deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2507
Published: 2009-10-14
Description: A certain ActiveX control in the Indexing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly process URLs, which allows remote attackers to execute arbitrary programs via unspecified vectors that cause a "vulnerable binary" to load and run, aka "Memory Corruption in Indexing Service Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-057; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6042
CVE: CVE-2009-2510
Published: 2009-10-14
Description: The CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, as used by Internet Explorer and other applications, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, aka "Null Truncation in X.509 Common Name Vulnerability," a related issue to CVE-2009-2408.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://www.networkworld.com/news/2009/073009-more-holes-found-in-webs.html; http://www.networkworld.com/news/2009/091709-microsoft-ie-security-hole.html; http://www.securityfocus.com/bid/36475
CVE: CVE-2009-2511
Published: 2009-10-14
Description: Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows man-in-the-middle attackers to spoof arbitrary SSL servers and other entities via an X.509 certificate that has a malformed ASN.1 Object Identifier (OID) and was issued by a legitimate Certification Authority, aka "Integer Overflow in X.509 Object Identifiers Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-056; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6186
CVE: CVE-2009-2515
Published: 2009-10-14
Description: Integer underflow in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows local users to gain privileges via a crafted application that triggers an incorrect truncation of a 64-bit integer to a 32-bit integer, aka "Windows Kernel Integer Underflow Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-058; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6506
CVE: CVE-2009-2516
Published: 2009-10-14
Description: The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly validate data sent from user mode, which allows local users to gain privileges via a crafted PE .exe file that triggers a NULL pointer dereference during chain traversal, aka "Windows Kernel NULL Pointer Dereference Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-476
References: http://www.nsfocus.com/en/advisories/0903.html; http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-058
CVE: CVE-2009-2517
Published: 2009-10-14
Description: The kernel in Microsoft Windows Server 2003 SP2 does not properly handle unspecified exceptions when an error condition occurs, which allows local users to cause a denial of service (reboot) via a crafted application, aka "Windows Kernel Exception Handler Vulnerability."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-058; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6512
CVE: CVE-2009-2518
Published: 2009-10-14
Description: Integer overflow in GDI+ in Microsoft Office XP SP3 allows remote attackers to execute arbitrary code via an Office document with a bitmap (aka BMP) image that triggers memory corruption, aka "Office BMP Integer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6430
CVE: CVE-2009-2524
Published: 2009-10-14
Description: Integer underflow in the NTLM authentication feature in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote attackers to cause a denial of service (reboot) via a malformed packet, aka "Local Security Authority Subsystem Service Integer Overflow Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-059; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6263
CVE: CVE-2009-2525
Published: 2009-10-14
Description: Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly initialize unspecified functions within compressed audio files, which allows remote attackers to execute arbitrary code via (1) a crafted media file or (2) crafted streaming content, aka "Windows Media Runtime Heap Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-051; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6484
CVE: CVE-2009-2526
Published: 2009-10-14
Description: Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted packet to the Server service, aka "SMBv2 Infinite Loop Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5595
CVE: CVE-2009-2527
Published: 2009-10-14
Description: Heap-based buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via (1) a crafted ASF file or (2) crafted streaming content, aka "WMP Heap Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-052; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6184
CVE: CVE-2009-2528
Published: 2009-10-14
Description: GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6426
CVE: CVE-2009-2529
Published: 2009-10-14
Description: Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "HTML Component Handling Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-054; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6419
CVE: CVE-2009-2530
Published: 2009-10-14
Description: Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-2531.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-054; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6190
CVE: CVE-2009-2531
Published: 2009-10-14
Description: Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-2530.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-054; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5766
CVE: CVE-2009-2532
Published: 2009-10-14
Description: Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in an SMB Multi-Protocol Negotiate Request packet, which allows remote attackers to execute arbitrary code via a crafted SMBv2 packet to the Server service, aka "SMBv2 Command Value Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6336
CVE: CVE-2009-2999
Published: 2009-10-14
Description: The com.android.phone process in Android 1.5 CRBxx allows remote attackers to cause a denial of service (application restart and network disconnection) via an SMS message containing a malformed WAP Push message that triggers an ArrayIndexOutOfBoundsException exception, possibly a related issue to CVE-2009-2656.
CVSS Score: 4.3 (MEDIUM)
References: http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=46e23fe762d2143d60589ab6d39c4b47c2c754d1; http://securitytracker.com/id?1022986; http://www.ocert.org/advisories/ocert-2009-014.html
CVE: CVE-2009-3126
Published: 2009-10-14
Description: Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted PNG image file, aka "GDI+ PNG Integer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6134
CVE: CVE-2009-3698
Published: 2009-10-14
Description: An unspecified function in the Dalvik API in Android 1.5 and earlier allows remote attackers to cause a denial of service (system process restart) via a crafted application, possibly a related issue to CVE-2009-2656.
CVSS Score: 4.3 (MEDIUM)
References: http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=cf4550c3198d6b3d92cdc52707fe70d7cc0caa9f; http://securitytracker.com/id?1022986; http://www.ocert.org/advisories/ocert-2009-014.html
CVE: CVE-2009-3029
Published: 2009-10-15
Description: Cross-site scripting (XSS) vulnerability in the console in Symantec SecurityExpressions Audit and Compliance Server 4.1.1, 4.1, and earlier allows remote authenticated users to inject arbitrary web script or HTML via "external client input" that triggers crafted error messages.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/36972; http://securitytracker.com/id?1022989; http://www.osvdb.org/58651
CVE: CVE-2009-3030
Published: 2009-10-15
Description: Cross-site scripting (XSS) vulnerability in Symantec SecurityExpressions Audit and Compliance Server 4.1.1, 4.1, and earlier allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an error message in a response, related to an "HTML Injection issue."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36972; http://securitytracker.com/id?1022989; http://www.osvdb.org/58650
CVE: CVE-2009-3699
Published: 2009-10-15
Description: Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825; http://secunia.com/advisories/36978
CVE: CVE-2009-2733
Published: 2009-10-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the scheduler title in the scheduler module, and the (2) atksearch[contractnumber], (3) atksearch_AE_customer[customer], (4) atksearchmode[contracttype], and possibly (5) atksearch[contractname] parameters to the Organization Contracts administration page, reachable through dispatch.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37035; http://securitytracker.com/id?1023017; http://www.achievo.org/download/releasenotes/1_4_0
CVE: CVE-2009-2734
Published: 2009-10-16
Description: SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter (aka user_id variable) to dispatch.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/37035; http://securitytracker.com/id?1023017; http://www.achievo.org/download/releasenotes/1_4_0
CVE: CVE-2009-2874
Published: 2009-10-16
Description: The TimesTenD process in Cisco Unified Presence 1.x, 6.x before 6.0(6), and 7.x before 7.0(4) allows remote attackers to cause a denial of service (process crash) via a large number of TCP connections to ports 16200 and 22794, aka Bug ID CSCsy17662.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/37039; http://securitytracker.com/id?1023018; http://www.cisco.com/en/US/products/products_security_advisory09186a0080afc930.shtml
CVE: CVE-2009-3281
Published: 2009-10-16
Description: The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 does not use correct file permissions, which allows host OS users to gain privileges on the host OS via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.vmware.com/pipermail/security-announce/2009/000066.html; http://secunia.com/advisories/36928; http://securitytracker.com/id?1022981
CVE: CVE-2009-3282
Published: 2009-10-16
Description: Integer overflow in the vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 allows host OS users to cause a denial of service to the host OS via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://lists.vmware.com/pipermail/security-announce/2009/000066.html; http://secunia.com/advisories/36928; http://securitytracker.com/id?1022981
CVE: CVE-2009-3696
Published: 2009-10-16
Description: Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name for a MySQL table.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.gentoo.org/show_bug.cgi?id=288899; http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html; http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html
CVE: CVE-2009-3697
Published: 2009-10-16
Description: SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.gentoo.org/show_bug.cgi?id=288899; http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html; http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html
CVE: CVE-2009-3705
Published: 2009-10-16
Description: PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the config_atkroot parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/0909-exploits/achievo134-rfi.txt; http://securitytracker.com/id?1023017; http://www.achievo.org/download/releasenotes/1_4_0
CVE: CVE-2009-3706
Published: 2009-10-16
Description: Unspecified vulnerability in the ZFS filesystem in Sun Solaris 10, and OpenSolaris snv_100 through snv_117, allows local users to bypass intended limitations of the file_chown_self privilege via certain uses of the chown system call.
CVSS Score: 4.4 (MEDIUM)
References: http://secunia.com/advisories/37010; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141444-09-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-265908-1
CVE: CVE-2009-3707
Published: 2009-10-16
Description: VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, and VMware Server 2.x allows remote attackers to cause a denial of service (process crash) via a \x25\xFF sequence in the USER and PASS commands, related to a "format string DoS" issue. NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://lists.vmware.com/pipermail/security-announce/2010/000090.html
CVE: CVE-2009-3708
Published: 2009-10-16
Description: Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-assisted remote attackers to execute arbitrary code via a long value in a (1) description or (2) keyword META tag.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/58649; http://secunia.com/advisories/36940; http://osvdb.org/58649
CVE: CVE-2009-3709
Published: 2009-10-16
Description: Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-assisted remote attackers to execute arbitrary code via a long value in a TITLE tag.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/58649; http://packetstormsecurity.org/0910-exploits/alleycode-overflow.txt; http://secunia.com/advisories/36940
CVE: CVE-2009-3710
Published: 2009-10-16
Description: RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username (dbadmin) and password (sq!us3r) for an SSH tunnel, which allows remote attackers to gain privileges via port 8022.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://osvdb.org/58858; http://packetstormsecurity.org/0910-exploits/riorey-passwd.txt; http://secunia.com/advisories/36971
CVE: CVE-2009-3711
Published: 2009-10-16
Description: Stack-based buffer overflow in the h_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2291&w=2; http://osvdb.org/58714; http://secunia.com/advisories/36991
CVE: CVE-2009-3712
Published: 2009-10-16
Description: Multiple SQL injection vulnerabilities in Ebay Clone 2009 allow remote attackers to execute arbitrary SQL commands via the (1) user_id parameter to feedback.php; and the item_id parameter to (2) view_full_size.php, (3) classifide_ad.php, and (4) crosspromoteitems.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35713; http://www.exploit-db.com/exploits/9125; https://exchange.xforce.ibmcloud.com/vulnerabilities/51675
CVE: CVE-2009-3713
Published: 2009-10-16
Description: SQL injection vulnerability in fichero.php in MorcegoCMS 1.7.6 and earlier allows remote attackers to execute arbitrary SQL commands via the query string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55796; http://secunia.com/advisories/35778; http://www.exploit-db.com/exploits/9121
CVE: CVE-2009-3714
Published: 2009-10-16
Description: Cross-site scripting (XSS) vulnerability in admin_login.php in MCshoutbox 1.1 allows remote attackers to inject arbitrary web script or HTML via the loginerror parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56062; http://secunia.com/advisories/35885; http://www.exploit-db.com/exploits/9205
CVE: CVE-2009-3715
Published: 2009-10-16
Description: Multiple SQL injection vulnerabilities in scr_login.php in MCshoutbox 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/56063; http://secunia.com/advisories/35885; http://www.exploit-db.com/exploits/9205
CVE: CVE-2009-3716
Published: 2009-10-16
Description: Unrestricted file upload vulnerability in admin.php in MCshoutbox 1.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in smilies/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/56064; http://secunia.com/advisories/35885; http://www.exploit-db.com/exploits/9205
CVE: CVE-2009-3717
Published: 2009-10-16
Description: Heap-based buffer overflow in LucVil PatPlayer 3.9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long URI in a playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/55746; http://secunia.com/advisories/35756; http://www.exploit-db.com/exploits/9102