deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3982
Published: 2009-12-17
Description: Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/37699; http://secunia.com/advisories/37783; http://secunia.com/advisories/37785
CVE: CVE-2009-3983
Published: 2009-12-17
Description: Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to send authenticated requests to arbitrary applications by replaying the NTLM credentials of a browser user.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://secunia.com/advisories/37699; http://secunia.com/advisories/37703
CVE: CVE-2009-3984
Published: 2009-12-17
Description: Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content (aka 204) status code and an empty body.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/37699; http://secunia.com/advisories/37703; http://secunia.com/advisories/37704
CVE: CVE-2009-3985
Published: 2009-12-17
Description: Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a related issue to CVE-2009-2654.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/37699; http://secunia.com/advisories/37704; http://secunia.com/advisories/37785
CVE: CVE-2009-3986
Published: 2009-12-17
Description: Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to execute arbitrary JavaScript with chrome privileges by leveraging a reference to a chrome window from a content window, related to the window.opener property.
CVSS Score: 7.6 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/37699; http://secunia.com/advisories/37704; http://secunia.com/advisories/37785
CVE: CVE-2009-3987
Published: 2009-12-17
Description: The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, generates different exception messages depending on whether the referenced COM object is listed in the registry, which allows remote attackers to obtain potentially sensitive information about installed software by making multiple calls that specify the ProgID values of different COM objects.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/37699; http://secunia.com/advisories/37785; http://securitytracker.com/id?1023346
CVE: CVE-2009-4336
Published: 2009-12-17
Description: Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth Calendar (pd_calendar) extension 0.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; https://exchange.xforce.ibmcloud.com/vulnerabilities/54780
CVE: CVE-2009-4337
Published: 2009-12-17
Description: SQL injection vulnerability in the Diocese of Portsmouth Calendar (pd_calendar) extension 0.4.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors, a different issue than CVE-2008-6691.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; https://exchange.xforce.ibmcloud.com/vulnerabilities/54779
CVE: CVE-2009-4338
Published: 2009-12-17
Description: SQL injection vulnerability in the Flash SlideShow (slideshow) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; https://exchange.xforce.ibmcloud.com/vulnerabilities/54781
CVE: CVE-2009-4339
Published: 2009-12-17
Description: SQL injection vulnerability in the Subscription (mf_subscription) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; https://exchange.xforce.ibmcloud.com/vulnerabilities/54782
CVE: CVE-2009-4340
Published: 2009-12-17
Description: Cross-site scripting (XSS) vulnerability in the No indexed Search (no_indexed_search) extension 0.2.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; https://exchange.xforce.ibmcloud.com/vulnerabilities/54784
CVE: CVE-2009-4341
Published: 2009-12-17
Description: SQL injection vulnerability in the No indexed Search (no_indexed_search) extension 0.2.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; https://exchange.xforce.ibmcloud.com/vulnerabilities/54783
CVE: CVE-2009-4342
Published: 2009-12-17
Description: SQL injection vulnerability in the Job Exchange (jobexchange) extension 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; https://exchange.xforce.ibmcloud.com/vulnerabilities/54785
CVE: CVE-2009-4343
Published: 2009-12-17
Description: Cross-site scripting (XSS) vulnerability in the Training Company Database (trainincdb) extension 0.4.7 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; https://exchange.xforce.ibmcloud.com/vulnerabilities/54786
CVE: CVE-2009-4344
Published: 2009-12-17
Description: Cross-site scripting (XSS) vulnerability in the ZID Linkliste (zid_linklist) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; https://exchange.xforce.ibmcloud.com/vulnerabilities/54789
CVE: CVE-2009-4345
Published: 2009-12-17
Description: Cross-site scripting (XSS) vulnerability in the vShoutbox (vshoutbox) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; https://exchange.xforce.ibmcloud.com/vulnerabilities/54787
CVE: CVE-2009-4346
Published: 2009-12-17
Description: Cross-site scripting (XSS) vulnerability in the Frontend news submitter with RTE (fe_rtenews) extension 1.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/; http://www.vupen.com/english/advisories/2009/3550; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE: CVE-2009-4347
Published: 2009-12-17
Description: Cross-site scripting (XSS) vulnerability in daloradius-users/login.php in daloRADIUS 0.9-8 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/daloradius-xss.txt; http://secunia.com/advisories/37751; http://www.securityfocus.com/archive/1/508473/100/0/threaded
CVE: CVE-2009-4348
Published: 2009-12-17
Description: Cross-site scripting (XSS) vulnerability in index.php in Harold Bakker's NewsScript (HB-NS) 1.3 allows remote attackers to inject arbitrary web script or HTML via the topic parameter in a topic action, a different vector than CVE-2006-2146.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37792; http://www.exploit-db.com/exploits/10466; http://secunia.com/advisories/37792
CVE: CVE-2009-4349
Published: 2009-12-17
Description: Cross-site request forgery (CSRF) vulnerability in administration/administrators.php in Link Up Gold 5.0 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/61017; http://packetstormsecurity.org/0912-exploits/linkupgold-xsrf.txt; http://secunia.com/advisories/37712
CVE: CVE-2009-4350
Published: 2009-12-17
Description: SQL injection vulnerability in index.php in Arctic Issue Tracker 2.1.1 allows remote attackers to execute arbitrary SQL commands via the (1) matchings[id] or (2) matchings[title] parameters in a Login action to an unspecified program, or (3) the matchings[id] parameter in a search action to index.php, a different vector than CVE-2008-3250.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/60957; http://packetstormsecurity.com/0912-exploits/arcticissue-xss.txt; http://secunia.com/advisories/37723
CVE: CVE-2009-4351
Published: 2009-12-17
Description: SQL injection vulnerability in ADMIN/loginaction.php in WSCreator 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the Email (aka username) parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/60987; http://secunia.com/advisories/37753; http://www.exploit-db.com/exploits/10446
CVE: CVE-2009-4352
Published: 2009-12-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in TransWARE Active! mail 2003 build 2003.0139.0871 and earlier, and possibly other versions before 2003.0139.0939, allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Cc, and (4) Bcc parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN49083120/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000075.html; http://secunia.com/advisories/37602
CVE: CVE-2009-4353
Published: 2009-12-17
Description: The Mobile Edition of TransWARE Active! mail 2003 build 2003.0139.0871 and earlier, and possibly other versions before 2003.0139.0911, does not remove the session ID in a Referer URL, which allows remote attackers to hijack web sessions via vectors such as an email with an embedded URL.
CVSS Score: 5.8 (MEDIUM)
References: http://jvn.jp/en/jp/JVN85821104/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000076.html; http://secunia.com/advisories/37602
CVE: CVE-2009-4354
Published: 2009-12-17
Description: TransWARE Active! mail 2003 build 2003.0139.0871 and earlier does not properly secure the session ID in a session cookie, which allows remote attackers to hijack web sessions, probably related to the "secure" flag for cookies in SSL sessions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-255
References: http://jvn.jp/en/jp/JVN36207497/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000077.html; http://www.transware.co.jp/support_am/security/vulnerability1.html
CVE: CVE-2009-3995
Published: 2009-12-18
Description: Multiple heap-based buffer overflows in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://forums.winamp.com/showthread.php?threadid=315355; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html; http://secunia.com/advisories/37495
CVE: CVE-2009-3997
Published: 2009-12-18
Description: Integer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57 might allow remote attackers to execute arbitrary code via an Oktalyzer file that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://forums.winamp.com/showthread.php?threadid=315355; http://secunia.com/advisories/37495; http://secunia.com/secunia_research/2009-57/
CVE: CVE-2007-2280
Published: 2009-12-18
Description: Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via an MSG_PROTOCOL command with long arguments, a different vulnerability than CVE-2009-3844.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2540&w=2; http://securitytracker.com/id?1023361; http://www.securityfocus.com/bid/37396
CVE: CVE-2007-2281
Published: 2009-12-18
Description: Integer overflow in the _ncp32._NtrpTCPReceiveMsg function in rds.exe in the Cell Manager Database Service in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via a large value in the size parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://dvlabs.tippingpoint.com/advisory/TPTI-09-15; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2540&w=2; http://securitytracker.com/id?1023361
CVE: CVE-2009-2875
Published: 2009-12-18
Description: Buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WebEx Recording Format (WRF) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/37810; http://securitytracker.com/id?1023360; http://tools.cisco.com/security/center/viewAlert.x?alertId=19499
CVE: CVE-2009-2876
Published: 2009-12-18
Description: Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted WebEx Recording Format (WRF) file, a different vulnerability than CVE-2009-2878 and CVE-2009-2879.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://fgc.fortinet.com/encyclopedia/vulnerability/fg-vd-09-012-cisco.html; http://secunia.com/advisories/37810; http://securitytracker.com/id?1023360
CVE: CVE-2009-2877
Published: 2009-12-18
Description: Stack-based buffer overflow in ataudio.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted WebEx Recording Format (WRF) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/37810; http://securitytracker.com/id?1023360; http://tools.cisco.com/security/center/viewAlert.x?alertId=19499
CVE: CVE-2009-2878
Published: 2009-12-18
Description: Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted WebEx Recording Format (WRF) file, a different vulnerability than CVE-2009-2876 and CVE-2009-2879.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://fgc.fortinet.com/encyclopedia/vulnerability/fg-vd-09-013-cisco.html; http://secunia.com/advisories/37810; http://securitytracker.com/id?1023360
CVE: CVE-2009-2879
Published: 2009-12-18
Description: Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted WebEx Recording Format (WRF) file, a different vulnerability than CVE-2009-2876 and CVE-2009-2878.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/37810; http://securitytracker.com/id?1023360; http://tools.cisco.com/security/center/viewAlert.x?alertId=19499
CVE: CVE-2009-2880
Published: 2009-12-18
Description: Buffer overflow in atrpui.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WebEx Recording Format (WRF) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/37810; http://securitytracker.com/id?1023360; http://tools.cisco.com/security/center/viewAlert.x?alertId=19499
CVE: CVE-2009-3703
Published: 2009-12-18
Description: Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/508504/100/0/threaded; http://www.securityfocus.com/bid/37357; http://www.securityfocus.com/archive/1/508504/100/0/threaded
CVE: CVE-2009-3996
Published: 2009-12-18
Description: Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via an Ultratracker file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://forums.winamp.com/showthread.php?threadid=315355; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html; http://secunia.com/advisories/37495
CVE: CVE-2009-4356
Published: 2009-12-18
Description: Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote attackers to execute arbitrary code via malformed (1) JPEG or (2) PNG data in an MP3 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://forums.winamp.com/showthread.php?threadid=315355; http://www.securityfocus.com/archive/1/508532/100/0/threaded; http://www.securityfocus.com/bid/37387
CVE: CVE-2009-4357
Published: 2009-12-18
Description: CQWeb (aka the web interface) in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/37811; http://securitytracker.com/id?1023370; http://www-01.ibm.com/support/docview.wss?uid=swg1PK86377
CVE: CVE-2009-4029
Published: 2009-12-20
Description: The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a race condition that allows local users to modify the contents of package files, introduce Trojan horse programs, or conduct other attacks before the build is complete.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-362
References: http://lists.gnu.org/archive/html/automake-patches/2009-11/msg00017.html; http://lists.gnu.org/archive/html/automake/2009-12/msg00010.html; http://lists.gnu.org/archive/html/automake/2009-12/msg00011.html
CVE: CVE-2009-4358
Published: 2009-12-20
Description: freebsd-update in FreeBSD 8.0, 7.2, 7.1, 6.4, and 6.3 uses insecure permissions in its working directory (/var/db/freebsd-update by default), which allows local users to read copies of sensitive files after a (1) freebsd-update fetch (fetch) or (2) freebsd-update upgrade (upgrade) operation.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/37575; http://security.freebsd.org/advisories/FreeBSD-SA-09:17.freebsd-update.asc; http://www.securityfocus.com/bid/37190
CVE: CVE-2009-4359
Published: 2009-12-20
Description: Cross-site scripting (XSS) vulnerability in folder.php in the SmartMedia 0.85 Beta module for XOOPS allows remote attackers to inject arbitrary web script or HTML via the categoryid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.packetstormsecurity.org/0911-exploits/xoopssmartmedia-xss.txt; http://www.securityfocus.com/bid/37156; https://exchange.xforce.ibmcloud.com/vulnerabilities/54488
CVE: CVE-2009-4360
Published: 2009-12-20
Description: SQL injection vulnerability in modules/content/index.php in the Content module 0.5 for XOOPS allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/exploitalert/7494; http://www.packetstormsecurity.org/0911-exploits/xoopscontent-sql.txt; http://www.securityfocus.com/bid/37155
CVE: CVE-2009-3701
Published: 2009-12-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHP_SELF variable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0388.html; http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.559&r2=1.515.2.589&ty=h; http://lists.horde.org/archives/announce/2009/000529.html
CVE: CVE-2009-3791
Published: 2009-12-21
Description: Unspecified vulnerability in Adobe Flash Media Server (FMS) before 3.5.3 allows attackers to cause a denial of service (resource exhaustion) via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.adobe.com/support/security/bulletins/apsb09-18.html; http://www.securityfocus.com/bid/37419; http://www.adobe.com/support/security/bulletins/apsb09-18.html