deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0780
Published: 2011-10-29
Description: IBM WebSphere MQ 7.x before 7.0.1.4 allows remote attackers to cause a denial of service (disk consumption) via multiple connection attempts to a stopped queue manager.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg27014224; http://www.ibm.com/support/docview.wss?uid=swg1IZ75124; https://exchange.xforce.ibmcloud.com/vulnerabilities/60638
CVE: CVE-2011-1368
Published: 2011-10-29
Description: The JavaServer Faces (JSF) application functionality in IBM WebSphere Application Server 8.x before 8.0.0.1 does not properly handle requests, which allows remote attackers to read unspecified files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg24030916; http://www.ibm.com/support/docview.wss?uid=swg1PM45992; https://exchange.xforce.ibmcloud.com/vulnerabilities/70168
CVE: CVE-2011-1370
Published: 2011-10-29
Description: The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://www-01.ibm.com/support/docview.wss?uid=swg21569452; https://exchange.xforce.ibmcloud.com/vulnerabilities/70923; http://www-01.ibm.com/support/docview.wss?uid=swg21569452
CVE: CVE-2009-2747
Published: 2011-10-30
Description: The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods, which allows remote attackers to obtain sensitive information via a crafted method call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=swg1PK91414; http://www.ibm.com/support/docview.wss?uid=swg1PK99480; https://exchange.xforce.ibmcloud.com/vulnerabilities/54228
CVE: CVE-2009-2748
Published: 2011-10-30
Description: Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg1PK92057; http://www.ibm.com/support/docview.wss?uid=swg1PK99481; https://exchange.xforce.ibmcloud.com/vulnerabilities/54229
CVE: CVE-2011-1366
Published: 2011-10-30
Description: Unspecified vulnerability in the Import feature in IBM Rational AppScan Enterprise and AppScan Reporting Console 5.2 through 7.9.x and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary commands on an agent server via a crafted ZIP archive.
CVSS Score: 8.8 (HIGH)
References: http://secunia.com/advisories/46326; http://secunia.com/advisories/46329; http://www-01.ibm.com/support/docview.wss?uid=swg21515110
CVE: CVE-2011-1367
Published: 2011-10-30
Description: Unspecified vulnerability in the File Load feature in IBM Rational AppScan Standard and Express 7.8.x, 7.9.x, and 8.0.x before 8.0.0.3 allows remote attackers to execute arbitrary commands via a crafted .scan file.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/46326; http://secunia.com/advisories/46329; http://www-01.ibm.com/support/docview.wss?uid=swg21515110
CVE: CVE-2009-0900
Published: 2011-10-30
Description: Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local users to gain privileges via crafted SSL information in a Client Channel Definition Table (CCDT) file.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-119
References: http://www.ibm.com/support/docview.wss?uid=swg1IC59375; https://exchange.xforce.ibmcloud.com/vulnerabilities/51038; http://www.ibm.com/support/docview.wss?uid=swg1IC59375
CVE: CVE-2009-0905
Published: 2011-10-30
Description: IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow local users to gain privileges by leveraging combinations of group names with the same initial substring.
CVSS Score: 1.7 (LOW)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg1IZ37102; https://exchange.xforce.ibmcloud.com/vulnerabilities/51042; http://www.ibm.com/support/docview.wss?uid=swg1IZ37102
CVE: CVE-2011-1364
Published: 2011-10-30
Description: Cross-site request forgery (CSRF) vulnerability in _ah/admin/interactive/execute (aka the Interactive Console) in the SDK Console (aka Admin Console) in the Google App Engine Python SDK before 1.5.4 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary Python code via the code parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://blog.watchfire.com/files/googleappenginesdk.pdf; http://code.google.com/p/googleappengine/wiki/SdkReleaseNotes; http://www.securityfocus.com/bid/50075
CVE: CVE-2011-4211
Published: 2011-10-30
Description: The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWED_MODES and ALLOWED_DIRS changes within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://blog.watchfire.com/files/googleappenginesdk.pdf; http://code.google.com/p/googleappengine/wiki/SdkReleaseNotes; http://www.securityfocus.com/bid/50464
CVE: CVE-2011-4212
Published: 2011-10-30
Description: The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a dev_appserver.RestrictedPathFunction._original_os reference within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://blog.watchfire.com/files/googleappenginesdk.pdf; http://code.google.com/p/googleappengine/wiki/SdkReleaseNotes; https://exchange.xforce.ibmcloud.com/vulnerabilities/71063
CVE: CVE-2011-4213
Published: 2011-10-30
Description: The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local users to bypass intended access restrictions and execute arbitrary commands via a file_blob_storage.os reference within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://blog.watchfire.com/files/googleappenginesdk.pdf; http://code.google.com/p/googleappengine/wiki/SdkReleaseNotes; https://exchange.xforce.ibmcloud.com/vulnerabilities/71062
CVE: CVE-2011-0941
Published: 2011-11-01
Description: Memory leak in Cisco Unified Communications Manager (CUCM) 6.x before 6.1(5)su2, 7.x before 7.1(5b)su3, 8.x before 8.0(3a)su1, and 8.5 before 8.5(1), and Cisco IOS 12.4 and 15.1, allows remote attackers to cause a denial of service (memory consumption and process failure or device reload) via a malformed SIP message, aka Bug IDs CSCti75128 and CSCtj09179.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-cucm; http://tools.cisco.com/security/center/viewAlert.x?alertId=24525; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-cucm
CVE: CVE-2011-1915
Published: 2011-11-01
Description: SQL injection vulnerability in eClient 7.3.2.3 in Enspire Distribution Management Solution 7.3.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/46638; http://www.kb.cert.org/vuls/id/402731; http://secunia.com/advisories/46638
CVE: CVE-2011-4064
Published: 2011-11-01
Description: Cross-site scripting (XSS) vulnerability in the setup interface in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html
CVE: CVE-2011-4214
Published: 2011-11-01
Description: OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://en.securitylab.ru/lab/PT-2011-20; http://www.kb.cert.org/vuls/id/800227; http://www.securityfocus.com/bid/50107
CVE: CVE-2011-4215
Published: 2011-11-01
Description: SQL injection vulnerability in lib/ooz_access.php in OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the cookieName variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://en.securitylab.ru/lab/PT-2011-21; http://www.kb.cert.org/vuls/id/800227; http://www.securityfocus.com/bid/50107
CVE: CVE-2011-4216
Published: 2011-11-01
Description: Investintech.com SlimPDF Reader does not properly restrict write operations, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/275036; https://exchange.xforce.ibmcloud.com/vulnerabilities/71100; http://www.kb.cert.org/vuls/id/275036
CVE: CVE-2011-4217
Published: 2011-11-01
Description: Investintech.com SlimPDF Reader does not properly restrict read operations during block data moves, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/275036; http://www.kb.cert.org/vuls/id/275036
CVE: CVE-2011-4218
Published: 2011-11-01
Description: Investintech.com SlimPDF Reader does not prevent faulting-instruction data from affecting write operations, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.kb.cert.org/vuls/id/275036; https://exchange.xforce.ibmcloud.com/vulnerabilities/71098; http://www.kb.cert.org/vuls/id/275036
CVE: CVE-2011-4219
Published: 2011-11-01
Description: Investintech.com SlimPDF Reader does not prevent faulting-address data from affecting branch selection, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.kb.cert.org/vuls/id/275036; https://exchange.xforce.ibmcloud.com/vulnerabilities/71097; http://www.kb.cert.org/vuls/id/275036
CVE: CVE-2011-4220
Published: 2011-11-01
Description: Investintech.com SlimPDF Reader does not properly restrict the arguments to unspecified function calls, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/275036; http://www.kb.cert.org/vuls/id/275036
CVE: CVE-2011-4221
Published: 2011-11-01
Description: Unspecified vulnerability in Investintech.com Able2Doc and Able2Doc Professional allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document.
CVSS Score: 9.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/275036; https://exchange.xforce.ibmcloud.com/vulnerabilities/71096; http://www.kb.cert.org/vuls/id/275036
CVE: CVE-2011-4222
Published: 2011-11-01
Description: Unspecified vulnerability in Investintech.com Able2Extract and Able2Extract Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document.
CVSS Score: 9.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/275036; https://exchange.xforce.ibmcloud.com/vulnerabilities/71095; http://www.kb.cert.org/vuls/id/275036
CVE: CVE-2011-4223
Published: 2011-11-01
Description: Unspecified vulnerability in Investintech.com Absolute PDF Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
CVSS Score: 9.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/275036; https://exchange.xforce.ibmcloud.com/vulnerabilities/71094; http://www.kb.cert.org/vuls/id/275036
CVE: CVE-2010-4968
Published: 2011-11-01
Description: SQL injection vulnerability in the webmaster-tips.net Flash Gallery (com_wmtpic) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/joomlawmtpic-sql.txt; http://securityreason.com/securityalert/8492; http://www.exploit-db.com/exploits/14128
CVE: CVE-2010-4969
Published: 2011-11-01
Description: SQL injection vulnerability in articlesdetails.php in BrotherScripts (BS) Business Directory allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14241; http://www.exploit-db.com/exploits/14241
CVE: CVE-2010-4970
Published: 2011-11-01
Description: SQL injection vulnerability in handlers/getpage.php in Wiki Web Help 0.28 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/wikiwebhelp-sql.txt; http://securityreason.com/securityalert/8491; http://www.exploit-db.com/exploits/14217
CVE: CVE-2010-4972
Published: 2011-11-01
Description: SQL injection vulnerability in index.php in YPNinc JokeScript allows remote attackers to execute arbitrary SQL commands via the ypncat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/ypnincjokescript-sql.txt; http://secunia.com/advisories/40378; http://securityreason.com/securityalert/8490
CVE: CVE-2010-4973
Published: 2011-11-01
Description: Cross-site scripting (XSS) vulnerability in the search feature in Campsite 3.4.0 allows remote attackers to inject arbitrary web script or HTML via the f_search_keywords parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40589; http://secunia.com/advisories/40589
CVE: CVE-2010-4974
Published: 2011-11-01
Description: SQL injection vulnerability in info.php in BrotherScripts (BS) and ScriptsFeed Auto Dealer allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/66013; http://packetstormsecurity.org/1007-exploits/bsautodealer-sql.txt; http://secunia.com/advisories/40391
CVE: CVE-2010-4975
Published: 2011-11-01
Description: SQL injection vulnerability in the Techjoomla SocialAds For JomSocial (com_socialads) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the ads description field in a showad action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14196; http://www.securityfocus.com/bid/41354; https://exchange.xforce.ibmcloud.com/vulnerabilities/60067
CVE: CVE-2010-4976
Published: 2011-11-01
Description: Cross-site scripting (XSS) vulnerability in search/search.php in MetInfo 3.0 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter (aka Search Box field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/65839; http://secunia.com/advisories/40402; http://securityreason.com/securityalert/8488
CVE: CVE-2010-4977
Published: 2011-11-01
Description: SQL injection vulnerability in menu.php in the Canteen (com_canteen) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the mealid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/66031; http://packetstormsecurity.org/1007-exploits/joomlacanteen-lfisql.txt; http://secunia.com/advisories/40503
CVE: CVE-2010-4978
Published: 2011-11-01
Description: Cross-site scripting (XSS) vulnerability in image/view.php in CANDID allows remote attackers to inject arbitrary web script or HTML via the image_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8493; http://www.packetstormsecurity.com/1006-exploits/candid-sql.txt; http://www.securityfocus.com/bid/41216
CVE: CVE-2010-4979
Published: 2011-11-01
Description: SQL injection vulnerability in image/view.php in CANDID allows remote attackers to execute arbitrary SQL commands via the image_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/8493; http://www.packetstormsecurity.com/1006-exploits/candid-sql.txt; http://www.securityfocus.com/bid/41216
CVE: CVE-2010-4980
Published: 2011-11-01
Description: SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/reservelogic-sql.txt; http://secunia.com/advisories/40435; http://securityreason.com/securityalert/8487
CVE: CVE-2010-4981
Published: 2011-11-01
Description: SQL injection vulnerability in trackads.php in YourFreeWorld Banner Management allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40289; http://www.exploit-db.com/exploits/13929; http://www.osvdb.org/65642
CVE: CVE-2010-4982
Published: 2011-11-01
Description: SQL injection vulnerability in address_book/contacts.php in My Kazaam Address & Contact Organizer allows remote attackers to execute arbitrary SQL commands via the var1 parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14326; http://www.vupen.com/english/advisories/2010/1785; https://exchange.xforce.ibmcloud.com/vulnerabilities/60269
CVE: CVE-2010-4983
Published: 2011-11-01
Description: SQL injection vulnerability in profile.php in iScripts CyberMatch 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/cybermatch-sql.txt; http://secunia.com/advisories/40434; http://securityreason.com/securityalert/8486
CVE: CVE-2010-4984
Published: 2011-11-01
Description: SQL injection vulnerability in notes.php in My Kazaam Notes Management System allows remote attackers to execute arbitrary SQL commands via vectors involving the "Enter Reference Number Below" text box.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/mykazaamnms-sqlxss.txt; http://securityreason.com/securityalert/8494; http://www.exploit-db.com/exploits/14325
CVE: CVE-2010-4985
Published: 2011-11-01
Description: Cross-site scripting (XSS) vulnerability in notes.php in My Kazaam Notes Management System allows remote attackers to inject arbitrary web script or HTML via vectors involving the "Enter Reference Number Below" text box.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1007-exploits/mykazaamnms-sqlxss.txt; http://securityreason.com/securityalert/8494; http://www.exploit-db.com/exploits/14325
CVE: CVE-2010-4986
Published: 2011-11-01
Description: SQL injection vulnerability in detail.php in Simple Document Management System (SDMS) allows remote attackers to execute arbitrary SQL commands via the doc_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14262; http://www.securityfocus.com/bid/41431; http://www.exploit-db.com/exploits/14262
CVE: CVE-2010-4987
Published: 2011-11-01
Description: SQL injection vulnerability in default.asp in KMSoft Guestbook (aka GBook) allows remote attackers to execute arbitrary SQL commands via the p parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14281; http://www.securityfocus.com/bid/41491; http://www.vupen.com/english/advisories/2010/1768
CVE: CVE-2010-4988
Published: 2011-11-01
Description: PHP remote file inclusion vulnerability in mod_chatting/themes/default/header.php in Family Connections Who is Chatting 2.2.3 allows remote attackers to execute arbitrary PHP code via a URL in the TMPL[path] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/14186; http://www.securityfocus.com/bid/41346; http://www.vupen.com/english/advisories/2010/1687
CVE: CVE-2010-4989
Published: 2011-11-01
Description: SQL injection vulnerability in main.asp in Ziggurat Farsi CMS allows remote attackers to execute arbitrary SQL commands via the grp parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14192; http://www.vupen.com/english/advisories/2010/1688; https://exchange.xforce.ibmcloud.com/vulnerabilities/60065
CVE: CVE-2010-4990
Published: 2011-11-01
Description: SQL injection vulnerability in the Front-edit Address Book (com_addressbook) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a contact action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14210; http://www.securityfocus.com/bid/41353; http://www.vupen.com/english/advisories/2010/1702
CVE: CVE-2010-4991
Published: 2011-11-01
Description: SQL injection vulnerability in the NinjaMonials (com_ninjamonials) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a display action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14211; http://www.securityfocus.com/bid/41345; https://exchange.xforce.ibmcloud.com/vulnerabilities/60094
CVE: CVE-2010-4992
Published: 2011-11-01
Description: SQL injection vulnerability in the Payments Plus component 2.1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the type parameter to add.html.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/joomlapaymentsplus-sql.txt; http://securityreason.com/securityalert/8497; http://www.exploit-db.com/exploits/14265
CVE: CVE-2010-4993
Published: 2011-11-01
Description: SQL injection vulnerability in the eventcal (com_eventcal) component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/joomlaeventcal-sql.txt; http://securityreason.com/securityalert/8496; http://www.exploit-db.com/exploits/14187
CVE: CVE-2010-4994
Published: 2011-11-01
Description: SQL injection vulnerability in the Jobs Pro component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the detailed_results parameter to search_jobs.html.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/joomlajobspro-sql.txt; http://securityreason.com/securityalert/8498; http://www.exploit-db.com/exploits/14246