deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-5299
Published: 2015-01-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in poMMo Aardvark PR16.1 allow remote attackers to inject arbitrary web script or HTML via (1) the referer parameter to index.php, (2) the site_name parameter to admin/setup/config/general.php, (3) the group_name parameter to admin/subscribers/subscribers_groups.php, or (4) the field_name parameter to admin/setup/setup_fields.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22976; https://www.htbridge.com/advisory/HTB22976
CVE: CVE-2011-5300
Published: 2015-01-01
Description: Cross-site request forgery (CSRF) vulnerability in admin/setup/config/users.php in poMMo Aardvark PR16.1 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via certain admin_ parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22976; https://www.htbridge.com/advisory/HTB22976
CVE: CVE-2011-5301
Published: 2015-01-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHPDug 2.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the story_url parameter to add_story.php, (2) the email parameter to editprofile.php, (3) the title parameter to adm/content_add.php, or (4) the username parameter to adm/admin_edit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22970; https://www.htbridge.com/advisory/HTB22970
CVE: CVE-2011-5302
Published: 2015-01-01
Description: Cross-site request forgery (CSRF) vulnerability in adm/admin_edit.php in PHPDug 2.0.0 allows remote attackers to hijack the authentication of administrators for requests that modify credentials.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22970; https://www.htbridge.com/advisory/HTB22970
CVE: CVE-2011-5303
Published: 2015-01-01
Description: Cross-site scripting (XSS) vulnerability in Spitfire CMS 1.0.436 allows remote attackers to inject arbitrary web script or HTML via a cms_username cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22903; https://www.htbridge.com/advisory/HTB22903
CVE: CVE-2011-5304
Published: 2015-01-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Sodahead Polls plugin before 2.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) the poll_id parameter to customizer.php or (2) the customize parameter to poll.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/sodahead-polls/changelog/; https://www.htbridge.com/advisory/HTB22893; https://www.htbridge.com/advisory/HTB22894
CVE: CVE-2011-5305
Published: 2015-01-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in CosmoShop ePRO 10.05.00 allow remote attackers to inject arbitrary web script or HTML via (1) the rcopy parameter to cgi-bin/admin/rubrikadmin.cgi, (2) the typ parameter to cgi-bin/admin/artikeladmin.cgi, or (3) the suchbegriff parameter to cgi-bin/admin/shophilfe_suche.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22878; https://www.htbridge.com/advisory/HTB22878
CVE: CVE-2011-5306
Published: 2015-01-01
Description: Cross-site request forgery (CSRF) vulnerability in cgi-bin/admin/setup_edit.cgi in CosmoShop ePRO 10.05.00 allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22878; https://www.htbridge.com/advisory/HTB22878
CVE: CVE-2011-5307
Published: 2015-01-01
Description: Cross-site scripting (XSS) vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22867; https://www.htbridge.com/advisory/HTB22867
CVE: CVE-2011-5308
Published: 2015-01-01
Description: Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote plugin before 0.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) cdnvote_post_id or (2) cdnvote_point parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://wpsecure.net/2011/02/cdnvote-plugin/; https://plugins.trac.wordpress.org/changeset/350873/cdnvote/trunk/cdnvote-post.php; https://www.htbridge.com/advisory/HTB22845
CVE: CVE-2011-5309
Published: 2015-01-01
Description: Cross-site scripting (XSS) vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22826; https://www.htbridge.com/advisory/HTB22826
CVE: CVE-2011-5310
Published: 2015-01-01
Description: Directory traversal vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://www.htbridge.com/advisory/HTB22826; https://www.htbridge.com/advisory/HTB22826
CVE: CVE-2011-5311
Published: 2015-01-01
Description: Cross-site request forgery (CSRF) vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to hijack the authentication of administrators for requests that modify pages via the data[text] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22826; https://www.htbridge.com/advisory/HTB22826
CVE: CVE-2011-5312
Published: 2015-01-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gollos 2.8 allow remote attackers to inject arbitrary web script or HTML via the returnurl parameter to (1) register.aspx, (2) publication/info.aspx, or (3) user/add.aspx, or (4) the q parameter to product/list.aspx.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22830; https://www.htbridge.com/advisory/HTB22830
CVE: CVE-2011-5313
Published: 2015-01-01
Description: Multiple SQL injection vulnerabilities in includes/password.php in Redaxscript 0.3.2 allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) password parameter to the password_reset program.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.htbridge.com/advisory/HTB22804; https://www.htbridge.com/advisory/HTB22804
CVE: CVE-2011-5314
Published: 2015-01-01
Description: templates/default/index.php in Redaxscript 0.3.2 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://www.htbridge.com/advisory/HTB22804; https://www.htbridge.com/advisory/HTB22804
CVE: CVE-2011-5315
Published: 2015-01-01
Description: Cross-site request forgery (CSRF) vulnerability in admin/index.php in whCMS 0.115 alpha allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22767; https://www.htbridge.com/advisory/HTB22767
CVE: CVE-2011-5316
Published: 2015-01-01
Description: Cross-site request forgery (CSRF) vulnerability in admin/index.php in Cambio 0.5a nightly r37 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22768; https://www.htbridge.com/advisory/HTB22768
CVE: CVE-2011-5317
Published: 2015-01-01
Description: Cross-site scripting (XSS) vulnerability in editText.php in WonderCMS before 0.4 allows remote attackers to inject arbitrary web script or HTML via the content parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22759; https://www.htbridge.com/advisory/HTB22759
CVE: CVE-2011-5318
Published: 2015-01-01
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in diafan.CMS before 5.1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify articles via a save_post action to admin/news/saveNEWS_ID/, (2) modify settings via a save_post action to admin/site/save2/, or (3) modify credentials via a save_post action to admin/usersite/save2/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22775; https://www.htbridge.com/advisory/HTB22775
CVE: CVE-2013-7417
Published: 2015-01-02
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/ipinfo.cgi in IPCop (aka IPCop Firewall) before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.  NOTE: this can be used to bypass the cross-site request forgery (CSRF) protection mechanism by setting the Referer.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129697/IPCop-2.1.4-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://sourceforge.net/p/ipcop/bugs/807/; http://www.asafety.fr/vuln-exploit-poc/xss-rce-ipcop-2-1-4-remote-command-execution/
CVE: CVE-2014-9434
Published: 2015-01-02
Description: Cross-site scripting (XSS) vulnerability in admin/managerrelated.php in the administrative backend in Absolut Engine 1.73 allows remote authenticated users to inject arbitrary web script or HTML via the title parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Dec/131; http://sroesemann.blogspot.de/2014/12/sroeadv-2014-08.html; http://www.securityfocus.com/bid/71822
CVE: CVE-2014-9435
Published: 2015-01-02
Description: Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the (1) sectionID parameter to admin/managersection.php, (2) userID parameter to admin/edituser.php, (3) username parameter to admin/admin.php, or (4) title parameter to admin/managerrelated.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2014/Dec/131; http://sroesemann.blogspot.de/2014/12/sroeadv-2014-08.html; http://www.securityfocus.com/bid/71822
CVE: CVE-2014-9436
Published: 2015-01-02
Description: Absolute path traversal vulnerability in SysAid On-Premise before 14.4.2 allows remote attackers to read arbitrary files via a \\\\ (four backslashes) in the fileName parameter to getRdsLogFile.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/129705/SysAid-Server-Arbitrary-File-Disclosure.html; http://seclists.org/fulldisclosure/2014/Dec/99; http://www.exploit-db.com/exploits/35593
CVE: CVE-2014-9437
Published: 2015-01-02
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_social_slider_margin parameter in a wpbs_save_settings action in the wpbs_panel page to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129509; https://exchange.xforce.ibmcloud.com/vulnerabilities/99510; http://packetstormsecurity.com/files/129509
CVE: CVE-2014-9438
Published: 2015-01-02
Description: Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that (1) ban a user via the username parameter in a dobanuser action to modcp/banning.php or (2) unban a user, (3) modify user profiles, edit a (4) post or (5) topic, or approve a (6) post or (7) topic via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129619/vBulletin-Moderator-Control-Panel-4.2.2-CSRF.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99472; https://rstforums.com/forum/88810-csrf-vbulletin-modcp.rst
CVE: CVE-2014-9439
Published: 2015-01-02
Description: Cross-site scripting (XSS) vulnerability in Easy File Sharing Web Server 6.8 allows remote attackers to inject arbitrary web script or HTML via the username field during registration, which is not properly handled by forum.ghp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/35626; https://exchange.xforce.ibmcloud.com/vulnerabilities/99532; http://www.exploit-db.com/exploits/35626
CVE: CVE-2014-9440
Published: 2015-01-02
Description: SQL injection vulnerability in browse.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129789/PHP-Address-Book-Cross-Site-Scripting-SQL-Injection.html; http://www.exploit-db.com/exploits/35591; https://exchange.xforce.ibmcloud.com/vulnerabilities/99531
CVE: CVE-2014-9441
Published: 2015-01-02
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) ll__opt[image2_url] or (3) ll__opt[image3_url] parameter in a ll_save_settings action to wp-admin/admin-ajax.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129507; https://exchange.xforce.ibmcloud.com/vulnerabilities/99490; http://packetstormsecurity.com/files/129507
CVE: CVE-2014-9442
Published: 2015-01-02
Description: SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/61942; https://plugins.trac.wordpress.org/changeset/1052064/cart66-lite; https://research.g0blin.co.uk/g0blin-00022/
CVE: CVE-2014-9443
Published: 2015-01-02
Description: Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/61744; https://wordpress.org/plugins/relevanssi/changelog/; http://secunia.com/advisories/61744
CVE: CVE-2014-7293
Published: 2015-01-02
Description: Cross-site scripting (XSS) vulnerability in the logon page in NYU OpenSSO Integration 2.1 and earlier for Ex Libris Patron Directory Services (PDS) allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Dec/125; http://tetraph.com/security/cves/cve-2014-7293-ex-libris-patron-directory-services-pds-xss-cross-site-scripting-security-vulnerability/; http://seclists.org/fulldisclosure/2014/Dec/125
CVE: CVE-2014-7294
Published: 2015-01-02
Description: Open redirect vulnerability in the logon page in NYU OpenSSO Integration 2.1 and earlier for Ex Libris Patron Directory Services (PDS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://packetstormsecurity.com/files/129756/Ex-Libris-Patron-Directory-Services-2.1-Open-Redirect.html; http://seclists.org/fulldisclosure/2014/Dec/127; http://tetraph.com/security/cves/cve-2014-7294-ex-libris-patron-directory-services-pds-open-redirect-security-vulnerability/
CVE: CVE-2014-9444
Published: 2015-01-02
Description: Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errors[fu-disallowed-mime-type][0][name] parameter to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129749/WordPress-Frontend-Uploader-0.9.2-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Dec/122; http://www.securityfocus.com/bid/71808
CVE: CVE-2014-9445
Published: 2015-01-02
Description: SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php.  NOTE: this can be leveraged for cross-site scripting (XSS) attacks by creating a file that generates an error.  NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/35584; https://exchange.xforce.ibmcloud.com/vulnerabilities/99365; https://exchange.xforce.ibmcloud.com/vulnerabilities/99366
CVE: CVE-2014-9446
Published: 2015-01-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 allow remote attackers to inject arbitrary web script or HTML via the sort_by parameter to the (1) opac parameter in opac-search.pl or (2) intranet parameter in catalogue/search.pl.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425; http://koha-community.org/koha-3-16-6-release/; http://koha-community.org/koha-3-18-2-release/
CVE: CVE-2014-9447
Published: 2015-01-02
Description: Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://advisories.mageia.org/MGASA-2015-0033.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148321.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148326.html
CVE: CVE-2014-9448
Published: 2015-01-02
Description: Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long string in a WAX file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/show/osvdb/81080; http://www.exploit-db.com/exploits/35105; http://www.exploit-db.com/exploits/35377
CVE: CVE-2014-9449
Published: 2015-01-02
Description: Buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp in Exiv2 0.24 allows remote attackers to cause a denial of service (crash) via a long IKEY INFO tag value in an AVI file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://dev.exiv2.org/issues/960; http://dev.exiv2.org/projects/exiv2/repository/diff?rev=3264&rev_to=3263; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148382.html
CVE: CVE-2014-9450
Published: 2015-01-02
Description: Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/61554; http://www.zabbix.com/rn1.8.22.php; http://www.zabbix.com/rn2.0.14.php
CVE: CVE-2014-9451
Published: 2015-01-02
Description: Multiple stack-based buffer overflows in the DIVA web service API (/webservice) in VDG Security SENSE (formerly DIVA) 2.3.13 allow remote attackers to execute arbitrary code via the (1) user or (2) password parameter in an AuthenticateUser request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2014/Dec/76; http://www.securityfocus.com/bid/71736
CVE: CVE-2014-9452
Published: 2015-01-02
Description: Directory traversal vulnerability in VDG Security SENSE (formerly DIVA) 2.3.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI to images/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2014/Dec/76; http://www.securityfocus.com/bid/71736
CVE: CVE-2014-9453
Published: 2015-01-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in simple-visitor-stat.php in the Simple visitor stat plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP User-Agent or (2) HTTP Referer header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129502/WordPress-Simple-Visitor-Stat-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99421; http://packetstormsecurity.com/files/129502/WordPress-Simple-Visitor-Stat-Cross-Site-Scripting.html
CVE: CVE-2014-9454
Published: 2015-01-02
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer plugin before 1.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) simple_sf_width or (3) simple_sf_style parameter in the simple-simple-sticky-footer page to wp-admin/themes.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129503/WordPress-Simple-Sticky-Footer-1.3.2-CSRF-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99374; https://exchange.xforce.ibmcloud.com/vulnerabilities/99375
CVE: CVE-2014-9455
Published: 2015-01-02
Description: SQL injection vulnerability in showads.php in CTS Projects & Software ClassAd 3.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129451/ClassAd-3.0-SQL-Injection.html; http://packetstormsecurity.com/files/129451/ClassAd-3.0-SQL-Injection.html
CVE: CVE-2014-9456
Published: 2015-01-02
Description: Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XML file.  NOTE: this issue was originally incorrectly mapped to CVE-2014-1004; see CVE-2014-1004 for more information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/35589; http://www.securityfocus.com/bid/88191; http://www.exploit-db.com/exploits/35589
CVE: CVE-2014-9457
Published: 2015-01-02
Description: SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the id parameter to catalog.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/35625; http://www.exploit-db.com/exploits/35625
CVE: CVE-2014-9458
Published: 2015-01-02
Description: Heap-based buffer overflow in the GDB debugger module in Hex-Rays IDA Pro before 6.6 cumulative fix 2014-12-24 allows remote GDB servers to have unspecified impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/61863; http://www.securityfocus.com/bid/87981; https://www.hex-rays.com/bugbounty.shtml
CVE: CVE-2014-9459
Published: 2015-01-02
Description: Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via the id parameter in an admin action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129751/e107-2.0-Alpha2-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2014/Dec/124; http://sroesemann.blogspot.de/2014/12/sroeadv-2014-04.html