deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1062
Published: 2010-03-23
Description: Directory traversal vulnerability in codelib/sys/common.inc.php in Phpkobo Free Real Estate Contact Form 1.09, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG_CODE parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1003-exploits/frecf-lfi.txt; http://secunia.com/advisories/38967; http://www.exploit-db.com/exploits/11773
CVE: CVE-2010-1063
Published: 2010-03-23
Description: Multiple directory traversal vulnerabilities in Phpkobo Free Real Estate Contact Form 1.09, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the LANG_CODE parameter to (1) codelib/cfg/common.inc.php, (2) form/app/common.inc.php, and (3) staff/app/common.inc.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/38967; http://www.securityfocus.com/bid/38731; http://secunia.com/advisories/38967
CVE: CVE-2009-4736
Published: 2010-03-23
Description: Cross-site scripting (XSS) vulnerability in search.php in CommonSense CMS 5.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0607-exploits/newangels-11.txt; http://secunia.com/advisories/37992; http://www.exploit-db.com/exploits/10766
CVE: CVE-2010-1040
Published: 2010-03-23
Description: The "IP address range limitation" function in OpenPNE 1.6 through 1.8, 2.0 through 2.8, 2.10 through 2.14, and 3.0 through 3.4, when mobile device support is enabled, allows remote attackers to bypass the "simple login" functionality via unknown vectors related to spoofing.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN06874657/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000006.html; http://secunia.com/advisories/38857
CVE: CVE-2010-1064
Published: 2010-03-23
Description: Erolife AjxGaleri VT stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/ajxgaleri.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/1001-exploits/erolife-disclose.txt; http://secunia.com/advisories/38033; http://www.exploit-db.com/exploits/11023
CVE: CVE-2010-1065
Published: 2010-03-23
Description: Lebisoft Ziyaretci Defteri 7.4 and 7.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/lebisoft.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/38039; http://www.exploit-db.com/exploits/11015; https://exchange.xforce.ibmcloud.com/vulnerabilities/55452
CVE: CVE-2010-1066
Published: 2010-03-23
Description: AR Web Content Manager (AWCM) 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for control/db_backup.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.org/1001-exploits/awcm-backup.txt; http://secunia.com/advisories/38065; http://www.exploit-db.com/exploits/11025
CVE: CVE-2010-1067
Published: 2010-03-23
Description: E-membres 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/bdEMembres.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/38062; http://www.exploit-db.com/exploits/11098; https://exchange.xforce.ibmcloud.com/vulnerabilities/55503
CVE: CVE-2010-1068
Published: 2010-03-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in surgeftpmgr.cgi in NetWin SurgeFTP 2.3a6 allow remote attackers to inject arbitrary web script or HTML via the (1) domainid or (2) classid parameter in a class action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1001-exploits/surgeftp-xss.txt; http://secunia.com/advisories/38097; http://www.exploit-db.com/exploits/11092
CVE: CVE-2010-1069
Published: 2010-03-23
Description: SQL injection vulnerability in games/game.php in ProArcadeScript allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1001-exploits/proarcadescripttogame-sql.txt; http://secunia.com/advisories/38040; http://www.exploit-db.com/exploits/11080
CVE: CVE-2010-1070
Published: 2010-03-23
Description: SQL injection vulnerability in index.php in ImagoScripts Deviant Art Clone allows remote attackers to execute arbitrary SQL commands via the seid parameter in a forums viewcat action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/61482; http://packetstormsecurity.org/1001-exploits/imagoscriptsdac-sql.txt; http://secunia.com/advisories/38096
CVE: CVE-2010-1071
Published: 2010-03-23
Description: SQL injection vulnerability in profil.php in phpMDJ 1.0.3 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1001-exploits/phpmdj103-sql.txt; http://secunia.com/advisories/33480; http://www.exploit-db.com/exploits/11083
CVE: CVE-2010-1072
Published: 2010-03-23
Description: Cross-site scripting (XSS) vulnerability in search.php in Sniggabo CMS 2.21 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://greyhathackers.wordpress.com/2010/01/07/sniggabo-cms-v2-21-xss-vulnerability/; http://packetstormsecurity.org/1001-exploits/sniggabocms-xss.txt; http://secunia.com/advisories/38029
CVE: CVE-2010-1073
Published: 2010-03-23
Description: SQL injection vulnerability in the jEmbed-Embed Anything (com_jembed) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a summary action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/61510; http://secunia.com/advisories/38112; http://www.exploit-db.com/exploits/11026
CVE: CVE-2010-1074
Published: 2010-03-23
Description: Cross-site scripting (XSS) vulnerability in the Currency Exchange module before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to watchdog logging.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/676214; http://drupal.org/node/676216; http://osvdb.org/61587
CVE: CVE-2010-1075
Published: 2010-03-23
Description: SQL injection vulnerability in index.php in Entry Level CMS (EL CMS) allows remote attackers to execute arbitrary SQL commands via the subj parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62513; http://packetstormsecurity.org/1002-exploits/elcms-sql.txt; http://secunia.com/advisories/38688
CVE: CVE-2010-1076
Published: 2010-03-23
Description: Cross-site scripting (XSS) vulnerability in index.php in Entry Level CMS (EL CMS) allows remote attackers to inject arbitrary web script or HTML via the subj parameter, which is not properly handled in a forced SQL error message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38688; http://secunia.com/advisories/38688
CVE: CVE-2010-1077
Published: 2010-03-23
Description: Directory traversal vulnerability in vbseo.php in Crawlability vBSEO plugin 3.1.0 for vBulletin allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the vbseourl parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1002-exploits/vbseo-lfi.txt; http://www.exploit-db.com/exploits/11526; http://www.vupen.com/english/advisories/2010/0442
CVE: CVE-2010-1078
Published: 2010-03-23
Description: SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbitrary SQL commands via encoded null bytes ("%00") in the view parameter, which bypasses a protection mechanism.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.bugreport.ir/index_68.htm; http://www.packetstormsecurity.org/1002-exploits/spherecms-sql.txt; http://www.securityfocus.com/archive/1/509603/100/0/threaded
CVE: CVE-2010-1079
Published: 2010-03-23
Description: Cross-site scripting (XSS) vulnerability in Sawmill before 7.2.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38730; http://www.sawmill.net/version_history7.html; http://www.securityfocus.com/bid/38387
CVE: CVE-2010-1080
Published: 2010-03-23
Description: Cross-site scripting (XSS) vulnerability in view.php in Pulse CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/62475; http://packetstormsecurity.org/1002-exploits/pulsecms-xss.txt; http://secunia.com/advisories/38650
CVE: CVE-2010-1081
Published: 2010-03-23
Description: Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/62506; http://packetstormsecurity.org/1002-exploits/joomlacp-lfi.txt; http://secunia.com/advisories/38692
CVE: CVE-2010-1082
Published: 2010-03-23
Description: Multiple directory traversal vulnerabilities in OI.Blogs 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to read arbitrary files via directory traversal sequences in the (1) theme parameter to loadStyles.php and the (2) scripts parameter to javascript/loadScripts.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/38726; http://secunia.com/advisories/38726
CVE: CVE-2010-0437
Published: 2010-03-24
Description: The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances involving an IPv6 TUN network interface and a large number of neighbors, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://bugzilla.kernel.org/show_bug.cgi?id=11469; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e550dfb0c2c31b6363aa463a035fc9f8dcaa3c9b; http://secunia.com/advisories/39033
CVE: CVE-2010-1089
Published: 2010-03-24
Description: SQL injection vulnerability in vedi_faq.php in PHP Trouble Ticket 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1003-exploits/phptroubleticket-sql.txt; http://secunia.com/advisories/38763; http://packetstormsecurity.org/1003-exploits/phptroubleticket-sql.txt
CVE: CVE-2010-1090
Published: 2010-03-24
Description: SQL injection vulnerability in index.php in phpMySite allows remote attackers to execute arbitrary SQL commands via the action parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/phpmysite-sqlxss.txt; http://www.exploit-db.com/exploits/11588; http://www.vupen.com/english/advisories/2010/0492
CVE: CVE-2010-1091
Published: 2010-03-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in contact.php in phpMySite allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) city, (3) email, (4) state, and (5) message parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1002-exploits/phpmysite-sqlxss.txt; http://www.exploit-db.com/exploits/11588; http://www.vupen.com/english/advisories/2010/0492
CVE: CVE-2010-1092
Published: 2010-03-24
Description: Multiple SQL injection vulnerabilities in login.php in ScriptsFeed Business Directory Software allow remote attackers to execute arbitrary SQL commands via the (1) us and (2) ps parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62626; http://secunia.com/advisories/38771; http://www.exploit-db.com/exploits/11592
CVE: CVE-2010-1093
Published: 2010-03-24
Description: SQL injection vulnerability in rss.php in 1024 CMS 2.1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a vp action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/38775; http://www.bugreport.ir/index_69.htm; http://www.securityfocus.com/bid/38476
CVE: CVE-2010-1094
Published: 2010-03-24
Description: SQL injection vulnerability in news.php in DZ EROTIK Auktionshaus V4rgo allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://4004securityproject.wordpress.com/2010/02/26/dz-erotik-auktionshaus-v-4-rgo-news-php-sql-injection/; http://osvdb.org/62623; http://secunia.com/advisories/38792
CVE: CVE-2010-1095
Published: 2010-03-24
Description: Cross-site scripting (XSS) vulnerability in login_reset_password_page.php in Tracking Requirements & Use Cases (TRUC) 0.11.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.vupen.com/english/advisories/2010/0491; http://www.vupen.com/english/advisories/2010/0491
CVE: CVE-2010-1096
Published: 2010-03-24
Description: Multiple SQL injection vulnerabilities in searchmatch.php in ScriptsFeed Dating Software allow remote attackers to execute arbitrary SQL commands via the (1) txtgender and (2) txtlookgender parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/62627; http://secunia.com/advisories/38767; http://www.vupen.com/english/advisories/2010/0493
CVE: CVE-2010-1097
Published: 2010-03-24
Description: include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the _SESSION[dede_admin_id] parameter, as demonstrated by a request to uploads/include/dialog/select_soft_post.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://bbs.wolvez.org/topic/125/; http://osvdb.org/62622; http://secunia.com/advisories/38790
CVE: CVE-2010-1098
Published: 2010-03-24
Description: The ANI parser in Microsoft Windows before 7 on the x86 platform, as used in Internet Explorer and other applications, allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted biClrUsed value in the BITMAPINFO header of a .ANI file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/skylined/issues/detail?id=3; http://skypher.com/index.php/2010/03/08/ani-file-bitmapinfoheader-biclrused-bounds-check-missing/; http://www.securityfocus.com/bid/38579
CVE: CVE-2009-2907
Published: 2010-03-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified "input fields."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/38913; http://www.springsource.com/security/cve-2009-2907; http://www.securityfocus.com/bid/38913
CVE: CVE-2010-0618
Published: 2010-03-24
Description: The flood-protection feature in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser and inkjet printers and MarkNet devices allows remote attackers to cause a denial of service (TCP outage) by making many passive FTP connections and then aborting these connections.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/39056; http://support.lexmark.com/index?page=content&id=TE85&locale=EN&userlocale=EN_US; http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=11&Itemid=11
CVE: CVE-2010-0619
Published: 2010-03-24
Description: Stack-based buffer overflow in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser printers and multi-function printers allows remote attackers to execute arbitrary code or cause a denial of service (device hang) via a long argument to a PJL INQUIRE command.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://support.lexmark.com/index?page=content&id=TE84&locale=EN&userlocale=EN_US; http://www.securityfocus.com/archive/1/510251/100/0/threaded; http://www.securityfocus.com/bid/38901
CVE: CVE-2010-1099
Published: 2010-03-24
Description: Integer overflow in Apple Safari allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189, CWE-264
References: http://www.securityfocus.com/archive/1/510283/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/57233; http://www.securityfocus.com/archive/1/510283/100/0/threaded
CVE: CVE-2010-1100
Published: 2010-03-24
Description: Integer overflow in Arora allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/archive/1/510283/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/57234; http://www.securityfocus.com/archive/1/510283/100/0/threaded
CVE: CVE-2010-1101
Published: 2010-03-24
Description: Integer overflow in Alexander Clauss iCab allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/archive/1/510283/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/57235; http://www.securityfocus.com/archive/1/510283/100/0/threaded
CVE: CVE-2010-1102
Published: 2010-03-24
Description: Integer overflow in OmniWeb allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/archive/1/510283/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/57236; http://www.securityfocus.com/archive/1/510283/100/0/threaded
CVE: CVE-2010-1103
Published: 2010-03-24
Description: Integer overflow in Stainless allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/archive/1/510283/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/57237; http://www.securityfocus.com/archive/1/510283/100/0/threaded
CVE: CVE-2010-1104
Published: 2010-03-25
Description: Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38007; http://www.osvdb.org/61655; http://www.securityfocus.com/bid/37765
CVE: CVE-2010-1105
Published: 2010-03-25
Description: Cross-site scripting (XSS) vulnerability in cgi/index.php in AdvertisementManager 3.1.0 and 3.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/61846; http://secunia.com/advisories/38243; http://www.packetstormsecurity.com/1001-exploits/advertisemanager-xssrfitraversal.txt
CVE: CVE-2010-1106
Published: 2010-03-25
Description: PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the req parameter.  NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.packetstormsecurity.com/1001-exploits/advertisemanager-xssrfitraversal.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/55756; http://www.packetstormsecurity.com/1001-exploits/advertisemanager-xssrfitraversal.txt
CVE: CVE-2010-1107
Published: 2010-03-25
Description: Cross-site scripting (XSS) vulnerability in the Recent Comments module 5.x through 5.x-1.2 and 6.x through 6.x-1.0 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a "custom block title interface."
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/688632; http://drupal.org/node/688636; http://drupal.org/node/690734
CVE: CVE-2010-1108
Published: 2010-03-25
Description: Cross-site scripting (XSS) vulnerability in the Control Panel module 5.x through 5.x-1.5 and 6.x through 6.x-1.2 for Drupal allows remote authenticated users, with "administer blocks" privileges, to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/686428; http://drupal.org/node/690718; http://secunia.com/advisories/38280
CVE: CVE-2010-1109
Published: 2010-03-25
Description: Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) v2 parameter in a member view action, (2) v1 parameter in a news action, (3) v1 parameter in an information action, (4) v2 parameter in a team view action, (5) v2 parameter in a club view action, or (6) v2 parameter in a matches view action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/1001-exploits/phpmysport-sqlaccess.txt; http://phpmysport.sourceforge.net/en/forum/bugs/sujet_2851.html; http://secunia.com/advisories/34279
CVE: CVE-2010-1110
Published: 2010-03-25
Description: Directory traversal vulnerability in index.php in phpMySport 1.4 allows remote attackers to list arbitrary directories via a .. (dot dot) in the current_folder parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/1001-exploits/phpmysport-sqlaccess.txt; http://phpmysport.sourceforge.net/en/forum/bugs/sujet_2851.html; http://www.securityfocus.com/bid/37856