deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0279
Published: 2009-01-27
Description: SQL injection vulnerability in comentar.php in Pardal CMS 0.2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33404; https://exchange.xforce.ibmcloud.com/vulnerabilities/48175; https://www.exploit-db.com/exploits/7851
CVE: CVE-2009-0280
Published: 2009-01-27
Description: Asp Project Management 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the crypt cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/archive/1/500292/100/0/threaded; http://www.securityfocus.com/bid/33401; https://exchange.xforce.ibmcloud.com/vulnerabilities/48172
CVE: CVE-2009-0281
Published: 2009-01-27
Description: SQL injection vulnerability in login.aspx in WarHound Walking Club allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33317; https://exchange.xforce.ibmcloud.com/vulnerabilities/48061; https://www.exploit-db.com/exploits/7802
CVE: CVE-2009-0282
Published: 2009-01-27
Description: Integer overflow in Ralink Technology USB wireless adapter (RT73) 3.08 for Windows, and other wireless card drivers including rt2400, rt2500, rt2570, and rt61, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Probe Request packet with a long SSID, possibly related to an integer signedness error.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512995; http://secunia.com/advisories/33592; http://secunia.com/advisories/33699
CVE: CVE-2009-0283
Published: 2009-01-27
Description: Cross-site scripting (XSS) vulnerability in err.asp in Oblog allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/500349/100/0/threaded; http://www.securityfocus.com/archive/1/500397/100/0/threaded; http://www.securityfocus.com/bid/33416
CVE: CVE-2009-0284
Published: 2009-01-27
Description: SQL injection vulnerability in category.php in Flax Article Manager 1.1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33625; http://www.flaxweb.com/products/articles; http://www.securityfocus.com/bid/33422
CVE: CVE-2009-0285
Published: 2009-01-27
Description: Cross-site scripting (XSS) vulnerability in error.asp in BBSXP 5.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/500336/100/0/threaded; http://www.securityfocus.com/bid/33411; https://exchange.xforce.ibmcloud.com/vulnerabilities/48187
CVE: CVE-2009-0286
Published: 2009-01-27
Description: Directory traversal vulnerability in upgrade/index.php in OpenGoo 1.1, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the form_data[script_class] parameter.
CVSS Score: 2.6 (LOW)
CWE: CWE-22
References: http://osvdb.org/51635; http://www.securityfocus.com/bid/33421; https://www.exploit-db.com/exploits/7863
CVE: CVE-2009-0287
Published: 2009-01-27
Description: SQL injection vulnerability in lib/patUser.php in KEEP Toolkit before 2.5.1 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://keeptoolkit.svn.sourceforge.net/viewvc/keeptoolkit?view=rev&revision=56; http://osvdb.org/51623; http://secunia.com/advisories/33652
CVE: CVE-2009-0288
Published: 2009-01-27
Description: Directory traversal vulnerability in k23productions TFTPUtil GUI 1.2.0 and 1.3.0 allows remote attackers to read arbitrary files outside the TFTP root directory via directory traversal sequences in a GET request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33561; http://sourceforge.net/forum/forum.php?forum_id=894598; http://www.princeofnigeria.org/blogs/index.php/2009/01/14/tftputil-gui-tftp-directory-traversal
CVE: CVE-2009-0289
Published: 2009-01-27
Description: k23productions TFTPUtil GUI 1.2.0 and 1.3.0 allows remote attackers to cause a denial of service (service crash) via a long filename in a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://sourceforge.net/forum/forum.php?forum_id=894598; http://www.princeofnigeria.org/blogs/index.php/2009/01/14/tftputil-gui-tftp-server-denial-of-servi?blog=1; http://www.securityfocus.com/archive/1/500107/100/0/threaded
CVE: CVE-2009-0290
Published: 2009-01-27
Description: Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the g4_path parameter.  NOTE: in some environments, this can be leveraged for remote code execution via a data: URI or a UNC share pathname.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33564; http://www.securityfocus.com/bid/33304; https://exchange.xforce.ibmcloud.com/vulnerabilities/48015
CVE: CVE-2009-0032
Published: 2009-01-27
Description: CUPS on Mandriva Linux 2008.0, 2008.1, 2009.0, Corporate Server (CS) 3.0 and 4.0, and Multi Network Firewall (MNF) 2.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pdf.log temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://securitytracker.com/id?1021637; http://www.mandriva.com/security/advisories?name=MDVSA-2009:027; http://www.mandriva.com/security/advisories?name=MDVSA-2009:028
CVE: CVE-2009-0291
Published: 2009-01-27
Description: Directory traversal vulnerability in fc.php in OpenX 2.6.3 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the MAX_type parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/500411/100/0/threaded; http://www.securityfocus.com/bid/33458; https://www.exploit-db.com/exploits/7883
CVE: CVE-2009-0292
Published: 2009-01-27
Description: SQL injection vulnerability in show_cat2.php in SHOP-INET 4 allows remote attackers to execute arbitrary SQL commands via the grid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51615; http://secunia.com/advisories/33660; https://www.exploit-db.com/exploits/7874
CVE: CVE-2009-0293
Published: 2009-01-27
Description: SQL injection vulnerability in profile_view.php in Wazzum Dating Software, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the userid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51625; http://secunia.com/advisories/33654; http://www.securityfocus.com/bid/33461
CVE: CVE-2009-0294
Published: 2009-01-27
Description: Multiple PHP remote file inclusion vulnerabilities in WB News 2.0.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) search.php, (2) archive.php, (3) comments.php, and (4) news.php; (5) News.php, (6) SendFriend.php, (7) Archive.php, and (8) Comments.php in base/; and possibly other components, different vectors than CVE-2007-1288.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/33691; http://www.securityfocus.com/archive/1/500398/100/0/threaded; http://www.securityfocus.com/bid/33434
CVE: CVE-2009-0295
Published: 2009-01-27
Description: SQL injection vulnerability in index.php in Information Technology Light Poll Information (ITLPoll) 2.7 Stable 2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/51616; http://secunia.com/advisories/33666; http://www.securityfocus.com/bid/33452
CVE: CVE-2009-0296
Published: 2009-01-27
Description: SQL injection vulnerability in shop_display_products.php in Script Toko Online 5.01 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51630; http://secunia.com/advisories/33661; https://www.exploit-db.com/exploits/7873
CVE: CVE-2009-0297
Published: 2009-01-27
Description: SQL injection vulnerability in login_check.asp in ClickAuction allows remote attackers to execute arbitrary SQL commands via the (1) txtEmail and (2) txtPassword parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51626; http://secunia.com/advisories/33647; https://www.exploit-db.com/exploits/7880
CVE: CVE-2009-0298
Published: 2009-01-27
Description: Heap-based buffer overflow in MW6 Technologies Barcode ActiveX control (Barcode.MW6Barcode.1, Barcode.dll) 3.0.0.1 allows remote attackers to execute arbitrary code via a long Supplement property.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33663; http://www.securityfocus.com/bid/33451; https://www.exploit-db.com/exploits/7869
CVE: CVE-2009-0299
Published: 2009-01-27
Description: SQL injection vulnerability in index.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51628; http://secunia.com/advisories/33649; http://www.securityfocus.com/bid/33460
CVE: CVE-2009-0300
Published: 2009-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-2636.  Reason: This candidate is a duplicate of CVE-2006-2636.  Notes: All CVE users should reference CVE-2006-2636 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-0301
Published: 2009-01-27
Description: Multiple insecure method vulnerabilities in the FlexCell.Grid ActiveX control (FlexCell.ocx) in FlexCell Grid Control 5.6.9 allow remote attackers to create and overwrite arbitrary files via the (1) SaveFile and (2) ExportToXML methods.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/33664; http://www.securityfocus.com/bid/33453; https://www.exploit-db.com/exploits/7868
CVE: CVE-2009-0302
Published: 2009-01-27
Description: SQL injection vulnerability in the Downloads module for PHP-Nuke 8.0 8.1.0.3.5b and earlier allows remote authenticated users to execute arbitrary SQL commands via the url parameter in the Add operation to modules.php.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-89
References: http://1337day.com/exploits/15481; http://osvdb.org/51633; http://osvdb.org/77349
CVE: CVE-2009-0303
Published: 2009-01-27
Description: Cross-site scripting (XSS) vulnerability in Web Help Desk before 9.1.18 allows remote attackers to inject arbitrary web script or HTML via vectors related to "encoded JavaScript" and Helpdesk.woa.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33651; http://updates.webhelpdesk.com/weblog/updates/StableReleases/2009/01/23/911812309.html; http://www.securityfocus.com/bid/33429
CVE: CVE-2009-0304
Published: 2009-01-27
Description: The kernel in Sun Solaris 10 and 11 snv_101b, and OpenSolaris before snv_108, allows remote attackers to cause a denial of service (system crash) via a crafted IPv6 packet, related to an "insufficient validation security vulnerability," as demonstrated by SunOSipv6.c.
CVSS Score: 7.8 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2009-January/067709.html; http://secunia.com/advisories/33605; http://securitytracker.com/id?1021635
CVE: CVE-2008-5982
Published: 2009-01-27
Description: Format string vulnerability in BMC PATROL Agent before 3.7.30 allows remote attackers to execute arbitrary code via format string specifiers in an invalid version number to TCP port 3181, which are not properly handled when writing a log message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://secunia.com/advisories/33049; http://www.securityfocus.com/archive/1/499013/100/0/threaded; http://www.securityfocus.com/bid/32692
CVE: CVE-2009-0311
Published: 2009-01-27
Description: The Backbone service (ftbackbone.exe) in EMC AutoStart before 5.3 SP2 allows remote attackers to execute arbitrary code via a packet with a crafted value that is dereferenced as a function pointer.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/51566; http://secunia.com/advisories/33667; http://www.securityfocus.com/archive/1/500350/100/0/threaded
CVE: CVE-2007-2795
Published: 2009-01-27
Description: Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) the authentication feature in IMailsec.dll, which triggers heap corruption in the IMail Server, or (2) a long SUBSCRIBE IMAP command, which triggers a stack-based buffer overflow in the IMAP Daemon.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://www.ipswitch.com/support/imail/releases/im200621.asp; http://www.zerodayinitiative.com/advisories/ZDI-07-042/; http://www.zerodayinitiative.com/advisories/ZDI-07-043/
CVE: CVE-2009-0042
Published: 2009-01-28
Description: Multiple unspecified vulnerabilities in the Arclib library (arclib.dll) before 7.3.0.15 in the CA Anti-Virus engine for CA Anti-Virus for the Enterprise 7.1, r8, and r8.1; Anti-Virus 2007 v8 and 2008; Internet Security Suite 2007 v3 and 2008; and other CA products allow remote attackers to bypass virus detection via a malformed archive file.
CVSS Score: 10.0 (HIGH)
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/26/ca20090126-01-ca-anti-virus-engine-detection-evasion-multiple-vulnerabilities.aspx; http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197601; http://www.securityfocus.com/archive/1/500417/100/0/threaded
CVE: CVE-2009-0312
Published: 2009-01-28
Description: Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hg.moinmo.in/moin/1.7/rev/89b91bf87dad; http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad; http://moinmo.in/SecurityFixes#moin1.8.1
CVE: CVE-2008-5983
Published: 2009-01-28
Description: Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-426
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042751.html; http://secunia.com/advisories/34522; http://secunia.com/advisories/40194
CVE: CVE-2009-0313
Published: 2009-01-28
Description: winetricks before 20081223 allows local users to overwrite arbitrary files via a symlink attack on the x_showmenu.txt temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://code.google.com/p/winezeug/source/detail?r=253; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://osvdb.org/51619
CVE: CVE-2008-5984
Published: 2009-01-28
Description: Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504251; http://secunia.com/advisories/33672; http://secunia.com/advisories/33703
CVE: CVE-2008-5985
Published: 2009-01-28
Description: Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504363; http://secunia.com/advisories/34187; http://www.gentoo.org/security/en/glsa/glsa-200903-16.xml
CVE: CVE-2008-5986
Published: 2009-01-28
Description: Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359; http://www.openwall.com/lists/oss-security/2009/01/26/2; http://www.securityfocus.com/bid/33446
CVE: CVE-2008-5987
Published: 2009-01-28
Description: Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504352; http://security.gentoo.org/glsa/glsa-200904-06.xml; http://www.openwall.com/lists/oss-security/2009/01/26/2
CVE: CVE-2009-0314
Published: 2009-01-28
Description: Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-426
References: http://bugzilla.gnome.org/show_bug.cgi?id=569214; http://secunia.com/advisories/33759; http://secunia.com/advisories/33769
CVE: CVE-2009-0315
Published: 2009-01-28
Description: Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
CVSS Score: 6.9 (MEDIUM)
References: http://www.mandriva.com/security/advisories?name=MDVSA-2009:059; http://www.openwall.com/lists/oss-security/2009/01/26/2; http://www.securityfocus.com/bid/33444
CVE: CVE-2009-0316
Published: 2009-01-28
Description: Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484305; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493937; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2009-0317
Published: 2009-01-28
Description: Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
CVSS Score: 6.9 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2009/01/26/2; http://www.securityfocus.com/bid/33442; https://bugzilla.redhat.com/show_bug.cgi?id=481570
CVE: CVE-2009-0318
Published: 2009-01-28
Description: Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
CVSS Score: 6.9 (MEDIUM)
References: http://bugzilla.gnome.org/show_bug.cgi?id=569648; http://secunia.com/advisories/33707; http://secunia.com/advisories/33823
CVE: CVE-2008-5988
Published: 2009-01-28
Description: SQL injection vulnerability in scripts/recruit_details.php in Jadu CMS for Government allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31376; https://exchange.xforce.ibmcloud.com/vulnerabilities/45404; https://www.exploit-db.com/exploits/6555
CVE: CVE-2008-5989
Published: 2009-01-28
Description: Directory traversal vulnerability in defs.php in PHPcounter 1.3.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the l parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31993; http://www.securityfocus.com/bid/31373; https://exchange.xforce.ibmcloud.com/vulnerabilities/45378
CVE: CVE-2008-5990
Published: 2009-01-28
Description: Directory traversal vulnerability in connect/init.inc in emergecolab 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sitecode parameter to connect/index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/31372; https://exchange.xforce.ibmcloud.com/vulnerabilities/45369; https://www.exploit-db.com/exploits/6551
CVE: CVE-2008-5991
Published: 2009-01-28
Description: Directory traversal vulnerability in docs.php in MailWatch for MailScanner 1.0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the doc parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31994; http://www.securityfocus.com/bid/31378; https://exchange.xforce.ibmcloud.com/vulnerabilities/45393
CVE: CVE-2008-5992
Published: 2009-01-28
Description: Multiple SQL injection vulnerabilities in Jetik Emlak Sistem A (ESA) 2.0 allow remote attackers to execute arbitrary SQL commands via the KayitNo parameter to (1) diger.php and (2) sayfalar.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32008; http://www.securityfocus.com/bid/31352; https://exchange.xforce.ibmcloud.com/vulnerabilities/45391
CVE: CVE-2008-5993
Published: 2009-01-28
Description: Directory traversal vulnerability in image.php in Barcode Generator 1D (barcodegen) 2.0.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the code parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/45406; https://www.exploit-db.com/exploits/6558; https://exchange.xforce.ibmcloud.com/vulnerabilities/45406
CVE: CVE-2008-5994
Published: 2009-01-28
Description: Cross-site scripting (XSS) vulnerability in index.php in Check Point Connectra NGX R62 HFA_01 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31553; http://www.securityfocus.com/bid/31369; https://exchange.xforce.ibmcloud.com/vulnerabilities/45385
CVE: CVE-2008-5995
Published: 2009-01-28
Description: Cross-site scripting (XSS) vulnerability in the freeCap CAPTCHA (sr_freecap) extension before 1.0.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31946; http://typo3.org/extensions/repository/view/sr_freecap/1.0.4/; http://typo3.org/teams/security/security-bulletins/typo3-20080924-2/