rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-0378 
Cross-site scripting (XSS) vulnerability in index.php in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the pet parameter in a sign action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T18:33:00.000Z
CVE-2009-0379 
SQL injection vulnerability in the Prince Clan Chess Club (com_pcchess) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the game_id parameter in a showgame action to index.php, a different vector than CVE-2008-0761.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T18:33:00.000Z
CVE-2009-0380 
SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) RC 2.8.2 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the bid parameter in a showbiz action to index.php, a different vector than CVE-2008-0607.  NOTE: CVE disputes this issue, since neither "showbiz" nor "bid" appears in the source code for SOBI2
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T18:33:00.000Z
CVE-2009-0381 
SQL injection vulnerability in the BazaarBuilder Ecommerce Shopping Cart (com_prod) 5.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter in a products action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T18:33:00.000Z
CVE-2009-0382 
Unspecified vulnerability in Internationalization (i18n) Translation 5.x before 5.x-2.5, a module for Drupal, allows remote attackers with "translate node" permissions to bypass intended access restrictions and read unpublished nodes via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T19:00:00.000Z
CVE-2009-0383 
delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T19:00:00.000Z
CVE-2009-0384 
SQL injection vulnerability in autor.php in OwnRS CMS 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T19:00:00.000Z
CVE-2009-0385 
Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T19:00:00.000Z
CVE-2009-0386 
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T19:00:00.000Z
CVE-2009-0387 
Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted Sync Sample (aka stss) atom data in a malformed QuickTime media .mov file, related to "mark keyframes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T19:00:00.000Z
CVE-2009-0388 
Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code via a large length value in a message, related to the (a) ClientConnection::CheckBufferSize and (b) ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-04T19:00:00.000Z
CVE-2009-0389 
Multiple insecure method vulnerabilities in the Web On Windows (WOW) ActiveX control in WOW ActiveX 2 allow remote attackers to (1) create and overwrite arbitrary files via the WriteIniFileString method, (2) execute arbitrary programs via the ShellExecute method, (3) read from the registry via unspecified vectors, and (4) write to the registry via unspecified vectors.  NOTE: vectors 1 and 2 can be used together to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T21:29:00.000Z
CVE-2009-0390 
Argument injection vulnerability in Enomaly Elastic Computing Platform (ECP), formerly Enomalism, before 2.1.1 allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T22:00:00.000Z
CVE-2009-0391 
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.0.1 on z/OS allows attackers to read arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-02T22:00:00.000Z
CVE-2009-0392 
Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T01:00:00.000Z
CVE-2009-0393 
Cross-site scripting (XSS) vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T01:00:00.000Z
CVE-2009-0394 
SQL injection vulnerability in login.php in Pre Lecture Exercises (PLEs) CMS 1.0 beta 4.2 allows remote attackers to execute arbitrary SQL commands via the school parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T01:00:00.000Z
CVE-2009-0395 
SQL injection vulnerability in the login feature in NetArt Media Car Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T01:00:00.000Z
CVE-2009-0396 
The Sony Ericsson W910i, W660i, K618i, K610i, Z610i, K810i, K660i, W880i, and K530i phones allow remote attackers to cause a denial of service (device reboot or hang-up) via a malformed WAP Push packet to (1) SMS or (2) UDP port 2948.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T01:00:00.000Z
CVE-2009-0397 
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11, and GStreamer Plug-ins (aka gstreamer-plugins) 0.8.5, might allow remote attackers to execute arbitrary code via crafted Time-to-sample (aka stts) atom data in a malformed QuickTime media .mov file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T11:00:00.000Z
CVE-2009-0398 
Array index error in the gst_qtp_trak_handler function in gst/qtdemux/qtdemux.c in GStreamer Plug-ins (aka gstreamer-plugins) 0.6.0 allows remote attackers to have an unknown impact via a crafted QuickTime media file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T11:00:00.000Z
CVE-2009-0399 
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php.  NOTE: this is only a vulnerability when the administrator does not properly follow installation directions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0400 
SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0401 
SQL injection vulnerability in browsecats.php in E-Php CMS allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0402 
SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name, (4) is_company, (5) email, (6) phone, (7) fax, (8) addr1, (9) addr2, (10) addr3, (11) zipcode, (12) city, (13) state, (14) country, and (15) vat_num parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0403 
SQL injection vulnerability in admin/authenticate.php in Chipmunk Blogger Script allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0404 
Multiple cross-site scripting (XSS) vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via invalid Cascading Style Sheets (CSS) expressions in the style attribute, which is processed by Internet Explorer 7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0405 
SQL injection vulnerability in articles.php in smartSite CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the var parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0406 
SQL injection vulnerability in index.php in Community CMS 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0407 
SQL injection vulnerability in admin/login.php in PHP-CMS Project 1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0408 
Cross-site request forgery (CSRF) vulnerability in osCommerce 2.2 RC 2a allows remote attackers to hijack the authentication of administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0409 
SQL injection vulnerability in offline_auth.php in Max.Blog 1.0.6 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0410 
Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA) in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows remote attackers to execute arbitrary code via a long e-mail address in a malformed RCPT command, leading to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0411 
Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls and other web script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T19:00:00.000Z
CVE-2009-0412 
The ProcessLogin function in class.auth.php in Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T20:00:00.000Z
CVE-2009-0413 
Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T23:00:00.000Z
CVE-2009-0414 
Unspecified vulnerability in Tor before 0.2.0.33 has unspecified impact and remote attack vectors that trigger heap corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T23:00:00.000Z
CVE-2009-0415 
Untrusted search path vulnerability in trickle 1.07 allows local users to execute arbitrary code via a Trojan horse trickle-overload.so in the current working directory, which is referenced in the LD_PRELOAD path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T23:00:00.000Z
CVE-2009-0416 
The SSL certificate setup program (genSslCert.sh) in Standards Based Linux Instrumentation for Manageability (SBLIM) sblim-sfcb 1.3.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /var/tmp/key.pem, (2) /var/tmp/cert.pem, and (3) /var/tmp/ssl.cnf temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-03T23:00:00.000Z
CVE-2009-0417 
Cross-site scripting (XSS) vulnerability in the AgaviWebRouting::gen(null) method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not strictly follow RFC 3986, such as Internet Explorer 6 and 7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-06T00:00:00.000Z
CVE-2009-0418 
The IPv6 Neighbor Discovery Protocol (NDP) implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity), read private network traffic, and possibly execute arbitrary code via a spoofed message that modifies the Forward Information Base (FIB), a related issue to CVE-2008-2476.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-04T19:00:00.000Z
CVE-2009-0419 
Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly restrict access from web pages to Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-4033.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-04T19:00:00.000Z
CVE-2009-0420 
SQL injection vulnerability in the RD-Autos (com_rdautos) 1.5.5 Stable component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0421 
SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0422 
Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SERVER[ConfigFile] parameter to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0423 
Directory traversal vulnerability in index.php in Php Photo Album (PHPPA) 0.8 BETA allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the preview parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0424 
Cross-site scripting (XSS) vulnerability in sign1.php in AN Guestbook (ANG) before 0.7.7 allows remote attackers to inject arbitrary web script or HTML via the country parameter, which is not properly handled in (1) administrator/manage.php or (2) administrator/trash.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0425 
SQL injection vulnerability in index.php in Blue Eye CMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the clanek parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0426 
SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Classified Listings Manager 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0427 
SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Member Directory Manager 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0428 
SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Secure Document Library 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0429 
Multiple SQL injection vulnerabilities in Active Bids allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to search.asp, (2) SortDir parameter to auctionsended.asp, and the (3) catid parameter to wishlist.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0430 
Multiple cross-site scripting (XSS) vulnerabilities in Active Bids allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to search.asp and the (2) URL parameter to tellafriend.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0431 
SQL injection vulnerability in Default.asp in LinksPro Standard Edition allows remote attackers to execute arbitrary SQL commands via the OrderDirection parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T00:00:00.000Z
CVE-2009-0432 
The installation process for the File Transfer servlet in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19 does not enable the secure version, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-10T22:13:00.000Z
CVE-2009-0433 
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1.x before 5.1.1.19, 6.0.x before 6.0.2.29, and 6.1.x before 6.1.0.19, when Web Server plug-in content buffering is enabled, allows attackers to cause a denial of service (daemon crash) via unknown vectors, related to a mishandling of client read failures in which clients receive many 500 HTTP error responses and backend servers are incorrectly labeled as down.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-10T22:13:00.000Z
CVE-2009-0434 
PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.31, 6.1.x before 6.1.0.21, and 7.0.x before 7.0.0.1, when Performance Monitoring Infrastructure (PMI) is enabled, allows local users to obtain sensitive information by reading the (1) systemout.log and (2) ffdc files.  NOTE: this is probably a duplicate of CVE-2008-5413.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-10T22:13:00.000Z
CVE-2009-0435 
Unspecified vulnerability in the IBM Asynchronous I/O (aka AIO or libibmaio) library in the Java Message Service (JMS) component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.17 on AIX 5.3 allows attackers to cause a denial of service (daemon crash) via vectors related to the aio_getioev2 and getEvent methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-10T22:13:00.000Z
CVE-2009-0436 
The (1) mod_ibm_ssl and (2) mod_cgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server (WAS), set incorrect permissions for AF_UNIX sockets, which has unknown impact and local attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-10T22:13:00.000Z
CVE-2009-0437 
The Installation Factory installation process for IBM WebSphere Application Server (WAS) 6.0.2 on Windows, when WAS is registered as a Windows service, allows local users to obtain sensitive information by reading the logs/instconfigifwas6.log log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-10T22:13:00.000Z
CVE-2009-0438 
IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 on Windows allows remote attackers to bypass "Authorization checking" and obtain sensitive information from JSP pages via a crafted request.  NOTE: this is probably a duplicate of CVE-2008-5412.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-10T22:13:00.000Z
CVE-2009-0439 
Unspecified vulnerability in the queue manager in IBM WebSphere MQ (WMQ) 5.3, 6.0 before 6.0.2.6, and 7.0 before 7.0.0.2 allows local users to gain privileges via vectors related to the (1) setmqaut, (2) dmpmqaut, and (3) dspmqaut authorization commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-24T17:00:00.000Z
CVE-2009-0440 
IBM WebSphere Partner Gateway (WPG) 6.0.0 through 6.0.0.7 does not properly handle failures of signature verification, which might allow remote authenticated users to submit a crafted RosettaNet (aka RNIF) document to a backend application, related to (1) "altered service content" and (2) "digital signature foot-print."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-22T22:00:00.000Z
CVE-2009-0441 
PHP remote file inclusion vulnerability in skin_shop/standard/2_view_body/body_default.php in TECHNOTE 7.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the shop_this_skin_path parameter, a different vector than CVE-2008-4138.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-05T20:00:00.000Z