deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0464
Published: 2009-02-10
Description: PHP remote file inclusion vulnerability in includes/header.php in Groone GBook 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/51716; http://secunia.com/advisories/33768; http://www.securityfocus.com/bid/33578
CVE: CVE-2009-0465
Published: 2009-02-10
Description: The SaveDoc method in the All_In_The_Box.AllBox ActiveX control in ALL_IN_THE_BOX.OCX in Synactis ALL In-The-Box ActiveX 3 allows remote attackers to create and overwrite arbitrary files via an argument ending in a '\0' character, which bypasses the intended .box filename extension, as demonstrated by a C:\boot.ini\0 argument.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://osvdb.org/51693; http://secunia.com/advisories/33728; http://www.dsecrg.com/pages/vul/show.php?id=62
CVE: CVE-2009-0466
Published: 2009-02-10
Description: Cross-site scripting (XSS) vulnerability in Vivvo CMS before 4.1.1 allows remote attackers to inject arbitrary web script or HTML via a URI that triggers a 404 Page Not Found response.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33368; http://www.securityfocus.com/bid/33582; http://www.vivvo.net/changelog.php
CVE: CVE-2009-0467
Published: 2009-02-10
Description: Cross-site scripting (XSS) vulnerability in proxy.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allows remote attackers to inject arbitrary web script or HTML via the proxy parameter in a deny_log manage action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51659; http://secunia.com/advisories/33739; http://www.securityfocus.com/bid/33523
CVE: CVE-2009-0468
Published: 2009-02-10
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in ajax.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allow remote attackers to hijack the authentication of administrators for requests that (1) shutdown the server, (2) send ping packets, (3) enable network services, (4) configure a proxy server, and (5) modify other settings via parameters in the query string.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/51660; http://secunia.com/advisories/33739; http://www.securityfocus.com/bid/33523
CVE: CVE-2009-0469
Published: 2009-02-10
Description: Unspecified vulnerability in futomi's CGI Cafe Fulltext search CGI 1.1.2 allows remote attackers to gain administrative privileges via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN80771386/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000008.html; http://www.futomi.com/library/info/2009/20090123.html
CVE: CVE-2008-6099
Published: 2009-02-10
Description: PHP remote file inclusion vulnerability in index.php in RPortal 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the file_op parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32075; http://www.securityfocus.com/archive/1/496891/100/0/threaded; http://www.securityfocus.com/bid/31523
CVE: CVE-2008-6100
Published: 2009-02-10
Description: Multiple SQL injection vulnerabilities in Discussion Forums 2k 3.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) CatID parameter to (a) RSS1.php and (b) RSS2.php in misc/; and the (2) SubID parameter to (c) misc/RSS5.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31518; https://exchange.xforce.ibmcloud.com/vulnerabilities/45610; https://www.exploit-db.com/exploits/6643
CVE: CVE-2008-6101
Published: 2009-02-10
Description: SQL injection vulnerability in click.php in Adult Banner Exchange Website allows remote attackers to execute arbitrary SQL commands via the targetid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0809-exploits/abe-sql.txt; http://secunia.com/advisories/32067; http://www.securityfocus.com/bid/31510
CVE: CVE-2008-6102
Published: 2009-02-10
Description: SQL injection vulnerability in ratelink.php in Link Trader Script allows remote attackers to execute arbitrary SQL commands via the lnkid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32077; http://www.securityfocus.com/bid/31526; https://exchange.xforce.ibmcloud.com/vulnerabilities/45605
CVE: CVE-2008-6103
Published: 2009-02-10
Description: PHP remote file inclusion vulnerability in index.php in A4Desk Event Calendar, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the v parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.org/0809-exploits/a4deskphp-rfi.txt; http://secunia.com/advisories/32083; http://www.securityfocus.com/bid/31507
CVE: CVE-2008-6104
Published: 2009-02-10
Description: SQL injection vulnerability in A4Desk PHP Event Calendar allows remote attackers to execute arbitrary SQL commands via the eventid parameter to admin/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0810-exploits/a4desk-sqldisclose.txt; http://secunia.com/advisories/32083; http://www.securityfocus.com/bid/33835
CVE: CVE-2008-6105
Published: 2009-02-10
Description: Cross-site scripting (XSS) vulnerability in IBM Workplace for Business Controls and Reporting 2.x and IBM Workplace Web Content Management 6.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30433; http://www-1.ibm.com/support/docview.wss?uid=swg1PJ33180; http://www.securityfocus.com/bid/29625
CVE: CVE-2008-6106
Published: 2009-02-10
Description: Cross-site request forgery (CSRF) vulnerability in IBM Workplace for Business Controls and Reporting 2.x and IBM Workplace Web Content Management 6.x has unknown impact and remote attack vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/30433; http://www-1.ibm.com/support/docview.wss?uid=swg1PJ33180; http://www.securitytracker.com/id?1020236
CVE: CVE-2008-6107
Published: 2009-02-10
Description: The (1) sys32_mremap function in arch/sparc64/kernel/sys_sparc32.c, the (2) sparc_mmap_check function in arch/sparc/kernel/sys_sparc.c, and the (3) sparc64_mmap_check function in arch/sparc64/kernel/sys_sparc.c, in the Linux kernel before 2.6.25.4, omit some virtual-address range (aka span) checks when the mremap MREMAP_FIXED bit is not set, which allows local users to cause a denial of service (panic) via unspecified mremap calls, a related issue to CVE-2008-2137.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]4610&w=2; http://secunia.com/advisories/30258; http://securitytracker.com/id?1020120
CVE: CVE-2008-6108
Published: 2009-02-10
Description: Cross-site scripting (XSS) vulnerability in result.php in Galatolo WebManager (GWM) 1.0 allows remote attackers to inject arbitrary web script or HTML via the key parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/5758; https://www.exploit-db.com/exploits/5758
CVE: CVE-2008-4283
Published: 2009-02-10
Description: CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www-1.ibm.com/support/docview.wss?uid=isg1SE35864; http://www-1.ibm.com/support/docview.wss?uid=swg1PK69929; http://www.securityfocus.com/bid/33700
CVE: CVE-2008-4284
Published: 2009-02-10
Description: Open redirect vulnerability in the ibm_security_logout servlet in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.x versions, 6.0.x before 6.0.2.33, and 6.1.x before 6.1.0.23 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage feature.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-59
References: http://www-1.ibm.com/support/docview.wss?uid=swg21320242; http://www-1.ibm.com/support/docview.wss?uid=swg24021527; http://www.securityfocus.com/bid/33700
CVE: CVE-2009-0075
Published: 2009-02-10
Description: Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to CFunctionPointer and the appending of document objects, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://osvdb.org/51839; http://www.securityfocus.com/bid/33627; http://www.us-cert.gov/cas/techalerts/TA09-041A.html
CVE: CVE-2009-0076
Published: 2009-02-10
Description: Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directive in conjunction with unspecified other directives in a malformed Cascading Style Sheets (CSS) stylesheet in a crafted HTML document, aka "CSS Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/cas/techalerts/TA09-041A.html; http://www.vupen.com/english/advisories/2009/0389; http://www.zerodayinitiative.com/advisories/ZDI-09-012/
CVE: CVE-2009-0095
Published: 2009-02-10
Description: Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 does not properly validate object data in Visio files, which allows remote attackers to execute arbitrary code via a crafted file, aka "Memory Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/cas/techalerts/TA09-041A.html; http://www.vupen.com/english/advisories/2009/0391; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-005
CVE: CVE-2009-0096
Published: 2009-02-10
Description: Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 does not properly perform memory copy operations for object data, which allows remote attackers to execute arbitrary code via a crafted Visio document, aka "Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/cas/techalerts/TA09-041A.html; http://www.vupen.com/english/advisories/2009/0391; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-005
CVE: CVE-2009-0097
Published: 2009-02-10
Description: Microsoft Office Visio 2002 SP2 and 2003 SP3 does not properly validate memory allocation for Visio files, which allows remote attackers to execute arbitrary code via a crafted file, aka "Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/cas/techalerts/TA09-041A.html; http://www.vupen.com/english/advisories/2009/0391; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-005
CVE: CVE-2009-0098
Published: 2009-02-10
Description: Microsoft Exchange 2000 Server SP3, Exchange Server 2003 SP2, and Exchange Server 2007 SP1 do not properly interpret Transport Neutral Encapsulation (TNEF) properties, which allows remote attackers to execute arbitrary code via a crafted TNEF message, aka "Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://osvdb.org/51837; http://secunia.com/advisories/33838; http://www.us-cert.gov/cas/techalerts/TA09-041A.html
CVE: CVE-2009-0099
Published: 2009-02-10
Description: The Electronic Messaging System Microsoft Data Base (EMSMDB32) provider in Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2, as used in Exchange System Attendant, allows remote attackers to cause a denial of service (application outage) via a malformed MAPI command, aka "Literal Processing Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/51838; http://secunia.com/advisories/33838; http://www.us-cert.gov/cas/techalerts/TA09-041A.html
CVE: CVE-2009-0305
Published: 2009-02-10
Description: Multiple stack-based buffer overflows in the Research in Motion RIM AxLoader ActiveX control in AxLoader.ocx and AxLoader.dll in BlackBerry Application Web Loader 1.0 allow remote attackers to execute arbitrary code via unspecified use of the (1) load or (2) loadJad method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blackberry.com/btsc/KB16248; http://osvdb.org/51833; http://secunia.com/advisories/33847
CVE: CVE-2009-0432
Published: 2009-02-10
Description: The installation process for the File Transfer servlet in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19 does not enable the secure version, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://www-01.ibm.com/support/docview.wss?uid=swg27007951; http://www-1.ibm.com/support/docview.wss?uid=swg1PK59108; http://www.securityfocus.com/bid/33700
CVE: CVE-2009-0433
Published: 2009-02-10
Description: Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1.x before 5.1.1.19, 6.0.x before 6.0.2.29, and 6.1.x before 6.1.0.19, when Web Server plug-in content buffering is enabled, allows attackers to cause a denial of service (daemon crash) via unknown vectors, related to a mishandling of client read failures in which clients receive many 500 HTTP error responses and backend servers are incorrectly labeled as down.
CVSS Score: 2.6 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PK67161; http://www-01.ibm.com/support/docview.wss?uid=swg27006879; http://www-01.ibm.com/support/docview.wss?uid=swg27007033
CVE: CVE-2009-0434
Published: 2009-02-10
Description: PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.31, 6.1.x before 6.1.0.21, and 7.0.x before 7.0.0.1, when Performance Monitoring Infrastructure (PMI) is enabled, allows local users to obtain sensitive information by reading the (1) systemout.log and (2) ffdc files.  NOTE: this is probably a duplicate of CVE-2008-5413.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg27006876; http://www-01.ibm.com/support/docview.wss?uid=swg27007951; http://www-01.ibm.com/support/docview.wss?uid=swg27014463
CVE: CVE-2009-0435
Published: 2009-02-10
Description: Unspecified vulnerability in the IBM Asynchronous I/O (aka AIO or libibmaio) library in the Java Message Service (JMS) component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.17 on AIX 5.3 allows attackers to cause a denial of service (daemon crash) via vectors related to the aio_getioev2 and getEvent methods.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?rs=0&uid=swg24019205; http://www-01.ibm.com/support/docview.wss?uid=swg27007951; http://www.securityfocus.com/bid/33700
CVE: CVE-2009-0436
Published: 2009-02-10
Description: The (1) mod_ibm_ssl and (2) mod_cgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server (WAS), set incorrect permissions for AF_UNIX sockets, which has unknown impact and local attack vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg27006876; http://www-01.ibm.com/support/docview.wss?uid=swg27007033; http://www-01.ibm.com/support/docview.wss?uid=swg27007951
CVE: CVE-2009-0437
Published: 2009-02-10
Description: The Installation Factory installation process for IBM WebSphere Application Server (WAS) 6.0.2 on Windows, when WAS is registered as a Windows service, allows local users to obtain sensitive information by reading the logs/instconfigifwas6.log log file.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://www-1.ibm.com/support/docview.wss?uid=swg1PK67405; http://www.securityfocus.com/bid/33849; https://exchange.xforce.ibmcloud.com/vulnerabilities/48527
CVE: CVE-2009-0438
Published: 2009-02-10
Description: IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 on Windows allows remote attackers to bypass "Authorization checking" and obtain sensitive information from JSP pages via a crafted request.  NOTE: this is probably a duplicate of CVE-2008-5412.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg27014463; http://www-1.ibm.com/support/docview.wss?uid=swg1PK75248; http://www.securityfocus.com/bid/33700
CVE: CVE-2008-6109
Published: 2009-02-11
Description: Robin Rawson-Tetley Animal Shelter Manager (ASM) before 2.2.2 does not properly enforce the privileges of user accounts, which allows local users to bypass intended access restrictions by (1) opening unspecified screens, related to the "double click selector bug"; or modifying a (2) animal, (3) owner, (4) lost/found, (5) diary note, (6) owner donation, or (7) waiting list record, related to "change permissions" and the "new UI."
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30041; http://sourceforge.net/project/shownotes.php?group_id=82533&release_id=596220; http://www.securityfocus.com/bid/29022
CVE: CVE-2009-0455
Published: 2009-02-11
Description: Cross-site scripting (XSS) vulnerability in the anonymous comments feature in lib-comment.php in glFusion 1.1.0, 1.1.1, and earlier versions allows remote attackers to inject arbitrary web script or HTML via the username parameter to comment.php.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/33878; http://www.fortconsult.net/images/pdf/advisories/glFusion-xss-advisory.pdf; http://www.glfusion.org/article.php/xsscomments
CVE: CVE-2009-0475
Published: 2009-02-11
Description: Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2.0 and earlier allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a crafted MP3 file that triggers heap corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://android.git.kernel.org/?p=platform/external/opencore.git%3Ba=commit%3Bh=7b466cd0ecfdba72c4cbd0f3a8c[PII_REDACTED]b0f; http://review.source.android.com/Gerrit#change%2C8815; http://www.ocert.org/advisories/ocert-2009-002.html
CVE: CVE-2009-0513
Published: 2009-02-11
Description: Multiple PHP remote file inclusion vulnerabilities in WebFrame 0.76 allow remote attackers to execute arbitrary PHP code via a URL in the classFiles parameter to (1) admin/doc/index.php, (2) index.php, and (3) base/menu.php in mod/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/33701; https://www.exploit-db.com/exploits/8025; http://www.securityfocus.com/bid/33701
CVE: CVE-2009-0514
Published: 2009-02-11
Description: Multiple directory traversal vulnerabilities in WebFrame 0.76 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) currentmod and (2) LANG parameters to mod/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/33701; https://www.exploit-db.com/exploits/8025; http://www.securityfocus.com/bid/33701
CVE: CVE-2009-0515
Published: 2009-02-11
Description: Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/33862; http://www.securityfocus.com/bid/33704; http://www.vupen.com/english/advisories/2009/0383
CVE: CVE-2009-0516
Published: 2009-02-11
Description: SQL injection vulnerability in the classified page (classified.php) in BusinessSpace 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33875; http://www.securityfocus.com/archive/1/500787/100/0/threaded; http://www.securityfocus.com/bid/33692
CVE: CVE-2009-0517
Published: 2009-02-11
Description: Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fields parameter, which is supplied to an eval function call within the generic function in include/class/tz_env.class.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://osvdb.org/51727; http://secunia.com/advisories/33717; http://www.securityfocus.com/archive/1/500664/100/0/threaded
CVE: CVE-2008-6110
Published: 2009-02-11
Description: Unspecified vulnerability in SemanticScuttle before 0.90 has unknown impact and attack vectors related to improper validation of parameters to profile.php.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/32722; http://sourceforge.net/project/shownotes.php?release_id=640424; http://secunia.com/advisories/32722
CVE: CVE-2008-6111
Published: 2009-02-11
Description: SQL injection vulnerability in blog.php in NetArt Media Vlog System 1.1 allows remote attackers to execute arbitrary SQL commands via the note parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32784; http://www.securityfocus.com/bid/32425; http://www.vupen.com/english/advisories/2008/3247
CVE: CVE-2008-6112
Published: 2009-02-11
Description: Multiple directory traversal vulnerabilities in Ez Ringtone Manager allow remote attackers to read arbitrary files via a .. (dot dot) in the id parameter in a detail action to (1) main.php and (2) template.php in ringtones/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32767; http://www.securityfocus.com/bid/32431; http://www.vupen.com/english/advisories/2008/3244
CVE: CVE-2008-6113
Published: 2009-02-11
Description: Cross-site scripting (XSS) vulnerability in SemanticScuttle before 0.90 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the (1) username and (2) profile page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32722; http://sourceforge.net/project/shownotes.php?release_id=640424; http://www.securityfocus.com/bid/32409
CVE: CVE-2008-6114
Published: 2009-02-11
Description: SQL injection vulnerability in product_details.php in the Mytipper Zogo-shop 1.15.4 plugin for e107 allows remote attackers to execute arbitrary SQL commands via the product parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32795; http://www.securityfocus.com/bid/32423; https://exchange.xforce.ibmcloud.com/vulnerabilities/46784
CVE: CVE-2008-6115
Published: 2009-02-11
Description: SQL injection vulnerability in directory.php in Prozilla Hosting Index allows remote attackers to execute arbitrary SQL commands via the id parameter in a deadlink action, a different vector than CVE-2008-2083.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32754; http://www.securityfocus.com/bid/32427; http://www.vupen.com/english/advisories/2008/3242
CVE: CVE-2008-6116
Published: 2009-02-11
Description: SQL injection vulnerability in the EXtrovert Software Thyme (com_thyme) 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the event parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32417; https://exchange.xforce.ibmcloud.com/vulnerabilities/46777; https://www.exploit-db.com/exploits/7182
CVE: CVE-2008-6117
Published: 2009-02-11
Description: SQL injection vulnerability in homepage.php in PG Job Site Pro allows remote attackers to execute arbitrary SQL commands via the poll_view_id parameter in a results action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32837; http://www.securityfocus.com/bid/32434; http://www.vupen.com/english/advisories/2008/3237