deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1537
Published: 2010-04-26
Description: Multiple directory traversal vulnerabilities in phpCDB 1.0 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang_global parameter to (1) firstvisit.php, (2) newfolder.php, (3) showfolders.php, (4) newlang.php, (5) showinnerfolder.php, (6) writecode.php, and (7) showcode.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/1002-exploits/phpcdb-lfi.txt; http://www.exploit-db.com/exploits/11585; http://www.securityfocus.com/bid/38507
CVE: CVE-2010-1538
Published: 2010-04-26
Description: SQL injection vulnerability in print_raincheck.php in phpRAINCHECK 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1002-exploits/phpraincheck-sql.txt; http://www.exploit-db.com/exploits/11586; http://www.securityfocus.com/bid/38521
CVE: CVE-2010-1539
Published: 2010-04-26
Description: Cross-site scripting (XSS) vulnerability in the Workflow module 5.x-2.x before 5.x-2.6 and 6.x-1.x before 6.x-1.4 for Drupal, when used with the Token module, might allow remote authenticated users to inject arbitrary web script or HTML via a certain Comment field.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/731624; http://drupal.org/node/731644; http://drupal.org/node/731648
CVE: CVE-2010-1540
Published: 2010-04-26
Description: Directory traversal vulnerability in index.php in the MyBlog (com_myblog) component 3.0.329 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the task parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/38777; http://www.exploit-db.com/exploits/11625; http://www.securityfocus.com/bid/38530
CVE: CVE-2010-1541
Published: 2010-04-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in DFD Cart 1.198, 1.197, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) category and (2) list_quantity parameters to index.php, and the (3) category parameter to your.order.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/135/45/; http://osvdb.org/62671; http://osvdb.org/62672
CVE: CVE-2010-1542
Published: 2010-04-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in admin/configure.php in DFD Cart 1.198, 1.197, and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks or (2) change unspecified settings.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/135/45/; http://osvdb.org/62673; http://secunia.com/advisories/38635
CVE: CVE-2010-1543
Published: 2010-04-26
Description: Cross-site scripting (XSS) vulnerability in the eTracker module before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML by appending a crafted string to an arbitrary URL associated with the Drupal site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/731018; http://drupal.org/node/731682; http://secunia.com/advisories/38826
CVE: CVE-2010-1544
Published: 2010-04-26
Description: micro_httpd on the RCA DCM425 cable modem allows remote attackers to cause a denial of service (device reboot) via a long string to TCP port 80.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.org/1002-exploits/rcadcm425-dos.txt; http://secunia.com/advisories/38778; http://www.securityfocus.com/bid/38488
CVE: CVE-2009-4811
Published: 2010-04-27
Description: VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, and VMware Server 2.x allows remote attackers to cause a denial of service (process crash) via a \x25\x90 sequence in the USER and PASS commands, a related issue to CVE-2009-3707.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://freetexthost.com/qr1tffkzpu
CVE: CVE-2009-4812
Published: 2010-04-27
Description: Wolfram Research webMathematica allows remote attackers to obtain sensitive information via a direct request to the MSP script, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0431.html; http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0431.html
CVE: CVE-2009-4813
Published: 2010-04-27
Description: Cross-site scripting (XSS) vulnerability in myps.php in MyBB (aka MyBulletinBoard) 1.4.10 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a donate action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/61298; http://secunia.com/advisories/37910; http://www.exploit-db.com/exploits/10622
CVE: CVE-2009-4814
Published: 2010-04-27
Description: Cross-site scripting (XSS) vulnerability in Wolfram Research webMathematica allows remote attackers to inject arbitrary web script or HTML via the URI to the MSP script.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0431.html; http://osvdb.org/61266; http://secunia.com/advisories/37905
CVE: CVE-2009-4815
Published: 2010-04-27
Description: Directory traversal vulnerability in Serv-U before 9.2.0.1 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/37847; http://www.securityfocus.com/bid/37414; http://www.serv-u.com/releasenotes/
CVE: CVE-2009-4816
Published: 2010-04-27
Description: Directory traversal vulnerability in api/download_checker.php in MegaLab The Uploader 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/61270; http://secunia.com/advisories/37873; http://www.exploit-db.com/exploits/10599
CVE: CVE-2009-4817
Published: 2010-04-27
Description: Unrestricted file upload vulnerability in Element-IT Ultimate Uploader 1.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/61237; http://secunia.com/advisories/37880; http://www.exploit-db.com/exploits/10578
CVE: CVE-2009-4818
Published: 2010-04-27
Description: Unrestricted file upload vulnerability in upload.php in PHPSimplicity Simplicity oF Upload 1.3.2 allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif.
CVSS Score: 6.8 (MEDIUM)
References: http://www.exploit-db.com/exploits/10568; http://www.securityfocus.com/bid/37424; https://exchange.xforce.ibmcloud.com/vulnerabilities/54952
CVE: CVE-2009-4819
Published: 2010-04-27
Description: Multiple unrestricted file upload vulnerabilities in upload.php in PHPhotoalbum allow remote attackers to execute arbitrary code by uploading a file with a (1) .php.pgif or (2) .php.pjpeg double extension, then accessing it via a direct request to the file in albums/userpics/.
CVSS Score: 6.8 (MEDIUM)
References: http://www.exploit-db.com/exploits/10584; http://www.securityfocus.com/bid/37436; https://exchange.xforce.ibmcloud.com/vulnerabilities/54958
CVE: CVE-2009-4820
Published: 2010-04-27
Description: Angelo-Emlak 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for veribaze/angelo.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/61228; http://secunia.com/advisories/37724; http://www.exploit-db.com/exploits/10576
CVE: CVE-2009-4821
Published: 2010-04-27
Description: The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to (1) change the admin password via the admin_password parameter, (2) disable the security requirement for the Wi-Fi network via unspecified vectors, or (3) modify DNS settings via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/37777; http://www.hiredhacker.com/2009/12/15/d-link-dir-615-remote-exploit/; http://www.securityfocus.com/bid/37415
CVE: CVE-2009-4822
Published: 2010-04-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kasseler CMS 1.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) do, (2) id, and (3) uname parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/10581; http://www.securityfocus.com/bid/37435; https://exchange.xforce.ibmcloud.com/vulnerabilities/54953
CVE: CVE-2009-4823
Published: 2010-04-27
Description: Cross-site scripting (XSS) vulnerability in frontend/x3/files/fileop.html in cPanel 11.0 through 11.24.7 allows remote attackers to inject arbitrary web script or HTML via the fileop parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/61231; http://secunia.com/advisories/37826; http://www.cpanel.net/2009/12/cpanel-cross-site-scripting-vulnerability.html
CVE: CVE-2009-4824
Published: 2010-04-27
Description: Unspecified vulnerability in Kolab Webclient before 1.2.0 in Kolab Server before 2.2.3 allows attackers to have an unspecified impact via vectors related to an "image upload form."
CVSS Score: 7.5 (HIGH)
References: http://files.kolab.org/server/release/kolab-server-2.2.3/sources/release-notes.txt; http://osvdb.org/61301; http://secunia.com/advisories/37918
CVE: CVE-2009-4825
Published: 2010-04-27
Description: 8pixel.net Blog 4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for App_Data/sb.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/61227; http://secunia.com/advisories/37846; http://www.exploit-db.com/exploits/10573
CVE: CVE-2009-4826
Published: 2010-04-27
Description: Cross-site request forgery (CSRF) vulnerability in hosting/admin_ac.php in ScriptsEz Mini Hosting Panel allows remote attackers to hijack the authentication of administrators for requests that alter administrative settings via a cp action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/37721; http://www.exploit-db.com/exploits/10444; http://www.vupen.com/english/advisories/2009/3525
CVE: CVE-2009-4827
Published: 2010-04-27
Description: Cross-site request forgery (CSRF) vulnerability in admin.php in Mail Manager Pro allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a change action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/37750; http://www.exploit-db.com/exploits/10433; http://www.vupen.com/english/advisories/2009/3533
CVE: CVE-2009-4828
Published: 2010-04-27
Description: Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an admin_created action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/37713; http://www.exploit-db.com/exploits/10438; http://www.vupen.com/english/advisories/2009/3530
CVE: CVE-2009-4829
Published: 2010-04-27
Description: Cross-site scripting (XSS) vulnerability in the Automated Logout module 6.x-1.x before 6.x-1.7 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users with administer autologout privileges to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-79
References: http://drupal.org/node/667084; http://drupal.org/node/667086; http://drupal.org/node/667094
CVE: CVE-2009-4830
Published: 2010-04-27
Description: Unspecified vulnerability in OpenX 2.8.1 and 2.8.2 allows remote attackers to bypass authentication and obtain access to an Administrator account via unknown vectors, possibly related to www/admin/install.php, www/admin/install-plugins.php, and other www/admin/ files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://blog.openx.org/12/security-matters-2/; http://forum.openx.org/index.php?showtopic=503454011; http://osvdb.org/61300
CVE: CVE-2010-0105
Published: 2010-04-27
Description: The hfs implementation in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 supports hard links to directories and does not prevent certain deeply nested directory structures, which allows local users to cause a denial of service (filesystem corruption) via a crafted application that calls the mkdir and link functions, related to the fsck_hfs program in the diskdev_cmds component.
CVSS Score: 4.9 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://securityreason.com/achievement_securityalert/83; http://support.apple.com/kb/HT4435
CVE: CVE-2010-0772
Published: 2010-04-27
Description: Unspecified vulnerability in the channel process in IBM WebSphere MQ 7.0 before 7.0.1.2 allows remote authenticated users to cause a denial of service (daemon crash) via "incorrect channel control data."
CVSS Score: 4.0 (MEDIUM)
References: http://securitytracker.com/id?1023961; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ68621; http://www.vupen.com/english/advisories/2010/1083
CVE: CVE-2010-1559
Published: 2010-04-27
Description: SQL injection vulnerability in the SermonSpeaker (com_sermonspeaker) component before 3.2.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a speakerpopup action to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://joomlacode.org/gf/project/sermon_speaker/forum/?action=ForumBrowse&forum_id=7897&_forum_action=ForumMessageBrowse&thread_id=15219; http://joomlacode.org/gf/project/sermon_speaker/news/?action=NewsThreadView&id=2549; http://secunia.com/advisories/39385
CVE: CVE-2010-1560
Published: 2010-04-27
Description: Buffer overflow in the REPEAT function in IBM DB2 9.1 before FP9 allows remote authenticated users to cause a denial of service (trap) via unspecified vectors. NOTE: this might overlap CVE-2010-0462.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://attrition.org/pipermail/vim/2010-April/002341.html; http://osvdb.org/64041; http://secunia.com/advisories/39500
CVE: CVE-2010-0738
Published: 2010-04-28
Description: The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-749
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9324&w=2; http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35; http://secunia.com/advisories/39563
CVE: CVE-2010-1036
Published: 2010-04-28
Description: Cross-site scripting (XSS) vulnerability in HP System Insight Manager before 6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6823&w=2; http://secunia.com/advisories/39645; http://securitytracker.com/id?1023927
CVE: CVE-2010-1037
Published: 2010-04-28
Description: Cross-site request forgery (CSRF) vulnerability in HP System Insight Manager before 6.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6823&w=2; http://secunia.com/advisories/39645; http://securitytracker.com/id?1023927
CVE: CVE-2010-1038
Published: 2010-04-28
Description: Unspecified vulnerability in HP System Insight Manager before 6.0 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6823&w=2; http://secunia.com/advisories/39645; http://securitytracker.com/id?1023927
CVE: CVE-2010-1428
Published: 2010-04-28
Description: The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-749
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8872&w=2; http://secunia.com/advisories/39563; http://securitytracker.com/id?1023917
CVE: CVE-2010-1429
Published: 2010-04-28
Description: Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.  NOTE: this issue exists because of a CVE-2008-3273 regression.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8872&w=2; http://secunia.com/advisories/39563; http://securitytracker.com/id?1023918
CVE: CVE-2010-1585
Published: 2010-04-28
Description: The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://downloads.avaya.com/css/P8/documents/100133195; http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment/; http://www.mandriva.com/security/advisories?name=MDVSA-2011:041
CVE: CVE-2010-1586
Published: 2010-04-28
Description: Open redirect vulnerability in red2301.html in HP System Management Homepage (SMH) 2.x.x.x allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the RedirectUrl parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/39676; http://yehg.net/lab/pr0js/advisories/hp_system_management_homepage_url_redirection_abuse; https://exchange.xforce.ibmcloud.com/vulnerabilities/58107
CVE: CVE-2010-1587
Published: 2010-04-28
Description: The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0278.html; http://secunia.com/advisories/39567; http://www.osvdb.org/64020
CVE: CVE-2010-1588
Published: 2010-04-28
Description: SQL injection vulnerability in the Getwebsess function in shopsessionsubs.asp in Rocksalt International VP-ASP Shopping Cart 6.50 and earlier allows remote attackers to execute arbitrary SQL commands via the websess parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0400.html; http://osvdb.org/61890; http://secunia.com/advisories/38283
CVE: CVE-2010-1589
Published: 2010-04-28
Description: Directory traversal vulnerability in shopsessionsubs.asp in Rocksalt International VP-ASP Shopping Cart 6.50 and earlier might allow remote attackers to determine the existence of arbitrary files via directory traversal sequences in the client's DNS hostname (aka the REMOTE_HOST variable), related to the CookielessGenerateFilename and CookielessReadFile functions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0400.html; http://osvdb.org/61891; http://secunia.com/advisories/38283
CVE: CVE-2010-1590
Published: 2010-04-28
Description: Cross-site scripting (XSS) vulnerability in shopsessionsubs.asp in Rocksalt International VP-ASP Shopping Cart 6.50 and earlier might allow remote attackers to inject arbitrary web script or HTML via the client's DNS hostname (aka the REMOTE_HOST variable), related to the CookielessGenerateFilename and CookielessReadFile functions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0400.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0400.html
CVE: CVE-2010-1591
Published: 2010-04-28
Description: Beijing Rising International Rising Antivirus 2008 through 2010 does not properly validate input to certain IOCTLs, including 0x83003C07, which allows local users to gain privileges via crafted IOCTL requests to the (1) HookCont.sys, (2) HookNtos.sys, (3) HOOKREG.sys, or (4) HookSys.sys device driver; or the (5) RsNTGdi.sys kernel module, reachable through \Device\RSNTGDI.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://osvdb.org/61946; http://secunia.com/advisories/38335; http://www.ntinternals.org/ntiadv0805/ntiadv0805.html
CVE: CVE-2010-1592
Published: 2010-04-28
Description: sandra.sys 15.18.1.1 and earlier in the Sandra Device Driver in SiSoftware Sandra 16.10.2010.1 and earlier allows local users to gain privileges or cause a denial of service (system crash) via unspecified vectors involving "Model-Specific Registers."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/61947; http://secunia.com/advisories/38212; http://www.ntinternals.org/ntiadv0808/ntiadv0808.html
CVE: CVE-2010-1593
Published: 2010-04-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0450.html; http://groups.google.com/group/silverstripe-announce/browse_thread/thread/f51749342eee9456; http://open.silverstripe.org/changeset/97074
CVE: CVE-2010-1594
Published: 2010-04-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in ocsreports/index.php in OCS Inventory NG 1.02.1 allow remote attackers to inject arbitrary web script or HTML via (1) the query string, (2) the BASE parameter, or (3) the ega_1 parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/61943; http://packetstormsecurity.org/1001-exploits/ocsinventoryng-sqlxss.txt; http://secunia.com/advisories/38311