deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-3303
Published: 2011-10-06
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.0(8.13), 7.1 and 7.2 before 7.2(5.4), 8.0 before 8.0(5.25), 8.1 before 8.1(2.50), 8.2 before 8.2(5.6), 8.3 before 8.3(2.23), 8.4 before 8.4(2.7), and 8.5 before 8.5(1.1) and Cisco Firewall Services Module (aka FWSM) 3.1 before 3.1(21), 3.2 before 3.2(22), 4.0 before 4.0(16), and 4.1 before 4.1(7) allow remote attackers to cause a denial of service (device reload) via malformed ILS traffic, aka Bug IDs CSCtq57697 and CSCtq57802.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/76090; http://www.cisco.com/warp/public/707/cisco-sa-20111005-asa.shtml; http://www.cisco.com/warp/public/707/cisco-sa-20111005-fwsm.shtml
CVE: CVE-2011-3304
Published: 2011-10-06
Description: Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.2 before 7.2(5.3), 8.0 before 8.0(5.25), 8.1 before 8.1(2.50), 8.2 before 8.2(5.11), 8.3 before 8.3(2.23), 8.4 before 8.4(2), and 8.5 before 8.5(1.1) allow remote attackers to cause a denial of service (device reload) via crafted MSN Instant Messenger traffic, aka Bug ID CSCtl67486.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/76091; http://www.cisco.com/warp/public/707/cisco-sa-20111005-asa.shtml; http://www.securityfocus.com/bid/49952
CVE: CVE-2011-3305
Published: 2011-10-06
Description: Directory traversal vulnerability in Cisco Network Admission Control (NAC) Manager 4.8.x allows remote attackers to read arbitrary files via crafted traffic to TCP port 443, aka Bug ID CSCtq10755.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://osvdb.org/76080; http://secunia.com/advisories/46309; http://www.cisco.com/warp/public/707/cisco-sa-20111005-nac.shtml
CVE: CVE-2011-3332
Published: 2011-10-06
Description: Stack-based buffer overflow in Iceni Argus 6.20 and earlier and Infix 5.04 allows remote attackers to execute arbitrary code via a crafted PDF document that uses flate compression.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/76096; http://secunia.com/advisories/46320; http://www.kb.cert.org/vuls/id/225833
CVE: CVE-2011-2190
Published: 2011-10-07
Description: The generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for seeding of a random number generator, which makes it easier for local users to determine admin passwords via a brute-force attack.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://code.google.com/p/cherokee/issues/detail?id=1212; http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066222.html; http://www.cherokee-project.com/download/LATEST_is_1.2.99/cherokee-1.2.99.tar.gz
CVE: CVE-2011-2191
Published: 2011-10-07
Description: Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, as demonstrated by a crafted nickname field to vserver/apply.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066222.html; http://osvdb.org/72693; http://seclists.org/fulldisclosure/2011/Jun/0
CVE: CVE-2010-4870
Published: 2011-10-07
Description: SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1010-exploits/bloofoxcms-sql.txt; http://securityreason.com/securityalert/8427; http://www.exploit-db.com/exploits/15328
CVE: CVE-2010-4871
Published: 2011-10-07
Description: Unspecified vulnerability in SmartFTP before 4.0 Build 1142 allows attackers to have an unknown impact via a long filename.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/69136; http://secunia.com/advisories/42060; http://smartftp.com/forums/index.php?/topic/16425-smartftp-client-4-0-change-log
CVE: CVE-2010-4872
Published: 2011-10-07
Description: SQL injection vulnerability in newsroom.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL commands via the specific parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/95777/aspilotpilotcart-sql.txt; http://securityreason.com/securityalert/8428; http://www.exploit-db.com/exploits/15497
CVE: CVE-2010-4873
Published: 2011-10-07
Description: Cross-site scripting (XSS) vulnerability in confirm.php in WeBid 0.8.5 P1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/69103; http://packetstormsecurity.org/1011-exploits/webid085p1-xss.txt; http://secunia.com/advisories/42171
CVE: CVE-2010-4874
Published: 2011-10-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name, (2) last_name, (3) msn, or (4) aim parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1010-exploits/ninkobb-xss.txt; http://secunia.com/advisories/41933; http://securityreason.com/securityalert/8430
CVE: CVE-2010-4875
Published: 2011-10-07
Description: Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/69084; http://packetstormsecurity.org/1011-exploits/wpvodpod-xss.txt; http://secunia.com/advisories/42195
CVE: CVE-2010-4876
Published: 2011-10-07
Description: SQL injection vulnerability in viewpost.php in mBlogger 1.0.04 allows remote attackers to execute arbitrary SQL commands via the postID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14849; http://www.vupen.com/english/advisories/2010/2265; http://www.exploit-db.com/exploits/14849
CVE: CVE-2010-4877
Published: 2011-10-07
Description: Cross-site scripting (XSS) vulnerability in index.php in OneCMS 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the view parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1009-exploits/onecms-xss.txt; http://securityreason.com/securityalert/8432; http://www.securityfocus.com/bid/42949
CVE: CVE-2010-4878
Published: 2011-10-07
Description: PHP remote file inclusion vulnerability in formmailer.php in Kontakt Formular 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the script_pfad parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/14809; http://www.exploit-db.com/exploits/14809
CVE: CVE-2010-4879
Published: 2011-10-07
Description: PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the input_file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/14851; http://www.exploit-db.com/exploits/14851
CVE: CVE-2010-4880
Published: 2011-10-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in calendar.class.php in ApPHP Calendar (ApPHP CAL) allow remote attackers to inject arbitrary web script or HTML via the (1) category_name, (2) category_description, (3) event_name, or (4) event_description parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1008-advisories/apphp-xssxsrf.txt; http://securityreason.com/securityalert/8433; http://www.securityfocus.com/archive/1/513445/100/0/threaded
CVE: CVE-2010-4881
Published: 2011-10-07
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in calendar.class.php in ApPHP Calendar (ApPHP CAL) allow remote attackers to hijack the authentication of unspecified victims for requests that use the (1) category_name, (2) category_description, (3) event_name, or (4) event_description parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.org/1008-advisories/apphp-xssxsrf.txt; http://securityreason.com/securityalert/8433; http://www.securityfocus.com/archive/1/513445/100/0/threaded
CVE: CVE-2010-4882
Published: 2011-10-07
Description: Cross-site scripting (XSS) vulnerability in autocms.php in Auto CMS 1.6 allows remote attackers to inject arbitrary web script or HTML via the sitetitle parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8434; http://www.htbridge.ch/advisory/xss_vulnerability_in_auto_cms.html; http://www.securityfocus.com/archive/1/513361/100/0/threaded
CVE: CVE-2010-4883
Published: 2011-10-07
Description: Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://modxcms.com/forums/index.php/topic%2C55104.0.html; http://modxcms.com/forums/index.php/topic%2C55105.0.html; http://packetstormsecurity.org/1009-exploits/modx202pl-xss.txt
CVE: CVE-2010-4884
Published: 2011-10-07
Description: PHP remote file inclusion vulnerability in guestbook/gbook.php in Gaestebuch 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the script_pfad parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1008-exploits/hinnendahlgb-rfi.txt; http://securityreason.com/securityalert/8436; http://www.exploit-db.com/exploits/14810
CVE: CVE-2010-4885
Published: 2011-10-07
Description: Cross-site scripting (XSS) vulnerability in the XING Button (xing) extension before 1.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41269; http://typo3.org/extensions/repository/view/xing/1.0.2/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/
CVE: CVE-2010-4886
Published: 2011-10-07
Description: Cross-site scripting (XSS) vulnerability in the "official twitter tweet button for your page" (tweetbutton) extension before 1.0.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41268; http://typo3.org/extensions/repository/view/tweetbutton/1.0.5/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/
CVE: CVE-2010-4887
Published: 2011-10-07
Description: SQL injection vulnerability in the Commenting system Backend Module (commentsbe) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/
CVE: CVE-2010-4888
Published: 2011-10-07
Description: SQL injection vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/
CVE: CVE-2010-4889
Published: 2011-10-07
Description: Unspecified vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/
CVE: CVE-2010-4890
Published: 2011-10-07
Description: Cross-site scripting (XSS) vulnerability in the Yet Another Calendar (ke_yac) extension before 1.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/extensions/repository/view/ke_yac/1.1.2/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/; http://www.securityfocus.com/bid/42945
CVE: CVE-2010-4891
Published: 2011-10-07
Description: SQL injection vulnerability in the Yet Another Calendar (ke_yac) extension before 1.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://typo3.org/extensions/repository/view/ke_yac/1.1.2/; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-018/; http://www.securityfocus.com/bid/42945
CVE: CVE-2010-4892
Published: 2011-10-07
Description: Cross-site scripting (XSS) vulnerability in the powermail extension before 1.5.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41962; http://typo3.org/extensions/repository/view/powermail/1.5.5; http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-021
CVE: CVE-2011-3868
Published: 2011-10-07
Description: Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5, VMware Fusion 3.1.x before 3.1.3, and VMware AMS allows remote attackers to execute arbitrary code via a crafted UDF filesystem in an ISO image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/76060; http://secunia.com/advisories/46241; http://security.gentoo.org/glsa/glsa-201209-25.xml
CVE: CVE-2011-0333
Published: 2011-10-08
Description: Heap-based buffer overflow in the NgwiCalVTimeZoneBody::ParseSelf function in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted TZNAME variable in a VCALENDAR attachment in an e-mail message, related to an "integer truncation error."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/secunia_research/2011-66/; http://www.novell.com/support/viewContent.do?externalId=7009208; https://bugzilla.novell.com/show_bug.cgi?id=678715
CVE: CVE-2011-0334
Published: 2011-10-08
Description: Stack-based buffer overflow in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a long HTTP request for a .css file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/secunia_research/2011-67/; http://www.novell.com/support/viewContent.do?externalId=7009210; https://bugzilla.novell.com/show_bug.cgi?id=678939
CVE: CVE-2011-1696
Published: 2011-10-08
Description: Cross-site scripting (XSS) vulnerability in Novell Identity Manager (aka IDM) User Application 3.5.0, 3.5.1, 3.6.0, 3.6.1, 3.7.0, and 4.0.0, and Identity Manager Roles Based Provisioning Module 3.6.0, 3.6.1, 3.7.0, and 4.0.0, allows remote attackers to inject arbitrary web script or HTML via the apwaDetail (aka apwaDetailId) parameter, aka Bug 692972.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5111710.html; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5111711.html; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5112230.html
CVE: CVE-2011-2218
Published: 2011-10-08
Description: Unspecified vulnerability in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors, a different vulnerability than CVE-2011-2219.
CVSS Score: 5.0 (MEDIUM)
References: http://www.novell.com/support/viewContent.do?externalId=7006378; https://bugzilla.novell.com/show_bug.cgi?id=582471; http://www.novell.com/support/viewContent.do?externalId=7006378
CVE: CVE-2011-2219
Published: 2011-10-08
Description: Unspecified vulnerability in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors, a different vulnerability than CVE-2011-2218.
CVSS Score: 5.0 (MEDIUM)
References: http://www.novell.com/support/viewContent.do?externalId=7006378; https://bugzilla.novell.com/show_bug.cgi?id=582471; http://www.novell.com/support/viewContent.do?externalId=7006378
CVE: CVE-2011-2227
Published: 2011-10-08
Description: Cross-site scripting (XSS) vulnerability in Novell Identity Manager (aka IDM) User Application 3.5.0, 3.5.1, 3.6.0, 3.6.1, 3.7.0, and 4.0.0, and Identity Manager Roles Based Provisioning Module 3.6.0, 3.6.1, 3.7.0, and 4.0.0, allows remote attackers to inject arbitrary web script or HTML via the apwaDetail (aka apwaDetailId) parameter, aka Bug 709603.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5111710.html; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5111711.html; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5112230.html
CVE: CVE-2011-2661
Published: 2011-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 8.0 before HP3 allow remote attackers to inject arbitrary web script or HTML via the (1) Directory.Item.name or (2) Directory.Item.displayName parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.novell.com/support/viewContent.do?externalId=7009214; https://bugzilla.novell.com/show_bug.cgi?id=702786; http://www.novell.com/support/viewContent.do?externalId=7009214
CVE: CVE-2011-2662
Published: 2011-10-08
Description: Integer signedness error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a negative BYWEEKNO property in a weekly RRULE variable in a VCALENDAR attachment in an e-mail message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://www.novell.com/support/viewContent.do?externalId=7009215; https://bugzilla.novell.com/show_bug.cgi?id=707527; https://labs.idefense.com/verisign/intelligence/2009/vulnerabilities/display.php?id=947
CVE: CVE-2011-2663
Published: 2011-10-08
Description: Array index error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted yearly RRULE variable in a VCALENDAR attachment in an e-mail message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.novell.com/support/viewContent.do?externalId=7009216; http://www.securityfocus.com/archive/1/519875/100/0/threaded; https://bugzilla.novell.com/show_bug.cgi?id=705917
CVE: CVE-2011-3598
Published: 2011-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpPgAdmin before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) a web page title, related to classes/Misc.php; or the (2) return_url or (3) return_desc parameter to display.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://freshmeat.net/projects/phppgadmin/releases/336969; http://lists.fedoraproject.org/pipermail/package-announce/2011-October/067843.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-October/067846.html
CVE: CVE-2010-4893
Published: 2011-10-08
Description: Cross-site scripting (XSS) vulnerability in foodvendors.php in FestOS 2.3b allows remote attackers to inject arbitrary web script or HTML via the category parameter in a details action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41327; http://www.exploit-db.com/exploits/14948; https://exchange.xforce.ibmcloud.com/vulnerabilities/61691
CVE: CVE-2010-4894
Published: 2011-10-08
Description: SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbitrary SQL commands via the name parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/67836; http://packetstormsecurity.org/1009-exploits/chillycms-sqlxss.txt; http://secunia.com/advisories/41313
CVE: CVE-2010-4895
Published: 2011-10-08
Description: Cross-site scripting (XSS) vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the username field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1009-exploits/chillycms-sqlxss.txt; http://secunia.com/advisories/41313; http://securityreason.com/securityalert/8437
CVE: CVE-2010-4896
Published: 2011-10-08
Description: Cross-site scripting (XSS) vulnerability in admin/index.asp in Member Management System 4.0 allows remote attackers to inject arbitrary web script or HTML via the REF_URL parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/67898; http://pridels-team.blogspot.com/2010/09/member-management-system-v-40-xss-vuln.html; http://secunia.com/advisories/41362
CVE: CVE-2010-4897
Published: 2011-10-08
Description: SQL injection vulnerability in comment.php in BlueCMS 1.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header in a send action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bbs.wolvez.org/viewtopic.php?id=148; http://osvdb.org/67822; http://secunia.com/advisories/41255
CVE: CVE-2010-4898
Published: 2011-10-08
Description: SQL injection vulnerability in the Gantry (com_gantry) component 3.0.10 for Joomla! allows remote attackers to execute arbitrary SQL commands via the moduleid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/67825; http://secunia.com/advisories/41300; http://www.exploit-db.com/exploits/14911
CVE: CVE-2010-4899
Published: 2011-10-08
Description: SQL injection vulnerability in c.php in CMS WebManager-Pro before 8.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1009-exploits/webmanagerpro-sql.txt; http://securityreason.com/securityalert/8438; http://websecurity.com.ua/4146/
CVE: CVE-2010-4900
Published: 2011-10-08
Description: Open redirect vulnerability in c.php in CMS WebManager-Pro 8.1 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.org/1009-exploits/webmanagerpro-sql.txt; http://securityreason.com/securityalert/8438; http://websecurity.com.ua/4146/
CVE: CVE-2010-4901
Published: 2011-10-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in char_map.php in MySource Matrix 3.28.3 allow remote attackers to inject arbitrary web script or HTML via the (1) height or (2) width parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/67838; http://secunia.com/advisories/41295; http://securityreason.com/securityalert/8439
CVE: CVE-2010-4902
Published: 2011-10-08
Description: Multiple SQL injection vulnerabilities in the Clantools (com_clantools) component 1.2.3 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) squad or (2) showgame parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1009-exploits/joomlaclantools-sql.txt; http://secunia.com/advisories/41322; http://securityreason.com/securityalert/8440
CVE: CVE-2010-4903
Published: 2011-10-08
Description: SQL injection vulnerability in index.php in CubeCart 4.3.3 allows remote attackers to execute arbitrary SQL commands via the searchStr parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/41352; http://securityreason.com/securityalert/8441; http://www.acunetix.com/blog/web-security-zone/articles/sql-injection-xss-cubecart-4-3-3/