange Script 1.0, when register_globals is enabled, allows remote attackers to read arbitrary local files via directory traversal sequences in the filename parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33276; http://www.securityfocus.com/bid/32968; https://www.exploit-db.com/exploits/7542
CVE: CVE-2008-6337
Published: 2009-02-27
Description: SQL injection vulnerability in the Volunteer Management System (com_volunteer) module 2.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the job_id parameter in a jobshow action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33271; http://www.securityfocus.com/bid/32973; https://www.exploit-db.com/exploits/7546
CVE: CVE-2008-6338
Published: 2009-02-27
Description: SQL injection vulnerability in the WEBERkommunal Facilities (wes_facilities) extension 2.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33302; http://typo3.org/extensions/repository/view/wes_facilities/2.0.1/; http://typo3.org/teams/security/security-bulletins/typo3-20081222-4/